portok 1.0.3 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "portok",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Zero-downtime deployment proxy - routes traffic through a stable port to internal app instances with health-gated switching",
   "main": "portokd.js",
   "bin": {

package/portok.js

@@ -353,46 +353,80 @@ async function cmdInit(options) {
     results.push({ path: stateDir, status: 'error', error: err.message });
   }
 
-  // Install systemd template unit
+  // Install systemd template unit (embedded content)
   const systemdDest = path.join(systemdDir, serviceFileName);
+  const serviceContent = `# Portok systemd template unit for multi-instance deployments
+# Auto-generated by: portok init
+
+[Unit]
+Description=Portok Zero-Downtime Proxy (%i)
+After=network.target
+Documentation=https://github.com/nicatdursunlu/portok
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+
+# Instance configuration from env file
+EnvironmentFile=/etc/portok/%i.env
+
+# Set instance name automatically from systemd specifier
+Environment=INSTANCE_NAME=%i
+
+# Working directory
+WorkingDirectory=/opt/portok
+
+# Start the daemon
+ExecStart=/usr/bin/node /opt/portok/portokd.js
+
+# Restart policy
+Restart=always
+RestartSec=5
+StartLimitBurst=5
+StartLimitIntervalSec=60
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=portok-%i
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
+# Allow writing to state directory
+ReadWritePaths=/var/lib/portok
+
+# Network access (required for proxying)
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+[Install]
+WantedBy=multi-user.target
+`;
+
   try {
-    // Find the service file relative to this script
-    const scriptDir = path.dirname(process.argv[1]);
-    const possiblePaths = [
-      path.join(scriptDir, serviceFileName),
-      path.join(scriptDir, '..', serviceFileName),
-      '/opt/portok/' + serviceFileName,
-    ];
+    const existingContent = fs.existsSync(systemdDest) ? fs.readFileSync(systemdDest, 'utf-8') : null;
     
-    let sourceFile = null;
-    for (const p of possiblePaths) {
-      if (fs.existsSync(p)) {
-        sourceFile = p;
-        break;
-      }
-    }
-
-    if (sourceFile) {
-      const content = fs.readFileSync(sourceFile, 'utf-8');
-      const existingContent = fs.existsSync(systemdDest) ? fs.readFileSync(systemdDest, 'utf-8') : null;
+    if (existingContent === serviceContent) {
+      results.push({ path: systemdDest, status: 'exists' });
+    } else {
+      fs.writeFileSync(systemdDest, serviceContent, { mode: 0o644 });
+      results.push({ path: systemdDest, status: 'created' });
       
-      if (existingContent === content) {
-        results.push({ path: systemdDest, status: 'exists' });
-      } else {
-        fs.writeFileSync(systemdDest, content, { mode: 0o644 });
-        results.push({ path: systemdDest, status: 'created' });
-        
-        // Reload systemd daemon
-        try {
-          const { execSync } = require('child_process');
-          execSync('systemctl daemon-reload', { stdio: 'pipe' });
-          results.push({ path: 'systemctl daemon-reload', status: 'created' });
-        } catch (e) {
-          // Ignore if systemctl not available (e.g., in Docker)
-        }
+      // Reload systemd daemon
+      try {
+        const { execSync } = require('child_process');
+        execSync('systemctl daemon-reload', { stdio: 'pipe' });
+        results.push({ path: 'systemctl daemon-reload', status: 'created' });
+      } catch (e) {
+        // Ignore if systemctl not available (e.g., in Docker)
       }
-    } else {
-      results.push({ path: systemdDest, status: 'skipped', error: 'Template file not found' });
     }
   } catch (err) {
     results.push({ path: systemdDest, status: 'error', error: err.message });