ramm 0.0.3 → 0.0.4

package/dist/ramm.js

@@ -1,80 +1,228 @@
 // @bun
-// src/ramm.ts
-var {$, spawn } = globalThis.Bun;
+// src/base.ts
+var {spawn } = globalThis.Bun;
+
+// src/debug.ts
 var debugInternal = (func, command) => {
   console.info(`>>>${func}<<< ${command}`);
 };
+var debugSilentCommand = (command) => {
+  debugInternal("\x1B[32mCommand (silent)\x1B[0m", `\x1B[38;5;85m${command}\x1B[0m`);
+};
 var debugCommand = (command) => {
   debugInternal("\x1B[32mCommand\x1B[0m", `\x1B[38;5;85m${command}\x1B[0m`);
 };
 var debug = (text) => {
   debugInternal("\x1B[34mBlock\x1B[0m", `\x1B[38;5;81m${text}\x1B[0m`);
 };
-var execCommand = async (command) => {
-  debugCommand(command);
-  const result = await spawn(["bash", "-c", command], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  await result.exited;
-};
 
+// src/context.ts
 class Context {
   name;
   domain;
-  constructor(name, address) {
+  userspace;
+  sudo;
+  constructor({
+    name,
+    address,
+    userspace = false,
+    sudo = false
+  }) {
     this.name = name;
     this.domain = address;
+    this.sudo = sudo;
+    this.userspace = userspace;
   }
   getAddress() {
     return `${this.name}@${this.domain}`;
   }
 }
-var copyFiles = async (context, from, to) => {
+
+// src/base.ts
+var defaultContext = new Context({
+  name: "root",
+  address: "0.0.0.0",
+  userspace: false,
+  sudo: false
+});
+var tee = async (read) => {
+  const reader = read.getReader();
+  let output = "";
+  while (true) {
+    const { value, done: doneReading } = await reader.read();
+    if (doneReading) {
+      return output;
+    }
+    const decoder = new TextDecoder("utf-8");
+    output += decoder.decode(value);
+    process.stdout.write(value);
+  }
+};
+var readStreamToStr = async (read) => {
+  const reader = read.getReader();
+  let output = "";
+  while (true) {
+    const { value, done: doneReading } = await reader.read();
+    if (doneReading) {
+      return output;
+    }
+    const decoder = new TextDecoder("utf-8");
+    output += decoder.decode(value);
+  }
+};
+var execCommand = async (command) => {
+  debugCommand(command);
+  const result = spawn(["bash", "-c", command], {
+    stdin: "inherit",
+    stdout: "pipe",
+    stderr: "inherit"
+  });
+  const output = await tee(result.stdout);
+  await result.exited;
+  return {
+    output,
+    spawnResult: result
+  };
+};
+var execCommandSilent = async (command) => {
+  debugSilentCommand(command);
+  const result = spawn(["bash", "-c", command]);
+  const output = await readStreamToStr(result.stdout);
+  await result.exited;
+  return {
+    output,
+    spawnResult: result
+  };
+};
+var copyFiles = async (from, to, context) => {
   await execCommand(`rsync -avz ${from} ${context.getAddress()}:${to}`);
 };
-var exec = async (context, command) => {
+var exec = async (command, context) => {
   await execCommand(`ssh ${context.getAddress()} "${command}"`);
 };
+// src/init.ts
+var installBun = async (context) => {
+  const bunPath = new URL(import.meta.resolve("./bun.sh")).pathname;
+  await copyFiles(bunPath, "./bun.sh", context);
+  await exec("./bun.sh", context);
+};
+// src/podman.ts
+var {$: $2 } = globalThis.Bun;
+
+// src/packages.ts
+var {$ } = globalThis.Bun;
 var installSystemPackage = async (packageName) => {
-  const osName = await $`cat /etc/os-release | grep ^ID= | cut -d'=' -f2`.text();
+  const osName = (await $`cat /etc/os-release | grep ^ID= | cut -d'=' -f2`.text()).trim();
   if (osName === "ubuntu") {
-    execCommand(`apt-get install -y ${packageName}`);
+    await execCommand(`apt-get install -y ${packageName}`);
+  }
+};
+
+// src/systemd.ts
+var systemctlWordLangth = "systemctl ".length;
+var formatUserspace = (context, command) => {
+  const userPart = context.userspace ? "--user" : "";
+  return `systemctl ${userPart} ${command.slice(systemctlWordLangth)}`;
+};
+var getSysyemdServiceName = (name) => {
+  return `${name}.service`;
+};
+var getSystemdPathToService = (context, serviceName) => {
+  if (context.userspace) {
+    return `~/.config/systemd/user/${serviceName}`;
   }
+  return `/etc/systemd/system/${serviceName}`;
+};
+var stopSystemdService = async (constext, name) => {
+  await execCommand(formatUserspace(constext, `systemctl stop ${name}`));
+};
+var restartSystemdService = async (name, constext = defaultContext) => {
+  await execCommand(formatUserspace(constext, `systemctl restart ${name}`));
 };
+var checkSystemdService = async (context, serviceName) => {
+  const { spawnResult } = await execCommand(formatUserspace(context, `systemctl is-active ${serviceName}`));
+  return spawnResult.exitCode === 0;
+};
+var createSystemdService = async (context, serviceName, pathToServiceFile) => {
+  const pathToSeviceTarget = getSystemdPathToService(context, serviceName);
+  await execCommand(`cp -v ${pathToServiceFile} ${pathToSeviceTarget}`);
+  await execCommand(formatUserspace(context, "systemctl daemon-reload"));
+  await execCommand(formatUserspace(context, `systemctl enable ${serviceName}`));
+  await execCommand(formatUserspace(context, `sysyemctl start ${serviceName}`));
+};
+
+// src/nft.ts
+var localNftChainName = "local_chain";
+var setupNftable = async (allowedIpSsh) => {
+  const listTable = await execCommandSilent("nft list table inet ramm");
+  if (listTable.spawnResult.exitCode === 0) {
+    await execCommand("nft delete table inet ramm");
+  }
+  await execCommand("nft add table inet ramm");
+  await execCommand("nft add chain inet ramm input '{ type filter hook input priority 0 ; }'");
+  await execCommand(`nft add set inet ramm allowed_ssh_ipv4 '{ type ipv4_addr; flags dynamic; elements = { ${allowedIpSsh} } }'`);
+  await execCommand(`nft add chain inet ramm ${localNftChainName}`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} iif lo accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} ct state established,related accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} ip saddr @allowed_ssh_ipv4 tcp dport 22 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 ct state new limit rate over 3/minute drop`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 80 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 443 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} drop`);
+  await execCommand("nft add rule inet ramm input fib daddr type local jump local_chain ");
+};
+
+// src/podman.ts
 var installPodman = async () => {
-  if ((await $`command -v podman`).exitCode === 0) {
-    return;
+  if ((await $2`command -v podman`.nothrow().quiet()).exitCode !== 0) {
+    await installSystemPackage("podman");
   }
-  await installSystemPackage("podman");
+  await createNetwork();
+};
+var createNetwork = async () => {
+  await execCommand("podman network create --interface-name=podman_ramm ramm");
+};
+var getCreateCommand = async (name) => {
+  const podmanCreateCommand = await $2`podman inspect --format '{{.Config.CreateCommand}}' ${name}`.nothrow().quiet();
+  return podmanCreateCommand.text().slice(0, -1).slice(1, -1) || "";
 };
-var runPodmanContainer = async (command, name) => {
-  const podmanCreateCommand = await $`podman inspect --format '{{.Config.CreateCommand}}' ${name}`.nothrow().quiet();
-  if (podmanCreateCommand.exitCode !== 0) {
+var runPodmanContainer = async (name, command) => {
+  if (await getCreateCommand(name) !== command) {
+    await $2`podman rm -f ${name}`;
     await execCommand(command);
     return;
   }
-  const podmanCreateCommandText = podmanCreateCommand.text().slice(0, -1);
-  if (podmanCreateCommandText !== `[${command}]`) {
-    await $`podman rm -f ${name}`;
-    execCommand(command);
-    return;
-  }
   console.info("Podman container is already running");
 };
-var installBun = async (context) => {
-  const bunPath = import.meta.resolve("./bun.sh");
-  await copyFiles(context, bunPath, "bun.sh");
-  await exec(context, "./bun.sh");
+var runPodmanContainerService = async (name, command, context = defaultContext) => {
+  const serviceName = getSysyemdServiceName(name);
+  if (await checkSystemdService(context, serviceName)) {
+    await stopSystemdService(context, serviceName);
+  }
+  await runPodmanContainer(name, command);
+  await execCommand(`podman generate systemd --name --new ${name} > ${serviceName}`);
+  await createSystemdService(context, serviceName, serviceName);
+};
+var addNftPodmanRule = async () => {
+  const podmanNetworksResult = await execCommand("podman network inspect $(podman network ls -q) -f '{{.NetworkInterface}}'");
+  const podmanNetworks = podmanNetworksResult.output.trim().split(`
+`);
+  await execCommand(`nft add set inet ramm podman_interfaces '{ type ifname; flags dynamic; elements = { ${podmanNetworks.join(", ")} }; }'`);
+  await execCommand("nft add chain inet ramm forward '{ type filter hook input priority 0 ; }'");
+  await execCommand(`nft add rule inet ramm forward iifname @podman_interfaces jump ${localNftChainName}`);
 };
 export {
+  setupNftable,
+  runPodmanContainerService,
   runPodmanContainer,
+  restartSystemdService,
   installSystemPackage,
   installPodman,
   installBun,
   exec,
   debug,
   copyFiles,
+  addNftPodmanRule,
   Context
 };

package/dist/types/base.d.ts

@@ -0,0 +1,12 @@
+import { Context } from "./context.ts";
+export declare const defaultContext: Context;
+export declare const execCommand: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"inherit", "pipe", "inherit">;
+}>;
+export declare const execCommandSilent: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"ignore", "pipe", "inherit">;
+}>;
+export declare const copyFiles: (from: string, to: string, context: Context) => Promise<void>;
+export declare const exec: (command: string, context: Context) => Promise<void>;

package/dist/types/context.d.ts

@@ -0,0 +1,13 @@
+export declare class Context {
+    name: string;
+    domain: string;
+    userspace: boolean;
+    sudo: boolean;
+    constructor({ name, address, userspace, sudo, }: {
+        name: string;
+        address: string;
+        userspace?: boolean;
+        sudo?: boolean;
+    });
+    getAddress(): string;
+}

package/dist/types/debug.d.ts

@@ -0,0 +1,3 @@
+export declare const debugSilentCommand: (command: string) => void;
+export declare const debugCommand: (command: string) => void;
+export declare const debug: (text: string) => void;

package/dist/types/init.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from "./context.ts";
+export declare const installBun: (context: Context) => Promise<void>;

package/dist/types/nft.d.ts

@@ -0,0 +1,2 @@
+export declare const localNftChainName = "local_chain";
+export declare const setupNftable: (allowedIpSsh: string) => Promise<void>;

package/dist/types/packages.d.ts

@@ -0,0 +1 @@
+export declare const installSystemPackage: (packageName: string) => Promise<void>;

package/dist/types/podman.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "./context.ts";
+export declare const installPodman: () => Promise<void>;
+export declare const getCreateCommand: (name: string) => Promise<string>;
+export declare const runPodmanContainer: (name: string, command: string) => Promise<void>;
+export declare const runPodmanContainerService: (name: string, command: string, context?: Context) => Promise<void>;
+export declare const addNftPodmanRule: () => Promise<void>;

package/dist/types/ramm.d.ts

@@ -1,13 +1,9 @@
-export declare const debug: (text: string) => void;
-export declare class Context {
-    name: string;
-    domain: string;
-    constructor(name: string, address: string);
-    getAddress(): string;
-}
-export declare const copyFiles: (context: Context, from: string, to: string) => Promise<void>;
-export declare const exec: (context: Context, command: string) => Promise<void>;
-export declare const installSystemPackage: (packageName: string) => Promise<void>;
-export declare const installPodman: () => Promise<void>;
-export declare const runPodmanContainer: (command: string, name: string) => Promise<void>;
-export declare const installBun: (context: Context) => Promise<void>;
+export { exec, copyFiles } from "./base.ts";
+export { Context } from "./context.ts";
+export { installBun } from "./init.ts";
+export { installPodman, runPodmanContainer } from "./podman.ts";
+export { runPodmanContainerService, addNftPodmanRule } from "./podman.ts";
+export { restartSystemdService } from "./systemd.ts";
+export { installSystemPackage } from "./packages.ts";
+export { debug } from "./debug.ts";
+export { setupNftable } from "./nft.ts";

package/dist/types/systemd.d.ts

@@ -0,0 +1,6 @@
+import { Context } from "./context.ts";
+export declare const getSysyemdServiceName: (name: string) => string;
+export declare const stopSystemdService: (constext: Context, name: string) => Promise<void>;
+export declare const restartSystemdService: (name: string, constext?: Context) => Promise<void>;
+export declare const checkSystemdService: (context: Context, serviceName: string) => Promise<boolean>;
+export declare const createSystemdService: (context: Context, serviceName: string, pathToServiceFile: string) => Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ramm",
   "type": "module",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "scripts": {
     "build": "bun build ./src/ramm.ts --target bun --outdir ./dist && cp ./src/bun.sh ./dist/bun.sh && bun run types",
     "types": "tsc --project tsconfig.types.json"