ramm 0.0.3 → 0.0.5

package/dist/ramm.js

@@ -1,80 +1,262 @@
 // @bun
-// src/ramm.ts
-var {$, spawn } = globalThis.Bun;
+// src/base.ts
+var {spawn } = globalThis.Bun;
+
+// src/debug.ts
 var debugInternal = (func, command) => {
   console.info(`>>>${func}<<< ${command}`);
 };
+var debugSilentCommand = (command) => {
+  debugInternal("\x1B[32mCommand (silent)\x1B[0m", `\x1B[38;5;85m${command}\x1B[0m`);
+};
 var debugCommand = (command) => {
   debugInternal("\x1B[32mCommand\x1B[0m", `\x1B[38;5;85m${command}\x1B[0m`);
 };
-var debug = (text) => {
+var debugBlock = (text) => {
   debugInternal("\x1B[34mBlock\x1B[0m", `\x1B[38;5;81m${text}\x1B[0m`);
 };
-var execCommand = async (command) => {
-  debugCommand(command);
-  const result = await spawn(["bash", "-c", command], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit"
-  });
-  await result.exited;
-};
 
+// src/context.ts
 class Context {
   name;
   domain;
-  constructor(name, address) {
+  userspace;
+  sudo;
+  sshKey;
+  constructor({
+    name,
+    address,
+    userspace = false,
+    sudo = false,
+    sshKey
+  }) {
     this.name = name;
     this.domain = address;
+    this.sudo = sudo;
+    this.userspace = userspace;
+    this.sshKey = sshKey;
   }
   getAddress() {
     return `${this.name}@${this.domain}`;
   }
 }
-var copyFiles = async (context, from, to) => {
+
+// src/base.ts
+var defaultContext = new Context({
+  name: "root",
+  address: "0.0.0.0",
+  userspace: false,
+  sudo: false
+});
+var tee = async (read) => {
+  const reader = read.getReader();
+  let output = "";
+  while (true) {
+    const { value, done: doneReading } = await reader.read();
+    if (doneReading) {
+      return output;
+    }
+    const decoder = new TextDecoder("utf-8");
+    output += decoder.decode(value);
+    process.stdout.write(value);
+  }
+};
+var readStreamToStr = async (read) => {
+  const reader = read.getReader();
+  let output = "";
+  while (true) {
+    const { value, done: doneReading } = await reader.read();
+    if (doneReading) {
+      return output;
+    }
+    const decoder = new TextDecoder("utf-8");
+    output += decoder.decode(value);
+  }
+};
+var execCommand = async (command) => {
+  debugCommand(command);
+  const result = spawn(["bash", "-c", command], {
+    stdin: "inherit",
+    stdout: "pipe",
+    stderr: "inherit"
+  });
+  const output = await tee(result.stdout);
+  await result.exited;
+  return {
+    output,
+    spawnResult: result
+  };
+};
+var execCommandSilent = async (command) => {
+  debugSilentCommand(command);
+  const result = spawn(["bash", "-c", command]);
+  const output = await readStreamToStr(result.stdout);
+  await result.exited;
+  return {
+    output,
+    spawnResult: result
+  };
+};
+var copyFilesBySsh = async (from, to, context) => {
   await execCommand(`rsync -avz ${from} ${context.getAddress()}:${to}`);
 };
-var exec = async (context, command) => {
-  await execCommand(`ssh ${context.getAddress()} "${command}"`);
+var execBySsh = async (command, context) => {
+  const sshKeyPart = context.sshKey ? ` -i ${context.sshKey}` : "";
+  return await execCommand(`ssh${sshKeyPart} ${context.getAddress()} '${command}'`);
 };
+// src/init.ts
+var installBun = async (context) => {
+  const bunPath = new URL(import.meta.resolve("./bun.sh")).pathname;
+  await copyFilesBySsh(bunPath, "./bun.sh", context);
+  await execBySsh("./bun.sh", context);
+};
+// src/podman.ts
+var {$: $2 } = globalThis.Bun;
+
+// src/packages.ts
+var {$ } = globalThis.Bun;
 var installSystemPackage = async (packageName) => {
-  const osName = await $`cat /etc/os-release | grep ^ID= | cut -d'=' -f2`.text();
+  const osName = (await $`cat /etc/os-release | grep ^ID= | cut -d'=' -f2`.text()).trim();
   if (osName === "ubuntu") {
-    execCommand(`apt-get install -y ${packageName}`);
+    await execCommand(`apt-get install -y ${packageName}`);
   }
 };
+
+// src/systemd.ts
+var systemctlWordLangth = "systemctl ".length;
+var formatUserspace = (context, command) => {
+  const userPart = context.userspace ? "--user" : "";
+  return `systemctl ${userPart} ${command.slice(systemctlWordLangth)}`;
+};
+var getSysyemdServiceName = (name) => {
+  return `${name}.service`;
+};
+var getSystemdPathToService = (context, serviceName) => {
+  if (context.userspace) {
+    return `~/.config/systemd/user/${serviceName}`;
+  }
+  return `/etc/systemd/system/${serviceName}`;
+};
+var stopSystemdService = async (constext, name) => {
+  await execCommand(formatUserspace(constext, `systemctl stop ${name}`));
+};
+var restartSystemdService = async (name, constext = defaultContext) => {
+  await execCommand(formatUserspace(constext, `systemctl restart ${name}`));
+};
+var checkSystemdService = async (context, serviceName) => {
+  const { spawnResult } = await execCommand(formatUserspace(context, `systemctl is-active ${serviceName}`));
+  return spawnResult.exitCode === 0;
+};
+var createSystemdService = async (context, serviceName, pathToServiceFile) => {
+  const pathToSeviceTarget = getSystemdPathToService(context, serviceName);
+  await execCommand(`cp -v ${pathToServiceFile} ${pathToSeviceTarget}`);
+  await execCommand(formatUserspace(context, "systemctl daemon-reload"));
+  await execCommand(formatUserspace(context, `systemctl enable ${serviceName}`));
+  await execCommand(formatUserspace(context, `sysyemctl start ${serviceName}`));
+};
+
+// src/nft.ts
+var localNftChainName = "local_chain";
+var setupNftable = async (allowedIpSsh) => {
+  const listTable = await execCommandSilent("nft list table inet ramm");
+  if (listTable.spawnResult.exitCode === 0) {
+    await execCommand("nft delete table inet ramm");
+  }
+  await execCommand("nft add table inet ramm");
+  await execCommand("nft add chain inet ramm input '{ type filter hook input priority 0 ; }'");
+  await execCommand(`nft add set inet ramm allowed_ssh_ipv4 '{ type ipv4_addr; flags dynamic; elements = { ${allowedIpSsh} } }'`);
+  await execCommand(`nft add chain inet ramm ${localNftChainName}`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} iif lo accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} ct state established,related accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} ip saddr @allowed_ssh_ipv4 tcp dport 22 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 ct state new limit rate over 3/minute drop`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 80 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 443 accept`);
+  await execCommand(`nft add rule inet ramm ${localNftChainName} drop`);
+  await execCommand("nft add rule inet ramm input fib daddr type local jump local_chain ");
+};
+
+// src/podman.ts
 var installPodman = async () => {
-  if ((await $`command -v podman`).exitCode === 0) {
-    return;
+  if ((await $2`command -v podman`.nothrow().quiet()).exitCode !== 0) {
+    await installSystemPackage("podman");
   }
-  await installSystemPackage("podman");
+  await createNetwork();
+};
+var createNetwork = async () => {
+  await execCommand("podman network create --interface-name=podman_ramm ramm");
+};
+var getCreateCommand = async (name) => {
+  const podmanCreateCommand = await $2`podman inspect --format '{{.Config.CreateCommand}}' ${name}`.nothrow().quiet();
+  return podmanCreateCommand.text().slice(0, -1).slice(1, -1) || "";
 };
-var runPodmanContainer = async (command, name) => {
-  const podmanCreateCommand = await $`podman inspect --format '{{.Config.CreateCommand}}' ${name}`.nothrow().quiet();
-  if (podmanCreateCommand.exitCode !== 0) {
+var runPodmanContainer = async (name, command) => {
+  if (await getCreateCommand(name) !== command) {
+    await $2`podman rm -f ${name}`;
     await execCommand(command);
     return;
   }
-  const podmanCreateCommandText = podmanCreateCommand.text().slice(0, -1);
-  if (podmanCreateCommandText !== `[${command}]`) {
-    await $`podman rm -f ${name}`;
-    execCommand(command);
+  console.info("Podman container is already running");
+};
+var runPodmanContainerService = async (name, command, context = defaultContext) => {
+  const serviceName = getSysyemdServiceName(name);
+  if (await checkSystemdService(context, serviceName)) {
+    await stopSystemdService(context, serviceName);
+  }
+  await runPodmanContainer(name, command);
+  await execCommand(`podman generate systemd --name --new ${name} > ${serviceName}`);
+  await createSystemdService(context, serviceName, serviceName);
+};
+var addNftPodmanRule = async () => {
+  const podmanNetworksResult = await execCommand("podman network inspect $(podman network ls -q) -f '{{.NetworkInterface}}'");
+  const podmanNetworks = podmanNetworksResult.output.trim().split(`
+`);
+  await execCommand(`nft add set inet ramm podman_interfaces '{ type ifname; flags dynamic; elements = { ${podmanNetworks.join(", ")} }; }'`);
+  await execCommand("nft add chain inet ramm forward '{ type filter hook forward priority 0 ; }'");
+  await execCommand(`nft add rule inet ramm forward iifname != @podman_interfaces jump ${localNftChainName}`);
+};
+// src/ssh.ts
+import { debug } from "console";
+async function createSshKey(pathToKey, comment) {
+  const name = pathToKey.split("/").at(-1);
+  const pathToKeyPub = `${pathToKey}.pub`;
+  const pathToDir = pathToKey.split("/").slice(0, -1).join("/");
+  const pathToKeyFile = Bun.file(pathToKey);
+  const pathToKeyPubFile = Bun.file(pathToKeyPub);
+  if (await pathToKeyFile.exists() && await pathToKeyPubFile.exists()) {
+    return await pathToKeyPubFile.text();
+  }
+  await execCommand(`mkdir -p ${pathToDir}`);
+  await execCommand(`ssh-keygen -t ed25519 -f ${pathToKey} -N "" -C "${comment || name}"`);
+  await execCommand(`chmod 600 ${pathToKey}`);
+  const pubKey = await Bun.file(pathToKeyPub).text();
+  return pubKey;
+}
+var addSshKey = async (pubKey, context) => {
+  const { output: keys } = await execBySsh("cat .ssh/authorized_keys", context);
+  if (keys.includes(pubKey)) {
     return;
   }
-  console.info("Podman container is already running");
+  await execBySsh(`echo "${pubKey}" >> .ssh/authorized_keys`, context);
 };
-var installBun = async (context) => {
-  const bunPath = import.meta.resolve("./bun.sh");
-  await copyFiles(context, bunPath, "bun.sh");
-  await exec(context, "./bun.sh");
+var createAndAddSshKey = async (pathToKey, comment, context) => {
+  const pubKey = await createSshKey(pathToKey, comment);
+  debug(`Key is: ${pubKey}`);
+  await addSshKey(pubKey, context);
 };
 export {
+  setupNftable,
+  runPodmanContainerService,
   runPodmanContainer,
+  restartSystemdService,
   installSystemPackage,
   installPodman,
   installBun,
-  exec,
-  debug,
-  copyFiles,
+  execBySsh,
+  debugBlock,
+  createAndAddSshKey,
+  copyFilesBySsh,
+  addNftPodmanRule,
   Context
 };

package/dist/types/base.d.ts

@@ -0,0 +1,12 @@
+import { Context } from "./context.ts";
+export declare const defaultContext: Context;
+export declare const execCommand: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"inherit", "pipe", "inherit">;
+}>;
+export declare const execCommandSilent: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"ignore", "pipe", "inherit">;
+}>;
+export declare const copyFiles: (from: string, to: string, context: Context) => Promise<void>;
+export declare const exec: (command: string, context: Context) => Promise<void>;

package/dist/types/context.d.ts

@@ -0,0 +1,13 @@
+export declare class Context {
+    name: string;
+    domain: string;
+    userspace: boolean;
+    sudo: boolean;
+    constructor({ name, address, userspace, sudo, }: {
+        name: string;
+        address: string;
+        userspace?: boolean;
+        sudo?: boolean;
+    });
+    getAddress(): string;
+}

package/dist/types/debug.d.ts

@@ -0,0 +1,3 @@
+export declare const debugSilentCommand: (command: string) => void;
+export declare const debugCommand: (command: string) => void;
+export declare const debug: (text: string) => void;

package/dist/types/dist/ramm.d.ts

@@ -0,0 +1,30 @@
+export function setupNftable(allowedIpSsh: any): Promise<void>;
+export function runPodmanContainerService(name: any, command: any, context?: Context): Promise<void>;
+export function runPodmanContainer(name: any, command: any): Promise<void>;
+export function restartSystemdService(name: any, constext?: Context): Promise<void>;
+export function installSystemPackage(packageName: any): Promise<void>;
+export function installPodman(): Promise<void>;
+export function installBun(context: any): Promise<void>;
+export function execBySsh(command: any, context: any): Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"inherit", "pipe", "inherit">;
+}>;
+export function debugBlock(text: any): void;
+export function createAndAddSshKey(pathToKey: any, comment: any, context: any): Promise<void>;
+export function copyFilesBySsh(from: any, to: any, context: any): Promise<void>;
+export function addNftPodmanRule(): Promise<void>;
+export class Context {
+    constructor({ name, address, userspace, sudo, sshKey }: {
+        name: any;
+        address: any;
+        userspace?: boolean | undefined;
+        sudo?: boolean | undefined;
+        sshKey: any;
+    });
+    name: any;
+    domain: any;
+    userspace: boolean;
+    sudo: boolean;
+    sshKey: any;
+    getAddress(): string;
+}

package/dist/types/init.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from "./context.ts";
+export declare const installBun: (context: Context) => Promise<void>;

package/dist/types/nft.d.ts

@@ -0,0 +1,2 @@
+export declare const localNftChainName = "local_chain";
+export declare const setupNftable: (allowedIpSsh: string) => Promise<void>;

package/dist/types/packages.d.ts

@@ -0,0 +1 @@
+export declare const installSystemPackage: (packageName: string) => Promise<void>;

package/dist/types/podman.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "./context.ts";
+export declare const installPodman: () => Promise<void>;
+export declare const getCreateCommand: (name: string) => Promise<string>;
+export declare const runPodmanContainer: (name: string, command: string) => Promise<void>;
+export declare const runPodmanContainerService: (name: string, command: string, context?: Context) => Promise<void>;
+export declare const addNftPodmanRule: () => Promise<void>;

package/dist/types/ramm.d.ts

@@ -1,13 +1,9 @@
-export declare const debug: (text: string) => void;
-export declare class Context {
-    name: string;
-    domain: string;
-    constructor(name: string, address: string);
-    getAddress(): string;
-}
-export declare const copyFiles: (context: Context, from: string, to: string) => Promise<void>;
-export declare const exec: (context: Context, command: string) => Promise<void>;
-export declare const installSystemPackage: (packageName: string) => Promise<void>;
-export declare const installPodman: () => Promise<void>;
-export declare const runPodmanContainer: (command: string, name: string) => Promise<void>;
-export declare const installBun: (context: Context) => Promise<void>;
+export { exec, copyFiles } from "./base.ts";
+export { Context } from "./context.ts";
+export { installBun } from "./init.ts";
+export { installPodman, runPodmanContainer } from "./podman.ts";
+export { runPodmanContainerService, addNftPodmanRule } from "./podman.ts";
+export { restartSystemdService } from "./systemd.ts";
+export { installSystemPackage } from "./packages.ts";
+export { debug } from "./debug.ts";
+export { setupNftable } from "./nft.ts";

package/dist/types/src/base.d.ts

@@ -0,0 +1,15 @@
+import { Context } from "./context.ts";
+export declare const defaultContext: Context;
+export declare const execCommand: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"inherit", "pipe", "inherit">;
+}>;
+export declare const execCommandSilent: (command: string) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"ignore", "pipe", "inherit">;
+}>;
+export declare const copyFilesBySsh: (from: string, to: string, context: Context) => Promise<void>;
+export declare const execBySsh: (command: string, context: Context) => Promise<{
+    output: string;
+    spawnResult: import("bun").Subprocess<"inherit", "pipe", "inherit">;
+}>;

package/dist/types/src/context.d.ts

@@ -0,0 +1,15 @@
+export declare class Context {
+    name: string;
+    domain: string;
+    userspace: boolean;
+    sudo: boolean;
+    sshKey?: string;
+    constructor({ name, address, userspace, sudo, sshKey, }: {
+        name: string;
+        address: string;
+        userspace?: boolean;
+        sudo?: boolean;
+        sshKey?: string;
+    });
+    getAddress(): string;
+}

package/dist/types/src/debug.d.ts

@@ -0,0 +1,4 @@
+export declare const debugSilentCommand: (command: string) => void;
+export declare const debugCommand: (command: string) => void;
+export declare const debugBlock: (text: string) => void;
+export declare const debug: (text: string) => void;

package/dist/types/src/init.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from "./context.ts";
+export declare const installBun: (context: Context) => Promise<void>;

package/dist/types/src/nft.d.ts

@@ -0,0 +1,2 @@
+export declare const localNftChainName = "local_chain";
+export declare const setupNftable: (allowedIpSsh: string) => Promise<void>;

package/dist/types/src/packages.d.ts

@@ -0,0 +1 @@
+export declare const installSystemPackage: (packageName: string) => Promise<void>;

package/dist/types/src/podman.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "./context.ts";
+export declare const installPodman: () => Promise<void>;
+export declare const getCreateCommand: (name: string) => Promise<string>;
+export declare const runPodmanContainer: (name: string, command: string) => Promise<void>;
+export declare const runPodmanContainerService: (name: string, command: string, context?: Context) => Promise<void>;
+export declare const addNftPodmanRule: () => Promise<void>;

package/dist/types/src/ramm.d.ts

@@ -0,0 +1,10 @@
+export { execBySsh, copyFilesBySsh } from "./base.ts";
+export { Context } from "./context.ts";
+export { installBun } from "./init.ts";
+export { installPodman, runPodmanContainer } from "./podman.ts";
+export { runPodmanContainerService, addNftPodmanRule } from "./podman.ts";
+export { restartSystemdService } from "./systemd.ts";
+export { installSystemPackage } from "./packages.ts";
+export { debugBlock } from "./debug.ts";
+export { setupNftable } from "./nft.ts";
+export { createAndAddSshKey } from "./ssh.ts";

package/dist/types/src/ssh.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from "../dist/ramm.js";
+export declare const createAndAddSshKey: (pathToKey: string, comment: string, context: Context) => Promise<void>;

package/dist/types/src/systemd.d.ts

@@ -0,0 +1,6 @@
+import { Context } from "./context.ts";
+export declare const getSysyemdServiceName: (name: string) => string;
+export declare const stopSystemdService: (constext: Context, name: string) => Promise<void>;
+export declare const restartSystemdService: (name: string, constext?: Context) => Promise<void>;
+export declare const checkSystemdService: (context: Context, serviceName: string) => Promise<boolean>;
+export declare const createSystemdService: (context: Context, serviceName: string, pathToServiceFile: string) => Promise<void>;

package/dist/types/systemd.d.ts

@@ -0,0 +1,6 @@
+import { Context } from "./context.ts";
+export declare const getSysyemdServiceName: (name: string) => string;
+export declare const stopSystemdService: (constext: Context, name: string) => Promise<void>;
+export declare const restartSystemdService: (name: string, constext?: Context) => Promise<void>;
+export declare const checkSystemdService: (context: Context, serviceName: string) => Promise<boolean>;
+export declare const createSystemdService: (context: Context, serviceName: string, pathToServiceFile: string) => Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ramm",
   "type": "module",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "scripts": {
     "build": "bun build ./src/ramm.ts --target bun --outdir ./dist && cp ./src/bun.sh ./dist/bun.sh && bun run types",
     "types": "tsc --project tsconfig.types.json"