ramm 0.0.59 → 0.0.62

package/README.md

@@ -1,151 +1,381 @@
-## Overview
+# RAMM
 
-RAMM is a Bun library designed to simplify remote server management, deployment automation, and container operations with JS. Ansibsle inspired mechanism, but in JS with imperative commands
+A Bun library for server management and deployment automation in TypeScript. Write your infrastructure logic in real code — no YAML, no DSL, no templating language to fight with.
 
-It provides utilities for:
+## Why not Ansible?
 
-- Remote command execution over SSH
-- File synchronization using rsync
-- System package management
-- Podman container management
+Ansible is great, but it comes with a cost: you write infrastructure in YAML with Jinja2 templates. The moment your logic gets non-trivial — conditionals, loops, dynamic values — you're fighting the format instead of solving the problem.
+
+RAMM takes a different approach: **your deployment scripts are just TypeScript**. Full language, real abstractions, IDE support, type checking, any npm package you need. If you know JS, you already know how to write RAMM scripts.
+
+The trade-off is explicit: Ansible gives you a huge module ecosystem and declarative guarantees. RAMM gives you simplicity and the full power of a real programming language. For developers who want to own their deployment code without learning a separate tool, RAMM is the better fit.
+
+## How it works
+
+The core pattern is `buildAndRunOverSsh`: write a script that configures your server (`server.ts`), then run it from your local machine (`client.ts`). RAMM compiles the server script with `bun build` and executes it on the remote host — all commands inside run on the server.
+
+```
+client.ts          →    [bun build]    →    server.ts runs on remote
+(local machine)                             (all execCommand calls are local to the server)
+```
 
 ## Installation
 
 ```bash
 bun add ramm
-# or
-npm install ramm
 ```
 
-## Quick Start Example
+## Quick Start
+
+**`client.ts`** — runs on your local machine:
 
 ```ts
-import { $, build } from "bun";
-import { Context, exec, copyFiles, debug, installBun } from "ramm";
+import { buildAndRunOverSsh, Context } from "ramm";
 
-const context = new Context("root", "example.com");
+const ctx = new Context({ user: "root", address: "1.2.3.4" });
 
-debug("Install bun");
-await installBun(context);
+await buildAndRunOverSsh({
+  entrypoint: "./server.ts",
+  context: ctx,
+});
+```
 
-debug("Build project");
-await build({
-  outdir: "dist",
-  entrypoints: ["src/server.ts"],
-  target: "bun",
+**`server.ts`** — compiled and executed on the remote server:
+
+```ts
+import {
+  installPodman,
+  createPodmanCommand,
+  runPodmanContainerService,
+  setupNftable,
+  printBlock,
+} from "ramm";
+
+printBlock("Firewall");
+await setupNftable({
+  allowedIpV4: ["1.2.3.4"],
+  allowedPorts: [443],
 });
 
-debug("Deploy files");
-await copyFiles(context, "./dist/", "./dist");
+printBlock("Container");
+await installPodman();
+
+const cmd = createPodmanCommand({
+  name: "app",
+  command: "myregistry.io/app:latest",
+  envs: [{ name: "PORT", value: "3000" }],
+});
 
-debug("Start server");
-await exec(context, "bun run ./dist/server.js");
+await runPodmanContainerService("app", cmd);
 ```
 
-## Core API Reference
+---
 
-### Context Class
+## API
 
-Data storage to connect server
+### Context
+
+Describes the server connection.
 
 ```ts
-class Context {
-  constructor(name: string, address: string);
-  getAddress(): string;
-}
+const ctx = new Context({
+  user: "root",
+  address: "1.2.3.4",
+  sshKey: "~/.ssh/id_ed25519", // optional
+  sudo: false,                  // prefix commands with sudo (default: false)
+  userspace: false,             // use systemd --user scope (default: false)
+});
+
+ctx.getAddress(); // "root@1.2.3.4"
+```
+
+---
+
+### Commands
+
+#### `execCommand(command, props?, context?)`
+
+Runs a command locally. Throws on non-zero exit code.
+
+```ts
+await execCommand("systemctl restart app");
+await execCommand("mkdir -p /opt/app", {}, ctx); // with sudo if ctx.sudo = true
 ```
 
-- name: Server username
-- address: Server IP/hostname
-- getAddress(): Returns "user@host" format
+#### `execCommandMayError(command, props?, context?)`
 
-### copyFiles
+Same as `execCommand` but does not throw — returns the result with exit code.
 
 ```ts
-copyFiles(context: Context, from: string, to: string)
+const result = await execCommandMayError("command -v podman", {}, ctx);
+if (result.spawnResult.exitCode !== 0) {
+  // podman is not installed
+}
 ```
 
-Uses rsync to copy files to remote server. Supports directories.
+#### `execCommandOverSsh(command, context)`
 
-Example
+Runs a command on a remote server over SSH.
 
 ```ts
-await copyFiles(context, "./local", "/remote/path");
+await execCommandOverSsh("systemctl restart app", ctx);
 ```
 
-### Exec
+#### `copyFilesOverSsh(from, to, context)`
+
+Copies files to the remote server using rsync.
 
 ```ts
-exec(context: Context, command: string)
+await copyFilesOverSsh("./dist/", "/opt/app/dist", ctx);
 ```
 
-Executes command on remote server via SSH.
+---
+
+### Build & Deploy
 
-Example
+#### `buildAndRunOverSsh({ entrypoint, context })`
+
+Compiles a TypeScript script with `bun build` and runs it on the remote server. This is the primary usage pattern.
 
 ```ts
-await exec(ctx, "systemctl restart nginx");
+await buildAndRunOverSsh({
+  entrypoint: "./server.ts",
+  context: ctx,
+});
 ```
 
-### Install system package
+#### `passVarsClient(data, context)` / `passVarsServer(context?)`
+
+Passes variables from the local environment into the server script. Call `passVarsClient` before `buildAndRunOverSsh`, then `passVarsServer` inside the server script.
 
 ```ts
-installSystemPackage(packageName: string)
+// client.ts
+await passVarsClient({ DB_URL: process.env.DB_URL }, ctx);
+await buildAndRunOverSsh({ entrypoint: "./server.ts", context: ctx });
+
+// server.ts
+const vars = await passVarsServer();
+console.log(vars.DB_URL);
 ```
 
-Auto-detects OS and uses appropriate package manager.
+---
 
-Example
+### Packages
+
+#### `installSystemPackage(package, context?)`
+
+Installs a system package. Auto-detects the OS and uses `apt` or `dnf`. Skips if already installed.
 
 ```ts
-await installSystemPackage("nginx");
+await installSystemPackage("nftables");
+
+// with explicit config for a custom package
+await installSystemPackage({
+  name: "nginx",
+  command: "nginx",
+});
 ```
 
-### Install podman
+#### `installBunOverSsh(context)`
+
+Installs Bun on a remote server.
 
 ```ts
-installPodman(packageName: string)
+await installBunOverSsh(ctx);
 ```
 
-Installs Podman if not present.
+---
+
+### Podman
 
-Example
+#### `installPodman(context?)`
+
+Installs Podman and creates the `ramm` network. Skips if already installed.
 
 ```ts
 await installPodman();
 ```
 
-### Install podman
+#### `createPodmanCommand(options)`
+
+Builds a `podman run` command string from structured options.
 
 ```ts
-runPodmanContainer(command: string, name: string)
+const cmd = createPodmanCommand({
+  name: "app",
+  command: "myregistry.io/app:latest",
+  networks: ["ramm"],           // default: ["ramm"]
+  replace: true,                // default: true
+  background: true,             // default: true
+  envs: [{ name: "PORT", value: "3000" }],
+  volumes: [{ from: "/data", to: "/data" }],
+});
+// "podman run --name app --replace -d --network ramm -e PORT=3000 -v /data:/data myregistry.io/app:latest"
 ```
 
-Smart container management:
+#### `runPodmanContainer(name, command, context?)`
 
-- Checks if container exists
-- Recreates if configuration changed
-- Skips if already running
+Runs a container. Skips if already running with the same command. Recreates if the command changed.
 
-Example
+```ts
+await runPodmanContainer("app", cmd);
+```
+
+#### `runPodmanContainerService(name, command, context?)`
+
+Runs a container and registers it as a systemd service for autostart on reboot.
+
+```ts
+await runPodmanContainerService("app", cmd);
+```
+
+#### `loginPodman(address, login, password, context?)`
+
+Authenticates with a container registry.
 
 ```ts
-await runPodmanContainer("podman run -d --name web nginx", "web");
+await loginPodman("registry.example.com", "user", "password");
 ```
 
-### Install bun
+#### `addNftPodmanRule(context?)`
+
+Adds an nftables rule to allow Podman network traffic through the firewall.
 
 ```ts
-installBun(context: Context)
+await addNftPodmanRule();
 ```
 
-Smart container management:
+---
+
+### Systemd
+
+#### `createSystemdService(name, content, context?)`
+
+Writes a unit file, enables and starts the service.
+
+```ts
+await createSystemdService(
+  "app.service",
+  `[Unit]
+Description=My App
+
+[Service]
+ExecStart=bun run /opt/app/server.js
+Restart=always
+
+[Install]
+WantedBy=multi-user.target`
+);
+```
+
+#### `createSystemdUnit(name, content, context?)`
+
+Writes a unit file and reloads systemd. Does not start the service.
+
+#### `startSystemdUnit(name, context?)` / `restartSystemdUnit(name, context?)` / `enableSystemdUnit(name, context?)` / `reloadSystemd(context?)`
+
+Systemd unit management.
+
+```ts
+await reloadSystemd();
+await enableSystemdUnit("app.service");
+await startSystemdUnit("app.service");
+```
+
+#### `getSystemdPathToUnit(name, context?)`
+
+Returns the path to the unit file — `/etc/systemd/system/` or `~/.config/systemd/user/` for userspace context.
+
+---
+
+### Firewall (nftables)
+
+#### `setupNftable({ allowedIpV4, allowedPorts, context? })`
+
+Creates an `inet ramm` nftables table. Closes all ports except the ones listed, rate-limits SSH, saves the config, and enables autostart.
+
+```ts
+await setupNftable({
+  allowedIpV4: ["1.2.3.4"],  // IPs with unrestricted SSH access
+  allowedPorts: [80, 443],
+});
+```
+
+---
+
+### SSH Keys
+
+#### `createAndAddSshKey(filePath, comment, context)`
+
+Creates an ed25519 key (if it doesn't exist) and adds the public key to `authorized_keys` on the server.
+
+```ts
+await createAndAddSshKey("~/.ssh/deploy_key", "deploy", ctx);
+```
+
+#### `addSshKeyToUse({ key, fingerprint, filePath, server, context? })`
+
+Saves a private key locally, adds the fingerprint to `known_hosts`, and configures `~/.ssh/config`.
+
+#### `saveSshFingerptint(filePath, context)`
+
+Fetches the server's fingerprint and saves it to a file.
+
+#### `addKeyToHostConfig(pathToHost, address, pathToKey, context?)`
+
+Adds a `Host` block to the SSH config.
+
+---
+
+### Files
+
+#### `writeFile(path, content, context?)`
+
+Writes a file. Skips if the content is already the same.
+
+```ts
+await writeFile("/etc/app/config.json", JSON.stringify(config));
+```
+
+#### `writeFileStrUniq(path, str, context?)`
+
+Appends a string to a file only if it is not already present.
+
+```ts
+await writeFileStrUniq("~/.bashrc", 'export PATH="$PATH:/opt/bin"');
+```
+
+---
+
+### Cron
+
+#### `createCron({ time, pathToFile, context? })`
+
+Adds a crontab entry. Skips if the entry already exists. Updates the schedule if the file is already in crontab with a different time.
+
+```ts
+await createCron({
+  time: "0 3 * * *",
+  pathToFile: "/opt/scripts/backup.sh",
+});
+```
+
+---
+
+### Utilities
+
+#### `printBlock(name)`
+
+Prints a named block to the console — useful for structuring deployment output.
+
+```ts
+printBlock("Database"); // → Block: Database
+```
 
-- Copies installation script to server
-- Executes bun.sh on remote host
+#### `normalizePath(path)`
 
-Example
+Expands `~/` to an absolute path.
 
 ```ts
-await installBun(context);
+normalizePath("~/.ssh/config"); // "/home/user/.ssh/config"
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ramm",
   "type": "module",
-  "version": "0.0.59",
+  "version": "0.0.62",
   "scripts": {
     "build": "bun build ./src/ramm.ts --target bun --outdir ./dist && cp ./src/bun.sh ./dist/bun.sh",
     "types": "tsc --project tsconfig.types.json"
@@ -14,9 +14,13 @@
   "engines": {
     "bun": ">=1.0.0"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/utftu/ramm.git"
+  },
   "devDependencies": {
     "@types/bun": "latest",
     "typescript": "^5.8.2",
     "dapes": "^0.0.26"
   }
-}
+}

package/dist/bun.sh

@@ -1,23 +0,0 @@
-#!/bin/bash
-
-if ! command -v unzip &> /dev/null; then
-  . /etc/os-release
-
-  if [[ "$ID_LIKE" == *"rhel"* ]]; then
-    sudo dnf install -y unzip
-  fi
-  
-  if [[ "$ID" == "ubuntu" ]]; then
-    sudo apt update
-    sudo apt install -y unzip
-  fi
-fi
-
-if ! command -v bun &> /dev/null; then
-    echo "Installing bun..."
-    
-    curl -fsSL https://bun.sh/install | bash
-    ln -s "$HOME/.bun/bin/bun" /usr/local/bin/bun
-else
-    echo "Already installed bun."
-fi

package/dist/ramm.js

@@ -1,620 +0,0 @@
-// @bun
-// src/base/base.ts
-var {spawn } = globalThis.Bun;
-
-// src/print.ts
-var printInternal = (left, right) => {
-  console.info(`\x1B[32m${left}:\x1B[0m \x1B[38;5;85m${right}\x1B[0m`);
-};
-var printCommand = (command) => {
-  printInternal("Command", command);
-};
-var printFunction = (func) => {
-  printInternal("Function", func);
-};
-var printBlock = (name) => {
-  console.info(`\x1B[34mBlock:\x1B[0m \x1B[38;5;81m${name}\x1B[0m`);
-};
-
-// src/context.ts
-class Context {
-  user;
-  domain;
-  userspace;
-  sudo;
-  sshKey;
-  params = {};
-  constructor({
-    user,
-    address,
-    userspace = false,
-    sudo = false,
-    sshKey
-  }) {
-    this.user = user;
-    this.domain = address;
-    this.sudo = sudo;
-    this.userspace = userspace;
-    this.sshKey = sshKey;
-  }
-  getAddress() {
-    return `${this.user}@${this.domain}`;
-  }
-}
-
-// src/base/tee.ts
-var tee = async (read, write, prefix) => {
-  const reader = read.getReader();
-  let leftover = "";
-  let output = "";
-  const decoder = new TextDecoder("utf-8");
-  while (true) {
-    const { value, done } = await reader.read();
-    if (done) {
-      if (leftover)
-        write(prefix + leftover + `
-`);
-      return output;
-    }
-    const decodedOutput = decoder.decode(value, { stream: true });
-    output += decodedOutput;
-    const lines = (leftover + decodedOutput).split(`
-`);
-    leftover = lines.pop() ?? "";
-    for (const line of lines) {
-      write(prefix + line + `
-`);
-    }
-  }
-};
-var teeStdout = (read, prefix) => {
-  return tee(read, (text) => process.stdout.write(text), prefix);
-};
-var teeStderr = (read, prefix) => {
-  return tee(read, (text) => process.stderr.write(text), prefix);
-};
-
-// src/base/base.ts
-var defaultContext = new Context({
-  user: "root",
-  address: "0.0.0.0",
-  userspace: false,
-  sudo: false
-});
-var execCommandRaw = async (command, { store = {}, signal, env, cwd, prefix = "" } = {}, ctx) => {
-  const finalCommand = ctx?.sudo ? `sudo ${command}` : command;
-  const spawnResult = spawn(["bash", "-c", finalCommand], {
-    stdin: "inherit",
-    stdout: "pipe",
-    stderr: "pipe",
-    signal,
-    cwd,
-    env
-  });
-  store.spawnResult = spawnResult;
-  const [stdout, stderr] = await Promise.all([
-    teeStdout(spawnResult.stdout, prefix),
-    teeStderr(spawnResult.stderr, prefix)
-  ]);
-  await spawnResult.exited;
-  return {
-    stderr,
-    stdout,
-    spawnResult
-  };
-};
-var execCommandMayError = async (command, props, context) => {
-  printCommand(command);
-  return execCommandRaw(command, props, context);
-};
-var execCommand = async (command, props, context) => {
-  const result = await execCommandMayError(command, props, context);
-  if (result.spawnResult.exitCode !== 0) {
-    console.error(`Error exit code: ${result.spawnResult.exitCode}`);
-    console.error(`Command: ${command}`);
-    throw new Error(command);
-  }
-  return result;
-};
-var copyFilesBySsh = async (from, to, context) => {
-  await execCommand(`rsync -avz ${from} ${context.getAddress()}:${to}`);
-};
-var execCommandOverSsh = async (command, context) => {
-  const sshKeyPart = context.sshKey ? ` -i ${context.sshKey}` : "";
-  return await execCommand(`ssh${sshKeyPart} ${context.getAddress()} '${command}'`);
-};
-// src/init.ts
-var installBunOverSsh = async (context) => {
-  const bunPath = new URL(import.meta.resolve("./bun.sh")).pathname;
-  await copyFilesBySsh(bunPath, "./bun.sh", context);
-  await execCommandOverSsh("./bun.sh", context);
-};
-// src/podman.ts
-var {$: $2 } = globalThis.Bun;
-
-// src/packages.ts
-var {$ } = globalThis.Bun;
-var dnfOs = ["rocky", "fedora", "alma"];
-var aptOs = ["ubuntu"];
-var getManagerByOs = (osName) => {
-  if (aptOs.includes(osName)) {
-    return "apt";
-  } else if (dnfOs.includes(osName)) {
-    return "dnf";
-  } else {
-    throw new Error(`Unsupported OS: ${osName}`);
-  }
-};
-var getManagerConfig = (manager, packageConfig) => {
-  if (packageConfig.managers && manager in packageConfig.managers) {
-    const managerEnt = packageConfig.managers[manager];
-    return managerEnt;
-  }
-  return {
-    name: packageConfig.name,
-    command: packageConfig.command
-  };
-};
-var getInstallCommand = (manager, config) => {
-  if (manager === "apt") {
-    return `apt install -y ${config.name}`;
-  } else if (manager === "dnf") {
-    return `dnf install -y ${config.name}`;
-  } else {
-    throw new Error("Unknow manager");
-  }
-};
-var packages = {
-  nftables: {
-    name: "nftables",
-    command: "nft"
-  },
-  podman: {
-    name: "podman",
-    command: "podman"
-  }
-};
-var installSystemPackage = async (packageEnt, context) => {
-  const finalPackageEnt = typeof packageEnt === "string" ? packages[packageEnt] : packageEnt;
-  if (!finalPackageEnt) {
-    const errorMessage = `No package ent for: ${packageEnt}`;
-    throw new Error(errorMessage);
-  }
-  const osName = (await $`cat /etc/os-release | grep ^ID= | cut -d'=' -f2`.text()).trim().replace(/"/g, "");
-  const manager = getManagerByOs(osName);
-  const managerConfig = getManagerConfig(manager, finalPackageEnt);
-  const checkResult = await execCommandMayError(`command -v ${managerConfig.command}`, {}, context);
-  if (checkResult.spawnResult.exitCode === 0) {
-    return;
-  }
-  const installCommand = getInstallCommand(manager, managerConfig);
-  await execCommand(installCommand, {}, context);
-  if (osName === "ubuntu") {
-    await execCommand(`apt-get install -y ${managerConfig.name}`, {}, context);
-  } else if (dnfOs.includes(osName)) {
-    await execCommand(`dnf install -y ${managerConfig.name}`, {}, context);
-  } else {
-    throw new Error(`Unsupported OS: ${osName}`);
-  }
-};
-
-// src/files.ts
-import { appendFile, exists } from "fs/promises";
-var {file, write } = globalThis.Bun;
-
-// src/path.ts
-import { homedir } from "os";
-import { join } from "path";
-function normalizePath(rawFilePath) {
-  let finalFilePath = rawFilePath.trim();
-  if (finalFilePath.startsWith("~/")) {
-    finalFilePath = join(homedir(), finalFilePath.slice(2));
-  }
-  return finalFilePath;
-}
-
-// src/files.ts
-var normalizeFileContent = (str) => {
-  if (str === "") {
-    return str;
-  }
-  if (str.at(-1) !== `
-`) {
-    return str + `
-`;
-  }
-  return str;
-};
-var createDir = async (str) => {
-  const dirname = str.split("/").slice(0, -1).join("/");
-  const exist = await exists(dirname);
-  if (exist) {
-    return;
-  }
-  await execCommand(`mkdir -p ${dirname}`);
-};
-var checkStrInFile = async (filePath, str) => {
-  const file2 = Bun.file(filePath);
-  if (!await file2.exists()) {
-    return false;
-  }
-  const fileText = await file2.text();
-  if (fileText.includes(str)) {
-    return true;
-  }
-  return false;
-};
-var createFileIfNeed = async (rawFilePath) => {
-  const filePath = normalizePath(rawFilePath);
-  await createDir(filePath);
-  if (!await file(filePath).exists()) {
-    await execCommand(`touch ${filePath}`);
-  }
-};
-var writeIfNewStr = async (rawFilePath, str) => {
-  const filePath = normalizePath(rawFilePath);
-  await createFileIfNeed(filePath);
-  if (await checkStrInFile(filePath, str)) {
-    return;
-  }
-  await appendFile(filePath, normalizeFileContent(str));
-};
-var writeFile = async (pathToFile, str) => {
-  const normalizedPath = normalizePath(pathToFile);
-  await createFileIfNeed(normalizedPath);
-  await write(normalizedPath, str);
-};
-var writeFileFull = async (pathToFile, str) => {
-  const normalizedPath = normalizePath(pathToFile);
-  await createFileIfNeed(normalizedPath);
-  const fileText = await file(normalizedPath).text();
-  if (fileText === str) {
-    return;
-  }
-  await write(normalizedPath, str);
-};
-
-// src/systemd.ts
-var systemctlWordLangth = "systemctl ".length;
-var formatUserspace = (command, context = defaultContext) => {
-  const userPart = context.userspace ? " --user " : "";
-  return "systemctl" + userPart + " " + command.slice(systemctlWordLangth);
-};
-var reloadSystemd = async (context = defaultContext) => {
-  await execCommand(formatUserspace("systemctl daemon-reload", context));
-};
-var startSystemdUnit = async (unitName, context = defaultContext) => {
-  await execCommand(formatUserspace(`systemctl start ${unitName}`, context));
-};
-var enabledSystemdUnit = async (unitName, context = defaultContext) => {
-  await execCommand(formatUserspace(`systemctl enable ${unitName}`, context));
-};
-var restartSystemdUnit = async (name, context = defaultContext) => {
-  await execCommand(formatUserspace(`systemctl restart ${name}`, context));
-};
-var stopSystemdUnit = async (name, context = defaultContext) => {
-  await execCommand(formatUserspace(`systemctl stop ${name}`, context));
-};
-var checkSystemdUnit = async (serviceName, context = defaultContext) => {
-  const { spawnResult } = await execCommandMayError(formatUserspace(`systemctl is-active ${serviceName}`, context));
-  return spawnResult.exitCode === 0;
-};
-var createSystemdUnit = async (unitName, content, context = defaultContext) => {
-  const pathToSeviceTarget = getSystemdPathToUnit(unitName, context);
-  await writeFileFull(pathToSeviceTarget, content);
-  await reloadSystemd(context);
-};
-var getSystemdPathToUnit = (serviceName, context = defaultContext) => {
-  if (context.userspace) {
-    return `~/.config/systemd/user/${serviceName}`;
-  }
-  return `/etc/systemd/system/${serviceName}`;
-};
-var createSystemdService = async (serviceName, content, context = defaultContext) => {
-  await createSystemdUnit(serviceName, content, context);
-  await enabledSystemdUnit(serviceName, context);
-  await startSystemdUnit(serviceName, context);
-};
-
-// src/nft.ts
-var createNftTable = ({
-  allowedIpV4,
-  allowedPorts = []
-}) => {
-  const nftTable = `table inet ramm {
-    set allowed_ipv4 {
-      type ipv4_addr
-      flags dynamic
-      elements = { ${allowedIpV4.join(`
-	`)} }
-    }
-
-    chain local_chain_base {
-      iif "lo" accept
-      ct state established,related accept
-      ip saddr @allowed_ipv4 tcp dport 22 accept
-      tcp dport 22 ct state new limit rate over 700/minute burst 5 packets drop
-      tcp dport 22 accept
-      ${allowedPorts.map((port) => {
-    return `tcp dport ${port} accept`;
-  }).join(`
-`)}
-    }
-
-    chain local_chain {
-      jump local_chain_base
-      drop
-    }
-
-    chain prerouting {
-      type filter hook prerouting priority mangle; policy accept;
-      fib daddr type local jump local_chain
-    }
-  }
-  `;
-  return nftTable;
-};
-var setupNftable = async ({
-  allowedIpV4,
-  allowedPorts
-}) => {
-  await installSystemPackage("nftables");
-  const listTable = await execCommandMayError("nft list table inet ramm");
-  if (listTable.spawnResult.exitCode === 0) {
-    await execCommand("nft delete table inet ramm");
-  }
-  const nftTable = createNftTable({ allowedIpV4, allowedPorts });
-  await execCommand(`nft -f - <<EOF
-${nftTable}
-EOF`);
-  await safeNftTable();
-};
-var safeNftTable = async () => {
-  await execCommand("nft list ruleset > /etc/nftables.conf");
-  await execCommand("systemctl enable nftables");
-};
-
-// src/podman.ts
-var installPodman = async () => {
-  if ((await $2`command -v podman`.nothrow().quiet()).exitCode !== 0) {
-    await installSystemPackage("podman");
-  }
-  await createNetwork();
-};
-var createNetwork = async () => {
-  const netwroks = await execCommand("podman network inspect $(podman network ls -q) -f '{{.NetworkInterface}}'");
-  const podmanNetworks = await execCommand("podman network ls");
-  if (podmanNetworks.stdout.includes("ramm")) {
-    return;
-  }
-  if (netwroks.stdout.includes("podman_ramm")) {
-    return;
-  }
-  await execCommand("podman network create --interface-name=podman_ramm ramm");
-};
-var getCreateCommand = async (name) => {
-  const podmanCreateCommand = await $2`podman inspect --format '{{.Config.CreateCommand}}' ${name}`.nothrow().quiet();
-  return podmanCreateCommand.text().slice(0, -1).slice(1, -1) || "";
-};
-var loginPodman = async (address, login, password) => {
-  return await execCommand(`echo "${password}" | podman login --username "${login}" --password-stdin ${address}`);
-};
-var createPodmanCommand = ({
-  name,
-  replace = true,
-  background = true,
-  networks = ["ramm"],
-  envs = [],
-  volumes = [],
-  command
-}) => {
-  const values = [];
-  values.push("podman", "run");
-  if (name) {
-    values.push(`--name ${name}`);
-  }
-  if (replace) {
-    values.push("--replace");
-  }
-  if (background) {
-    values.push("-d");
-  }
-  for (const network of networks) {
-    values.push(`--network ${network}`);
-  }
-  for (const env of envs) {
-    values.push(`-e ${env.name}=${env.value}`);
-  }
-  for (const volume of volumes) {
-    values.push(`-v ${volume.from}:${volume.to}`);
-  }
-  values.push(command);
-  const str = values.join(" ");
-  return str;
-};
-var runPodmanContainer = async (name, command) => {
-  if (await getCreateCommand(name) !== command) {
-    await $2`podman rm -f ${name}`;
-    await execCommand(command);
-    return;
-  }
-  console.info("Podman container is already running");
-};
-var runPodmanContainerService = async (name, command, context = defaultContext) => {
-  const serviceName = `${name}.service`;
-  const filepath = getSystemdPathToUnit(serviceName);
-  if (await checkSystemdUnit(serviceName, context)) {
-    await stopSystemdUnit(serviceName, context);
-  }
-  await runPodmanContainer(name, command);
-  await execCommand(`podman generate systemd --name --new ${name} > ${filepath}`);
-  await reloadSystemd(context);
-  await startSystemdUnit(serviceName, context);
-  await enabledSystemdUnit(serviceName, context);
-};
-var addNftPodmanRule = async () => {
-  const podmanNetworksResult = await execCommand("podman network inspect $(podman network ls -q) -f '{{.NetworkInterface}}'");
-  const podmanNetworks = podmanNetworksResult.stdout.trim().split(`
-`);
-  await execCommand(`nft add set inet ramm podman_interfaces '{ type ifname; flags dynamic; elements = { ${podmanNetworks.join(", ")} }; }'`);
-  await execCommand("nft insert rule inet ramm prerouting iifname @podman_interfaces accept");
-  await safeNftTable();
-};
-// src/ssh.ts
-var {file: file2 } = globalThis.Bun;
-var addKeyToHostConfig = async (pathToHost, address, pathToKey) => {
-  const text = `Host ${address}
-  IdentityFile ${pathToKey}
-`;
-  await writeIfNewStr(pathToHost, text);
-};
-var getServerFingerprint = async (context) => {
-  const { stdout } = await execCommandOverSsh('ssh-keyscan -t ed25519 localhost | grep -v "^#"', context);
-  return stdout.replace("localhost", context.domain);
-};
-var saveSshFingerptint = async (filePath, context) => {
-  const normalizedPath = normalizePath(filePath);
-  const fingerprint = await getServerFingerprint(context);
-  await writeFileFull(filePath, normalizedPath);
-};
-async function createSshKey(filePath, comment) {
-  printFunction(`${createSshKey.name} ${filePath}`);
-  const normalizedPathToKey = normalizePath(filePath);
-  const name = normalizedPathToKey.split("/").at(-1);
-  const pathToKeyPub = `${normalizedPathToKey}.pub`;
-  const pathToDir = normalizedPathToKey.split("/").slice(0, -1).join("/");
-  const pathToKeyFile = file2(normalizedPathToKey);
-  const pathToKeyPubFile = file2(pathToKeyPub);
-  if (await pathToKeyFile.exists() && await pathToKeyPubFile.exists()) {
-    return await pathToKeyPubFile.text();
-  }
-  await execCommand(`mkdir -p ${pathToDir}`);
-  await execCommand(`ssh-keygen -t ed25519 -f ${normalizedPathToKey} -N "" -C "${comment || name}"`);
-  await execCommand(`chmod 600 ${normalizedPathToKey}`);
-  const pubKey = await Bun.file(pathToKeyPub).text();
-  return pubKey;
-}
-var addSshKeyToAuthorizedOverSsh = async (pubKey, context) => {
-  printFunction(`${addSshKeyToAuthorizedOverSsh.name} ${pubKey}`);
-  const { stdout: keys } = await execCommandOverSsh("cat .ssh/authorized_keys", context);
-  if (keys.includes(pubKey)) {
-    return;
-  }
-  await execCommandOverSsh(`echo "${pubKey}" >> .ssh/authorized_keys`, context);
-};
-var createAndAddSshKey = async (filePath, comment, context) => {
-  const normalizedPath = normalizePath(filePath);
-  const pubKey = await createSshKey(normalizedPath, comment);
-  console.log(`Key is: ${pubKey}`);
-  await addSshKeyToAuthorizedOverSsh(pubKey, context);
-};
-var addSshKeyToUse = async ({
-  key,
-  fingerprint,
-  filePath,
-  server
-}) => {
-  printFunction(`${addSshKeyToUse.name} ${filePath}`);
-  const normalizedFilePath = normalizePath(filePath);
-  await writeFileFull(normalizedFilePath, key);
-  await execCommand(`chmod 0600 ${normalizedFilePath}`);
-  await writeIfNewStr("~/.ssh/known_hosts", fingerprint);
-  await addKeyToHostConfig("~/.ssh/config", server, normalizedFilePath);
-};
-// src/cron.ts
-var createCron = async ({
-  time,
-  pathToFile
-}) => {
-  const pathToFileNorm = normalizePath(pathToFile);
-  const constructedLine = `${time} ${pathToFileNorm}`;
-  const tempFile = `/tmp/ramm_cron}`;
-  const { stdout: cronConfig } = await execCommandMayError("crontab -l");
-  let newCronConfig = cronConfig;
-  if (cronConfig.includes(constructedLine)) {
-    return;
-  }
-  if (cronConfig.includes(pathToFileNorm)) {
-    newCronConfig = cronConfig.split(`
-`).filter((str) => !str.includes(pathToFileNorm)).join(`
-`);
-  }
-  newCronConfig = normalizeFileContent(normalizeFileContent(cronConfig) + constructedLine);
-  await writeFile(tempFile, newCronConfig);
-  await execCommandMayError(`cat ${tempFile}`);
-  await execCommandMayError(`crontab ${tempFile}`);
-  await execCommandMayError(`rm ${tempFile}`);
-};
-// src/build.ts
-var {build, file: file3 } = globalThis.Bun;
-var buildAndRunOverSsh = async ({
-  entrypoint,
-  context
-}) => {
-  const normalizedEntrypoint = normalizePath(entrypoint);
-  const distName = `ramm_dist`;
-  const distDir = `/tmp/${distName}`;
-  const outputs = await build({
-    outdir: distDir,
-    entrypoints: [normalizedEntrypoint],
-    target: "bun"
-  });
-  const pathToDistFile = outputs.outputs[0]?.path;
-  const relativePathToFile = pathToDistFile.slice(distDir.length + 1);
-  await copyFilesBySsh(`${distDir}/`, distDir, context);
-  await execCommandOverSsh(`bun run ${distDir}/${relativePathToFile}`, context);
-  await execCommand(`rm -rf ${distDir}`);
-};
-var pathToJson = "/tmp/ramm_json";
-var passVarsClient = async (data, context) => {
-  printFunction("passVarsClient");
-  const json = JSON.stringify(data);
-  await writeFile(pathToJson, json);
-  await copyFilesBySsh(pathToJson, pathToJson, context);
-  await execCommand(`rm -rf ${pathToJson}`);
-};
-var passVarsServer = async () => {
-  printFunction("passVarsServer");
-  const jsonData = await file3(pathToJson).json();
-  await execCommand(`rm -rf ${pathToJson}`);
-  return jsonData;
-};
-export {
-  writeIfNewStr,
-  writeFileFull,
-  writeFile,
-  startSystemdUnit,
-  setupNftable,
-  saveSshFingerptint,
-  runPodmanContainerService,
-  runPodmanContainer,
-  restartSystemdUnit,
-  reloadSystemd,
-  printBlock,
-  passVarsServer,
-  passVarsClient,
-  normalizePath,
-  normalizeFileContent,
-  loginPodman,
-  installSystemPackage,
-  installPodman,
-  installBunOverSsh,
-  getSystemdPathToUnit as getSystemdPathToService,
-  getServerFingerprint,
-  execCommandRaw,
-  execCommandOverSsh,
-  execCommandMayError,
-  execCommand,
-  enabledSystemdUnit,
-  createSystemdUnit,
-  createSystemdService,
-  createPodmanCommand,
-  createCron,
-  createAndAddSshKey,
-  copyFilesBySsh,
-  buildAndRunOverSsh,
-  addSshKeyToUse,
-  addNftPodmanRule,
-  addKeyToHostConfig,
-  Context
-};

package/dist/types/base/base.d.ts

@@ -1,35 +0,0 @@
-import { type Subprocess } from "bun";
-import { Context } from "../context.ts";
-export declare const defaultContext: Context;
-export type ExecCommandStore = {
-    spawnResult?: Subprocess<"inherit", "pipe", "pipe">;
-};
-type ExecProps = {
-    store?: ExecCommandStore;
-    env?: Record<string, string>;
-    cwd?: string;
-    prefix?: string;
-    signal?: AbortSignal;
-} | void;
-export declare const execCommandRaw: (command: string, { store, signal, env, cwd, prefix }?: ExecProps, ctx?: Context) => Promise<{
-    stderr: string;
-    stdout: string;
-    spawnResult: Subprocess<"inherit", "pipe", "pipe">;
-}>;
-export declare const execCommandMayError: (command: string, props: ExecProps, context?: Context) => Promise<{
-    stderr: string;
-    stdout: string;
-    spawnResult: Subprocess<"inherit", "pipe", "pipe">;
-}>;
-export declare const execCommand: (command: string, props: ExecProps, context?: Context) => Promise<{
-    stderr: string;
-    stdout: string;
-    spawnResult: Subprocess<"inherit", "pipe", "pipe">;
-}>;
-export declare const copyFilesBySsh: (from: string, to: string, context: Context) => Promise<void>;
-export declare const execCommandOverSsh: (command: string, context: Context) => Promise<{
-    stderr: string;
-    stdout: string;
-    spawnResult: Subprocess<"inherit", "pipe", "pipe">;
-}>;
-export {};

package/dist/types/base/tee.d.ts

@@ -1,2 +0,0 @@
-export declare const teeStdout: (read: ReadableStream, prefix: string) => Promise<string>;
-export declare const teeStderr: (read: ReadableStream, prefix: string) => Promise<string>;

package/dist/types/build.d.ts

@@ -1,7 +0,0 @@
-import type { Context } from "./context.ts";
-export declare const buildAndRunOverSsh: ({ entrypoint, context, }: {
-    entrypoint: string;
-    context: Context;
-}) => Promise<void>;
-export declare const passVarsClient: (data: Record<string, any>, context: Context) => Promise<void>;
-export declare const passVarsServer: () => Promise<any>;

package/dist/types/context.d.ts

@@ -1,16 +0,0 @@
-export declare class Context {
-    user: string;
-    domain: string;
-    userspace: boolean;
-    sudo: boolean;
-    sshKey?: string;
-    params: Record<string, string>;
-    constructor({ user, address, userspace, sudo, sshKey, }: {
-        user: string;
-        address: string;
-        userspace?: boolean;
-        sudo?: boolean;
-        sshKey?: string;
-    });
-    getAddress(): string;
-}

package/dist/types/cron.d.ts

@@ -1,4 +0,0 @@
-export declare const createCron: ({ time, pathToFile, }: {
-    time: string;
-    pathToFile: string;
-}) => Promise<void>;

package/dist/types/files.d.ts

@@ -1,4 +0,0 @@
-export declare const normalizeFileContent: (str: string) => string;
-export declare const writeIfNewStr: (rawFilePath: string, str: string) => Promise<void>;
-export declare const writeFile: (pathToFile: string, str: string) => Promise<void>;
-export declare const writeFileFull: (pathToFile: string, str: string) => Promise<void>;

package/dist/types/init.d.ts

@@ -1,2 +0,0 @@
-import type { Context } from "./context.ts";
-export declare const installBunOverSsh: (context: Context) => Promise<void>;

package/dist/types/nft.d.ts

@@ -1,6 +0,0 @@
-export declare const localNftChainName = "local_chain";
-export declare const setupNftable: ({ allowedIpV4, allowedPorts, }: {
-    allowedIpV4: string[];
-    allowedPorts: string[];
-}) => Promise<void>;
-export declare const safeNftTable: () => Promise<void>;

package/dist/types/packages.d.ts

@@ -1,13 +0,0 @@
-import type { Context } from "./context.ts";
-type Manager = "dnf" | "apt";
-type PackageConfig = {
-    name: string;
-    command: string;
-    managers?: Record<Manager, ManagerConfig>;
-};
-type ManagerConfig = {
-    name: string;
-    command: string;
-};
-export declare const installSystemPackage: (packageEnt: string | PackageConfig, context?: Context) => Promise<void>;
-export {};

package/dist/types/path.d.ts

@@ -1 +0,0 @@
-export declare function normalizePath(rawFilePath: string): string;

package/dist/types/podman.d.ts

@@ -1,25 +0,0 @@
-import type { Context } from "./context.ts";
-export declare const installPodman: () => Promise<void>;
-export declare const loginPodman: (address: string, login: string, password: string) => Promise<{
-    stderr: string;
-    stdout: string;
-    spawnResult: import("bun").Subprocess<"inherit", "pipe", "pipe">;
-}>;
-export declare const createPodmanCommand: ({ name, replace, background, networks, envs, volumes, command, }: {
-    name?: string;
-    replace?: boolean;
-    background?: boolean;
-    networks?: string[];
-    envs?: {
-        name: string;
-        value: string;
-    }[];
-    volumes?: {
-        from: string;
-        to: string;
-    }[];
-    command: string;
-}) => string;
-export declare const runPodmanContainer: (name: string, command: string) => Promise<void>;
-export declare const runPodmanContainerService: (name: string, command: string, context?: Context) => Promise<void>;
-export declare const addNftPodmanRule: () => Promise<void>;

package/dist/types/print.d.ts

@@ -1,3 +0,0 @@
-export declare const printCommand: (command: string) => void;
-export declare const printFunction: (func: string) => void;
-export declare const printBlock: (name: string) => void;

package/dist/types/ramm.d.ts

@@ -1,13 +0,0 @@
-export { execCommandOverSsh, execCommand, execCommandMayError, copyFilesBySsh, execCommandRaw, } from "./base/base.ts";
-export { Context } from "./context.ts";
-export { installBunOverSsh } from "./init.ts";
-export { installPodman, runPodmanContainer, loginPodman, runPodmanContainerService, addNftPodmanRule, createPodmanCommand, } from "./podman.ts";
-export { startSystemdUnit, enabledSystemdUnit, restartSystemdUnit, createSystemdService, getSystemdPathToUnit as getSystemdPathToService, createSystemdUnit, reloadSystemd, } from "./systemd.ts";
-export { installSystemPackage } from "./packages.ts";
-export { printBlock } from "./print.ts";
-export { setupNftable } from "./nft.ts";
-export { writeIfNewStr, writeFile, writeFileFull, normalizeFileContent, } from "./files.ts";
-export { createAndAddSshKey, getServerFingerprint, addKeyToHostConfig, addSshKeyToUse, saveSshFingerptint, } from "./ssh.ts";
-export { normalizePath } from "./path.ts";
-export { createCron } from "./cron.ts";
-export { buildAndRunOverSsh, passVarsClient, passVarsServer } from "./build.ts";

package/dist/types/ssh.d.ts

@@ -1,11 +0,0 @@
-import type { Context } from "./context.ts";
-export declare const addKeyToHostConfig: (pathToHost: string, address: string, pathToKey: string) => Promise<void>;
-export declare const getServerFingerprint: (context: Context) => Promise<string>;
-export declare const saveSshFingerptint: (filePath: string, context: Context) => Promise<void>;
-export declare const createAndAddSshKey: (filePath: string, comment: string, context: Context) => Promise<void>;
-export declare const addSshKeyToUse: ({ key, fingerprint, filePath, server, }: {
-    key: string;
-    fingerprint: string;
-    filePath: string;
-    server: string;
-}) => Promise<void>;

package/dist/types/systemd.d.ts

@@ -1,10 +0,0 @@
-import { Context } from "./context.ts";
-export declare const reloadSystemd: (context?: Context) => Promise<void>;
-export declare const startSystemdUnit: (unitName: string, context?: Context) => Promise<void>;
-export declare const enabledSystemdUnit: (unitName: string, context?: Context) => Promise<void>;
-export declare const restartSystemdUnit: (name: string, context?: Context) => Promise<void>;
-export declare const stopSystemdUnit: (name: string, context?: Context) => Promise<void>;
-export declare const checkSystemdUnit: (serviceName: string, context?: Context) => Promise<boolean>;
-export declare const createSystemdUnit: (unitName: string, content: string, context?: Context) => Promise<void>;
-export declare const getSystemdPathToUnit: (serviceName: string, context?: Context) => string;
-export declare const createSystemdService: (serviceName: string, content: string, context?: Context) => Promise<void>;