spinuptui 0.19.0

package/src/lib/vanitySite.ts

@@ -0,0 +1,297 @@
+// Vanity-site helpers: the embedded placeholder index.php, a site_user derivation,
+// and the SSH push that seeds the page into a fresh site's docroot.
+//
+// The page is EMBEDDED here (not read from docs/vanity-site/index.php) so it ships
+// with the installed binary — same location-independence lesson as config.json.
+// docs/vanity-site/index.php is the design reference; keep the two in sync.
+
+import { resolve4 } from "node:dns/promises"
+import { SSH_OPTS, sshPort, runProcess, meaningfulError, remoteDocRoot } from "./dbBackup.ts"
+import { pushUrl, LOAD_PUSH_SCALE } from "./uptimeKuma.ts"
+
+// The vanity convention: the site living at the server's own hostname. Every
+// feature that special-cases vanity sites (full monitoring, page re-seed) keys
+// off this ONE predicate so they can't diverge.
+export function isVanityPair(siteDomain: string, serverName: string): boolean {
+  return siteDomain === serverName
+}
+
+// Does the hostname now resolve to the server IP? Used to gate Let's Encrypt on the
+// new A record having propagated. Uses the system resolver; a fresh subdomain has no
+// prior cache, so this reflects the new record quickly once it's live.
+export async function aRecordResolves(host: string, ip: string): Promise<boolean> {
+  try {
+    return (await resolve4(host)).includes(ip)
+  } catch {
+    return false
+  }
+}
+
+// Brand-neutral, auto light/dark, reads its hostname from the request. The
+// <load>/<uptime> tags are machine-readable (WHMCS uptime checker parses them).
+// Machine modes for monitoring tools (Uptime Kuma etc. — see docs/uptime-kuma.md):
+//   ?healthz            → 200 "ok" / 503 "unhealthy: …" (plain text, no key)
+//   ?format=json[&key=] → metrics JSON; key required when one is baked in at
+//                         seed time via the __SPINUP_HEALTH_KEY__ placeholder.
+export const VANITY_INDEX_PHP = `<?php
+    // --- Server load (1-min average) -------------------------------------------
+    $load = @file_get_contents("/proc/loadavg");
+    $load = $load ? explode(' ', $load)[0] : '';
+    if (!$load && function_exists('exec')) {
+        $reguptime = trim(@exec("uptime"));
+        if ($reguptime && preg_match("/, *(\\d) (users?), .*: (.*), (.*), (.*)/", $reguptime, $m)) $load = $m[3];
+    }
+
+    // --- Uptime ----------------------------------------------------------------
+    $uptime_text = @file_get_contents("/proc/uptime");
+    $uptime = $uptime_text ? substr($uptime_text, 0, strpos($uptime_text, " ")) : '';
+    if (!$uptime && function_exists('shell_exec')) $uptime = @shell_exec("cut -d. -f1 /proc/uptime");
+    $days  = floor($uptime / 60 / 60 / 24);
+    $hours = str_pad($uptime / 60 / 60 % 24, 2, "0", STR_PAD_LEFT);
+    $mins  = str_pad($uptime / 60 % 60, 2, "0", STR_PAD_LEFT);
+    $secs  = str_pad($uptime % 60, 2, "0", STR_PAD_LEFT);
+
+    // Reusable on any server: derive the name from the request host, not a literal.
+    $host = $_SERVER['HTTP_HOST'] ?? gethostname();
+
+    // --- Machine-readable modes (?healthz, ?format=json) ------------------------
+    // Substituted at seed time; empty means the JSON mode needs no key.
+    $health_key = '__SPINUP_HEALTH_KEY__';
+    if (isset($_GET['healthz']) || (($_GET['format'] ?? '') === 'json')) {
+        header('Cache-Control: no-store');
+        $cores = 1;
+        $cpuinfo = @file_get_contents('/proc/cpuinfo');
+        if ($cpuinfo && preg_match_all('/^processor\\s*:/m', $cpuinfo, $m)) $cores = max(1, count($m[0]));
+        // SpinupWP's FPM pool disables disk_*/exec (fatal even with @) but leaves
+        // shell_exec — guard with function_exists and fall back to df.
+        $disk_free_pct = null;
+        if (function_exists('disk_free_space') && function_exists('disk_total_space')) {
+            $dt = @disk_total_space(__DIR__);
+            $df = @disk_free_space(__DIR__);
+            if ($dt && $df !== false) $disk_free_pct = round($df / $dt * 100, 1);
+        } elseif (function_exists('shell_exec')) {
+            $df_out = @shell_exec('df -Pk ' . escapeshellarg(__DIR__) . ' 2>/dev/null');
+            if ($df_out && preg_match('/\\n\\S+\\s+(\\d+)\\s+\\d+\\s+(\\d+)\\s/', $df_out, $dm) && (int)$dm[1] > 0) {
+                $disk_free_pct = round((int)$dm[2] / (int)$dm[1] * 100, 1);
+            }
+        }
+        $mem_available_pct = null;
+        $meminfo = @file_get_contents('/proc/meminfo');
+        if ($meminfo && preg_match('/^MemTotal:\\s+(\\d+)/m', $meminfo, $mt)
+                     && preg_match('/^MemAvailable:\\s+(\\d+)/m', $meminfo, $ma)
+                     && (int)$mt[1] > 0) {
+            $mem_available_pct = round((int)$ma[1] / (int)$mt[1] * 100, 1);
+        }
+        // Unhealthy = CPU pressure (1-min load per core > 2) or low disk (< 10% free).
+        $reasons = [];
+        if ($load !== '' && ((float)$load / $cores) > 2) $reasons[] = 'load';
+        if ($disk_free_pct !== null && $disk_free_pct < 10) $reasons[] = 'disk';
+
+        // ?healthz: binary state only — safe without a key. A plain HTTP monitor
+        // (200-299 = up) gets threshold alerting for free via the 503.
+        if (isset($_GET['healthz'])) {
+            http_response_code($reasons ? 503 : 200);
+            header('Content-Type: text/plain; charset=utf-8');
+            echo $reasons ? 'unhealthy: ' . implode(' ', $reasons) : 'ok';
+            exit;
+        }
+        if ($health_key !== '' && !hash_equals($health_key, (string)($_GET['key'] ?? ''))) {
+            http_response_code(403);
+            header('Content-Type: application/json');
+            echo '{"error":"forbidden"}';
+            exit;
+        }
+        header('Content-Type: application/json');
+        echo json_encode([
+            'host' => $host,
+            'status' => $reasons ? 'unhealthy' : 'ok',
+            'load_1m' => $load === '' ? null : (float)$load,
+            'cores' => $cores,
+            'uptime_s' => (int)$uptime,
+            'disk_free_pct' => $disk_free_pct,
+            'mem_available_pct' => $mem_available_pct,
+            'php_version' => PHP_VERSION,
+            'time' => gmdate('c'),
+        ]);
+        exit;
+    }
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="robots" content="noindex, nofollow">
+    <title><?= htmlspecialchars($host) ?></title>
+    <style>
+        :root {
+            --bg: #fafafa; --card: #ffffff; --line: #ececec;
+            --ink: #1b1b1f; --muted: #6b7280; --faint: #9ca3af;
+            --ok: #16a34a; --accent: #111827;
+        }
+        @media (prefers-color-scheme: dark) {
+            :root {
+                --bg: #0b0d10; --card: #14171c; --line: #232830;
+                --ink: #e8eaed; --muted: #9aa3af; --faint: #6b7280;
+                --ok: #34d399; --accent: #e8eaed;
+            }
+        }
+        * { box-sizing: border-box; }
+        body, html { height: 100%; margin: 0; }
+        body {
+            display: flex; align-items: center; justify-content: center;
+            background: var(--bg); color: var(--ink);
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+            -webkit-font-smoothing: antialiased;
+        }
+        .card {
+            width: min(92vw, 440px);
+            padding: 40px 44px;
+            background: var(--card);
+            border: 1px solid var(--line);
+            border-radius: 14px;
+        }
+        /* Swap in a logo by setting a background-image here, or replace the dot. */
+        .status {
+            display: inline-flex; align-items: center; gap: 8px;
+            font-size: 12px; letter-spacing: .08em; text-transform: uppercase;
+            color: var(--muted);
+        }
+        .dot {
+            width: 9px; height: 9px; border-radius: 50%; background: var(--ok);
+            box-shadow: 0 0 0 0 var(--ok); animation: pulse 2.4s infinite;
+        }
+        @keyframes pulse {
+            0%   { box-shadow: 0 0 0 0 color-mix(in srgb, var(--ok) 55%, transparent); }
+            70%  { box-shadow: 0 0 0 10px transparent; }
+            100% { box-shadow: 0 0 0 0 transparent; }
+        }
+        @media (prefers-reduced-motion: reduce) { .dot { animation: none; } }
+        h1 {
+            margin: 18px 0 4px; font-size: 22px; font-weight: 600;
+            letter-spacing: -.01em; word-break: break-all;
+        }
+        .sub { margin: 0 0 28px; color: var(--muted); font-size: 14px; }
+        .metrics {
+            display: flex; gap: 14px; padding-top: 22px;
+            border-top: 1px solid var(--line);
+        }
+        .metric { flex: 1; }
+        .metric .k { font-size: 11px; letter-spacing: .06em; text-transform: uppercase; color: var(--faint); }
+        load, uptime {
+            display: block; margin-top: 5px;
+            font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+            font-size: 15px; color: var(--ink);
+        }
+    </style>
+</head>
+<body>
+    <main class="card">
+        <span class="status"><span class="dot"></span>Online</span>
+        <h1><?= htmlspecialchars($host) ?></h1>
+        <p class="sub">This server is up and running.</p>
+        <div class="metrics">
+            <div class="metric">
+                <div class="k">Uptime</div>
+                <?php echo "<uptime>{$days}d {$hours}:{$mins}:{$secs}</uptime>"; ?>
+            </div>
+            <div class="metric">
+                <div class="k">Load (1m)</div>
+                <?php echo "<load>" . htmlspecialchars($load) . "</load>"; ?>
+            </div>
+        </div>
+    </main>
+</body>
+</html>
+`
+
+// Derive a sane Linux site_user from a hostname. Assumes the apex is the last two
+// labels (fine for .com etc.; user can edit the default). Letters/digits only,
+// starts with a letter, capped at 32 chars (Linux username limit).
+export function deriveSiteUser(hostname: string): string {
+  const labels = hostname.toLowerCase().trim().replace(/\.$/, "").split(".")
+  const sub = labels.length > 2 ? labels.slice(0, labels.length - 2) : [labels[0] ?? ""]
+  let u = sub.join("").replace(/[^a-z0-9]/g, "")
+  if (!u) u = "site"
+  if (!/^[a-z]/.test(u)) u = `s${u}`
+  return u.slice(0, 32)
+}
+
+export interface VanitySeedTarget {
+  host: string // server IP / hostname for SSH
+  user: string // site_user
+  port: number | null
+  domain: string // the site domain (for the docroot path)
+  publicFolder: string | null
+  // Baked into the page's ?format=json mode (letters/digits only — it lands inside
+  // a single-quoted PHP string). Empty/absent ⇒ the JSON mode needs no key.
+  healthKey?: string | null
+}
+
+// Push the embedded index.php into the site's docroot over SSH. Idempotent — safe
+// to re-run on resume (it overwrites). base64-pipe avoids any quoting headaches.
+export async function seedVanityIndex(t: VanitySeedTarget): Promise<{ ok: boolean; error?: string }> {
+  const docroot = remoteDocRoot(t.domain, t.publicFolder)
+  const php = VANITY_INDEX_PHP.replace("__SPINUP_HEALTH_KEY__", t.healthKey ?? "")
+  const b64 = Buffer.from(php, "utf8").toString("base64")
+  const remote = `mkdir -p '${docroot}' && printf '%s' '${b64}' | base64 -d > '${docroot}/index.php'`
+  const r = await runProcess(["ssh", ...SSH_OPTS, ...sshPort(t.port), `${t.user}@${t.host}`, remote], 60_000)
+  if (r.code !== 0) return { ok: false, error: meaningfulError(r.stderr, "Couldn't write index.php over SSH (is your key on the server yet?).") }
+  return { ok: true }
+}
+
+export interface PushCronTarget {
+  host: string // server IP / hostname for SSH
+  user: string // site_user (the cron lands in this user's crontab — no sudo needed)
+  port: number | null
+  kumaUrl: string // Uptime Kuma base URL
+  pushToken: string
+  // When set, a second marker-managed cron line feeds the server's Redis
+  // sentinel monitor (`{server} redis`): redis-cli ping → status=up/down.
+  // Unlike the load heartbeat (dead-man's switch), this line ACTIVELY reports
+  // down — Redis being dead while the server is fine is exactly the state it
+  // exists to catch. Server dead ⇒ both monitors go silent anyway.
+  redisToken?: string | null
+}
+
+const PUSH_CRON_MARKER = "spinup-kuma-push"
+const REDIS_CRON_MARKER = "spinup-kuma-redis"
+
+// Is Redis answerable from this box's shell? Run BEFORE creating the sentinel
+// monitor: a server without redis-cli (or with auth in the way) would otherwise
+// get a monitor that's red forever. Fail loudly at setup time instead.
+export async function probeServerRedis(t: { host: string; user: string; port: number | null }): Promise<{ ok: boolean; error?: string }> {
+  const r = await runProcess(["ssh", ...SSH_OPTS, ...sshPort(t.port), `${t.user}@${t.host}`, `[ "$(redis-cli ping 2>/dev/null)" = "PONG" ]`], 30_000)
+  if (r.code === 0) return { ok: true }
+  return { ok: false, error: "redis-cli didn't answer PONG on the server — Redis sentinel skipped." }
+}
+
+// Install (or refresh) the once-a-minute heartbeat cron that feeds the Kuma push
+// monitor: status=up plus the 1-min load in `ping`, which Kuma graphs. The beat
+// stopping is the signal (dead-man's switch) — so the cron itself never reports
+// "down"; it just goes quiet when the server/cron/egress dies.
+//
+// Load is sent ×LOAD_PUSH_SCALE as an INTEGER (1.64 → 164): some Kuma builds
+// validate `ping` as an int and silently store null for floats (verified live).
+// The store's Kuma poll divides by the same constant.
+//
+// Idempotent: a marker comment identifies our line, and the install strips any
+// previous marked line before appending. NO `%` anywhere in the line — cron
+// treats a bare % as newline (which also rules out awk printf here).
+export async function seedVanityPushCron(t: PushCronTarget): Promise<{ ok: boolean; error?: string }> {
+  const push = pushUrl(t.kumaUrl, t.pushToken)
+  const lines = [`* * * * * curl -fsS --max-time 20 '${push}?status=up&msg=ok&ping='$(awk '{print int($1*${LOAD_PUSH_SCALE})}' /proc/loadavg) >/dev/null 2>&1 # ${PUSH_CRON_MARKER}`]
+  if (t.redisToken) {
+    const redisPush = pushUrl(t.kumaUrl, t.redisToken)
+    lines.push(`* * * * * s=down; [ "$(redis-cli ping 2>/dev/null)" = "PONG" ] && s=up; curl -fsS --max-time 20 "${redisPush}?status=$s&msg=redis-$s&ping=" >/dev/null 2>&1 # ${REDIS_CRON_MARKER}`)
+  }
+  // The lines contain quotes of both kinds once cron expands them, so ship them
+  // base64'd (same trick as the index.php seed) instead of fighting nesting.
+  // Both markers are always stripped first, so seeding WITHOUT a redisToken also
+  // removes a previously installed sentinel line (idempotent uninstall).
+  const b64 = Buffer.from(lines.join("\n") + "\n", "utf8").toString("base64")
+  const remote = `( crontab -l 2>/dev/null | grep -v -e '${PUSH_CRON_MARKER}' -e '${REDIS_CRON_MARKER}' ; printf '%s' '${b64}' | base64 -d ) | crontab -`
+  const r = await runProcess(["ssh", ...SSH_OPTS, ...sshPort(t.port), `${t.user}@${t.host}`, remote], 60_000)
+  if (r.code !== 0) return { ok: false, error: meaningfulError(r.stderr, "Couldn't install the heartbeat cron over SSH.") }
+  return { ok: true }
+}

package/src/lib/wpInventory.ts

@@ -0,0 +1,153 @@
+// A site's installed plugins & themes over SSH — the `wp plugin list` / `wp theme
+// list` detail the API never exposes (it only counts pending updates). Strictly
+// read-only: we shell out to the local `ssh` client as the site user (the same
+// non-interactive, key-based auth the health view uses) and run wp-cli in the
+// site's real WordPress directory.
+//
+// The WP dir is DETECTED, never assumed: `public_folder` is a setting, not a fact
+// (see CLAUDE.md "WordPress layout rules"), so we reuse the clone wizard's
+// wp-settings.php probe to locate core on both /public/ and root-webroot sites.
+
+import type { Server, Site } from "../api/types.ts"
+import { SSH_OPTS, sshPort } from "./dbBackup.ts"
+import { detectWpDirScript } from "./serverClone.ts"
+
+// One plugin or theme, mirroring `wp {plugin,theme} list` columns.
+export interface WpItem {
+  name: string
+  status: string // active | inactive | must-use | dropin | parent | active-network
+  version: string
+  update: string // available | none | unavailable
+  updateVersion: string | null // the version an update would install, when available
+}
+
+export interface WpInventory {
+  plugins: WpItem[]
+  themes: WpItem[]
+}
+
+export type WpInventoryResult =
+  | { ok: true; target: string; wpDir: string; inventory: WpInventory }
+  | { ok: false; target: string; error: string }
+
+// wp-cli's JSON fields (snake_case) → our WpItem.
+interface RawItem {
+  name?: string
+  status?: string
+  version?: string
+  update?: string | boolean // wp emits `false` for must-use/dropin items
+  update_version?: string
+}
+
+function normalize(raw: RawItem[]): WpItem[] {
+  return raw.map((r) => ({
+    name: r.name ?? "(unknown)",
+    status: r.status ?? "",
+    version: r.version ?? "",
+    update: typeof r.update === "string" ? r.update : "none",
+    updateVersion: r.update_version && r.update_version !== "" ? r.update_version : null,
+  }))
+}
+
+// Split the batched remote output into its ===LABEL sections.
+function splitSections(out: string): Record<string, string[]> {
+  const sections: Record<string, string[]> = {}
+  let current = ""
+  for (const rawLine of out.split("\n")) {
+    const line = rawLine.replace(/\r$/, "")
+    const m = line.match(/^===([A-Z]+)$/)
+    if (m) {
+      current = m[1]
+      sections[current] = []
+    } else if (current) {
+      sections[current].push(line)
+    }
+  }
+  return sections
+}
+
+// wp --format=json emits a single-line JSON array; tolerate blank/garbage by
+// returning [] rather than throwing (a fresh site can legitimately have 0 themes).
+function parseJsonArray(lines: string[] | undefined): RawItem[] {
+  const text = (lines ?? []).join("").trim()
+  if (!text) return []
+  try {
+    const parsed = JSON.parse(text)
+    return Array.isArray(parsed) ? parsed : []
+  } catch {
+    return []
+  }
+}
+
+export async function fetchWpInventory(
+  server: Server,
+  site: Site,
+  sshUser: string | null,
+): Promise<WpInventoryResult> {
+  const ip = server.ip_address
+  const user = site.site_user ?? sshUser
+  if (!ip) return { ok: false, target: "(no IP)", error: "Server has no IP address." }
+  if (!user) return { ok: false, target: ip, error: "Site has no site user — can't SSH in to read wp-cli." }
+  const target = `${user}@${ip}`
+  // We deliberately do NOT gate on site.is_wordpress: the API flag is unreliable
+  // (it's false for many git/Bedrock sites and for Standard-WP sites SpinupWP
+  // misclassified — e.g. a /public/ install imported as "Generic"). The remote
+  // wp-settings.php probe below is authoritative for both /public/ and Bedrock
+  // (web/wp) layouts, and returns a clean "no core found" error otherwise.
+  const root = `/sites/${site.domain}/files`
+  const fields = "name,status,version,update,update_version"
+  // Detect the WP dir, bail cleanly if there's no core, then list both from it.
+  const remote = [
+    detectWpDirScript(root, site.public_folder ?? undefined),
+    `if [ -z "$W" ]; then echo ===NOTWP; echo ===END; exit 0; fi`,
+    `WP=$(command -v wp 2>/dev/null || echo /usr/local/bin/wp)`,
+    `echo ===WPDIR; printf '%s\\n' "$W"`,
+    // The trailing `echo` after each wp command is load-bearing: `wp --format=json`
+    // emits NO trailing newline, so without it the next ===MARKER glues onto the end
+    // of the JSON line — the marker never parses and JSON.parse chokes on it.
+    `echo ===PLUGINS; "$WP" --path="$W" plugin list --fields=${fields} --format=json 2>/dev/null || true; echo`,
+    `echo ===THEMES; "$WP" --path="$W" theme list --fields=${fields} --format=json 2>/dev/null || true; echo`,
+    `echo ===END`,
+  ].join("\n")
+
+  let proc: ReturnType<typeof Bun.spawn>
+  try {
+    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    })
+  } catch (err) {
+    return { ok: false, target, error: `Failed to launch ssh: ${(err as Error).message}` }
+  }
+  const timer = setTimeout(() => {
+    try {
+      proc.kill()
+    } catch {
+      /* already gone */
+    }
+  }, 45_000)
+  const code = await proc.exited
+  clearTimeout(timer)
+  const stdout = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+
+  if (code !== 0 && !stdout.includes("===END")) {
+    const reason = stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${code}`
+    return { ok: false, target, error: reason }
+  }
+
+  const s = splitSections(stdout)
+  if ("NOTWP" in s) {
+    return { ok: false, target, error: `No WordPress core found under ${root} — is this a WordPress site?` }
+  }
+  const wpDir = (s.WPDIR?.[0] || root).trim()
+  const plugins = normalize(parseJsonArray(s.PLUGINS))
+  const themes = normalize(parseJsonArray(s.THEMES))
+  return { ok: true, target, wpDir, inventory: { plugins, themes } }
+}
+
+// Count of items with an update available — for section-header badges.
+export function updateCount(items: WpItem[]): number {
+  return items.filter((i) => i.update === "available").length
+}