synfull 0.1.2 → 0.1.3

package/README.md

@@ -13,11 +13,11 @@ synfull start
 synfull open
 ```
 
-During interactive `synfull setup`, you can choose whether to bind to `0.0.0.0` for access from other devices on your LAN; localhost-only (`127.0.0.1`) remains the default, and non-interactive setup stays local-only. LAN binding exposes the login page and server to every reachable network interface: use a trusted LAN, configure the host firewall to allow only the devices/subnet you intend, change the initial `admin` / `admin` password locally before signing in remotely, and do not expose Synfull directly to the public internet. npm installation alone does not register a background service or change system startup.
+During interactive `synfull setup`, you can choose whether to bind to `0.0.0.0` for access from other devices on your LAN; localhost-only (`127.0.0.1`) remains the default, and non-interactive setup stays local-only. On Linux, setup also offers to add your account to the `docker` group so the Docker integration can access the daemon. This is optional and grants root-equivalent control of the computer; decline if you do not fully trust the account with administrator-level Docker access. If Synfull's systemd service is installed, setup restarts it after group membership changes; otherwise, an interactive user session may need a logout/login before new group membership applies. LAN binding exposes the login page and server to every reachable network interface: use a trusted LAN, configure the host firewall to allow only intended devices/subnets, change the initial `admin` / `admin` password locally before signing in remotely, and do not expose Synfull directly to the public internet. npm installation alone does not register a background service or change system startup.
 
 ### Commands
 
-- `synfull setup` asks whether to allow LAN access, then prepares the isolated Python runtime and dependencies. The choice is saved in the CLI config and used by later starts and service registration.
+- `synfull setup` asks whether to allow LAN access and, on Linux, whether to grant the current account Docker-group access; it then prepares the isolated Python runtime and dependencies. Both choices are optional and are used by later starts/service registration. Docker group membership is root-equivalent. If an installed Synfull systemd service is present, setup restarts it after adding group access; otherwise log out and back in for a shell session to receive the new group membership.
 - `synfull start` runs in the background; `synfull run` keeps the server in the foreground.
 - `synfull status`, `synfull stop`, and `synfull open` manage a manually started instance.
 - `synfull install-service` explicitly enables automatic start and restart. On Windows this registers a per-user logon scheduled task. On Linux it creates and enables a system-wide systemd service and therefore requires `sudo`; the service runs as your invoking user, not root.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synfull",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Local-first cross-platform host monitoring dashboard",
   "license": "MIT",
   "type": "commonjs",

package/scripts/synfull.cjs

@@ -66,16 +66,62 @@ function saveBindHost(host) {
   fs.mkdirSync(HOME, { recursive: true })
   fs.writeFileSync(CLI_CONFIG, `${JSON.stringify({ bindHost: host }, null, 2)}\n`, { mode: 0o600 })
 }
-async function configureBindHost() {
+async function configureBindHost(rl) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return
+  const answer = await rl.question('Allow other devices on your LAN to access Synfull by binding to 0.0.0.0? (y/N): ')
+  const host = /^y(es)?$/i.test(answer.trim()) ? '0.0.0.0' : '127.0.0.1'
+  saveBindHost(host)
+  console.log(host === '0.0.0.0'
+    ? 'LAN access enabled. Change the initial admin password from this machine before signing in from another device; use a trusted LAN and configure your firewall.'
+    : 'Synfull will only accept connections from this machine.')
+}
+async function configureDockerAccess(rl, options = {}) {
+  const platform = options.platform || process.platform
+  const interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY)
+  const username = options.username || process.env.SUDO_USER || os.userInfo().username
+  const isRoot = options.isRoot ?? Boolean(process.getuid && process.getuid() === 0)
+  const spawnCommand = options.spawnSync || spawnSync
+  const runCommand = options.run || run
+  if (platform !== 'linux' || !interactive) return false
+  if (isRoot) {
+    console.log('Run `synfull setup` as your normal account (not sudo); setup will request sudo only if Docker group access is approved.')
+    return false
+  }
+  const dockerGroup = spawnCommand('getent', ['group', 'docker'], { encoding: 'utf8', windowsHide: true })
+  if (dockerGroup.status !== 0) {
+    console.log('No Linux docker group was found. Install/configure Docker Engine first; Synfull did not change account permissions.')
+    return false
+  }
+  console.log('Docker group membership grants root-equivalent control of this computer (including control over containers and host files).')
+  const answer = await rl.question(`Allow Synfull to use Docker by adding ${username} to the docker group? (y/N): `)
+  if (!/^y(es)?$/i.test(answer.trim())) {
+    console.log('Docker group access was not changed. The Docker integration will remain unavailable unless your account already has socket access.')
+    return false
+  }
+  const groups = spawnCommand('id', ['-nG', username], { encoding: 'utf8', windowsHide: true })
+  const alreadyMember = groups.status === 0 && groups.stdout.trim().split(/\s+/).includes('docker')
+  if (!alreadyMember) {
+    const command = process.getuid && process.getuid() === 0 ? 'usermod' : 'sudo'
+    const args = command === 'sudo' ? ['usermod', '-aG', 'docker', username] : ['-aG', 'docker', username]
+    runCommand(command, args)
+    console.log(`Added ${username} to the docker group.`)
+  } else {
+    console.log(`${username} is already in the docker group.`)
+  }
+  const serviceInstalled = spawnCommand('systemctl', ['cat', 'synfull-npm.service'], { stdio: 'ignore', windowsHide: true }).status === 0
+  if (!serviceInstalled) console.log('No Synfull systemd service is installed. Log out/in (or start a fresh session with Docker group membership) before running Synfull so it receives the new group permissions.')
+  return serviceInstalled
+}
+function restartSynfullService(runCommand = run) {
+  runCommand('sudo', ['systemctl', 'restart', 'synfull-npm.service'])
+  console.log('Restarted the Synfull system service so it picks up Docker group access.')
+}
+async function configureSetup() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
   try {
-    const answer = await rl.question('Allow other devices on your LAN to access Synfull by binding to 0.0.0.0? (y/N): ')
-    const host = /^y(es)?$/i.test(answer.trim()) ? '0.0.0.0' : '127.0.0.1'
-    saveBindHost(host)
-    console.log(host === '0.0.0.0'
-      ? 'LAN access enabled. Change the initial admin password from this machine before signing in from another device; use a trusted LAN and configure your firewall.'
-      : 'Synfull will only accept connections from this machine.')
+    await configureBindHost(rl)
+    return await configureDockerAccess(rl)
   } finally {
     rl.close()
   }
@@ -237,7 +283,12 @@ async function main() {
   if (command === '--version' || command === '-v') { console.log(VERSION); return }
   if (command === '--help' || command === '-h') { help(); return }
   if (!['win32', 'linux'].includes(process.platform)) throw new Error('Synfull npm CLI currently supports Windows and Linux.')
-  if (command === 'setup') { await configureBindHost(); ensureRuntime(); console.log(`Runtime ready. Data directory: ${STATE_DIR}`) }
+  if (command === 'setup') {
+    const restartServiceForDocker = await configureSetup()
+    ensureRuntime()
+    if (restartServiceForDocker) restartSynfullService()
+    console.log(`Runtime ready. Data directory: ${STATE_DIR}`)
+  }
   else if (command === 'start') startServer(false)
   else if (command === 'run') startServer(true)
   else if (command === 'stop') stopServer()
@@ -253,4 +304,4 @@ async function main() {
   else help()
 }
 if (require.main === module) main().catch(error => { console.error(`Synfull: ${error.message}`); process.exitCode = 1 })
-module.exports = { ensureRuntime, serverEnvironment, configuredBindHost, selectedBindHost, saveBindHost, APP_DIR, STATE_DIR, ROOT }
+module.exports = { ensureRuntime, serverEnvironment, configuredBindHost, selectedBindHost, saveBindHost, configureDockerAccess, restartSynfullService, APP_DIR, STATE_DIR, ROOT }