underpost 3.2.80 → 3.3.0

package/src/server/dns.js

@@ -5,15 +5,13 @@
  * @namespace UnderpostDns
  */
 import axios from 'axios';
-import fs from 'fs';
 import validator from 'validator';
 import { loggerFactory } from './logger.js';
 import dns from 'node:dns';
 import os from 'node:os';
 import { shellExec, pbcopy } from './process.js';
 import Underpost from '../index.js';
-import { writeEnv, readConfJson, loadCronDeployEnv } from './conf.js';
-import { resolveDeployId } from './cron.js';
+import { readConfJson } from './conf.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -271,6 +269,83 @@ class Dns {
     logger.info('Cleared all egress bans.');
   }
 
+  /**
+   * Blocks all outbound traffic from this host, except for established/related connections.
+   * This is useful for security purposes, especially in a dynamic DNS context where you want to prevent
+   * any new outbound connections while still allowing existing ones (like SSH) to continue.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static blockAllEgress() {
+    // Clear any existing egress rules.
+    shellExec(`sudo nft flush chain inet filter output`, { silent: true });
+    shellExec(`sudo nft flush chain inet filter forward`, { silent: true });
+
+    // Allow return traffic for established/related connections.
+    //    This keeps existing inbound connections such as SSH alive.
+    shellExec(`sudo nft add rule inet filter output ct state established,related counter accept`, { silent: true });
+
+    // Block all new outbound connections from this host and forwarded traffic.
+    shellExec(`sudo nft chain inet filter output '{ policy drop; }'`, { silent: true });
+    shellExec(`sudo nft chain inet filter forward '{ policy drop; }'`, { silent: true });
+
+    logger.info('All outbound traffic blocked.');
+  }
+
+  /**
+   * Unblocks all outbound traffic from this host and forwarded interfaces.
+   * Restores default output and forward chain policies to ACCEPT and clears egress rules.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static unblockAllEgress() {
+    // Restore default chain policies to accept all traffic.
+    shellExec(`sudo nft chain inet filter output '{ policy accept; }'`, { silent: true });
+    shellExec(`sudo nft chain inet filter forward '{ policy accept; }'`, { silent: true });
+
+    // Clear any existing egress blocking rules.
+    shellExec(`sudo nft flush chain inet filter output`, { silent: true });
+    shellExec(`sudo nft flush chain inet filter forward`, { silent: true });
+
+    logger.info('All outbound traffic unblocked and restored to default ACCEPT policy.');
+  }
+
+  /**
+   * Blocks all new inbound traffic to this host, except for established/related connections.
+   * This prevents any new incoming connections while keeping existing sessions (like SSH) alive.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static blockAllIngress() {
+    // Clear any existing ingress rules.
+    shellExec(`sudo nft flush chain inet filter input`, { silent: true });
+
+    // Allow return traffic for established/related connections.
+    // This keeps active inbound/outbound sessions alive.
+    shellExec(`sudo nft add rule inet filter input ct state established,related counter accept`, { silent: true });
+
+    // Block all new inbound connections to this host.
+    shellExec(`sudo nft chain inet filter input '{ policy drop; }'`, { silent: true });
+
+    logger.info('All new inbound traffic blocked.');
+  }
+
+  /**
+   * Unblocks all inbound traffic to this host.
+   * Restores default input chain policy to ACCEPT and clears ingress rules.
+   * @static
+   * @memberof UnderpostDns
+   */
+  static unblockAllIngress() {
+    // Restore default chain policy to accept all incoming traffic.
+    shellExec(`sudo nft chain inet filter input '{ policy accept; }'`, { silent: true });
+
+    // Clear any existing ingress blocking rules.
+    shellExec(`sudo nft flush chain inet filter input`, { silent: true });
+
+    logger.info('All inbound traffic unblocked and restored to default ACCEPT policy.');
+  }
+
   /**
    * Performs the dynamic DNS update logic.
    * It checks if the public IP has changed and, if so, updates the configured DNS records.
@@ -279,10 +354,8 @@ class Dns {
    * @memberof UnderpostDns
    * @param {string} deployList Comma-separated string of deployment IDs to process.
    * @returns {Promise<void>}
-   */
+  */
   static async callback(deployList) {
-    // loadCronDeployEnv();
-
     const isOnline = await Dns.isInternetConnection();
 
     if (!isOnline) return;
@@ -440,6 +513,10 @@ class Dns {
    * @property {boolean} [options.banEgressClear=false] - Clear all banned egress IPs.
    * @property {boolean} [options.banBothAdd=false] - Ban IPs from both ingress and egress.
    * @property {boolean} [options.banBothRemove=false] - Unban IPs from both ingress and egress.
+   * @property {boolean} [options.blockAllEgress=false] - Block all outbound traffic from this host.
+   * @property {boolean} [options.unblockAllEgress=false] - Unblock all outbound traffic.
+   * @property {boolean} [options.blockAllIngress=false] - Block all new inbound traffic to this host.
+   * @property {boolean} [options.unblockAllIngress=false] - Unblock all inbound traffic.
    * @property {boolean} [options.dhcp=false] - Get local DHCP IP instead of public IP.
    * @property {boolean} [options.copy=false] - Copy the public IP to clipboard.
    * @return {Promise<string|void>} The public IP if no ban/unban action is taken.
@@ -457,6 +534,10 @@ class Dns {
       banEgressClear: false,
       banBothAdd: false,
       banBothRemove: false,
+      blockAllEgress: false,
+      unblockAllEgress: false,
+      blockAllIngress: false,
+      unblockAllIngress: false,
       copy: false,
       dhcp: false,
     },
@@ -507,6 +588,19 @@ class Dns {
       });
     }
 
+    if (options.blockAllEgress) {
+      return Dns.blockAllEgress();
+    }
+    if (options.unblockAllEgress) {
+      return Dns.unblockAllEgress();
+    }
+    if (options.blockAllIngress) {
+      return Dns.blockAllIngress();
+    }
+    if (options.unblockAllIngress) {
+      return Dns.unblockAllIngress();
+    }
+
     if (options.mac) {
       const mac = Dns.getMainInterfaceMac();
       console.log(mac);

package/src/server/environment.js

@@ -0,0 +1,98 @@
+/**
+ * Environment and global installation path resolution.
+ * @module src/server/environment.js
+ * @namespace ServerEnvironment
+ */
+'use strict';
+
+import dotenv from 'dotenv';
+import fs from 'fs-extra';
+import { execFileSync } from 'node:child_process';
+import { loggerFactory } from './logger.js';
+
+const logger = loggerFactory(import.meta);
+
+/**
+ * Node directory backing every hostPath PersistentVolume the deploy flow
+ * materializes (`<root>/<pv id>`), including the shared gateway's static tree.
+ * Cluster bring-up gives it the shared container label, because the pods that
+ * read these documents are unprivileged.
+ * @constant {string}
+ * @memberof ServerEnvironment
+ */
+const HOST_VOLUME_ROOT = '/home/dd/engine/volume';
+const envFileCache = new Map();
+let rootEnvPath;
+
+/**
+ * Resolves the global npm module directory.
+ * @returns {string}
+ * @memberof ServerEnvironment
+ */
+const getNpmRootPath = () => {
+  try {
+    return execFileSync('npm', ['root', '-g'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return '';
+  }
+};
+
+/**
+ * Resolves the global Underpost installation directory.
+ * @returns {string}
+ * @memberof ServerEnvironment
+ */
+const getUnderpostRootPath = () => {
+  const npmRoot = getNpmRootPath();
+  return npmRoot ? `${npmRoot}/underpost` : '';
+};
+
+const readEnvFile = (path) => {
+  if (envFileCache.has(path)) return envFileCache.get(path);
+  let values = {};
+  try {
+    if (path && fs.existsSync(path)) values = dotenv.parse(fs.readFileSync(path, 'utf8'));
+  } catch (error) {
+    logger.warn('Ignoring unreadable env file', { target: path, message: error.message });
+  }
+  envFileCache.set(path, values);
+  return values;
+};
+
+const environmentValueFactory = (key) => {
+  const processValue = `${process.env[key] ?? ''}`.trim();
+  if (processValue) return processValue;
+
+  if (rootEnvPath === undefined) {
+    const underpostRoot = getUnderpostRootPath();
+    rootEnvPath = underpostRoot ? `${underpostRoot}/.env` : '';
+  }
+
+  for (const path of ['./.env', rootEnvPath]) {
+    const value = `${readEnvFile(path)[key] ?? ''}`.trim();
+    if (value) return value;
+  }
+  return '';
+};
+
+/**
+ * Writes environment values as a dotenv file.
+ * @method writeEnv
+ * @param {string} envPath - Destination file path.
+ * @param {Object<string, *>} envObj - Environment values keyed by variable name.
+ * @returns {void}
+ * @memberof ServerEnvironment
+ */
+const writeEnv = (envPath, envObj) =>
+  fs.writeFileSync(
+    envPath,
+    Object.keys(envObj)
+      .map((key) => `${key}=${envObj[key]}`)
+      .join('\n'),
+    'utf8',
+  );
+
+export { environmentValueFactory, getNpmRootPath, getUnderpostRootPath, HOST_VOLUME_ROOT, writeEnv };