vibed-infra 0.3.0

package/lib/env.sh

@@ -0,0 +1,224 @@
+# shellcheck shell=bash
+# Environment helpers for infra packager.
+
+load_dotenv() {
+  local env_file="${1:-.env}"
+  [[ -f "$env_file" ]] || return 0
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line%$'\r'}"
+    [[ -z "${line//[[:space:]]/}" || "$line" =~ ^[[:space:]]*# ]] && continue
+    local key="${line%%=*}"
+    local val="${line#*=}"
+    key="${key%%[[:space:]]*}"
+    key="${key##[[:space:]]*}"
+    key="${key%$'\r'}"
+    val="${val%$'\r'}"
+    if [[ "$val" =~ ^\"(.*)\"$ ]]; then val="${BASH_REMATCH[1]}"; fi
+    if [[ "$val" =~ ^\'(.*)\'$ ]]; then val="${BASH_REMATCH[1]}"; fi
+    [[ -z "$key" || "$key" == *[!A-Za-z0-9_]* ]] && continue
+    if [[ -z "${!key-}" ]]; then
+      export "$key=$val"
+    fi
+  done <"$env_file"
+}
+
+env_flag_on() {
+  local name="$1"
+  local val="${!name-}"
+  case "$val" in
+    1|true|TRUE|yes|YES|on|ON) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+role_auto_update_on() {
+  local primary="$1"
+  if [[ -n "${!primary+x}" ]]; then
+    env_flag_on "$primary"
+    return
+  fi
+  env_flag_on AUTO_UPDATE
+}
+
+any_auto_update_on() {
+  local flag
+  for flag in "$@"; do
+    if role_auto_update_on "$flag"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+append_missing_env_keys() {
+  local example="$1"
+  local envfile="$2"
+  shift 2
+  [[ -f "$example" && -f "$envfile" ]] || return 0
+  local key line added=0
+  local legacy_off=0
+  if grep -qiE "^[[:space:]]*AUTO_UPDATE=(0|false|off)\b" "$envfile"; then
+    legacy_off=1
+  fi
+  for key in "$@"; do
+    if grep -qE "^[[:space:]]*${key}=" "$envfile"; then
+      continue
+    fi
+    line="$(grep -E "^[[:space:]]*${key}=" "$example" | head -1 || true)"
+    [[ -n "$line" ]] || continue
+    if [[ "$legacy_off" -eq 1 && "$key" == *_AUTO_UPDATE ]]; then
+      line="${key}=0"
+    fi
+    if [[ "$added" -eq 0 ]]; then
+      {
+        echo ""
+        echo "# --- Auto-update (added by infra install; see .env.example) ---"
+      } >>"$envfile"
+    fi
+    echo "$line" >>"$envfile"
+    echo "appended to .env: $key"
+    added=1
+  done
+}
+
+log_update() {
+  local dir="${1:-.}"
+  local msg="$2"
+  mkdir -p "$dir/logs"
+  local line
+  line="$(date -u +"%Y-%m-%dT%H:%M:%SZ") $msg"
+  echo "$line" | tee -a "$dir/logs/auto-update.log"
+}
+
+resolve_update_lock_file() {
+  if [[ -n "${UPDATE_LOCK_FILE:-}" ]]; then
+    echo "$UPDATE_LOCK_FILE"
+    return 0
+  fi
+  if [[ -d /var/lock && -w /var/lock ]]; then
+    echo /var/lock/infra-auto-update.lock
+    return 0
+  fi
+  echo /tmp/infra-auto-update.lock
+}
+
+with_update_lock() {
+  local log_dir="$1"
+  local role_label="$2"
+  local fn="$3"
+  local lock
+  lock="$(resolve_update_lock_file)"
+  exec 9>"$lock" || {
+    log_update "$log_dir" "${role_label}: cannot open lock $lock — proceeding without flock"
+    "$fn"
+    return $?
+  }
+  if ! flock -n 9; then
+    log_update "$log_dir" "${role_label}: another auto-update holds $lock — skip"
+    exec 9>&-
+    return 0
+  fi
+  "$fn"
+  local rc=$?
+  flock -u 9 2>/dev/null || true
+  exec 9>&-
+  return "$rc"
+}
+
+local_image_id() {
+  local image="$1"
+  docker image inspect -f '{{.Id}}' "$image" 2>/dev/null || true
+}
+
+remote_image_digest() {
+  local image="$1"
+  local digest="" out
+  if out="$(docker buildx imagetools inspect "$image" --format '{{.Manifest.Digest}}' 2>/dev/null)"; then
+    digest="$(printf '%s\n' "$out" | tr -d '[:space:]')"
+  fi
+  if [[ "$digest" != sha256:* ]]; then
+    if out="$(docker buildx imagetools inspect "$image" -f '{{.Manifest.Digest}}' 2>/dev/null)"; then
+      digest="$(printf '%s\n' "$out" | tr -d '[:space:]')"
+    fi
+  fi
+  if [[ "$digest" != sha256:* ]]; then
+    if out="$(docker buildx imagetools inspect "$image" 2>/dev/null)"; then
+      digest="$(printf '%s\n' "$out" | awk '/^Digest:/{print $2; exit}')"
+    fi
+  fi
+  if [[ "$digest" == sha256:* ]]; then
+    echo "$digest"
+  fi
+}
+
+local_repo_digest() {
+  local image="$1"
+  docker image inspect -f '{{range .RepoDigests}}{{println .}}{{end}}' "$image" 2>/dev/null \
+    | sed -n 's/.*@//p' \
+    | head -1
+}
+
+pull_image_if_needed() {
+  local image="$1"
+  local remote locald
+  if ! docker image inspect "$image" >/dev/null 2>&1; then
+    docker pull "$image" >/dev/null
+    echo "pulled (missing locally)"
+    return 0
+  fi
+  remote="$(remote_image_digest "$image")"
+  if [[ -z "$remote" ]]; then
+    docker pull "$image" >/dev/null
+    echo "pulled (digest probe unavailable)"
+    return 0
+  fi
+  locald="$(local_repo_digest "$image")"
+  if [[ -n "$locald" && "$locald" == "$remote" ]]; then
+    echo "skipped (already $remote)"
+    return 0
+  fi
+  docker pull "$image" >/dev/null
+  echo "pulled ($remote)"
+}
+
+container_needs_image() {
+  local name="$1"
+  local image="$2"
+  if ! docker inspect "$name" >/dev/null 2>&1; then
+    return 0
+  fi
+  local running new
+  running="$(docker inspect -f '{{.Image}}' "$name" 2>/dev/null || true)"
+  new="$(docker image inspect -f '{{.Id}}' "$image" 2>/dev/null || true)"
+  [[ -z "$running" || -z "$new" || "$running" != "$new" ]]
+}
+
+graceful_stop() {
+  local name="$1"
+  local timeout="${2:-180}"
+  if docker inspect "$name" >/dev/null 2>&1; then
+    docker stop -t "$timeout" "$name" >/dev/null 2>&1 || true
+  fi
+}
+
+memory_args() {
+  local limit="${1:-}"
+  if [[ -n "$limit" ]]; then
+    echo --memory="$limit"
+  fi
+}
+
+chown_data_dir() {
+  local dir="$1"
+  local uid="${2:-1000}"
+  mkdir -p "$dir"
+  if [[ "$(id -u)" -eq 0 ]]; then
+    chown -R "${uid}:${uid}" "$dir" || true
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo chown -R "${uid}:${uid}" "$dir" 2>/dev/null || \
+      echo "warning: could not chown $dir to ${uid} — fix if container cannot write" >&2
+  else
+    echo "warning: ensure $dir is writable by uid ${uid}" >&2
+  fi
+  chmod 755 "$dir" 2>/dev/null || true
+}

package/lib/fetch.sh

@@ -0,0 +1,49 @@
+# shellcheck shell=bash
+# Fetch helpers for infra packager.
+
+infra_fetch() {
+  local url="$1"
+  local out="$2"
+  mkdir -p "$(dirname "$out")"
+  if [[ "$url" =~ ^/ ]]; then
+    cp -f "$url" "$out"
+    return 0
+  fi
+  if [[ "$url" =~ ^file:// ]]; then
+    cp -f "${url#file://}" "$out"
+    return 0
+  fi
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$url" -o "$out"
+  else
+    wget -qO "$out" "$url"
+  fi
+}
+
+infra_write_if_missing() {
+  local url="$1"
+  local path="$2"
+  local executable="${3:-0}"
+  if [[ -f "$path" ]]; then
+    echo "exists (unchanged): $path"
+    return 0
+  fi
+  echo "downloading $(basename "$path") ..."
+  infra_fetch "$url" "$path"
+  if [[ "$executable" == "1" ]]; then
+    chmod +x "$path"
+  fi
+  echo "created: $path"
+}
+
+infra_write_template() {
+  local url="$1"
+  local path="$2"
+  local executable="${3:-0}"
+  echo "refreshing $(basename "$path") ..."
+  infra_fetch "$url" "$path"
+  if [[ "$executable" == "1" ]]; then
+    chmod +x "$path"
+  fi
+  echo "updated: $path"
+}

package/lib/generate.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""Generate nginx site config from packageconfig gateway profile."""
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from load_config import get_profile, load_packageconfig  # noqa: E402
+
+
+def render_site(site: dict) -> str:
+    host = site["host"]
+    aliases = site.get("aliases") or []
+    server_names = " ".join([host, *aliases])
+    backend = site["backend"]
+    backend_port = site.get("backendPort", 8080)
+    ui = site["ui"]
+    ui_port = site.get("uiPort", 80)
+    health = site.get("healthPath", "/api/health")
+    create = site.get("createPath") or ""
+    be_var = backend.replace("-", "_")
+    ui_var = ui.replace("-", "_")
+    proxy_headers = f"""    proxy_pass http://${be_var}_upstream;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;"""
+    create_block = ""
+    if create:
+        create_block = f"""
+  location = {create} {{
+    limit_req zone=api_create burst=2 nodelay;
+{proxy_headers}
+  }}
+"""
+
+    return f"""# --- {host} ---
+server {{
+  listen 443 ssl;
+  http2 on;
+  server_name {server_names};
+
+  ssl_certificate     /etc/nginx/certs/fullchain.pem;
+  ssl_certificate_key /etc/nginx/certs/privkey.pem;
+  ssl_protocols       TLSv1.2 TLSv1.3;
+  ssl_prefer_server_ciphers on;
+
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+  add_header X-Content-Type-Options nosniff always;
+  add_header X-Frame-Options DENY always;
+  add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+  limit_conn addr 40;
+
+  set ${be_var}_upstream {backend}:{backend_port};
+  set ${ui_var}_upstream {ui}:{ui_port};
+
+  location = {health} {{
+{proxy_headers}
+  }}
+{create_block}
+  location /api/ {{
+    limit_req zone=api_public burst=40 nodelay;
+{proxy_headers}
+  }}
+
+  location / {{
+    proxy_pass http://${ui_var}_upstream;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }}
+}}
+"""
+
+
+def render_gateway(conf: dict, profile: str, prof: dict, output_name: str = "domains.conf") -> str:
+    sites = prof.get("sites") or []
+    parts = [
+        "# Generated by lib/generate.py — edit packageconfig sites[] and re-install",
+        "resolver 127.0.0.11 valid=10s ipv6=off;",
+        "",
+        "server {",
+        "  listen 80 default_server;",
+        "  server_name _;",
+        "  location /.well-known/acme-challenge/ { root /var/www/certbot; }",
+        "  location / { return 301 https://$host$request_uri; }",
+        "}",
+        "",
+    ]
+    for site in sites:
+        parts.append(render_site(site))
+        parts.append("")
+    include = prof.get("templates", {}).get("nginxInclude")
+    if include and Path(include).name != output_name:
+        parts.append(f"include /etc/nginx/conf.d/{Path(include).name};")
+    return "\n".join(parts)
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("packageconfig")
+    ap.add_argument("--profile", default="gateway")
+    ap.add_argument("-o", "--output", required=True)
+    args = ap.parse_args()
+    conf = load_packageconfig(Path(args.packageconfig))
+    prof = get_profile(conf, args.profile)
+    out = render_gateway(conf, args.profile, prof, Path(args.output).name)
+    Path(args.output).write_text(out, encoding="utf-8")
+    print(f"wrote {args.output}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/lib/load_config.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+"""Load infra packageconfig.yaml without external deps (subset YAML)."""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+
+def _strip_quotes(s: str) -> str:
+    s = s.strip()
+    if (s.startswith('"') and s.endswith('"')) or (s.startswith("'") and s.endswith("'")):
+        return s[1:-1]
+    return s
+
+
+def load_packageconfig(path: Path) -> dict[str, Any]:
+    try:
+        import yaml  # type: ignore
+
+        with path.open(encoding="utf-8") as f:
+            return yaml.safe_load(f) or {}
+    except ImportError:
+        return _parse_minimal(path.read_text(encoding="utf-8"))
+
+
+def _parse_minimal(text: str) -> dict[str, Any]:
+    """Parse flat/nested keys for our packageconfig shape only."""
+    root: dict[str, Any] = {}
+    stack: list[tuple[int, dict[str, Any]]] = [(-1, root)]
+    list_key: str | None = None
+    list_indent = -1
+
+    for raw in text.splitlines():
+        if not raw.strip() or raw.lstrip().startswith("#"):
+            continue
+        indent = len(raw) - len(raw.lstrip(" "))
+        line = raw.lstrip()
+        while stack and indent <= stack[-1][0]:
+            stack.pop()
+            if list_indent >= 0 and indent <= list_indent:
+                list_key = None
+                list_indent = -1
+        parent = stack[-1][1]
+
+        if line.startswith("- ") and list_key and isinstance(parent.get(list_key), list):
+            item: dict[str, Any] = {}
+            rest = line[2:].strip()
+            if ":" in rest:
+                k, _, v = rest.partition(":")
+                item[k.strip()] = _strip_quotes(v.strip())
+            parent[list_key].append(item)
+            stack.append((indent, item))
+            continue
+
+        if ":" not in line:
+            continue
+        key, _, rest = line.partition(":")
+        key = key.strip()
+        rest = rest.strip()
+        if rest == "":
+            # Only known sequences — do not treat every plural key as a list
+            # (`profiles`, `images`, `templates` are mappings).
+            if key in ("sites", "aliases", "extras", "services", "flags"):
+                parent[key] = []
+                list_key = key
+                list_indent = indent
+            else:
+                child: dict[str, Any] = {}
+                parent[key] = child
+                stack.append((indent, child))
+        elif rest.startswith("[") and rest.endswith("]"):
+            inner = rest[1:-1].strip()
+            parent[key] = [_strip_quotes(x.strip()) for x in inner.split(",") if x.strip()] if inner else []
+        else:
+            parent[key] = _strip_quotes(rest)
+    return root
+
+
+def get_profile(conf: dict[str, Any], name: str) -> dict[str, Any]:
+    profiles = conf.get("profiles") or {}
+    if name not in profiles:
+        raise KeyError(f"profile not found: {name}")
+    return profiles[name]
+
+
+def main() -> int:
+    if len(sys.argv) < 3:
+        print("usage: load_config.py <packageconfig> <profile> [key...]", file=sys.stderr)
+        return 2
+    conf = load_packageconfig(Path(sys.argv[1]))
+    prof = get_profile(conf, sys.argv[2])
+    node: Any = prof
+    for k in sys.argv[3:]:
+        if isinstance(node, dict):
+            node = node.get(k, "")
+        else:
+            node = ""
+    if isinstance(node, (dict, list)):
+        import json
+
+        print(json.dumps(node))
+    else:
+        print(node)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/lib/prompt.sh

@@ -0,0 +1,25 @@
+# shellcheck shell=bash
+# Interactive component picker (TTY only).
+
+infra_pick_profile() {
+  if [[ -n "${INFRA_PROFILE:-}" ]]; then
+    echo "$INFRA_PROFILE"
+    return 0
+  fi
+  if [[ ! -t 0 ]]; then
+    echo "Set INFRA_PROFILE=api|nodes|gateway (or pass --profile) when piping install.sh" >&2
+    return 1
+  fi
+  echo "Select component to install:" >&2
+  echo "  1) Backend (API)" >&2
+  echo "  2) Workers (nodes)" >&2
+  echo "  3) Gateway (HTTPS + UI)" >&2
+  local choice
+  read -r -p "Choice [1-3]: " choice
+  case "$choice" in
+    1|api|backend) echo "api" ;;
+    2|nodes|workers) echo "nodes" ;;
+    3|gateway) echo "gateway" ;;
+    *) echo "Invalid choice" >&2; return 1 ;;
+  esac
+}

package/lib/tls.sh

@@ -0,0 +1,59 @@
+# shellcheck shell=bash
+# TLS / certbot helpers.
+
+infra_tls_check() {
+  local fullchain="$1"
+  local privkey="$2"
+  [[ -f "$fullchain" && -f "$privkey" ]]
+}
+
+infra_tls_suggest_certbot() {
+  local domains=("$@")
+  local joined=""
+  local d
+  for d in "${domains[@]}"; do
+    joined+=" -d $d"
+  done
+  cat <<EOF
+
+TLS certificates not found. Issue with certbot (port 80 must be free):
+
+  sudo certbot certonly --standalone${joined}
+
+Or after gateway HTTP is up (webroot):
+
+  sudo certbot certonly --webroot -w /var/www/certbot${joined}
+
+Then set TLS_FULLCHAIN and TLS_PRIVKEY in .env and run ./start.sh
+
+EOF
+}
+
+infra_tls_offer_interactive() {
+  local fullchain="$1"
+  local privkey="$2"
+  shift 2
+  local domains=("$@")
+  if infra_tls_check "$fullchain" "$privkey"; then
+    return 0
+  fi
+  infra_tls_suggest_certbot "${domains[@]}"
+  if [[ ! -t 0 ]]; then
+    return 0
+  fi
+  read -r -p "Run certbot --standalone now? [y/N] " ans
+  case "$ans" in
+    y|Y|yes|YES)
+      if ! command -v certbot >/dev/null 2>&1; then
+        echo "certbot not found — install certbot first" >&2
+        return 1
+      fi
+      local args=()
+      local d
+      for d in "${domains[@]}"; do
+        args+=(-d "$d")
+      done
+      sudo certbot certonly --standalone "${args[@]}"
+      ;;
+  esac
+}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "vibed-infra",
+  "version": "0.3.0",
+  "description": "Product-agnostic VPS packager: wget install, Docker Compose, TLS/nginx, auto-update",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/naiemk/vibed-infra.git"
+  },
+  "bugs": {
+    "url": "https://github.com/naiemk/vibed-infra/issues"
+  },
+  "homepage": "https://github.com/naiemk/vibed-infra#readme",
+  "bin": {
+    "vibed-infra": "./install.sh"
+  },
+  "files": [
+    "install.sh",
+    "start.sh",
+    "update.sh",
+    "install-auto-update.sh",
+    "lib",
+    "templates",
+    "schema",
+    "github",
+    "skills"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "bash scripts/validate-package.sh"
+  }
+}