vibed-infra 0.8.0 → 0.9.0

package/README.md

@@ -72,7 +72,7 @@ See [`skills/infra-update-agent/SKILL.md`](skills/infra-update-agent/SKILL.md).
 | `VIBED_HOME` | Machine vibed root (default `~/services/vibed-infra`) |
 | `VIBED_UPDATE_AGENT` | Override update-agent dir (default `$VIBED_HOME/update-agent`) |
 | `GATEWAY_PUBLIC_IP` | VPS IPv4 (from `gateway.publicIp`) |
-| `TLS_EMAIL` / `TLS_MODE` | Let’s Encrypt email; `lab` or `letsencrypt` |
+| `TLS_EMAIL` / `TLS_MODE` | Let’s Encrypt email; `lab` or `letsencrypt` (docker certbot → `./certs` PEMs; optional `CERTBOT_IMAGE` / `LETSENCRYPT_HOME`) |
 | `PERSIST_LOG_DIR` | Per-service event log dir |
 | `DOCKER_AUTO_PRUNE` | Prune dangling images after update (default on) |
 

package/lib/host_gateway.sh

@@ -52,9 +52,11 @@ vibed_bootstrap_host_gateway() {
     fi
   }
 
-  # Always refresh setup-tls (idempotent re-install / multi-app)
+  # Always refresh gateway scripts (idempotent re-install / multi-app)
   _hg_fetch "templates/host-gateway/setup-tls.sh" "$home/setup-tls.sh"
-  chmod +x "$home/setup-tls.sh"
+  _hg_fetch "templates/host-gateway/start-gateway.sh" "$home/start-gateway.sh"
+  _hg_fetch "templates/host-gateway/reload-gateway.sh" "$home/reload-gateway.sh"
+  chmod +x "$home/setup-tls.sh" "$home/start-gateway.sh" "$home/reload-gateway.sh"
 
   if [[ -f "${home}/.vibed-host-gateway" ]]; then
     echo "host gateway already present: $home"
@@ -66,11 +68,9 @@ vibed_bootstrap_host_gateway() {
   _hg_fetch "templates/host-gateway/gateway/nginx.conf" "$home/gateway/nginx.conf"
   _hg_fetch "templates/host-gateway/gateway/conf.d/00-default.conf" "$home/gateway/conf.d/00-default.conf"
   _hg_fetch "templates/host-gateway/.env.example" "$home/.env.example"
-  _hg_fetch "templates/host-gateway/start-gateway.sh" "$home/start-gateway.sh"
-  _hg_fetch "templates/host-gateway/reload-gateway.sh" "$home/reload-gateway.sh"
   _hg_fetch "templates/host-gateway/update-gateway.sh" "$home/update-gateway.sh"
   _hg_fetch "lib/env.sh" "$home/lib-env.sh"
-  chmod +x "$home/start-gateway.sh" "$home/reload-gateway.sh" "$home/update-gateway.sh"
+  chmod +x "$home/update-gateway.sh"
 
   if [[ ! -f "$home/.env" ]]; then
     cp "$home/.env.example" "$home/.env"

package/lib/package.py

@@ -100,8 +100,13 @@ DOCKER_PRUNE_UNTIL=72h
 def _env_gateway(meta: dict, conf: dict, sites: list) -> str:
     au = conf["profiles"]["gateway"]["autoUpdate"]
     gw = conf["profiles"]["gateway"]
-    host = sites[0]["host"] if sites else "example.com"
-    cert_dir = sites[0].get("tlsCertDir", f"/etc/letsencrypt/live/{host}") if sites else "/etc/letsencrypt/live/example.com"
+    # Host gateway stores PEMs under ./certs (setup-tls.sh). tlsCertDir is legacy/docs only
+    # unless it already points at a relative ./certs tree.
+    cert_dir = "./certs"
+    if sites:
+        raw = sites[0].get("tlsCertDir") or ""
+        if raw.startswith("./certs") or raw.rstrip("/") == "certs":
+            cert_dir = raw.rstrip("/")
     flags = au.get("flags") or ["GATEWAY_AUTO_UPDATE"]
     flag_lines = "\n".join(f"{f}=0" for f in flags)
     public_ip = gw.get("publicIp") or meta.get("publicIp") or ""

package/lib/tls.sh

@@ -9,22 +9,16 @@ infra_tls_check() {
 
 infra_tls_suggest_certbot() {
   local domains=("$@")
-  local joined=""
-  local d
-  for d in "${domains[@]}"; do
-    joined+=" -d $d"
-  done
   cat <<EOF
 
-TLS certificates not found. Issue with certbot (port 80 must be free):
+TLS certificates not found. From the host gateway directory, issue with:
 
-  sudo certbot certonly --standalone${joined}
+  cd ~/services/gateway && ./setup-tls.sh --force
 
-Or after gateway HTTP is up (webroot):
+(setup-tls.sh uses docker certbot when available — no host certbot/sudo required —
+or host certbot when installed. PEMs land in ./certs/.)
 
-  sudo certbot certonly --webroot -w /var/www/certbot${joined}
-
-Then set TLS_FULLCHAIN and TLS_PRIVKEY in .env and run ./start.sh
+Or set TLS_MODE=lab for self-signed lab certs, then ./start.sh
 
 EOF
 }
@@ -41,19 +35,16 @@ infra_tls_offer_interactive() {
   if [[ ! -t 0 ]]; then
     return 0
   fi
-  read -r -p "Run certbot --standalone now? [y/N] " ans
+  local gw="${GATEWAY_HOME:-${HOME:-}/services/gateway}"
+  read -r -p "Run setup-tls.sh in ${gw}? [y/N] " ans
   case "$ans" in
     y|Y|yes|YES)
-      if ! command -v certbot >/dev/null 2>&1; then
-        echo "certbot not found — install certbot first" >&2
+      if [[ -x "${gw}/setup-tls.sh" ]]; then
+        (cd "$gw" && ./setup-tls.sh --force)
+      else
+        echo "setup-tls.sh not found at ${gw} — bootstrap the host gateway first" >&2
         return 1
       fi
-      local args=()
-      local d
-      for d in "${domains[@]}"; do
-        args+=(-d "$d")
-      done
-      sudo certbot certonly --standalone "${args[@]}"
       ;;
   esac
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibed-infra",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Product-agnostic VPS packager: wget install, Docker Compose, TLS/nginx, auto-update",
   "license": "MIT",
   "repository": {

package/schema/packageconfig.md

@@ -27,7 +27,7 @@ gateway:
       aliases: [www.app.example.com]
       healthPath: /api/health
       createPath: /api/items
-      tlsCertDir: /etc/letsencrypt/live/app.example.com
+      tlsCertDir: ./certs  # host gateway PEMs; legacy /etc/letsencrypt/... paths ignored in .env.gateway.example
 ```
 
 Defaults: containers `{name}-api` / `{name}-ui` / `{name}-worker`; host gateway container `vps-gateway`.

package/skills/system-gateway/SKILL.md

@@ -55,7 +55,7 @@ cd ~/services/gateway
 ./setup-tls.sh --force  # re-issue after host or IP change
 ```
 
-- **Production:** certbot (webroot if gateway is up, else standalone). On failure, fix DNS then re-run `setup-tls.sh`.
+- **Production:** `setup-tls.sh` issues Let’s Encrypt via docker `certbot/certbot` by default (config under `$GATEWAY_HOME/letsencrypt`, PEMs copied to `$GATEWAY_HOME/certs/`). No sudo required when Docker is available. Host certbot + sudo still preferred when present (same `--config-dir` under gateway home). Webroot if gateway is up, else standalone. On failure, fix DNS then re-run `setup-tls.sh`.
 - **Lab/CI:** `TLS_MODE=lab` → multi-SAN self-signed under `./certs/`.
 
 ## Webhook path (immediate docker pull)

package/templates/host-gateway/.env.example

@@ -9,6 +9,9 @@ TLS_MODE=
 TLS_EMAIL=
 GATEWAY_PUBLIC_IP=
 CERTBOT_WWW=./certbot-www
+# Optional Let's Encrypt (docker certbot when host certbot/sudo unavailable)
+# CERTBOT_IMAGE=certbot/certbot
+# LETSENCRYPT_HOME=./letsencrypt
 HTTP_PORT=80
 HTTPS_PORT=443
 GATEWAY_MEMORY_LIMIT=64m

package/templates/host-gateway/setup-tls.sh

@@ -12,6 +12,8 @@ for arg in "$@"; do
     -h|--help)
       echo "usage: $0 [--force]"
       echo "  Issues Let's Encrypt (TLS_EMAIL / TLS_MODE=letsencrypt) or lab self-signed certs."
+      echo "  LE prefers host certbot when available (root or passwordless sudo);"
+      echo "  otherwise uses docker run certbot/certbot (no sudo). PEMs land in ./certs/."
       echo "  Re-runs when certs missing, domains/IP changed vs .vibed-tls-state, or --force."
       exit 0
       ;;
@@ -137,27 +139,104 @@ issue_letsencrypt() {
     echo "TLS_EMAIL (or gateway.tlsEmail) required for Let's Encrypt" >&2
     return 1
   fi
-  if ! command -v certbot >/dev/null 2>&1; then
-    echo "certbot not found — install certbot, or set TLS_MODE=lab for self-signed" >&2
-    return 1
+
+  local LE_HOME="${LETSENCRYPT_HOME:-${SCRIPT_DIR}/letsencrypt}"
+  local CERTBOT_IMAGE="${CERTBOT_IMAGE:-certbot/certbot}"
+  mkdir -p "$LE_HOME" "$LE_HOME/work" "$LE_HOME/logs" "$CERT_DIR" "$CERTBOT_WWW"
+
+  # Absolute webroot for docker bind mounts
+  local CERTBOT_WWW_ABS="$CERTBOT_WWW"
+  [[ "$CERTBOT_WWW_ABS" != /* ]] && CERTBOT_WWW_ABS="${SCRIPT_DIR}/${CERTBOT_WWW_ABS#./}"
+  mkdir -p "$CERTBOT_WWW_ABS"
+
+  local use_webroot=0
+  if gateway_running; then
+    use_webroot=1
   fi
-  local args=(certonly --non-interactive --agree-tos --email "$email" --cert-name "$primary")
+
+  local domain_args=()
   local d
   for d in "${all[@]}"; do
-    args+=(-d "$d")
+    domain_args+=(-d "$d")
   done
-  if gateway_running; then
-    echo "Gateway running — certbot webroot ($CERTBOT_WWW)"
-    args+=(--webroot -w "$CERTBOT_WWW")
-  else
-    echo "Gateway not running — certbot standalone (port 80 must be free)"
-    args+=(--standalone)
-  fi
+
+  local base_args=(
+    certonly
+    --agree-tos
+    --non-interactive
+    --email "$email"
+    --cert-name "$primary"
+    "${domain_args[@]}"
+  )
   if [[ "${CERTBOT_DRY_RUN:-0}" == "1" ]]; then
-    args+=(--dry-run)
+    base_args+=(--dry-run)
+  fi
+
+  local ran=0
+  local host_can_run=0
+  if command -v certbot >/dev/null 2>&1; then
+    if [[ "$(id -u)" -eq 0 ]]; then
+      host_can_run=1
+    elif sudo -n true >/dev/null 2>&1; then
+      host_can_run=1
+    fi
+  fi
+
+  if [[ "$host_can_run" == "1" ]]; then
+    local host_args=(
+      "${base_args[@]}"
+      --config-dir "$LE_HOME"
+      --work-dir "$LE_HOME/work"
+      --logs-dir "$LE_HOME/logs"
+    )
+    if [[ "$use_webroot" == "1" ]]; then
+      echo "Gateway running — host certbot webroot ($CERTBOT_WWW_ABS)"
+      host_args+=(--webroot -w "$CERTBOT_WWW_ABS")
+    else
+      echo "Gateway not running — host certbot standalone (port 80 must be free)"
+      host_args+=(--standalone)
+    fi
+    local run_certbot=(certbot)
+    if [[ "$(id -u)" -ne 0 ]]; then
+      run_certbot=(sudo certbot)
+    fi
+    if "${run_certbot[@]}" "${host_args[@]}"; then
+      ran=1
+      # Best-effort: reclaim root-owned LE tree after sudo certbot
+      if [[ "$(id -u)" -ne 0 ]]; then
+        sudo -n chown -R "$(id -u):$(id -g)" "$LE_HOME" 2>/dev/null || true
+      fi
+    fi
+  fi
+
+  if [[ "$ran" != "1" && "$host_can_run" != "1" ]] && command -v docker >/dev/null 2>&1; then
+    local docker_args=(
+      run --rm
+      -v "${LE_HOME}:/etc/letsencrypt"
+    )
+    local container_args=("${base_args[@]}")
+    if [[ "$use_webroot" == "1" ]]; then
+      echo "Gateway running — docker certbot webroot ($CERTBOT_WWW_ABS)"
+      docker_args+=(-v "${CERTBOT_WWW_ABS}:/var/www/certbot")
+      container_args+=(--webroot -w /var/www/certbot)
+    else
+      echo "Gateway not running — docker certbot standalone (-p 80:80)"
+      docker_args+=(-p 80:80)
+      container_args+=(--standalone)
+    fi
+    if docker "${docker_args[@]}" "$CERTBOT_IMAGE" "${container_args[@]}"; then
+      ran=1
+    fi
   fi
-  if ! sudo certbot "${args[@]}"; then
-    cat <<EOF >&2
+
+  if [[ "$ran" != "1" ]]; then
+    if [[ "$host_can_run" != "1" ]] && ! command -v docker >/dev/null 2>&1; then
+      cat <<EOF >&2
+Neither usable host certbot nor docker found.
+Install Docker (preferred for non-root), or certbot with sudo, or set TLS_MODE=lab.
+EOF
+    else
+      cat <<EOF >&2
 
 Let's Encrypt failed (often DNS not pointing here yet).
 1. Paste dist/DNS-SKILL.md into your AU DNS agent (or create the A records yourself).
@@ -165,15 +244,27 @@ Let's Encrypt failed (often DNS not pointing here yet).
 3. Re-run: cd ${SCRIPT_DIR} && ./setup-tls.sh --force
 
 EOF
+    fi
     return 1
   fi
-  local live="/etc/letsencrypt/live/${primary}"
+
+  # Dry-run does not write live PEMs
+  if [[ "${CERTBOT_DRY_RUN:-0}" == "1" ]]; then
+    echo "certbot dry-run succeeded (no PEMs written)"
+    return 0
+  fi
+
+  local live="${LE_HOME}/live/${primary}"
   if [[ ! -f "${live}/fullchain.pem" || ! -f "${live}/privkey.pem" ]]; then
     echo "certbot succeeded but ${live} PEMs missing" >&2
     return 1
   fi
-  patch_env_key TLS_FULLCHAIN "${live}/fullchain.pem"
-  patch_env_key TLS_PRIVKEY "${live}/privkey.pem"
+  cp -L "${live}/fullchain.pem" "${CERT_DIR}/fullchain.pem"
+  cp -L "${live}/privkey.pem" "${CERT_DIR}/privkey.pem"
+  chmod 644 "${CERT_DIR}/fullchain.pem"
+  chmod 600 "${CERT_DIR}/privkey.pem"
+  patch_env_key TLS_FULLCHAIN "${CERT_DIR}/fullchain.pem"
+  patch_env_key TLS_PRIVKEY "${CERT_DIR}/privkey.pem"
   patch_env_key TLS_MODE letsencrypt
   patch_env_key TLS_EMAIL "$email"
 }

package/templates/host-gateway/start-gateway.sh

@@ -33,7 +33,7 @@ if [[ ! -f "$TLS_FULLCHAIN" || ! -f "$TLS_PRIVKEY" ]]; then
   echo "TLS certs not found:" >&2
   echo "  $TLS_FULLCHAIN" >&2
   echo "  $TLS_PRIVKEY" >&2
-  echo "Run gen-dev-certs.sh into ./certs for lab, or certbot for production." >&2
+  echo "Run ./setup-tls.sh (lab or letsencrypt) to create ./certs PEMs." >&2
   exit 1
 fi
 
@@ -44,6 +44,10 @@ fi
 
 docker network create "$NETWORK" >/dev/null 2>&1 || true
 mkdir -p "$CERTBOT_WWW" "$APPS_DIR"
+# Absolute path for live ACME webroot bind mount
+CERTBOT_ABS="$CERTBOT_WWW"
+[[ "$CERTBOT_ABS" != /* ]] && CERTBOT_ABS="${SCRIPT_DIR}/${CERTBOT_ABS#./}"
+mkdir -p "$CERTBOT_ABS"
 
 if docker inspect "$GATEWAY_NAME" >/dev/null 2>&1; then
   echo "Removing existing container $GATEWAY_NAME ..."
@@ -58,7 +62,7 @@ STAGE="$(mktemp -d)"
 cleanup_stage() { rm -rf "$STAGE"; }
 trap cleanup_stage EXIT
 
-mkdir -p "$STAGE/conf.d" "$STAGE/certs" "$STAGE/certbot" "$STAGE/apps"
+mkdir -p "$STAGE/conf.d" "$STAGE/certs" "$STAGE/apps"
 cp "$NGINX_CONF" "$STAGE/nginx.conf"
 cp -r "$CONF_D/." "$STAGE/conf.d/"
 cp "$TLS_FULLCHAIN" "$STAGE/certs/fullchain.pem"
@@ -75,10 +79,6 @@ if [[ -d "$APPS_DIR" ]]; then
     fi
   done
 fi
-if [[ -d "$CERTBOT_WWW" ]]; then
-  cp -r "$CERTBOT_WWW/." "$STAGE/certbot/" 2>/dev/null || true
-fi
-
 tar -C "$STAGE" -cf - . | docker run --rm -i -v "${CONF_VOL}:/cfg" alpine tar -xf - -C /cfg
 
 echo "Starting $GATEWAY_NAME (HTTP ${HTTP_PORT}, HTTPS ${HTTPS_PORT}) ..."
@@ -92,6 +92,7 @@ docker run -d \
   -p "${HTTP_PORT}:80" \
   -p "${HTTPS_PORT}:443" \
   -v "${CONF_VOL}:/gateway-cfg:ro" \
+  -v "${CERTBOT_ABS}:/var/www/certbot" \
   "$NGINX_IMAGE" \
   sh -c 'mkdir -p /etc/nginx/certs /etc/nginx/conf.d /etc/nginx/apps /var/www/certbot && \
     cp /gateway-cfg/nginx.conf /etc/nginx/nginx.conf && \
@@ -99,7 +100,6 @@ docker run -d \
     if [ -d /gateway-cfg/apps ]; then cp -r /gateway-cfg/apps/. /etc/nginx/apps/; fi && \
     cp /gateway-cfg/certs/fullchain.pem /etc/nginx/certs/fullchain.pem && \
     cp /gateway-cfg/certs/privkey.pem /etc/nginx/certs/privkey.pem && \
-    cp -r /gateway-cfg/certbot/. /var/www/certbot/ 2>/dev/null || true && \
     exec nginx -g "daemon off;"' >/dev/null
 
 trap - EXIT