ysk-server-core 1.0.0

package/dist/hosting/system-apply.d.ts

@@ -0,0 +1,242 @@
+/**
+ * System-level apply orchestrators: write configs under dataDir, optionally install/copy with YSK_EXECUTE.
+ */
+import type { HostExecutor } from '../host/executor.js';
+export type BlockReason = 'no_execute' | 'no_root' | 'missing_binary' | 'network' | 'validation' | 'other';
+export interface ApplyResult {
+    ok: boolean;
+    /** True when system commands were actually run */
+    executed?: boolean;
+    /** Plan-only / dry path (no host mutation attempted) */
+    dryRun?: boolean;
+    /** True when panel action could not run due to environment */
+    blocked?: boolean;
+    blockReason?: BlockReason;
+    /** Human message for panel — never "run this in your shell" */
+    blockMessage?: string;
+    written: string[];
+    /** Internal only — not for user homework */
+    commands: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+        stdout?: string;
+    }>;
+    notes: string[];
+    steps?: Array<{
+        name: string;
+        status: 'ok' | 'skipped' | 'failed' | 'blocked';
+        detail?: string;
+    }>;
+}
+export declare function panelBlockMessage(reason: BlockReason): string;
+/**
+ * Write Postfix/Dovecot/OpenDKIM managed configs + install helper;
+ * optionally apt-install when root+EXECUTE. Never fakes ok when install requested but skipped.
+ */
+export declare function applyEmailStack(input: {
+    dataDir: string;
+    domain: string;
+    mailHostname?: string;
+    host: HostExecutor;
+    installPackages?: boolean;
+}): Promise<ApplyResult & {
+    serviceStatus?: Record<string, string>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+}>;
+/**
+ * Issue / renew cert via panel: always attempts real execution when allowed.
+ * Never instructs the operator to copy shell commands.
+ */
+export declare function applyLetsEncrypt(input: {
+    domain: string;
+    email: string;
+    host: HostExecutor;
+    /** Default true — panel always tries to run */
+    run?: boolean;
+    /** Force dns-01 (auto when domain is wildcard) */
+    challenge?: 'http-01' | 'dns-01';
+}): Promise<ApplyResult>;
+/**
+ * Write Apache PHP vhost (backend bind only) + optional enable.
+ * Topology: Nginx → Apache (127.0.0.1:8080) → PHP-FPM sock.
+ */
+export declare function applyPhpHosting(input: {
+    dataDir: string;
+    domain: string;
+    /** Optional ServerAlias list */
+    serverAliases?: string[];
+    docRoot: string;
+    phpVersion: string;
+    poolName: string;
+    host: HostExecutor;
+    enableSite?: boolean;
+    /** Project list for owned-conf checks when retiring orphans. */
+    projects?: Array<Record<string, unknown>>;
+}): Promise<ApplyResult & {
+    siteEnabled: boolean;
+    apacheUpstream: string;
+    vhostPath: string;
+}>;
+/**
+ * Write FTPS (vsftpd) under dataDir; install/start when requested + privileged.
+ * Prefer applyFtpsService when JsonStore is available (full panel flow).
+ * Never fakes ok when install requested but skipped/failed.
+ */
+export declare function applyFtps(input: {
+    dataDir: string;
+    domain: string;
+    host: HostExecutor;
+    install?: boolean;
+    settings?: {
+        pasvMin?: number;
+        pasvMax?: number;
+        listenPort?: number;
+        sslEnable?: boolean;
+        forceSsl?: boolean;
+        pasvAddress?: string;
+        writeEnable?: boolean;
+        banner?: string;
+    };
+}): Promise<ApplyResult & {
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+}>;
+/** Live ufw status for panel (honest probe, no mutation). */
+export declare function probeFirewallStatus(host: HostExecutor): Promise<{
+    installed: boolean;
+    active: string;
+    statusText: string;
+    numberedRules: string[];
+    executeEnabled: boolean;
+    isRoot: boolean;
+}>;
+/** Live fail2ban status for panel. */
+export declare function probeFail2banStatus(host: HostExecutor): Promise<{
+    installed: boolean;
+    active: string;
+    enabled: string;
+    jails: Array<{
+        name: string;
+        currentlyBanned?: number;
+        totalBanned?: number;
+        raw?: string;
+    }>;
+    executeEnabled: boolean;
+    isRoot: boolean;
+    defaultJails: string[];
+}>;
+/** List banned IPs for a jail (or all jails). Read is best-effort (no EXECUTE required). */
+export declare function fail2banBannedIps(host: HostExecutor, jail?: string): Promise<{
+    ok: boolean;
+    notes: string[];
+    items: Array<{
+        jail: string;
+        ip: string;
+    }>;
+    requiresExecute: boolean;
+    blocked?: boolean;
+}>;
+export declare function fail2banUnban(host: HostExecutor, jail: string, ip: string): Promise<{
+    ok: boolean;
+    notes: string[];
+    requiresExecute: boolean;
+    blocked?: boolean;
+}>;
+export declare function fail2banIgnoreIp(host: HostExecutor, dataDir: string | undefined, ip: string, action?: 'add' | 'remove'): Promise<{
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    requiresExecute: boolean;
+    blocked?: boolean;
+    apply_status: 'written' | 'applied' | 'blocked' | 'failed';
+}>;
+/**
+ * Write ufw script under dataDir; apply only when EXECUTE+root.
+ * Never fakes ok=true when apply was requested but skipped/failed.
+ */
+export declare function applyFirewall(input: {
+    host: HostExecutor;
+    dataDir?: string;
+    allowSmtp?: boolean;
+    apply?: boolean;
+    extraTcpPorts?: number[];
+    /** Prefer over expanded ports — e.g. ["21","30000:30100"] */
+    extraPortSpecs?: string[];
+}): Promise<ApplyResult & {
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+}>;
+/**
+ * Write fail2ban jail.local under dataDir; optional apt install + enable.
+ * Never reports ok=true for skipped system mutations when apply=true.
+ */
+export declare function applyFail2ban(input: {
+    dataDir: string;
+    host: HostExecutor;
+    /** When true, attempt apt install + systemctl (needs root + YSK_EXECUTE) */
+    apply?: boolean;
+    jails?: string[];
+    bantime?: string;
+    findtime?: string;
+    maxretry?: number;
+}): Promise<ApplyResult & {
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    serviceActive?: string;
+}>;
+/**
+ * Write nginx proxy conf and optionally sync + reload.
+ */
+export declare function applyNginxSite(input: {
+    dataDir: string;
+    serverName: string;
+    upstream: string;
+    ssl?: boolean;
+    host: HostExecutor;
+    reload?: boolean;
+}): Promise<ApplyResult>;
+/**
+ * Install systemd unit for control plane from template.
+ */
+export declare function writeControlPlaneSystemdUnit(input: {
+    dataDir: string;
+    nodePath?: string;
+    cliPath: string;
+    user?: string;
+}): {
+    unitPath: string;
+    content: string;
+};
+export declare function installControlPlaneSystemd(input: {
+    dataDir: string;
+    cliPath: string;
+    host: HostExecutor;
+    enable?: boolean;
+}): Promise<ApplyResult>;
+/** Probe control-plane unit active/enabled state (honest status for panel). */
+export declare function probeControlPlaneSystemd(host: HostExecutor, dataDir?: string): Promise<{
+    unit: string;
+    unitPathHint: string;
+    active: string;
+    enabled: string;
+    executeEnabled: boolean;
+    isRoot: boolean;
+    /** True when process can install+enable (EXECUTE + root) */
+    canInstall: boolean;
+    /** /etc/systemd unit file present */
+    systemUnitExists: boolean;
+    /** dataDir managed template path if dataDir provided */
+    managedUnitPath: string | null;
+    managedUnitExists: boolean;
+    /** systemctl show subset (best-effort) */
+    show: {
+        mainPid: string | null;
+        activeEnterTimestamp: string | null;
+        fragmentPath: string | null;
+        description: string | null;
+    };
+}>;
+//# sourceMappingURL=system-apply.d.ts.map

package/dist/hosting/system-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-apply.d.ts","sourceRoot":"","sources":["../../src/hosting/system-apply.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAcxD,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,SAAS,GACT,gBAAgB,GAChB,SAAS,GACT,YAAY,GACZ,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,kDAAkD;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnG;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAe7D;AAgBD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CACT,WAAW,GAAG;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;CACvB,CACF,CA+KA;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,SAAS,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;CAClC,GAAG,OAAO,CAAC,WAAW,CAAC,CAiGvB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C,GAAG,OAAO,CACT,WAAW,GAAG;IACZ,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB,CACF,CA4HA;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAgF7E;AAED,6DAA6D;AAC7D,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACrE,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC,CAwCD;AAED,sCAAsC;AACtC,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACrE,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAoED;AAED,4FAA4F;AAC5F,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IACT,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC,CA4CD;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBxF;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,KAAK,GAAG,QAAgB,GAC/B,OAAO,CAAC;IACT,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC5D,CAAC,CA2DD;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAsD7E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiErG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CA8CvB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAwBxC;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAuCvB;AAED,+EAA+E;AAC/E,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,YAAY,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,OAAO,CAAC;IACpB,qCAAqC;IACrC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0CAA0C;IAC1C,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;CACH,CAAC,CAwFD"}