ysk-server-core 1.0.0

package/dist/hosting/system-apply.js

@@ -0,0 +1,1148 @@
+/**
+ * System-level apply orchestrators: write configs under dataDir, optionally install/copy with YSK_EXECUTE.
+ */
+import { mkdirSync, writeFileSync, existsSync, copyFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { planEmailStackInstall } from '../email/dns-records.js';
+import { planLetsEncrypt, renderNginxProxy } from './nginx-ssl.js';
+import { apacheBackendBind, apacheBackendPort, apacheBackendUpstream, renderPhpVhost, selectPhpRuntime, } from './runtime.js';
+import { planFirewall } from './extras.js';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { HostSoftwareProbe, shellEnsureAptPackage } from './software-probe/index.js';
+export function panelBlockMessage(reason) {
+    switch (reason) {
+        case 'no_execute':
+            return tl('ops.blocked.needExecute');
+        case 'no_root':
+            return tl('notes.auto.n0008');
+        case 'missing_binary':
+            return tl('notes.auto.n0524');
+        case 'network':
+            return tl('notes.auto.n1316');
+        case 'validation':
+            return tl('notes.auto.n1465');
+        default:
+            return tl('notes.auto.n0898');
+    }
+}
+async function runAll(host, commands, execute) {
+    const out = [];
+    if (!execute)
+        return out;
+    for (const argv of commands) {
+        const r = await host.runCommand(argv, { timeoutMs: 180_000 });
+        out.push({ argv, exitCode: r.exitCode, stderr: r.stderr, stdout: r.stdout });
+    }
+    return out;
+}
+/**
+ * Write Postfix/Dovecot/OpenDKIM managed configs + install helper;
+ * optionally apt-install when root+EXECUTE. Never fakes ok when install requested but skipped.
+ */
+export async function applyEmailStack(input) {
+    const domain = input.domain.trim().toLowerCase();
+    if (!domain)
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.needDomain'), { httpStatus: 400 });
+    const mailHost = input.mailHostname ?? `mail.${domain}`;
+    const dir = join(input.dataDir, 'email', domain);
+    mkdirSync(join(dir, 'postfix'), { recursive: true });
+    mkdirSync(join(dir, 'dovecot'), { recursive: true });
+    mkdirSync(join(dir, 'opendkim'), { recursive: true });
+    const certBase = `/etc/letsencrypt/live/${mailHost}`;
+    const mainCf = [
+        `# Generated by YSK Server for ${domain}`,
+        `myhostname = ${mailHost}`,
+        `myorigin = ${domain}`,
+        'inet_interfaces = all',
+        'inet_protocols = all',
+        'smtpd_banner = $myhostname ESMTP YSK',
+        'smtpd_tls_security_level = may',
+        `smtpd_tls_cert_file = ${certBase}/fullchain.pem`,
+        `smtpd_tls_key_file = ${certBase}/privkey.pem`,
+        'smtp_tls_security_level = may',
+        'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination',
+        'smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination',
+        'mynetworks = 127.0.0.0/8 [::1]/128',
+        'home_mailbox = Maildir/',
+        'milter_default_action = accept',
+        'milter_protocol = 6',
+        'smtpd_milters = inet:localhost:8891',
+        'non_smtpd_milters = inet:localhost:8891',
+        '',
+    ].join('\n');
+    const masterCfSnippet = [
+        '# YSK snippet — ensure submission/smtps (merge carefully into /etc/postfix/master.cf)',
+        'submission inet n       -       y       -       -       smtpd',
+        '  -o syslog_name=postfix/submission',
+        '  -o smtpd_tls_security_level=encrypt',
+        '  -o smtpd_sasl_auth_enable=yes',
+        'smtps     inet n       -       y       -       -       smtpd',
+        '  -o syslog_name=postfix/smtps',
+        '  -o smtpd_tls_wrappermode=yes',
+        '  -o smtpd_sasl_auth_enable=yes',
+        '',
+    ].join('\n');
+    const dovecot = [
+        '# Generated by YSK Server',
+        'protocols = imap lmtp',
+        'listen = *, ::',
+        'mail_location = maildir:~/Maildir',
+        'ssl = required',
+        `ssl_cert = <${certBase}/fullchain.pem`,
+        `ssl_key = <${certBase}/privkey.pem`,
+        'auth_mechanisms = plain login',
+        'disable_plaintext_auth = yes',
+        '',
+    ].join('\n');
+    const opendkim = [
+        'Syslog yes',
+        'Mode sv',
+        'Canonicalization relaxed/simple',
+        `Domain ${domain}`,
+        'Selector default',
+        `KeyFile ${dir}/opendkim/default.private`,
+        'Socket inet:8891@localhost',
+        'PidFile /run/opendkim/opendkim.pid',
+        '',
+    ].join('\n');
+    const keyTable = `default._domainkey.${domain} ${domain}:default:${dir}/opendkim/default.private\n`;
+    const signingTable = `*@${domain} default._domainkey.${domain}\n`;
+    const written = [
+        join(dir, 'postfix', 'main.cf'),
+        join(dir, 'postfix', 'master.cf.ysk-snippet'),
+        join(dir, 'dovecot', 'dovecot.conf'),
+        join(dir, 'opendkim', 'opendkim.conf'),
+        join(dir, 'opendkim', 'KeyTable'),
+        join(dir, 'opendkim', 'SigningTable'),
+        join(dir, 'install-mta.sh'),
+        join(dir, 'README.txt'),
+    ];
+    writeFileSync(written[0], mainCf, 'utf8');
+    writeFileSync(written[1], masterCfSnippet, 'utf8');
+    writeFileSync(written[2], dovecot, 'utf8');
+    writeFileSync(written[3], opendkim, 'utf8');
+    writeFileSync(written[4], keyTable, 'utf8');
+    writeFileSync(written[5], signingTable, 'utf8');
+    const plan = planEmailStackInstall(domain);
+    const installScript = [
+        '#!/usr/bin/env bash',
+        `# YSK Server MTA install helper for ${domain}`,
+        'set -euo pipefail',
+        `DOMAIN=${JSON.stringify(domain)}`,
+        `MAILHOST=${JSON.stringify(mailHost)}`,
+        `DIR=${JSON.stringify(dir)}`,
+        'export DEBIAN_FRONTEND=noninteractive',
+        `apt-get update`,
+        `apt-get install -y ${plan.packages.join(' ')}`,
+        'cp "$DIR/postfix/main.cf" /etc/postfix/main.cf',
+        'cp "$DIR/dovecot/dovecot.conf" /etc/dovecot/dovecot.conf',
+        'cp "$DIR/opendkim/opendkim.conf" /etc/opendkim.conf',
+        'systemctl enable --now postfix',
+        'systemctl enable --now dovecot',
+        'systemctl enable --now opendkim',
+        'systemctl reload postfix || systemctl restart postfix',
+        'echo "MTA configs applied for $DOMAIN — still need DNS/PTR/Port25"',
+        '',
+    ].join('\n');
+    writeFileSync(written[6], installScript, 'utf8');
+    writeFileSync(written[7], [
+        `YSK Server managed mail configs for ${domain}`,
+        `Mail host: ${mailHost}`,
+        'Always review before copy to /etc.',
+        tl('notes.auto.n0526'),
+        `Helper: ${written[6]}`,
+        `Ports: ${plan.ports.join(', ')}`,
+        'External: SPF/DKIM/DMARC/PTR + Port 25 or SMTP relay',
+        '',
+    ].join('\n'), 'utf8');
+    const notes = [...plan.notes, `Configs under ${dir}`, `Install helper: ${written[6]}`];
+    const commands = [];
+    if (input.installPackages) {
+        commands.push(['apt-get', 'update']);
+        // Never leave postfix in "No configuration" (no main.cf → unit skipped)
+        commands.push([
+            'bash',
+            '-c',
+            [
+                'MAILNAME="$(hostname -f 2>/dev/null || hostname 2>/dev/null || echo localhost)"',
+                'echo "postfix postfix/main_mailer_type select Internet Site" | debconf-set-selections',
+                'echo "postfix postfix/mailname string $MAILNAME" | debconf-set-selections',
+            ].join('; '),
+        ]);
+        commands.push([
+            'bash',
+            '-c',
+            `DEBIAN_FRONTEND=noninteractive apt-get install -y ${plan.packages.join(' ')}`,
+        ]);
+        commands.push(['cp', written[0], '/etc/postfix/main.cf']);
+        commands.push(['cp', written[2], '/etc/dovecot/dovecot.conf']);
+        commands.push(['systemctl', 'enable', '--now', 'postfix']);
+        commands.push(['systemctl', 'enable', '--now', 'dovecot']);
+        commands.push(['systemctl', 'reload', 'postfix']);
+    }
+    const wantInstall = Boolean(input.installPackages);
+    const execute = Boolean(wantInstall && input.host.executeEnabled() && input.host.isRoot());
+    if (wantInstall && !execute) {
+        notes.push(tl('notes.auto.n0641'));
+    }
+    const commandResults = await runAll(input.host, commands, execute);
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    const serviceStatus = {};
+    for (const svc of ['postfix', 'dovecot', 'opendkim']) {
+        try {
+            const st = await input.host.runCommand(['systemctl', 'is-active', svc], { timeoutMs: 5_000 });
+            serviceStatus[svc] = (st.stdout || st.stderr || `exit_${st.exitCode}`).trim();
+        }
+        catch {
+            serviceStatus[svc] = 'unknown';
+        }
+    }
+    notes.push(`services: ${JSON.stringify(serviceStatus)}`);
+    return {
+        ok: wantInstall ? execute && ranOk : true,
+        written,
+        commands: commands.map((a) => a.join(' ')),
+        commandResults,
+        notes,
+        serviceStatus,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot()
+    };
+}
+/**
+ * Issue / renew cert via panel: always attempts real execution when allowed.
+ * Never instructs the operator to copy shell commands.
+ */
+export async function applyLetsEncrypt(input) {
+    const domain = input.domain.trim().toLowerCase();
+    const isWildcard = domain.startsWith('*.');
+    const challenge = input.challenge ?? (isWildcard ? 'dns-01' : 'http-01');
+    const plan = planLetsEncrypt({
+        domain,
+        email: input.email,
+        provider: 'letsencrypt',
+        challenge
+    });
+    const want = input.run !== false;
+    const hasExecute = input.host.executeEnabled();
+    const isRoot = input.host.isRoot();
+    const execute = Boolean(want && hasExecute && isRoot);
+    let blocked = false;
+    let blockReason;
+    let blockMessage;
+    const notes = [];
+    const steps = [];
+    if (want && !hasExecute) {
+        blocked = true;
+        blockReason = 'no_execute';
+        blockMessage = panelBlockMessage('no_execute');
+        notes.push(blockMessage);
+        steps.push({ name: tl('notes.ssl.requestCert'), status: 'blocked', detail: blockMessage });
+    }
+    else if (want && !isRoot) {
+        blocked = true;
+        blockReason = 'no_root';
+        blockMessage = panelBlockMessage('no_root');
+        notes.push(blockMessage);
+        steps.push({ name: tl('notes.ssl.requestCert'), status: 'blocked', detail: blockMessage });
+    }
+    const commands = plan.commands.map((c) => ['bash', '-c', c]);
+    const commandResults = await runAll(input.host, commands, execute);
+    if (execute) {
+        const ranOk = commandResults.length > 0 && commandResults.every((c) => c.exitCode === 0);
+        if (ranOk) {
+            notes.push(tl('notes.auto.n0752'));
+            steps.push({ name: tl('notes.ssl.requestCert'), status: 'ok' });
+            steps.push({ name: tl('notes.auto.n1515'), status: 'ok' });
+        }
+        else {
+            const err = commandResults
+                .map((c) => `${c.stderr || ''}\n${c.stdout || ''}`)
+                .filter((s) => s.trim())
+                .join('\n');
+            const { notesForLetsEncryptFailure } = await import('./ssl-le-errors.js');
+            const humanNotes = notesForLetsEncryptFailure(err, domain);
+            notes.push(...humanNotes);
+            steps.push({
+                name: tl('notes.ssl.requestCert'),
+                status: 'failed',
+                detail: humanNotes[0] || err.slice(0, 200) || undefined,
+            });
+        }
+        return {
+            ok: ranOk,
+            executed: true,
+            blocked: false,
+            written: [],
+            commands: plan.commands,
+            commandResults,
+            notes,
+            steps
+        };
+    }
+    // Explicit plan-only (run=false): plan success — not a failed certificate issue.
+    if (!want) {
+        notes.push('letsencrypt plan only (run=false) — not issued');
+        steps.push({ name: tl('notes.ssl.requestCert'), status: 'ok', detail: 'planned' });
+        return {
+            ok: true,
+            executed: false,
+            blocked: false,
+            dryRun: true,
+            written: [],
+            commands: plan.commands,
+            commandResults,
+            notes,
+            steps,
+        };
+    }
+    // Wanted run but blocked (no EXECUTE/root) — honest fail-closed
+    return {
+        ok: false,
+        executed: false,
+        blocked,
+        blockReason,
+        blockMessage,
+        written: [],
+        commands: plan.commands,
+        commandResults,
+        notes,
+        steps
+    };
+}
+/**
+ * Write Apache PHP vhost (backend bind only) + optional enable.
+ * Topology: Nginx → Apache (127.0.0.1:8080) → PHP-FPM sock.
+ */
+export async function applyPhpHosting(input) {
+    const rt = selectPhpRuntime(input.phpVersion);
+    const bind = apacheBackendBind();
+    const port = apacheBackendPort();
+    const apacheUpstream = apacheBackendUpstream();
+    const dir = join(input.dataDir, 'apache', 'sites');
+    mkdirSync(dir, { recursive: true });
+    mkdirSync(input.docRoot, { recursive: true });
+    const conf = renderPhpVhost({
+        domain: input.domain,
+        serverAliases: input.serverAliases,
+        docRoot: input.docRoot,
+        phpVersion: rt.version,
+        poolName: input.poolName,
+        bind,
+        port,
+    });
+    const path = join(dir, `ysk-${input.poolName}.conf`);
+    writeFileSync(path, conf, 'utf8');
+    const index = join(input.docRoot, 'index.php');
+    if (!existsSync(index)) {
+        writeFileSync(index, '<?php echo "YSK PHP OK\\n";\n', 'utf8');
+    }
+    const notes = [
+        `PHP ${rt.version} Apache vhost at ${path}`,
+        `Apache backend ${bind}:${port} (Nginx proxies; FPM sock)`,
+        `binary ${rt.binaryPath}`,
+    ];
+    // Retire orphan dataDir confs with the same ServerName (not owned by other projects).
+    try {
+        const { retireOrphanApacheConfsForDomain } = await import('./apache/artifacts.js');
+        const retired = await retireOrphanApacheConfsForDomain({
+            dataDir: input.dataDir,
+            host: input.host,
+            domain: input.domain,
+            keepBasename: `ysk-${input.poolName}.conf`,
+            projects: input.projects ?? [],
+        });
+        notes.push(...retired.notes.slice(0, 6));
+    }
+    catch (e) {
+        notes.push(`orphan retire skipped: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const commands = [];
+    if (input.enableSite) {
+        // Ensure Apache listens only on backend (not public :80)
+        commands.push([
+            'bash',
+            '-c',
+            [
+                'set -e',
+                'if [ ! -d /etc/apache2 ]; then exit 0; fi',
+                `cp -a /etc/apache2/ports.conf /etc/apache2/ports.conf.ysk-bak 2>/dev/null || true`,
+                `cat > /etc/apache2/ports.conf <<'EOF'`,
+                `# Managed by YSK — Apache PHP backend; Nginx owns public :80/:443`,
+                `Listen ${bind}:${port}`,
+                `EOF`,
+                // Disable default public sites if present
+                'a2dissite 000-default 2>/dev/null || true',
+                'a2dissite default-ssl 2>/dev/null || true',
+                // Modules for FPM via proxy_fcgi
+                'a2enmod proxy 2>/dev/null || true',
+                'a2enmod proxy_fcgi 2>/dev/null || true',
+                'a2enmod setenvif 2>/dev/null || true',
+                'a2enmod rewrite 2>/dev/null || true',
+            ].join('\n'),
+        ]);
+        const siteName = `ysk-${input.poolName}`;
+        commands.push(['cp', path, `/etc/apache2/sites-available/${siteName}.conf`]);
+        commands.push(['a2ensite', siteName]);
+        commands.push(['apache2ctl', 'configtest']);
+        commands.push(['systemctl', 'reload', 'apache2']);
+    }
+    const execute = Boolean(input.enableSite && input.host.executeEnabled() && input.host.isRoot());
+    if (input.enableSite && !execute)
+        notes.push(tl('notes.auto.n1150'));
+    const commandResults = await runAll(input.host, commands, execute);
+    const ranOk = commandResults.length === 0 || commandResults.every((c) => c.exitCode === 0);
+    let phpActive;
+    let apacheActive;
+    if (execute) {
+        const st = await input.host.runCommand(['systemctl', 'is-active', `php${rt.version}-fpm`], {
+            timeoutMs: 5_000,
+        });
+        phpActive = (st.stdout || st.stderr || '').trim();
+        notes.push(`php-fpm is-active: ${phpActive}`);
+        const ap = await input.host.runCommand(['systemctl', 'is-active', 'apache2'], {
+            timeoutMs: 5_000,
+        });
+        apacheActive = (ap.stdout || ap.stderr || '').trim();
+        notes.push(`apache2 is-active: ${apacheActive}`);
+    }
+    const siteEnabled = Boolean(execute && ranOk && apacheActive === 'active');
+    if (input.enableSite && execute && !siteEnabled) {
+        notes.push('Apache site enable incomplete — Nginx→Apache path may fail');
+    }
+    // RemoteIP so PHP sees real client after Nginx real_ip restore
+    if (execute) {
+        try {
+            const { applyRealIpArtifacts } = await import('./real-ip/index.js');
+            const rip = await applyRealIpArtifacts({
+                dataDir: input.dataDir,
+                host: input.host,
+                enableApacheRemoteIp: true,
+            });
+            notes.push(...rip.notes);
+        }
+        catch (e) {
+            notes.push(`real-ip/RemoteIP apply skipped: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    return {
+        ok: execute ? ranOk && siteEnabled : true,
+        written: [path, index],
+        commands: commands.map((c) => c.join(' ')),
+        commandResults,
+        notes: phpActive ? [...notes, `php_fpm=${phpActive}`] : notes,
+        siteEnabled,
+        apacheUpstream,
+        vhostPath: path,
+    };
+}
+/**
+ * Write FTPS (vsftpd) under dataDir; install/start when requested + privileged.
+ * Prefer applyFtpsService when JsonStore is available (full panel flow).
+ * Never fakes ok when install requested but skipped/failed.
+ */
+export async function applyFtps(input) {
+    const { buildVsftpdConf, ftpsPaths, DEFAULT_FTPS_SETTINGS } = await import('./ftps-service.js');
+    const paths = ftpsPaths(input.dataDir);
+    mkdirSync(paths.root, { recursive: true });
+    const settings = {
+        ...DEFAULT_FTPS_SETTINGS,
+        sslDomain: input.domain,
+        ...(input.settings ?? {})
+    };
+    const confBody = buildVsftpdConf({ dataDir: input.dataDir, settings });
+    writeFileSync(paths.conf, confBody, 'utf8');
+    const notes = [
+        tl('notes.tpl.wroteSettings', { path: paths.conf }),
+        `PASV ${settings.pasvMin}-${settings.pasvMax}`,
+    ];
+    const steps = [
+        { name: tl('notes.ftp.writeVsftpd'), status: 'ok', detail: paths.conf },
+    ];
+    // install only when explicitly requested (never default true)
+    const want = input.install === true;
+    const execute = Boolean(want && input.host.executeEnabled() && input.host.isRoot());
+    if (want && !execute) {
+        const reason = !input.host.executeEnabled() ? 'no_execute' : 'no_root';
+        const blockMessage = panelBlockMessage(reason);
+        notes.push(blockMessage);
+        steps.push({ name: tl('notes.ftp.startVsftpd'), status: 'blocked', detail: blockMessage });
+        return {
+            ok: false,
+            executed: false,
+            blocked: true,
+            blockReason: reason,
+            blockMessage,
+            written: [paths.conf],
+            commands: [],
+            commandResults: [],
+            notes,
+            steps,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot()
+        };
+    }
+    if (!want) {
+        notes.push(tl('notes.auto.n0735'));
+        return {
+            ok: true,
+            executed: false,
+            written: [paths.conf],
+            commands: [],
+            commandResults: [],
+            notes,
+            steps,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot()
+        };
+    }
+    const commands = [
+        [
+            'bash',
+            '-c',
+            shellEnsureAptPackage('vsftpd', 'vsftpd db-util'),
+        ],
+        ['cp', paths.conf, '/etc/vsftpd.conf'],
+        ['systemctl', 'enable', '--now', 'vsftpd'],
+    ];
+    const commandResults = await runAll(input.host, commands, true);
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    if (ranOk) {
+        notes.push(tl('notes.ftp.vsftpdStarted'));
+        steps.push({ name: tl('notes.ftp.startVsftpd'), status: 'ok' });
+    }
+    else {
+        notes.push(tl('notes.auto.n0464'));
+        steps.push({ name: tl('notes.ftp.startVsftpd'), status: 'failed' });
+    }
+    return {
+        ok: ranOk,
+        executed: true,
+        written: [paths.conf],
+        commands: [],
+        commandResults,
+        notes,
+        steps,
+        requiresExecute: false,
+        requiresRoot: false
+    };
+}
+/** Live ufw status for panel (honest probe, no mutation). */
+export async function probeFirewallStatus(host) {
+    const installed = (await new HostSoftwareProbe(host).presence('ufw')).installed;
+    let active = 'unknown';
+    let statusText = '';
+    const numberedRules = [];
+    if (installed) {
+        try {
+            const st = await host.runCommand(['ufw', 'status'], { timeoutMs: 8_000 });
+            statusText = `${st.stdout || ''}\n${st.stderr || ''}`.trim();
+            const first = statusText.split('\n')[0] || '';
+            if (/inactive/i.test(first))
+                active = 'inactive';
+            else if (/active/i.test(first))
+                active = 'active';
+            else
+                active = first.slice(0, 40) || 'unknown';
+        }
+        catch {
+            statusText = '';
+            active = 'unknown';
+        }
+        try {
+            const num = await host.runCommand(['ufw', 'status', 'numbered'], { timeoutMs: 8_000 });
+            const body = `${num.stdout || ''}`.trim();
+            for (const line of body.split('\n')) {
+                const t = line.trim();
+                if (/^\[\s*\d+\]/.test(t) || t.includes('ALLOW') || t.includes('DENY')) {
+                    numberedRules.push(t);
+                }
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return {
+        installed,
+        active,
+        statusText: statusText.slice(0, 4000),
+        numberedRules: numberedRules.slice(0, 80),
+        executeEnabled: host.executeEnabled(),
+        isRoot: host.isRoot()
+    };
+}
+/** Live fail2ban status for panel. */
+export async function probeFail2banStatus(host) {
+    const defaultJails = planFirewall({}).fail2banJails;
+    const f2b = await new HostSoftwareProbe(host).presence('fail2ban');
+    const installed = f2b.installed;
+    let active = f2b.units?.[0]?.active ?? 'unknown';
+    let enabled = f2b.units?.[0]?.enabled ?? 'unknown';
+    try {
+        if (active === 'unknown' || !active) {
+            const a = await host.runCommand(['systemctl', 'is-active', 'fail2ban'], { timeoutMs: 4_000 });
+            active = (a.stdout || a.stderr || 'unknown').trim().split(/\s+/)[0] || 'unknown';
+        }
+    }
+    catch {
+        active = installed ? 'unknown' : 'not-found';
+    }
+    try {
+        const e = await host.runCommand(['systemctl', 'is-enabled', 'fail2ban'], { timeoutMs: 4_000 });
+        enabled = (e.stdout || e.stderr || 'unknown').trim().split(/\s+/)[0] || 'unknown';
+    }
+    catch {
+        enabled = 'unknown';
+    }
+    const jails = [];
+    if (installed) {
+        try {
+            const list = await host.runCommand(['fail2ban-client', 'status'], { timeoutMs: 8_000 });
+            const text = `${list.stdout || ''}\n${list.stderr || ''}`;
+            const m = text.match(/Jail list:\s*(.+)/i);
+            const names = m
+                ? m[1]
+                    .split(/[,\s]+/)
+                    .map((s) => s.trim())
+                    .filter(Boolean)
+                : [];
+            for (const name of names.slice(0, 24)) {
+                try {
+                    const js = await host.runCommand(['fail2ban-client', 'status', name], {
+                        timeoutMs: 5_000
+                    });
+                    const raw = `${js.stdout || ''}`.trim();
+                    const cur = raw.match(/Currently banned:\s*(\d+)/i);
+                    const tot = raw.match(/Total banned:\s*(\d+)/i);
+                    jails.push({
+                        name,
+                        currentlyBanned: cur ? Number(cur[1]) : undefined,
+                        totalBanned: tot ? Number(tot[1]) : undefined,
+                        raw: raw.slice(0, 500)
+                    });
+                }
+                catch {
+                    jails.push({ name });
+                }
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return {
+        installed,
+        active,
+        enabled,
+        jails,
+        executeEnabled: host.executeEnabled(),
+        isRoot: host.isRoot(),
+        defaultJails
+    };
+}
+/** List banned IPs for a jail (or all jails). Read is best-effort (no EXECUTE required). */
+export async function fail2banBannedIps(host, jail) {
+    const items = [];
+    const jails = [];
+    if (jail) {
+        jails.push(jail);
+    }
+    else {
+        const st = await probeFail2banStatus(host);
+        jails.push(...st.jails.map((j) => j.name));
+    }
+    if (!jails.length) {
+        return {
+            ok: true,
+            requiresExecute: false,
+            items: [],
+            notes: [tl('notes.auto.n1091')]
+        };
+    }
+    for (const j of jails.slice(0, 20)) {
+        const r = await host.runCommand(['fail2ban-client', 'status', j], { timeoutMs: 8_000 });
+        const text = `${r.stdout || ''}\n${r.stderr || ''}`;
+        if (r.exitCode !== 0 && /permission|root|error/i.test(text)) {
+            return {
+                ok: false,
+                blocked: !host.executeEnabled(),
+                requiresExecute: !host.executeEnabled(),
+                items: [],
+                notes: [
+                    host.executeEnabled()
+                        ? tl('notes.auto.n1438')
+                        : tl('notes.auto.n1437'),
+                ]
+            };
+        }
+        const m = text.match(/Banned IP list:\s*(.+)/i);
+        if (!m)
+            continue;
+        const ips = m[1]
+            .split(/[,\s]+/)
+            .map((s) => s.trim())
+            .filter((ip) => /^\d{1,3}(\.\d{1,3}){3}$/.test(ip) || ip.includes(':'));
+        for (const ip of ips)
+            items.push({ jail: j, ip });
+    }
+    return {
+        ok: true,
+        requiresExecute: false,
+        items,
+        notes: [tl('notes.auto.t0218', { v0: (items.length) })]
+    };
+}
+export async function fail2banUnban(host, jail, ip) {
+    if (!host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            requiresExecute: true,
+            notes: [tl('notes.auto.n1139')]
+        };
+    }
+    const safeJail = jail.replace(/[^a-zA-Z0-9._-]/g, '');
+    const safeIp = ip.trim();
+    const r = await host.runCommand(['fail2ban-client', 'set', safeJail, 'unbanip', safeIp], {
+        timeoutMs: 10_000
+    });
+    return {
+        ok: r.exitCode === 0,
+        requiresExecute: false,
+        notes: [
+            r.exitCode === 0
+                ? tl('notes.auto.t0219', { v0: (safeIp), v1: (safeJail) })
+                : tl('notes.auto.t0220', { v0: (r.stderr || r.stdout) }),
+        ]
+    };
+}
+export async function fail2banIgnoreIp(host, dataDir, ip, action = 'add') {
+    const written = [];
+    const notes = [];
+    const safeIp = ip.trim();
+    if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(safeIp) && !safeIp.includes(':')) {
+        return {
+            ok: false,
+            notes: [tl('notes.invalidIp')],
+            written,
+            requiresExecute: false,
+            apply_status: 'failed'
+        };
+    }
+    // Persist ignore list under dataDir (always — feeds jail.local ignoreip=)
+    if (dataDir) {
+        const dir = join(dataDir, 'fail2ban');
+        mkdirSync(dir, { recursive: true });
+        const listPath = join(dir, 'ignoreip.txt');
+        let list = [];
+        if (existsSync(listPath)) {
+            list = readFileSync(listPath, 'utf8')
+                .split(/\n/)
+                .map((s) => s.trim())
+                .filter(Boolean);
+        }
+        if (action === 'add' && !list.includes(safeIp))
+            list.push(safeIp);
+        if (action === 'remove')
+            list = list.filter((x) => x !== safeIp);
+        writeFileSync(listPath, list.join('\n') + (list.length ? '\n' : ''), 'utf8');
+        written.push(listPath);
+        notes.push(tl('notes.auto.t0221', { v0: (listPath), v1: (list.length) }));
+    }
+    if (!host.executeEnabled()) {
+        // Control-plane written is success; live client needs EXECUTE (honest written, not fake applied)
+        return {
+            ok: true,
+            notes: [
+                ...notes,
+                tl('notes.auto.n1231'),
+            ],
+            written,
+            requiresExecute: true,
+            apply_status: 'written'
+        };
+    }
+    // set ignoreip on sshd jail — applied only when client succeeds
+    const r = await host.runCommand(['fail2ban-client', 'set', 'sshd', action === 'add' ? 'addignoreip' : 'delignoreip', safeIp], { timeoutMs: 10_000 });
+    const ok = r.exitCode === 0;
+    notes.push(ok
+        ? tl('notes.auto.t0222', { v0: (action), v1: (safeIp) })
+        : tl('notes.auto.t0223', { v0: (r.stderr || r.stdout || 'failed') }));
+    return {
+        ok,
+        notes,
+        written,
+        requiresExecute: false,
+        apply_status: ok ? 'applied' : 'failed'
+    };
+}
+/**
+ * Write ufw script under dataDir; apply only when EXECUTE+root.
+ * Never fakes ok=true when apply was requested but skipped/failed.
+ */
+export async function applyFirewall(input) {
+    const plan = planFirewall({
+        allowSmtp: input.allowSmtp,
+        extraTcpPorts: input.extraTcpPorts,
+        extraPortSpecs: input.extraPortSpecs
+    });
+    const notes = ['Rules generated by planFirewall'];
+    const written = [];
+    if (input.dataDir) {
+        const dir = join(input.dataDir, 'firewall');
+        mkdirSync(dir, { recursive: true });
+        const scriptPath = join(dir, 'ufw-apply.sh');
+        const body = [
+            '#!/usr/bin/env bash',
+            '# Generated by YSK Server — review before running',
+            'set -euo pipefail',
+            ...plan.rules.map((r) => r),
+            '',
+        ].join('\n');
+        writeFileSync(scriptPath, body, 'utf8');
+        written.push(scriptPath);
+        notes.push(`Script: ${scriptPath}`);
+    }
+    const commands = plan.commands.map((c) => ['bash', '-c', c]);
+    const want = Boolean(input.apply);
+    const execute = Boolean(want && input.host.executeEnabled() && input.host.isRoot());
+    if (want && !execute) {
+        const reason = !input.host.executeEnabled() ? 'no_execute' : 'no_root';
+        notes.push(panelBlockMessage(reason));
+        return {
+            ok: false,
+            executed: false,
+            blocked: true,
+            blockReason: reason,
+            blockMessage: panelBlockMessage(reason),
+            written,
+            commands: plan.commands,
+            commandResults: [],
+            notes,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot()
+        };
+    }
+    const commandResults = await runAll(input.host, commands, execute);
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    if (want && !ranOk)
+        notes.push(tl('notes.auto.n0457'));
+    else if (want)
+        notes.push(tl('notes.auto.n0757'));
+    return {
+        ok: want ? execute && ranOk : true,
+        executed: execute,
+        written,
+        commands: plan.commands,
+        commandResults,
+        notes: [...notes, tl('notes.auto.t0224', { v0: (plan.fail2banJails.join(', ')) })],
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot()
+    };
+}
+/**
+ * Write fail2ban jail.local under dataDir; optional apt install + enable.
+ * Never reports ok=true for skipped system mutations when apply=true.
+ */
+export async function applyFail2ban(input) {
+    const plan = planFirewall({});
+    const jails = input.jails ?? plan.fail2banJails;
+    // Prefer deep writer (ignoreip + policy)
+    const { writeFail2banJailLocal } = await import('./fail2ban-ops.js');
+    const { path: jailPath } = writeFail2banJailLocal(input.dataDir, {
+        bantime: input.bantime ?? '1h',
+        findtime: input.findtime ?? '10m',
+        maxretry: input.maxretry ?? 5,
+        jails
+    });
+    const notes = [`Wrote ${jailPath}`, `Jails: ${jails.join(', ')}`];
+    const commands = [];
+    if (input.apply) {
+        commands.push([
+            'bash',
+            '-c',
+            shellEnsureAptPackage('fail2ban-client', 'fail2ban'),
+        ]);
+        commands.push(['cp', jailPath, '/etc/fail2ban/jail.local']);
+        commands.push(['systemctl', 'enable', '--now', 'fail2ban']);
+        commands.push(['systemctl', 'reload', 'fail2ban']);
+    }
+    const execute = Boolean(input.apply && input.host.executeEnabled() && input.host.isRoot());
+    if (input.apply && !execute) {
+        const reason = !input.host.executeEnabled() ? 'no_execute' : 'no_root';
+        notes.push(panelBlockMessage(reason));
+        return {
+            ok: false,
+            executed: false,
+            blocked: true,
+            blockReason: reason,
+            blockMessage: panelBlockMessage(reason),
+            written: [jailPath],
+            commands: commands.map((c) => c.join(' ')),
+            commandResults: [],
+            notes,
+            requiresExecute: !input.host.executeEnabled(),
+            requiresRoot: !input.host.isRoot()
+        };
+    }
+    const commandResults = await runAll(input.host, commands, execute);
+    let serviceActive;
+    if (execute || input.host.pathExists('/usr/bin/fail2ban-client')) {
+        try {
+            const st = await input.host.runCommand(['systemctl', 'is-active', 'fail2ban'], {
+                timeoutMs: 5_000
+            });
+            serviceActive = (st.stdout || st.stderr || '').trim();
+            notes.push(`fail2ban is-active: ${serviceActive}`);
+        }
+        catch {
+            serviceActive = 'unknown';
+        }
+    }
+    const ranOk = commandResults.every((c) => c.exitCode === 0);
+    if (input.apply && !ranOk)
+        notes.push(tl('notes.auto.n0282'));
+    else if (input.apply)
+        notes.push(tl('notes.auto.n0754'));
+    else
+        notes.push(tl('notes.auto.n0764'));
+    return {
+        ok: input.apply ? execute && ranOk : true,
+        executed: execute,
+        written: [jailPath],
+        commands: commands.map((c) => c.join(' ')),
+        commandResults,
+        notes,
+        requiresExecute: !input.host.executeEnabled(),
+        requiresRoot: !input.host.isRoot(),
+        serviceActive
+    };
+}
+/**
+ * Write nginx proxy conf and optionally sync + reload.
+ */
+export async function applyNginxSite(input) {
+    const conf = renderNginxProxy({
+        serverName: input.serverName,
+        upstream: input.upstream,
+        ssl: Boolean(input.ssl),
+        cloudflareRealIp: true
+    });
+    const dir = join(input.dataDir, 'nginx', 'conf.d');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, `${input.serverName.replace(/[^a-z0-9.-]+/gi, '_')}.conf`);
+    writeFileSync(path, conf, 'utf8');
+    const notes = [tl('notes.tpl.wroteManaged', { path: path })];
+    const commands = [];
+    if (input.reload) {
+        commands.push(['nginx', '-t']);
+        commands.push(['systemctl', 'reload', 'nginx']);
+    }
+    const execute = Boolean(input.reload && input.host.executeEnabled());
+    if (input.reload && !input.host.executeEnabled()) {
+        notes.push(tl('ops.blocked.nginxReload'));
+        return {
+            ok: false,
+            executed: false,
+            blocked: true,
+            blockReason: 'no_execute',
+            blockMessage: panelBlockMessage('no_execute'),
+            written: [path],
+            commands: commands.map((c) => c.join(' ')),
+            commandResults: [],
+            notes
+        };
+    }
+    const commandResults = await runAll(input.host, commands, execute);
+    const failed = commandResults.some((r) => r.exitCode !== 0);
+    if (input.reload && failed) {
+        notes.push(tl('notes.auto.n0338'));
+    }
+    else if (input.reload && execute) {
+        notes.push(tl('notes.nginx.reloaded'));
+    }
+    else if (!input.reload) {
+        notes.push(tl('notes.auto.n0567'));
+    }
+    return {
+        ok: !failed,
+        executed: execute,
+        written: [path],
+        commands: commands.map((c) => c.join(' ')),
+        commandResults,
+        notes
+    };
+}
+/**
+ * Install systemd unit for control plane from template.
+ */
+export function writeControlPlaneSystemdUnit(input) {
+    const dir = join(input.dataDir, 'systemd');
+    mkdirSync(dir, { recursive: true });
+    const unitPath = join(dir, 'ysk-server.service');
+    const node = input.nodePath ?? process.execPath;
+    const user = input.user ?? 'root';
+    const content = `[Unit]
+Description=YSK Server control plane
+After=network.target
+
+[Service]
+Type=simple
+User=${user}
+WorkingDirectory=${input.dataDir}
+Environment=NODE_ENV=production
+ExecStart=${node} ${input.cliPath} serve --config ${join(input.dataDir, 'config.json')}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`;
+    writeFileSync(unitPath, content, 'utf8');
+    return { unitPath, content };
+}
+export async function installControlPlaneSystemd(input) {
+    const { unitPath } = writeControlPlaneSystemdUnit({
+        dataDir: input.dataDir,
+        cliPath: input.cliPath
+    });
+    const notes = [tl('notes.auto.t0225', { v0: (unitPath) })];
+    const commands = [];
+    if (input.enable) {
+        commands.push(['cp', unitPath, '/etc/systemd/system/ysk-server.service']);
+        commands.push(['systemctl', 'daemon-reload']);
+        commands.push(['systemctl', 'enable', '--now', 'ysk-server']);
+    }
+    const canExecute = Boolean(input.host.executeEnabled() && input.host.isRoot());
+    const execute = Boolean(input.enable && canExecute);
+    if (input.enable && !execute) {
+        const reason = !input.host.executeEnabled() ? 'no_execute' : 'no_root';
+        notes.push(tl('notes.auto.n0444'));
+        return {
+            ok: false,
+            executed: false,
+            blocked: true,
+            blockReason: reason,
+            blockMessage: panelBlockMessage(reason),
+            written: [unitPath],
+            commands: commands.map((c) => c.join(' ')),
+            commandResults: [],
+            notes
+        };
+    }
+    const commandResults = await runAll(input.host, commands, execute);
+    const failed = commandResults.some((r) => r.exitCode !== 0);
+    if (input.enable && failed)
+        notes.push(tl('notes.auto.n0442'));
+    else if (input.enable)
+        notes.push(tl('notes.auto.n0758'));
+    else
+        notes.push(tl('notes.auto.n0569'));
+    return {
+        ok: !failed,
+        executed: execute,
+        written: [unitPath],
+        commands: commands.map((c) => c.join(' ')),
+        commandResults,
+        notes
+    };
+}
+/** Probe control-plane unit active/enabled state (honest status for panel). */
+export async function probeControlPlaneSystemd(host, dataDir) {
+    const unit = 'ysk-server';
+    const unitPathHint = '/etc/systemd/system/ysk-server.service';
+    let active = 'unknown';
+    let enabled = 'unknown';
+    try {
+        const a = await host.runCommand(['systemctl', 'is-active', unit], { timeoutMs: 5_000 });
+        active = (a.stdout || a.stderr || 'unknown').trim().split('\n')[0] || 'unknown';
+    }
+    catch {
+        active = 'unknown';
+    }
+    try {
+        const e = await host.runCommand(['systemctl', 'is-enabled', unit], { timeoutMs: 5_000 });
+        enabled = (e.stdout || e.stderr || 'unknown').trim().split('\n')[0] || 'unknown';
+    }
+    catch {
+        enabled = 'unknown';
+    }
+    let systemUnitExists = false;
+    try {
+        systemUnitExists = host.pathExists(unitPathHint);
+    }
+    catch {
+        systemUnitExists = false;
+    }
+    const managedUnitPath = dataDir ? join(dataDir, 'systemd', 'ysk-server.service') : null;
+    let managedUnitExists = false;
+    if (managedUnitPath) {
+        try {
+            managedUnitExists = host.pathExists(managedUnitPath) || existsSync(managedUnitPath);
+        }
+        catch {
+            managedUnitExists = false;
+        }
+    }
+    const show = {
+        mainPid: null,
+        activeEnterTimestamp: null,
+        fragmentPath: null,
+        description: null
+    };
+    try {
+        const s = await host.runCommand([
+            'systemctl',
+            'show',
+            unit,
+            '-p',
+            'MainPID',
+            '-p',
+            'ActiveEnterTimestamp',
+            '-p',
+            'FragmentPath',
+            '-p',
+            'Description',
+            '--no-page',
+        ], { timeoutMs: 5_000 });
+        if (s.exitCode === 0 && s.stdout) {
+            for (const line of s.stdout.split('\n')) {
+                const i = line.indexOf('=');
+                if (i <= 0)
+                    continue;
+                const k = line.slice(0, i).trim();
+                const v = line.slice(i + 1).trim();
+                if (k === 'MainPID' && v && v !== '0')
+                    show.mainPid = v;
+                if (k === 'ActiveEnterTimestamp' && v && v !== 'n/a')
+                    show.activeEnterTimestamp = v;
+                if (k === 'FragmentPath' && v)
+                    show.fragmentPath = v;
+                if (k === 'Description' && v)
+                    show.description = v;
+            }
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    const executeEnabled = host.executeEnabled();
+    const isRoot = host.isRoot();
+    return {
+        unit,
+        unitPathHint,
+        active,
+        enabled,
+        executeEnabled,
+        isRoot,
+        canInstall: executeEnabled && isRoot,
+        systemUnitExists,
+        managedUnitPath,
+        managedUnitExists,
+        show
+    };
+}
+// silence unused import if any
+void copyFileSync;
+//# sourceMappingURL=system-apply.js.map