ysk-server-core 1.0.0

package/dist/hosting/db-cluster/plan-mariadb-galera.js

@@ -0,0 +1,190 @@
+import { tl } from 'ysk-server-shared';
+function clusterName(c) {
+    return String(c.params.clusterName || c.name || 'ysk-galera').replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 32);
+}
+function sstMethod(c) {
+    const m = String(c.params.sstMethod || 'mariabackup');
+    return m === 'rsync' ? 'rsync' : 'mariabackup';
+}
+function galeraPort(c) {
+    const p = Number(c.params.galeraPort);
+    return p > 0 && p < 65536 ? p : 4567;
+}
+/** Comma-separated gcomm addresses */
+export function galeraAddressList(c) {
+    const port = galeraPort(c);
+    return c.members
+        .filter((m) => m.role !== 'arbiter' || true)
+        .map((m) => `${m.host}:${port}`)
+        .join(',');
+}
+export function renderGaleraCnf(c, thisHost) {
+    const name = clusterName(c);
+    const addrs = galeraAddressList(c);
+    const sst = sstMethod(c);
+    const gport = galeraPort(c);
+    const node = c.members.find((m) => m.host === thisHost) ?? c.members[0];
+    const nodeName = (node?.label || node?.host || 'node1').replace(/[^a-zA-Z0-9_-]/g, '-');
+    return `# YSK Server managed — MariaDB Galera
+# written ≠ cluster healthy until nodes join and probe ok
+# cluster: ${c.id} (${name})
+
+[mysqld]
+binlog_format=ROW
+default_storage_engine=InnoDB
+innodb_autoinc_lock_mode=2
+
+# Bind: prefer private network IP on each node
+bind-address=0.0.0.0
+
+wsrep_on=ON
+wsrep_provider=/usr/lib/galera/libgalera_smm.so
+wsrep_cluster_name="${name}"
+wsrep_cluster_address="gcomm://${addrs}"
+wsrep_node_name="${nodeName}"
+wsrep_node_address="${thisHost}"
+wsrep_sst_method=${sst}
+wsrep_slave_threads=4
+wsrep_provider_options="gcache.size=1G;gmcast.listen_addr=tcp://0.0.0.0:${gport}"
+
+# First bootstrap uses: galera_new_cluster (not normal systemctl start)
+`;
+}
+export function renderGaleraPlanMarkdown(c) {
+    const name = clusterName(c);
+    const lines = [
+        `# MariaDB Galera plan — ${c.name}`,
+        ``,
+        `- id: \`${c.id}\``,
+        `- cluster_name: \`${name}\``,
+        `- members: ${c.members.map((m) => `${m.host} (${m.role}/${m.access})`).join(', ')}`,
+        `- sst: ${sstMethod(c)}`,
+        ``,
+        `## Order`,
+        `1. Install mariadb-server + galera on **all** nodes`,
+        `2. Open firewall for 3306, ${galeraPort(c)}, 4444, 4568 (private net only)`,
+        `3. Place conf drop-in on each node`,
+        `4. **Bootstrap** first node: \`galera_new_cluster\` (or \`systemctl start mariadb\` with --wsrep-new-cluster)`,
+        `5. Start remaining nodes normally; SST will sync`,
+        `6. Probe: \`SHOW STATUS LIKE 'wsrep%'\` — size ≥ member count, ready ON`,
+        ``,
+        `## Honesty`,
+        `- Plan success ≠ healthy cluster`,
+        `- Requires YSK_EXECUTE + root to apply system conf on this panel host`,
+        `- Peer nodes: run peer-apply.sh or push via SSH/fleet (later)`,
+        ``,
+    ];
+    return lines.join('\n');
+}
+export function renderPeerApplyScript(c) {
+    return `#!/usr/bin/env bash
+# YSK peer apply helper — review before run on EACH peer
+# cluster ${c.id} (${clusterName(c)})
+set -euo pipefail
+CONF_SRC="\${1:-./99-ysk-galera.cnf}"
+DEST="/etc/mysql/mariadb.conf.d/99-ysk-galera.cnf"
+if [[ ! -f "$CONF_SRC" ]]; then
+  echo "missing $CONF_SRC" >&2
+  exit 2
+fi
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "need root" >&2
+  exit 3
+fi
+install -m 644 "$CONF_SRC" "$DEST"
+echo "written $DEST — start join with: systemctl restart mariadb"
+echo "bootstrap only on FIRST node: galera_new_cluster"
+`;
+}
+/**
+ * Build dry-run plan for Galera (no host mutation).
+ */
+export function planMariadbGalera(c) {
+    const notes = [];
+    const steps = [];
+    const files = [];
+    if (c.engine !== 'mariadb' || c.kind !== 'mariadb-galera') {
+        return {
+            ok: false,
+            dryRun: true,
+            clusterId: c.id,
+            kind: c.kind,
+            engine: c.engine,
+            steps: [],
+            files: [],
+            notes: [tl('notes.auto.n1033')],
+            requiresExecute: true,
+            requiresRoot: true
+        };
+    }
+    if (c.members.length < 2) {
+        notes.push(tl('notes.auto.n0826'));
+    }
+    const local = c.members.find((m) => m.access === 'local') ?? c.members[0];
+    const thisHost = local.host;
+    const cnf = renderGaleraCnf(c, thisHost);
+    const planMd = renderGaleraPlanMarkdown(c);
+    const peerSh = renderPeerApplyScript(c);
+    files.push({ relativePath: 'conf/99-ysk-galera.cnf', body: cnf }, { relativePath: 'plan.md', body: planMd }, { relativePath: 'scripts/peer-apply.sh', body: peerSh });
+    steps.push({
+        id: 'conf-local',
+        memberId: local.id,
+        title: tl('notes.auto.t0581', { v0: (thisHost) }),
+        kind: 'conf',
+        body: cnf,
+        risk: 'write-panel'
+    });
+    for (const m of c.members.filter((x) => x.id !== local.id)) {
+        const peerCnf = renderGaleraCnf(c, m.host);
+        files.push({
+            relativePath: `conf/peers/${m.host.replace(/[^a-zA-Z0-9._-]/g, '_')}.cnf`,
+            body: peerCnf
+        });
+        steps.push({
+            id: `conf-peer-${m.id}`,
+            memberId: m.id,
+            title: `Peer conf ${m.host}`,
+            kind: 'conf',
+            body: peerCnf,
+            risk: 'write-panel'
+        });
+        steps.push({
+            id: `manual-peer-${m.id}`,
+            memberId: m.id,
+            title: tl('notes.auto.t0582', { v0: (m.host) }),
+            kind: 'manual',
+            body: tl('notes.auto.t0583'),
+            risk: 'execute-host'
+        });
+    }
+    steps.push({
+        id: 'bootstrap',
+        memberId: local.id,
+        title: tl('notes.auto.n0083'),
+        kind: 'command',
+        argv: ['galera_new_cluster'],
+        risk: 'execute-host'
+    });
+    steps.push({
+        id: 'probe',
+        title: tl('notes.auto.n0889'),
+        kind: 'probe',
+        risk: 'read'
+    });
+    notes.push(tl('notes.auto.n0032'), `wsrep_cluster_address=gcomm://${galeraAddressList(c)}`, tl('notes.auto.n1524'), sstMethod(c) === 'mariabackup'
+        ? tl('notes.auto.n0190')
+        : 'SST=rsync');
+    return {
+        ok: true,
+        dryRun: true,
+        clusterId: c.id,
+        kind: c.kind,
+        engine: c.engine,
+        steps,
+        files,
+        notes,
+        requiresExecute: true,
+        requiresRoot: true
+    };
+}
+//# sourceMappingURL=plan-mariadb-galera.js.map

package/dist/hosting/db-cluster/plan-mariadb-galera.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-mariadb-galera.js","sourceRoot":"","sources":["../../../src/hosting/db-cluster/plan-mariadb-galera.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,SAAS,WAAW,CAAC,CAAY;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,SAAS,CAAC,CAAY;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,CAAY;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,OAAO;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAY,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAExF,OAAO;;aAEI,CAAC,CAAC,EAAE,KAAK,IAAI;;;;;;;;;;;;sBAYJ,IAAI;iCACO,KAAK;mBACnB,QAAQ;sBACL,QAAQ;mBACX,GAAG;;0EAEoD,KAAK;;;CAG9E,CAAC;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAY;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG;QACZ,2BAA2B,CAAC,CAAC,IAAI,EAAE;QACnC,EAAE;QACF,WAAW,CAAC,CAAC,EAAE,IAAI;QACnB,qBAAqB,IAAI,IAAI;QAC7B,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpF,UAAU,SAAS,CAAC,CAAC,CAAC,EAAE;QACxB,EAAE;QACF,UAAU;QACV,qDAAqD;QACrD,8BAA8B,UAAU,CAAC,CAAC,CAAC,iCAAiC;QAC5E,oCAAoC;QACpC,+GAA+G;QAC/G,kDAAkD;QAClD,yEAAyE;QACzE,EAAE;QACF,YAAY;QACZ,kCAAkC;QAClC,uEAAuE;QACvE,+DAA+D;QAC/D,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAY;IAChD,OAAO;;YAEG,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;CAelC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAyB,EAAE,CAAC;IAEvC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAExC,KAAK,CAAC,IAAI,CACR,EAAE,YAAY,EAAE,wBAAwB,EAAE,IAAI,EAAE,GAAG,EAAE,EACrD,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EACzC,EAAE,YAAY,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,CACxD,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,aAAa;KAAE,CAAC,CAAC;IAEzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC;YACT,YAAY,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM;YACzE,IAAI,EAAE,OAAO;SAAE,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE;YACvB,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,aAAa;SAAE,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,EAAE;YACzB,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,IAAI,EAAE,cAAc;SAAE,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,CAAC,oBAAoB,CAAC;QAC5B,IAAI,EAAE,cAAc;KAAE,CAAC,CAAC;IAE1B,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM;KAAE,CAAC,CAAC;IAElB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,CAAC,EACtB,iCAAiC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EACvD,EAAE,CAAC,kBAAkB,CAAC,EACtB,SAAS,CAAC,CAAC,CAAC,KAAK,aAAa;QAC5B,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,WAAW,CAChB,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,IAAI;KAAE,CAAC;AACzB,CAAC"}

package/dist/hosting/db-cluster/plan-mysql-replica.d.ts

@@ -0,0 +1,13 @@
+/**
+ * MySQL async primary → replica plan (pure; never mutates host).
+ */
+import type { ClusterPlan, DbCluster, DbClusterMember } from './types.js';
+/** Primary mysqld drop-in */
+export declare function renderMysqlPrimaryCnf(c: DbCluster, _m: DbClusterMember, index: number): string;
+/** Replica mysqld drop-in */
+export declare function renderMysqlReplicaCnf(c: DbCluster, m: DbClusterMember, index: number): string;
+export declare function renderMysqlReplicaPlanMd(c: DbCluster): string;
+export declare function renderMysqlChangeReplicationSql(c: DbCluster): string;
+export declare function renderMysqlPrimaryGrantsSql(c: DbCluster): string;
+export declare function planMysqlReplica(c: DbCluster): ClusterPlan;
+//# sourceMappingURL=plan-mysql-replica.d.ts.map

package/dist/hosting/db-cluster/plan-mysql-replica.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-mysql-replica.d.ts","sourceRoot":"","sources":["../../../src/hosting/db-cluster/plan-mysql-replica.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAmB,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAwB3F,6BAA6B;AAC7B,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe9F;AAED,6BAA6B;AAC7B,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmB7F;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CA2B7D;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAuBpE;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,SAAS,GAAG,WAAW,CA2G1D"}

package/dist/hosting/db-cluster/plan-mysql-replica.js

@@ -0,0 +1,221 @@
+import { tl } from 'ysk-server-shared';
+function primary(c) {
+    return (c.members.find((m) => m.role === 'primary' || m.role === 'master') ??
+        c.members.find((m) => m.access === 'local') ??
+        c.members[0]);
+}
+function replicas(c) {
+    const p = primary(c);
+    return c.members.filter((m) => m.id !== p?.id);
+}
+function serverIdFor(c, index) {
+    const base = Number(c.params.serverIdBase) || 100;
+    return base + index;
+}
+function replUser(c) {
+    return String(c.params.replUser || 'ysk_repl').replace(/[^a-zA-Z0-9_]/g, '_').slice(0, 32);
+}
+/** Primary mysqld drop-in */
+export function renderMysqlPrimaryCnf(c, _m, index) {
+    const sid = serverIdFor(c, index);
+    return `# YSK Server managed — MySQL primary (async replication)
+# cluster: ${c.id} (${c.name})
+# written ≠ replica healthy until CHANGE REPLICATION + probe ok
+
+[mysqld]
+server-id=${sid}
+log_bin=mysql-bin
+binlog_format=ROW
+gtid_mode=ON
+enforce_gtid_consistency=ON
+bind-address=0.0.0.0
+# Optional: binlog_expire_logs_seconds=604800
+`;
+}
+/** Replica mysqld drop-in */
+export function renderMysqlReplicaCnf(c, m, index) {
+    const sid = serverIdFor(c, index);
+    const p = primary(c);
+    return `# YSK Server managed — MySQL replica
+# cluster: ${c.id} · this=${m.host} · primary=${p?.host ?? '?'}
+# After conf: CHANGE REPLICATION SOURCE / START REPLICA (see scripts)
+
+[mysqld]
+server-id=${sid}
+report_host=${m.host}
+log_bin=mysql-bin
+binlog_format=ROW
+gtid_mode=ON
+enforce_gtid_consistency=ON
+read_only=ON
+super_read_only=ON
+relay_log=relay-bin
+# skip_replica_start=ON  # uncomment until CHANGE REPLICATION done
+`;
+}
+export function renderMysqlReplicaPlanMd(c) {
+    const p = primary(c);
+    const user = replUser(c);
+    const reps = replicas(c);
+    return [
+        `# MySQL primary→replica plan — ${c.name}`,
+        ``,
+        `- id: \`${c.id}\``,
+        `- primary: ${p?.host ?? '—'} (${p?.access ?? ''})`,
+        `- replicas: ${reps.map((m) => m.host).join(', ') || '—'}`,
+        `- repl user: \`${user}\` (set password once; not stored in conf)`,
+        ``,
+        `## Order`,
+        `1. Install mysql-server on all nodes`,
+        `2. Apply **primary** conf drop-in → restart mysql`,
+        `3. On primary: CREATE USER + GRANT REPLICATION SLAVE`,
+        `4. Snapshot / clone data to replica (mysqldump --all-databases or clone plugin)`,
+        `5. Apply **replica** conf → restart`,
+        `6. On replica: CHANGE REPLICATION SOURCE TO ...; START REPLICA;`,
+        `7. Probe: SHOW MASTER STATUS / SHOW REPLICA STATUS`,
+        ``,
+        `## Honesty`,
+        `- Plan success ≠ replication running`,
+        `- Password never written into managed conf files`,
+        `- Peer apply is manual / SSH / fleet (later)`,
+        ``,
+    ].join('\n');
+}
+export function renderMysqlChangeReplicationSql(c) {
+    const p = primary(c);
+    const user = replUser(c);
+    const host = p?.host ?? 'PRIMARY_HOST';
+    const port = p?.port ?? 3306;
+    return `-- Run on REPLICA after data clone. Replace PASSWORD.
+-- MySQL 8.0.23+ syntax:
+
+CHANGE REPLICATION SOURCE TO
+  SOURCE_HOST='${host}',
+  SOURCE_PORT=${port},
+  SOURCE_USER='${user}',
+  SOURCE_PASSWORD='CHANGE_ME',
+  SOURCE_AUTO_POSITION=1;
+
+START REPLICA;
+SHOW REPLICA STATUS\\G
+
+-- Older MySQL:
+-- CHANGE MASTER TO MASTER_HOST='${host}', MASTER_PORT=${port},
+--   MASTER_USER='${user}', MASTER_PASSWORD='CHANGE_ME', MASTER_AUTO_POSITION=1;
+-- START SLAVE;
+`;
+}
+export function renderMysqlPrimaryGrantsSql(c) {
+    const user = replUser(c);
+    return `-- Run on PRIMARY (replace PASSWORD; restrict host to replica net)
+CREATE USER IF NOT EXISTS '${user}'@'%' IDENTIFIED BY 'CHANGE_ME';
+GRANT REPLICATION SLAVE ON *.* TO '${user}'@'%';
+FLUSH PRIVILEGES;
+-- Prefer: '${user}'@'10.%' or exact replica IP instead of '%'
+`;
+}
+export function planMysqlReplica(c) {
+    const notes = [];
+    const steps = [];
+    const files = [];
+    if (c.engine !== 'mysql' || c.kind !== 'mysql-replica') {
+        return {
+            ok: false,
+            dryRun: true,
+            clusterId: c.id,
+            kind: c.kind,
+            engine: c.engine,
+            steps: [],
+            files: [],
+            notes: [tl('notes.auto.n1034')],
+            requiresExecute: true,
+            requiresRoot: true
+        };
+    }
+    const p = primary(c);
+    if (!p) {
+        return {
+            ok: false,
+            dryRun: true,
+            clusterId: c.id,
+            kind: c.kind,
+            engine: c.engine,
+            steps: [],
+            files: [],
+            notes: [tl('notes.auto.n1589')],
+            requiresExecute: true,
+            requiresRoot: true
+        };
+    }
+    if (replicas(c).length < 1) {
+        notes.push(tl('notes.auto.n0825'));
+    }
+    const primaryCnf = renderMysqlPrimaryCnf(c, p, 0);
+    files.push({ relativePath: 'conf/99-ysk-mysql-primary.cnf', body: primaryCnf });
+    files.push({ relativePath: 'plan.md', body: renderMysqlReplicaPlanMd(c) });
+    files.push({
+        relativePath: 'scripts/primary-grants.sql',
+        body: renderMysqlPrimaryGrantsSql(c)
+    });
+    files.push({
+        relativePath: 'scripts/replica-change-source.sql',
+        body: renderMysqlChangeReplicationSql(c)
+    });
+    steps.push({
+        id: 'conf-primary',
+        memberId: p.id,
+        title: `Primary conf（${p.host}）`,
+        kind: 'conf',
+        body: primaryCnf,
+        risk: 'write-panel'
+    });
+    steps.push({
+        id: 'sql-grants',
+        memberId: p.id,
+        title: tl('notes.auto.n0162'),
+        kind: 'manual',
+        body: renderMysqlPrimaryGrantsSql(c),
+        risk: 'execute-host'
+    });
+    replicas(c).forEach((m, i) => {
+        const cnf = renderMysqlReplicaCnf(c, m, i + 1);
+        const safe = m.host.replace(/[^a-zA-Z0-9._-]/g, '_');
+        files.push({ relativePath: `conf/peers/${safe}-replica.cnf`, body: cnf });
+        steps.push({
+            id: `conf-replica-${m.id}`,
+            memberId: m.id,
+            title: `Replica conf ${m.host}`,
+            kind: 'conf',
+            body: cnf,
+            risk: 'write-panel'
+        });
+        steps.push({
+            id: `sql-replica-${m.id}`,
+            memberId: m.id,
+            title: `Replica ${m.host}：CHANGE REPLICATION + START`,
+            kind: 'manual',
+            body: renderMysqlChangeReplicationSql(c),
+            risk: 'execute-host'
+        });
+    });
+    steps.push({
+        id: 'probe',
+        title: tl('notes.auto.n0887'),
+        kind: 'probe',
+        risk: 'read'
+    });
+    notes.push(tl('notes.auto.n0032'), `primary=${p.host} · replicas=${replicas(c).map((m) => m.host).join(',') || 'none'}`, tl('notes.auto.n0662'), tl('notes.auto.n0107'));
+    return {
+        ok: true,
+        dryRun: true,
+        clusterId: c.id,
+        kind: c.kind,
+        engine: c.engine,
+        steps,
+        files,
+        notes,
+        requiresExecute: true,
+        requiresRoot: true
+    };
+}
+//# sourceMappingURL=plan-mysql-replica.js.map

package/dist/hosting/db-cluster/plan-mysql-replica.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-mysql-replica.js","sourceRoot":"","sources":["../../../src/hosting/db-cluster/plan-mysql-replica.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,SAAS,OAAO,CAAC,CAAY;IAC3B,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAY;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,CAAY,EAAE,KAAa;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;IAClD,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAY;IAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,CAAY,EAAE,EAAmB,EAAE,KAAa;IACpF,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO;aACI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI;;;;YAIhB,GAAG;;;;;;;CAOd,CAAC;AACF,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,CAAY,EAAE,CAAkB,EAAE,KAAa;IACnF,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO;aACI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,IAAI,IAAI,GAAG;;;;YAIlD,GAAG;cACD,CAAC,CAAC,IAAI;;;;;;;;;CASnB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAY;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,kCAAkC,CAAC,CAAC,IAAI,EAAE;QAC1C,EAAE;QACF,WAAW,CAAC,CAAC,EAAE,IAAI;QACnB,cAAc,CAAC,EAAE,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE,GAAG;QACnD,eAAe,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QAC1D,kBAAkB,IAAI,4CAA4C;QAClE,EAAE;QACF,UAAU;QACV,sCAAsC;QACtC,mDAAmD;QACnD,sDAAsD;QACtD,iFAAiF;QACjF,qCAAqC;QACrC,iEAAiE;QACjE,oDAAoD;QACpD,EAAE;QACF,YAAY;QACZ,sCAAsC;QACtC,kDAAkD;QAClD,8CAA8C;QAC9C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,CAAY;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,cAAc,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC7B,OAAO;;;;iBAIQ,IAAI;gBACL,IAAI;iBACH,IAAI;;;;;;;;mCAQc,IAAI,kBAAkB,IAAI;oBACzC,IAAI;;CAEvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAY;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;6BACoB,IAAI;qCACI,IAAI;;cAE3B,IAAI;CACjB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAY;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAyB,EAAE,CAAC;IAEvC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SAAE,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SAAE,CAAC;IACzB,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,+BAA+B,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC;QACT,YAAY,EAAE,4BAA4B;QAC1C,IAAI,EAAE,2BAA2B,CAAC,CAAC,CAAC;KAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC;QACT,YAAY,EAAE,mCAAmC;QACjD,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC;KAAE,CAAC,CAAC;IAE9C,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,GAAG;QAChC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,aAAa;KAAE,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACpC,IAAI,EAAE,cAAc;KAAE,CAAC,CAAC;IAE1B,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,cAAc,IAAI,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,gBAAgB,CAAC,CAAC,EAAE,EAAE;YAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,aAAa;SAAE,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,EAAE;YACzB,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,6BAA6B;YACrD,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC;YACxC,IAAI,EAAE,cAAc;SAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM;KAAE,CAAC,CAAC;IAElB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,CAAC,EACtB,WAAW,CAAC,CAAC,IAAI,eAAe,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,EACpF,EAAE,CAAC,kBAAkB,CAAC,EACtB,EAAE,CAAC,kBAAkB,CAAC,CACvB,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,IAAI;KAAE,CAAC;AACzB,CAAC"}

package/dist/hosting/db-cluster/plan-postgres-replica.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PostgreSQL streaming primary → replica plan (pure).
+ */
+import type { ClusterPlan, DbCluster, DbClusterMember } from './types.js';
+export declare function renderPostgresPrimaryConf(c: DbCluster): string;
+export declare function renderPostgresReplicaConf(c: DbCluster, m: DbClusterMember): string;
+export declare function renderPostgresPlanMd(c: DbCluster): string;
+export declare function renderPostgresPrimarySql(c: DbCluster): string;
+export declare function renderPostgresBasebackupSh(c: DbCluster): string;
+export declare function planPostgresReplica(c: DbCluster): ClusterPlan;
+//# sourceMappingURL=plan-postgres-replica.d.ts.map

package/dist/hosting/db-cluster/plan-postgres-replica.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-postgres-replica.d.ts","sourceRoot":"","sources":["../../../src/hosting/db-cluster/plan-postgres-replica.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAmB,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmB3F,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAiB9D;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAclF;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAwBzD;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAQ7D;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAe/D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,GAAG,WAAW,CA4F7D"}

package/dist/hosting/db-cluster/plan-postgres-replica.js

@@ -0,0 +1,193 @@
+import { tl } from 'ysk-server-shared';
+function primary(c) {
+    return (c.members.find((m) => m.role === 'primary' || m.role === 'master') ??
+        c.members.find((m) => m.access === 'local') ??
+        c.members[0]);
+}
+function replicas(c) {
+    const p = primary(c);
+    return c.members.filter((m) => m.id !== p?.id);
+}
+function replUser(c) {
+    return String(c.params.replUser || 'ysk_repl').replace(/[^a-zA-Z0-9_]/g, '_').slice(0, 32);
+}
+export function renderPostgresPrimaryConf(c) {
+    return `# YSK Server managed — PostgreSQL primary (streaming)
+# cluster: ${c.id} (${c.name})
+# Append or place under conf.d / postgresql.conf include
+
+# wal_level = replica
+# max_wal_senders = 10
+# max_replication_slots = 10
+# hot_standby = on
+# listen_addresses = '*'
+
+wal_level = replica
+max_wal_senders = 10
+max_replication_slots = 10
+hot_standby = on
+listen_addresses = '*'
+`;
+}
+export function renderPostgresReplicaConf(c, m) {
+    const p = primary(c);
+    const user = replUser(c);
+    const host = p?.host ?? 'PRIMARY_HOST';
+    const port = p?.port ?? 5432;
+    return `# YSK Server managed — PostgreSQL replica
+# this=${m.host} · primary=${host}
+# After base backup: create standby.signal and set primary_conninfo
+
+# In postgresql.conf (or auto.conf):
+hot_standby = on
+primary_conninfo = 'host=${host} port=${port} user=${user} password=CHANGE_ME application_name=${m.label || m.host}'
+# primary_slot_name = 'ysk_${m.host.replace(/[^a-z0-9_]/gi, '_').slice(0, 40)}'
+`;
+}
+export function renderPostgresPlanMd(c) {
+    const p = primary(c);
+    const user = replUser(c);
+    return [
+        `# PostgreSQL streaming plan — ${c.name}`,
+        ``,
+        `- id: \`${c.id}\``,
+        `- primary: ${p?.host ?? '—'}`,
+        `- replicas: ${replicas(c).map((m) => m.host).join(', ') || '—'}`,
+        `- repl user: \`${user}\``,
+        ``,
+        `## Order`,
+        `1. Install postgresql on all nodes`,
+        `2. Primary: apply conf (wal_level=replica) → restart`,
+        `3. Primary: CREATE ROLE ${user} REPLICATION LOGIN PASSWORD '…'`,
+        `4. pg_hba: host replication ${user} <replica-net> scram-sha-256`,
+        `5. Replica: stop postgres; rm data; pg_basebackup -h primary -U ${user} -D $PGDATA -Fp -Xs -P -R`,
+        `6. Start replica; probe: pg_is_in_recovery()`,
+        ``,
+        `## Honesty`,
+        `- Plan ≠ replication running`,
+        `- Password only in scripts as CHANGE_ME`,
+        ``,
+    ].join('\n');
+}
+export function renderPostgresPrimarySql(c) {
+    const user = replUser(c);
+    return `-- Run on PRIMARY
+CREATE ROLE ${user} WITH REPLICATION LOGIN PASSWORD 'CHANGE_ME';
+-- pg_hba.conf example:
+-- host replication ${user} 10.0.0.0/8 scram-sha-256
+SELECT pg_reload_conf();
+`;
+}
+export function renderPostgresBasebackupSh(c) {
+    const p = primary(c);
+    const user = replUser(c);
+    return `#!/usr/bin/env bash
+# Run on REPLICA as postgres (review first)
+set -euo pipefail
+PRIMARY="${p?.host ?? 'PRIMARY'}"
+USER="${user}"
+PGDATA="\${PGDATA:-/var/lib/postgresql/16/main}"
+systemctl stop postgresql || true
+rm -rf "\$PGDATA"/*
+pg_basebackup -h "\$PRIMARY" -U "\$USER" -D "\$PGDATA" -Fp -Xs -P -R
+systemctl start postgresql
+psql -c "SELECT pg_is_in_recovery();"
+`;
+}
+export function planPostgresReplica(c) {
+    if (c.engine !== 'postgres' || c.kind !== 'postgres-replica') {
+        return {
+            ok: false,
+            dryRun: true,
+            clusterId: c.id,
+            kind: c.kind,
+            engine: c.engine,
+            steps: [],
+            files: [],
+            notes: [tl('notes.auto.n0571')],
+            requiresExecute: true,
+            requiresRoot: true
+        };
+    }
+    const p = primary(c);
+    if (!p) {
+        return {
+            ok: false,
+            dryRun: true,
+            clusterId: c.id,
+            kind: c.kind,
+            engine: c.engine,
+            steps: [],
+            files: [],
+            notes: [tl('notes.auto.n1567')],
+            requiresExecute: true,
+            requiresRoot: true
+        };
+    }
+    const notes = [tl('notes.auto.n0033'), `primary=${p.host}`];
+    const steps = [];
+    const files = [
+        { relativePath: 'conf/99-ysk-postgres-primary.conf', body: renderPostgresPrimaryConf(c) },
+        { relativePath: 'plan.md', body: renderPostgresPlanMd(c) },
+        { relativePath: 'scripts/primary-repl-role.sql', body: renderPostgresPrimarySql(c) },
+        { relativePath: 'scripts/replica-basebackup.sh', body: renderPostgresBasebackupSh(c) },
+    ];
+    steps.push({
+        id: 'conf-primary',
+        memberId: p.id,
+        title: `Primary conf（${p.host}）`,
+        kind: 'conf',
+        body: renderPostgresPrimaryConf(c),
+        risk: 'write-panel'
+    });
+    steps.push({
+        id: 'sql-role',
+        memberId: p.id,
+        title: 'Primary CREATE ROLE REPLICATION',
+        kind: 'manual',
+        body: renderPostgresPrimarySql(c),
+        risk: 'execute-host'
+    });
+    for (const m of replicas(c)) {
+        const conf = renderPostgresReplicaConf(c, m);
+        const safe = m.host.replace(/[^a-zA-Z0-9._-]/g, '_');
+        files.push({ relativePath: `conf/peers/${safe}-replica.conf`, body: conf });
+        steps.push({
+            id: `conf-replica-${m.id}`,
+            memberId: m.id,
+            title: `Replica conf ${m.host}`,
+            kind: 'conf',
+            body: conf,
+            risk: 'write-panel'
+        });
+        steps.push({
+            id: `basebackup-${m.id}`,
+            memberId: m.id,
+            title: `Replica ${m.host} pg_basebackup`,
+            kind: 'manual',
+            body: renderPostgresBasebackupSh(c),
+            risk: 'execute-host'
+        });
+    }
+    steps.push({
+        id: 'probe',
+        title: tl('notes.auto.n0888'),
+        kind: 'probe',
+        risk: 'read'
+    });
+    if (!replicas(c).length)
+        notes.push(tl('notes.auto.n0034'));
+    return {
+        ok: true,
+        dryRun: true,
+        clusterId: c.id,
+        kind: c.kind,
+        engine: c.engine,
+        steps,
+        files,
+        notes,
+        requiresExecute: true,
+        requiresRoot: true
+    };
+}
+//# sourceMappingURL=plan-postgres-replica.js.map

package/dist/hosting/db-cluster/plan-postgres-replica.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-postgres-replica.js","sourceRoot":"","sources":["../../../src/hosting/db-cluster/plan-postgres-replica.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,SAAS,OAAO,CAAC,CAAY;IAC3B,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAY;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAY;IAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAY;IACpD,OAAO;aACI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI;;;;;;;;;;;;;;CAc3B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAY,EAAE,CAAkB;IACxE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,cAAc,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC7B,OAAO;SACA,CAAC,CAAC,IAAI,cAAc,IAAI;;;;;2BAKN,IAAI,SAAS,IAAI,SAAS,IAAI,wCAAwC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI;6BACrF,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;CAC5E,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAY;IAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,iCAAiC,CAAC,CAAC,IAAI,EAAE;QACzC,EAAE;QACF,WAAW,CAAC,CAAC,EAAE,IAAI;QACnB,cAAc,CAAC,EAAE,IAAI,IAAI,GAAG,EAAE;QAC9B,eAAe,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE;QACjE,kBAAkB,IAAI,IAAI;QAC1B,EAAE;QACF,UAAU;QACV,oCAAoC;QACpC,sDAAsD;QACtD,2BAA2B,IAAI,iCAAiC;QAChE,+BAA+B,IAAI,8BAA8B;QACjE,mEAAmE,IAAI,2BAA2B;QAClG,8CAA8C;QAC9C,EAAE;QACF,YAAY;QACZ,8BAA8B;QAC9B,yCAAyC;QACzC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;cACK,IAAI;;sBAEI,IAAI;;CAEzB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAY;IACrD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;;;WAGE,CAAC,EAAE,IAAI,IAAI,SAAS;QACvB,IAAI;;;;;;;CAOX,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAY;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SAAE,CAAC;IACzB,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,EAAE;YACf,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC/B,eAAe,EAAE,IAAI;YACrB,YAAY,EAAE,IAAI;SAAE,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAyB;QAClC,EAAE,YAAY,EAAE,mCAAmC,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,EAAE;QACzF,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE;QAC1D,EAAE,YAAY,EAAE,+BAA+B,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC,EAAE;QACpF,EAAE,YAAY,EAAE,+BAA+B,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE;KACvF,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,GAAG;QAChC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,aAAa;KAAE,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,cAAc;KAAE,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,cAAc,IAAI,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,gBAAgB,CAAC,CAAC,EAAE,EAAE;YAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,aAAa;SAAE,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,gBAAgB;YACxC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC;YACnC,IAAI,EAAE,cAAc;SAAE,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM;KAAE,CAAC,CAAC;IAElB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,eAAe,EAAE,IAAI;QACrB,YAAY,EAAE,IAAI;KAAE,CAAC;AACzB,CAAC"}