ysk-server-core 1.0.0

package/dist/hosting/defense/types.d.ts

@@ -0,0 +1,134 @@
+/**
+ * YSK Defense Center — types
+ */
+export type DefensePresetId = 'daily' | 'hardened' | 'under_attack' | 'emergency';
+export type ThreatLevel = 'low' | 'elevated' | 'under_attack' | 'critical';
+export type DefenseActionKind = 'nginx_limits' | 'fail2ban_jails' | 'ufw_hint' | 'protection_mode' | 'note';
+export interface DefenseAction {
+    id: string;
+    kind: DefenseActionKind;
+    title: string;
+    detail: string;
+}
+export interface NginxLimitSpec {
+    /** e.g. 10r/s */
+    reqRate: string;
+    burst: number;
+    /** concurrent connections per IP */
+    connLimit: number;
+}
+export interface DefensePreset {
+    id: DefensePresetId;
+    label: string;
+    short: string;
+    bullets: string[];
+    nginx: NginxLimitSpec;
+    fail2banJails: string[];
+    /** maps to control-plane protection evaluation hint */
+    protectionHint: 'normal' | 'degraded' | 'ddos-protection' | 'offline';
+    danger?: boolean;
+    /** require body.confirm === 'EMERGENCY' */
+    requireConfirm?: string;
+}
+export interface ThreatSignal {
+    id: string;
+    label: string;
+    value: string | number | boolean;
+    points: number;
+    detail?: string;
+}
+export interface BanEntry {
+    ip: string;
+    source: 'fail2ban' | 'panel' | 'ufw' | 'auto';
+    jail?: string;
+    reason?: string;
+    at?: string;
+}
+export type AutoBanMode = 'off' | 'soft' | 'normal' | 'aggressive';
+export type BanMethod = 'fail2ban' | 'ufw' | 'both';
+export interface AutoBanPolicy {
+    enabled: boolean;
+    mode: AutoBanMode;
+    method: BanMethod;
+    /** minutes before same IP can be auto-banned again */
+    cooldownMinutes: number;
+    maxAutoBansPerHour: number;
+    whitelist: string[];
+    /** ISO timestamps of recent auto bans (for circuit breaker) */
+    recentAutoBanAts?: string[];
+    lastTickAt?: string;
+    lastTickNotes?: string[];
+    pausedReason?: string;
+}
+export interface SuspectIp {
+    ip: string;
+    score: number;
+    hits: number;
+    reasons: string[];
+    sources: string[];
+    lastSeen: string;
+    alreadyBanned?: boolean;
+    whitelisted?: boolean;
+}
+export interface StatusLabel {
+    short: string;
+    tone: 'ok' | 'warn' | 'danger' | 'default';
+    detail?: string;
+}
+export interface DefenseStatus {
+    at: string;
+    threatLevel: ThreatLevel;
+    score: number;
+    signals: ThreatSignal[];
+    activePreset: DefensePresetId;
+    presets: Array<Pick<DefensePreset, 'id' | 'label' | 'short' | 'bullets' | 'danger'>>;
+    bans: {
+        count: number;
+        items: BanEntry[];
+    };
+    nginxLimits: NginxLimitSpec & {
+        confPath: string;
+        exists: boolean;
+    };
+    firewall: {
+        active?: string;
+        installed?: boolean;
+    };
+    fail2ban: {
+        active?: string;
+        installed?: boolean;
+        jails?: number;
+    };
+    /** Human-readable strip labels (UI should prefer these) */
+    labels: {
+        firewall: StatusLabel;
+        fail2ban: StatusLabel;
+        apply: StatusLabel;
+        autoBan: StatusLabel;
+    };
+    autoBan: AutoBanPolicy & {
+        autoBansLastHour: number;
+    };
+    protectionMode?: string;
+    executeEnabled: boolean;
+    isRoot: boolean;
+    suggestions: Array<{
+        id: string;
+        title: string;
+        body: string;
+        action?: string;
+    }>;
+    notes: string[];
+}
+export interface DefenseApplyResult {
+    ok: boolean;
+    blocked?: boolean;
+    applied: boolean;
+    written: string[];
+    actions: DefenseAction[];
+    notes: string[];
+    preset: DefensePresetId;
+    requiresExecute?: boolean;
+    requiresRoot?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/hosting/defense/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;AAElF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,cAAc,GAAG,UAAU,CAAC;AAE3E,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,gBAAgB,GAChB,UAAU,GACV,iBAAiB,GACjB,MAAM,CAAC;AAEX,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,eAAe,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uDAAuD;IACvD,cAAc,EAAE,QAAQ,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACtE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AACnE,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC;IACrF,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAC;IAC3C,WAAW,EAAE,cAAc,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACpE,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,2DAA2D;IAC3D,MAAM,EAAE;QACN,QAAQ,EAAE,WAAW,CAAC;QACtB,QAAQ,EAAE,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW,CAAC;QACnB,OAAO,EAAE,WAAW,CAAC;KACtB,CAAC;IACF,OAAO,EAAE,aAAa,GAAG;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}

package/dist/hosting/defense/types.js

@@ -0,0 +1,5 @@
+/**
+ * YSK Defense Center — types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/hosting/defense/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/defense/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/hosting/dns-cluster.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Optional DNS cluster: peer list + scp zone files + remote nameserver reload/probe.
+ * Honesty: scp written ≠ reloaded; reload ok only when remote command succeeds.
+ */
+import type { JsonStore } from '../db/store.js';
+import type { HostExecutor } from '../host/executor.js';
+import type { ApplyStatus } from 'ysk-server-shared';
+export type DnsClusterPeer = {
+    id: string;
+    host: string;
+    port: number;
+    username: string;
+    /** remote path for zone files */
+    path: string;
+    label?: string;
+    /** optional SSH identity id under dataDir (BatchMode key) */
+    sshIdentityId?: string;
+    createdAt: string;
+    /** last probe snapshot (control-plane memory) */
+    lastProbe?: DnsPeerProbeResult;
+};
+export type DnsPeerProbeResult = {
+    at: string;
+    ok: boolean;
+    /** active unit if detected: named | bind9 | pdns | none */
+    service?: string;
+    zoneDirOk?: boolean;
+    notes: string[];
+    latencyMs?: number;
+};
+export type DnsPeerActionResult = {
+    peerId: string;
+    host: string;
+    label?: string;
+    scpOk?: boolean;
+    filesOk?: number;
+    filesFail?: number;
+    reloaded?: boolean;
+    reloadMethod?: string;
+    probe?: DnsPeerProbeResult;
+    notes: string[];
+    apply_status: ApplyStatus;
+};
+export type DnsClusterOpResult = {
+    ok: boolean;
+    apply_status: ApplyStatus;
+    blocked?: boolean;
+    requiresExecute?: boolean;
+    notes: string[];
+    peers: DnsPeerActionResult[];
+};
+export declare function listDnsClusterPeers(db: JsonStore): DnsClusterPeer[];
+export declare function upsertDnsClusterPeer(db: JsonStore, input: Partial<DnsClusterPeer> & {
+    host: string;
+    username: string;
+}): DnsClusterPeer;
+export declare function deleteDnsClusterPeer(db: JsonStore, id: string): boolean;
+/** Prefix remote reload with peer zone path → dataDir guess. */
+export declare function remoteReloadScriptForPeer(peerZonePath: string): string;
+/**
+ * Probe one peer over SSH (nameserver unit + zone dir).
+ */
+export declare function probeDnsClusterPeer(input: {
+    host: HostExecutor;
+    peer: DnsClusterPeer;
+    dataDir?: string;
+    db?: JsonStore;
+}): Promise<DnsPeerProbeResult>;
+/**
+ * Probe all (or one) registered peers.
+ */
+export declare function probeDnsClusterPeers(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir?: string;
+    peerId?: string;
+}): Promise<DnsClusterOpResult>;
+/**
+ * Reload nameserver on peer(s) via SSH (rndc / systemctl).
+ */
+export declare function reloadDnsClusterPeers(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir?: string;
+    peerId?: string;
+}): Promise<DnsClusterOpResult>;
+/**
+ * Push managed zone files to peers via scp; optionally remote reload after scp.
+ */
+export declare function pushDnsZonesToCluster(input: {
+    db: JsonStore;
+    host: HostExecutor;
+    dataDir: string;
+    peerId?: string;
+    /** default true (PR-D2): attempt remote reload after successful scp */
+    reload?: boolean;
+    /** after reload, run probe (default false) */
+    probeAfter?: boolean;
+}): Promise<DnsClusterOpResult>;
+//# sourceMappingURL=dns-cluster.d.ts.map

package/dist/hosting/dns-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-cluster.d.ts","sourceRoot":"","sources":["../../src/hosting/dns-cluster.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,EAAE,CAMnE;AAOD,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClE,cAAc,CAiBhB;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAKvE;AA4JD,gEAAgE;AAChE,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAStE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoD9B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkD9B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmE9B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyM9B"}