ysk-server-core 1.0.0

package/dist/hosting/postgres-provision.js

@@ -0,0 +1,166 @@
+/**
+ * PostgreSQL provision via psql when available.
+ * Never reports ok=true for skipped system mutations.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { probeEndpoint } from './db-client.js';
+import { binPresent } from './software-probe/index.js';
+function assertIdent(value, field) {
+    if (!/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/.test(value)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.fieldInvalid', { field, value }), { httpStatus: 400 });
+    }
+}
+/**
+ * Render SQL for role + database (password embedded only when executing).
+ */
+export function renderPostgresProvisionSql(input) {
+    assertIdent(input.dbName, 'dbName');
+    assertIdent(input.username, 'username');
+    // Use dollar-quoting for password safety in simple scripts
+    const pass = input.password.replace(/'/g, "''");
+    return [
+        `DO $$ BEGIN CREATE ROLE ${input.username} LOGIN PASSWORD '${pass}'; EXCEPTION WHEN duplicate_object THEN NULL; END $$;`,
+        `SELECT 'CREATE DATABASE ${input.dbName} OWNER ${input.username}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${input.dbName}')\\gexec`,
+        `GRANT ALL PRIVILEGES ON DATABASE ${input.dbName} TO ${input.username};`,
+    ];
+}
+/**
+ * Provision PG database + role.
+ * Without EXECUTE or psql: ok=false + SQL plan.
+ * With EXECUTE + psql: runs via `psql -v ON_ERROR_STOP=1 -c` / multi-step.
+ */
+export async function provisionPostgresDatabase(input) {
+    assertIdent(input.dbName, 'dbName');
+    assertIdent(input.username, 'username');
+    if (!input.password || input.password.length < 8) {
+        return {
+            ok: false,
+            executed: false,
+            requiresExecute: true,
+            psqlClient: false,
+            reachable: false,
+            sql: [],
+            connectionHint: {},
+            notes: ['password required (min 8 chars)'],
+            commandResults: []
+        };
+    }
+    const host = input.host ?? '127.0.0.1';
+    const port = input.port ?? 5432;
+    const sql = renderPostgresProvisionSql({
+        dbName: input.dbName,
+        username: input.username,
+        password: input.password
+    });
+    const connectionHint = {
+        database: input.dbName,
+        user: input.username,
+        host,
+        port
+    };
+    const notes = [];
+    const commandResults = [];
+    const reach = await probeEndpoint(host, port, 2000);
+    const reachable = reach.ok;
+    notes.push(reachable
+        ? `TCP ${host}:${port} ok (${reach.latencyMs}ms)`
+        : `TCP ${host}:${port} fail: ${reach.detail}`);
+    const psqlClient = await binPresent(input.hostExec, 'psql');
+    if (!psqlClient)
+        notes.push(tl('notes.auto.n0522'));
+    if (!input.hostExec.executeEnabled()) {
+        notes.push(tl('ops.blocked.needExecute'));
+    }
+    const want = input.execute === true;
+    const can = want && input.hostExec.executeEnabled() && psqlClient && reachable;
+    const safeSql = sql.map((s) => s.replace(input.password, '***'));
+    if (!want) {
+        return {
+            ok: true,
+            dryRun: true,
+            executed: false,
+            requiresExecute: !input.hostExec.executeEnabled(),
+            psqlClient,
+            reachable,
+            sql: safeSql,
+            connectionHint,
+            notes: [
+                ...notes,
+                tl('notes.db.dryRunMysql'),
+            ],
+            commandResults: []
+        };
+    }
+    if (!can) {
+        return {
+            ok: false,
+            executed: false,
+            blocked: !input.hostExec.executeEnabled(),
+            requiresExecute: !input.hostExec.executeEnabled(),
+            psqlClient,
+            reachable,
+            sql: safeSql,
+            connectionHint,
+            notes: [
+                ...notes,
+                tl('notes.auto.n1450'),
+            ],
+            commandResults: []
+        };
+    }
+    const adminDb = input.adminDb ?? 'postgres';
+    // Simpler portable SQL without \gexec
+    const statements = [
+        `CREATE USER ${input.username} WITH PASSWORD '${input.password.replace(/'/g, "''")}';`,
+        `CREATE DATABASE ${input.dbName} OWNER ${input.username};`,
+    ];
+    for (const stmt of statements) {
+        const r = await input.hostExec.runCommand([
+            'psql',
+            '-h',
+            host,
+            '-p',
+            String(port),
+            '-d',
+            adminDb,
+            '-v',
+            'ON_ERROR_STOP=0',
+            '-c',
+            stmt,
+        ], { timeoutMs: 30_000 });
+        commandResults.push({
+            argv: ['psql', '-c', '(redacted)'],
+            exitCode: r.exitCode,
+            stderr: r.stderr
+        });
+        // accept already-exists as soft success
+        const already = /already exists/i.test(r.stderr) || /already exists/i.test(r.stdout);
+        if (r.exitCode !== 0 && !already) {
+            notes.push(tl('notes.tpl.psqlFailed', { detail: r.stderr || r.stdout }));
+            return {
+                ok: false,
+                executed: true,
+                requiresExecute: false,
+                psqlClient: true,
+                reachable: true,
+                sql: sql.map((s) => s.replace(input.password, '***')),
+                connectionHint,
+                notes,
+                commandResults
+            };
+        }
+        notes.push(already ? `ok (already exists): ${stmt.slice(0, 40)}…` : `ok: ${stmt.slice(0, 40)}…`);
+    }
+    return {
+        ok: true,
+        executed: true,
+        requiresExecute: false,
+        psqlClient: true,
+        reachable: true,
+        sql: sql.map((s) => s.replace(input.password, '***')),
+        connectionHint,
+        notes: [...notes, 'PostgreSQL provision executed'],
+        commandResults
+    };
+}
+//# sourceMappingURL=postgres-provision.js.map

package/dist/hosting/postgres-provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-provision.js","sourceRoot":"","sources":["../../src/hosting/postgres-provision.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAiBvD,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,2DAA2D;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,2BAA2B,KAAK,CAAC,QAAQ,oBAAoB,IAAI,uDAAuD;QACxH,2BAA2B,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,QAAQ,gEAAgE,KAAK,CAAC,MAAM,WAAW;QACtJ,oCAAoC,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAAG;KACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAU/C;IACC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,KAAK,EAAE,CAAC,iCAAiC,CAAC;YAC1C,cAAc,EAAE,EAAE;SAAE,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,0BAA0B,CAAC;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KAAE,CAAC,CAAC;IAC9B,MAAM,cAAc,GAAG;QACrB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI;QACJ,IAAI;KAAE,CAAC;IACT,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,cAAc,GAA8C,EAAE,CAAC;IAErE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,SAAS;QACP,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC,SAAS,KAAK;QACjD,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,CAChD,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,UAAU,IAAI,SAAS,CAAC;IAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;YACjD,UAAU;YACV,SAAS;YACT,GAAG,EAAE,OAAO;YACZ,cAAc;YACd,KAAK,EAAE;gBACL,GAAG,KAAK;gBACR,EAAE,CAAC,sBAAsB,CAAC;aAC3B;YACD,cAAc,EAAE,EAAE;SAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;YACzC,eAAe,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;YACjD,UAAU;YACV,SAAS;YACT,GAAG,EAAE,OAAO;YACZ,cAAc;YACd,KAAK,EAAE;gBACL,GAAG,KAAK;gBACR,EAAE,CAAC,kBAAkB,CAAC;aACvB;YACD,cAAc,EAAE,EAAE;SAAE,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC;IAC5C,sCAAsC;IACtC,MAAM,UAAU,GAAG;QACjB,eAAe,KAAK,CAAC,QAAQ,mBAAmB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;QACtF,mBAAmB,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,QAAQ,GAAG;KAC3D,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CACvC;YACE,MAAM;YACN,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,MAAM,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,iBAAiB;YACjB,IAAI;YACJ,IAAI;SACL,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;SAAE,CAAC,CAAC;QACtB,wCAAwC;QACxC,MAAM,OAAO,GACX,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACzE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE,KAAK;gBACtB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACrD,cAAc;gBACd,KAAK;gBACL,cAAc;aAAE,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACnG,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,IAAI;QACd,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,cAAc;QACd,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,+BAA+B,CAAC;QAClD,cAAc;KAAE,CAAC;AACrB,CAAC"}

package/dist/hosting/powerdns-apply.d.ts

@@ -0,0 +1,215 @@
+/**
+ * PowerDNS dual-mode: probe tools + load managed BIND zone files.
+ *
+ * Public product rules:
+ * - Zone set is always **dataDir/dns/zones/*.zone** (any customer domain) — never hard-coded.
+ * - Paths under /etc/powerdns and /var/lib/powerdns are **distro defaults** (Debian/Ubuntu),
+ *   overridable only by platform layout, not by a single host identity.
+ * - dataDir itself is always the panel config (`--data-dir` / config.json).
+ *
+ * Ubuntu packages use **pdns-backend-bind**: zones come from named.conf, not from
+ * writing `dataDir/dns/zones/*.zone` alone. dig REFUSED + "Parsing 0 domain(s)"
+ * means the zone file exists but was never registered / rediscovered.
+ *
+ * Load path (honest):
+ *   1. Write managed zone file under dataDir
+ *   2. Sync BIND named.conf include with all managed zones
+ *   3. pdns_control rediscover|reload (or systemctl reload pdns)
+ *   4. Optional pdnsutil load-zone for non-bind backends
+ *
+ * Never fakes success — system apply needs YSK_EXECUTE + root.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import { listManagedDnsZones } from './dns-zone.js';
+export interface PowerDnsProbe {
+    pdnsutil?: string;
+    pdnsControl?: string;
+    pdnsServer?: string;
+    available: boolean;
+    notes: string[];
+}
+export interface PowerDnsLoadResult {
+    ok: boolean;
+    zone: string;
+    zonePath: string;
+    mode: 'plan' | 'loaded' | 'refused';
+    notes: string[];
+    written: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    probe: PowerDnsProbe;
+    /** How the zone was registered into PowerDNS (if loaded) */
+    loadMethod?: 'bind-named' | 'pdnsutil' | 'none';
+}
+export interface PowerDnsBindSyncResult {
+    ok: boolean;
+    mode: 'plan' | 'loaded' | 'refused';
+    zones: string[];
+    /** Zones confirmed via pdns_control list-zones after apply */
+    listedZones?: string[];
+    zonesConfPath: string;
+    notes: string[];
+    written: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+}
+/** Runtime dir for copies readable by pdns user (avoid world-chmod on dataDir). */
+export declare const POWERDNS_RUNTIME_ZONES_DIR = "/var/lib/powerdns/zones";
+/** Path PowerDNS bindbackend should read for a managed zone name. */
+export declare function powerDnsRuntimeZonePath(zone: string): string;
+/** Render BIND-style zone stanzas for PowerDNS bindbackend. */
+export declare function renderPowerDnsNamedZonesConf(zones: Array<{
+    zone: string;
+    zonePath: string;
+}>, opts?: {
+    runtimePaths?: boolean;
+}): string;
+/**
+ * Bash: copy zone files for pdns user, install named include, rediscover.
+ * Safe to re-run. Does not world-chmod dataDir; uses /var/lib/powerdns/zones.
+ */
+export declare function installPowerDnsBindZonesShell(input: {
+    /** Managed zone sources under dataDir */
+    zones: Array<{
+        zone: string;
+        zonePath: string;
+    }>;
+    /** Absolute path written under dataDir for operators (plan copy) */
+    dataDirZonesConf: string;
+    /** Panel dataDir — only used for parent +x so operators can traverse; not a+r tree */
+    dataDir: string;
+}): string;
+/** Parse list-zones block from sync shell stdout. */
+export declare function parsePdnsListZonesOutput(out: string): string[];
+/**
+ * Write managed named-zones.conf (dataDir + system) and rediscover PowerDNS BIND backend.
+ * This is the fix for: zone file on disk + pdns listening but dig REFUSED (0 domains).
+ */
+export declare function syncPowerDnsBindZones(input: {
+    dataDir: string;
+    host: HostExecutor;
+    /** When true, write system named.conf include + rediscover (needs root+EXECUTE) */
+    apply?: boolean;
+}): Promise<PowerDnsBindSyncResult>;
+/**
+ * Single entry for register/load managed zones into the local nameserver.
+ * Prefer this from apply / heal / delete / zone-file so scripts do not drift.
+ */
+export declare function registerManagedDnsWithNameserver(input: {
+    dataDir: string;
+    host: HostExecutor;
+    apply?: boolean;
+}): Promise<PowerDnsBindSyncResult>;
+export type PowerDnsBackendKind = 'bind' | 'pdnsutil' | 'unknown';
+/** Read launch= from pdns conf to pick load strategy. */
+export declare function detectPowerDnsBackend(host: HostExecutor): Promise<{
+    kind: PowerDnsBackendKind;
+    launch?: string;
+    notes: string[];
+}>;
+/**
+ * Detect PowerDNS CLI tools on PATH.
+ */
+export declare function probePowerDns(host: HostExecutor): Promise<PowerDnsProbe>;
+/**
+ * Ensure managed zone file exists, then optionally load into PowerDNS.
+ *
+ * Preferred for Ubuntu bind backend (pdns-backend-bind):
+ *   sync named.conf include + pdns_control rediscover
+ * Fallback:
+ *   pdnsutil load-zone <zone> <zonefile>
+ */
+export declare function applyPowerDnsZone(input: {
+    dataDir: string;
+    host: HostExecutor;
+    zone: string;
+    serverIp: string;
+    /** Optional public IPv6 for dual-stack zone */
+    serverIpv6?: string;
+    mailHost?: string;
+    /** When true, register zone into PowerDNS (needs EXECUTE + root for bind path) */
+    load?: boolean;
+    /** Rewrite zone file first (default true) */
+    rewriteZone?: boolean;
+}): Promise<PowerDnsLoadResult>;
+/**
+ * List managed zones with PowerDNS probe (for UI status).
+ */
+export declare function powerDnsStatus(input: {
+    dataDir: string;
+    host: HostExecutor;
+}): Promise<{
+    probe: PowerDnsProbe;
+    zones: ReturnType<typeof listManagedDnsZones>;
+}>;
+export interface PowerDnsInstallResult {
+    ok: boolean;
+    notes: string[];
+    written: string[];
+    commands: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    probe: PowerDnsProbe;
+}
+/**
+ * Bash: set local-address via pdns.d drop-in (public IPv4 only).
+ * Avoids 0.0.0.0:53 which conflicts with systemd-resolved on 127.0.0.53/54:53.
+ * Override with env YSK_PDNS_LOCAL_ADDRESS=x.x.x.x
+ */
+export declare function configurePdnsLocalAddressShell(): string;
+export type PowerDnsHealResult = {
+    ok: boolean;
+    localAddress?: string;
+    notes: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    unitActive?: boolean;
+    listenUdp53?: boolean;
+};
+/**
+ * Fix PowerDNS crash-loop: bind only public IPv4 instead of 0.0.0.0:53
+ * (conflicts with systemd-resolved on 127.0.0.53/54).
+ */
+export declare function healPowerDnsListener(input: {
+    host: HostExecutor;
+    /** Override bind address (default: detect public IPv4) */
+    localAddress?: string;
+    /** dataDir for re-registering managed zones after listener heal (optional) */
+    dataDir?: string;
+    /** Re-sync BIND named.conf after heal (default true when dataDir set) */
+    resyncZones?: boolean;
+}): Promise<PowerDnsHealResult>;
+/**
+ * Write PowerDNS install helper under dataDir; optional apt install when root+EXECUTE.
+ * After install, configures local-address to public IP (systemd-resolved safe).
+ * Never fakes success when install was requested but skipped/failed.
+ */
+export declare function installPowerDnsPackages(input: {
+    dataDir: string;
+    host: HostExecutor;
+    /** When true, run apt install (needs root + YSK_EXECUTE) */
+    install?: boolean;
+    /** Preferred bind IP for authoritative DNS */
+    localAddress?: string;
+}): Promise<PowerDnsInstallResult>;
+//# sourceMappingURL=powerdns-apply.d.ts.map

package/dist/hosting/powerdns-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"powerdns-apply.d.ts","sourceRoot":"","sources":["../../src/hosting/powerdns-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAuB,MAAM,eAAe,CAAC;AAGzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;IACrB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,+DAA+D;AAC/D,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,EAChD,IAAI,CAAC,EAAE;IAAsE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACpG,MAAM,CAiBR;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,yCAAyC;IACzC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAiFT;AAED,qDAAqD;AACrD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAoB9D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0GlC;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAElC;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE,yDAAyD;AACzD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACvE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CA0BD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAuB9E;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+Q9B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;CAAE,CAAC,CAGnF;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAwCvD;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,YAAY,CAAC;IACnB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgG9B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2EjC"}