ndev-stack 0.3.11__tar.gz → 0.3.12__tar.gz

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.11
+Version: 0.3.12
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/ndev/__init__.py

@@ -1,7 +1,7 @@
 """
 ndev: Fast, cross-platform PHP developer environment for Windows and Linux.
 """
-__version__ = "0.3.11"
+__version__ = "0.3.12"
 
 from . import common as common
 from .common.logger import logger as logger

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/ndev/linux/commands/vhost.py

@@ -319,6 +319,8 @@ def vhost_cmd(
         get_nginx_vhost_dirs,
         generate_vhost_config,
         ensure_nginx_sites_enabled_included,
+        install_nginx_ssl_cert,
+        ensure_docroot_accessible,
         add_to_hosts_privileged,
         reload_nginx,
     )
@@ -338,14 +340,25 @@ def vhost_cmd(
     if enabled_dir:
         ensure_nginx_sites_enabled_included()
 
+    # Install SSL certificates into /etc/nginx/ssl for systemd / SELinux compatibility
+    final_cert_path = cert_path
+    final_key_path = key_path
+    if ssl and cert_path and key_path:
+        try:
+            final_cert_path, final_key_path = install_nginx_ssl_cert(domain, cert_path, key_path)
+        except Exception as e:
+            logger.warning(f"Could not install SSL certificate to /etc/nginx/ssl: {e}")
+
+    ensure_docroot_accessible(root_path)
+
     conf_file = vhost_dir / f"{domain}.conf"
     config_template = generate_vhost_config(
         domain=domain,
-        root=root,
+        root=str(root_path),
         selected_sock=selected_sock,
         ssl=bool(ssl),
-        cert_path=cert_path,
-        key_path=key_path,
+        cert_path=final_cert_path,
+        key_path=final_key_path,
     )
 
     enabled_link = None
@@ -382,8 +395,8 @@ def vhost_cmd(
         if enabled_link:
             console.print(f"Symlink     : {enabled_link}")
         if ssl:
-            console.print(f"SSL Cert    : {cert_path}")
-            console.print(f"SSL Key     : {key_path}")
+            console.print(f"SSL Cert    : {final_cert_path}")
+            console.print(f"SSL Key     : {final_key_path}")
             console.print(f"\nOpen: https://{domain}")
         else:
             console.print(f"\nOpen: http://{domain}")

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/ndev/linux/runtime/nginx_helper.py

@@ -426,13 +426,24 @@ server {{
 
 def reload_nginx(password: Optional[str] = None) -> bool:
     """
-    Reload Nginx configuration safely using available init system or nginx CLI.
+    Reload Nginx configuration if active, or start Nginx if stopped.
     """
+    if os.geteuid() != 0 and password:
+        validate_sudo_password(password)
+
     cmd = None
     if shutil.which("systemctl"):
-        cmd = ["systemctl", "reload", "nginx"]
+        res = subprocess.run(["systemctl", "is-active", "--quiet", "nginx"])
+        if res.returncode == 0:
+            cmd = ["systemctl", "reload", "nginx"]
+        else:
+            cmd = ["systemctl", "start", "nginx"]
     elif shutil.which("service"):
-        cmd = ["service", "nginx", "reload"]
+        res = subprocess.run(["service", "nginx", "status"], capture_output=True)
+        if res.returncode == 0:
+            cmd = ["service", "nginx", "reload"]
+        else:
+            cmd = ["service", "nginx", "start"]
     else:
         nginx_bin = which_binary("nginx") or shutil.which("nginx")
         if nginx_bin:
@@ -442,18 +453,88 @@ def reload_nginx(password: Optional[str] = None) -> bool:
         return False
 
     if os.geteuid() != 0:
-        if password:
-            validate_sudo_password(password)
         cmd = ["sudo", "-n"] + cmd
 
     try:
         res = subprocess.run(cmd, capture_output=True, timeout=10)
         return res.returncode == 0
     except Exception as e:
-        logger.warning(f"Could not reload Nginx: {e}")
+        logger.warning(f"Could not reload/start Nginx: {e}")
         return False
 
 
+def install_nginx_ssl_cert(
+    domain: str,
+    src_cert: Path | str,
+    src_key: Path | str,
+    password: Optional[str] = None
+) -> Tuple[Path, Path]:
+    """
+    Install SSL certificate and key into /etc/nginx/ssl/{domain}.* with proper permissions and SELinux label.
+    Fixes 'BIO_new_file() failed (SSL: error:8000000d:system library:BIO_new_file:Permission denied)'
+    caused by systemd ProtectHome and SELinux restricting access to ~/.ndev/certs.
+    Returns (installed_cert_path, installed_key_path).
+    """
+    ssl_dir = Path("/etc/nginx/ssl")
+    dest_cert = ssl_dir / f"{domain}.crt"
+    dest_key = ssl_dir / f"{domain}.key"
+
+    cert_content = Path(src_cert).read_text(encoding="utf-8")
+    key_content = Path(src_key).read_text(encoding="utf-8")
+
+    write_privileged_file(dest_cert, cert_content, password=password)
+    write_privileged_file(dest_key, key_content, password=password)
+
+    if os.geteuid() == 0:
+        try:
+            os.chmod(str(dest_cert), 0o644)
+            os.chmod(str(dest_key), 0o644)
+        except Exception:
+            pass
+    else:
+        try:
+            os.chmod(str(dest_cert), 0o644)
+            os.chmod(str(dest_key), 0o644)
+        except (PermissionError, OSError):
+            subprocess.run(["sudo", "-n", "chmod", "644", str(dest_cert), str(dest_key)], check=False)
+
+    if shutil.which("restorecon"):
+        cmd = ["restorecon", "-Rv", str(ssl_dir)]
+        if os.geteuid() != 0:
+            cmd = ["sudo", "-n"] + cmd
+        try:
+            subprocess.run(cmd, capture_output=True)
+        except Exception:
+            pass
+
+    return dest_cert, dest_key
+
+
+def ensure_docroot_accessible(root_path: Path) -> None:
+    """
+    Ensure the parent directories up to root_path have execute permission (+x)
+    so the nginx worker process (e.g. user nginx) can traverse into document root.
+    """
+    home = Path.home()
+    sudo_user = os.environ.get("SUDO_USER")
+    if sudo_user:
+        try:
+            import pwd
+            home = Path(pwd.getpwnam(sudo_user).pw_dir)
+        except Exception:
+            pass
+
+    try:
+        resolved_root = root_path.resolve()
+        resolved_home = home.resolve()
+        if resolved_root == resolved_home or resolved_root.is_relative_to(resolved_home):
+            st = home.stat()
+            if not (st.st_mode & 0o001):
+                os.chmod(str(home), st.st_mode | 0o001)
+    except Exception:
+        pass
+
+
 def list_vhosts() -> List[Dict[str, Any]]:
     """List all configured virtual hosts across all searched Nginx config directories."""
     vhosts = []
@@ -513,8 +594,11 @@ def remove_vhost(domain: str, password: Optional[str] = None) -> bool:
             except Exception as e:
                 logger.warning(f"Could not remove {conf_file}: {e}")
 
-    # Remove optional certificates
+    # Remove system and optional certificates
     for cert_ext in [".crt", ".key"]:
+        sys_cert = Path(f"/etc/nginx/ssl/{clean_domain}{cert_ext}")
+        unlink_privileged(sys_cert, password=password)
+
         cfile = NDEV_DIR / "certs" / f"{clean_domain}{cert_ext}"
         if cfile.exists():
             try:

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/ndev/linux/tui.py

@@ -1203,6 +1203,8 @@ class NdevDashboard(App):
                 get_nginx_vhost_dirs,
                 generate_vhost_config,
                 ensure_nginx_sites_enabled_included,
+                install_nginx_ssl_cert,
+                ensure_docroot_accessible,
                 write_privileged_file,
                 symlink_privileged,
                 add_to_hosts_privileged,
@@ -1220,6 +1222,18 @@ class NdevDashboard(App):
             if ssl:
                 cert_path, key_path = generate_local_cert(domain, cert_dir)
 
+            final_cert_path = cert_path
+            final_key_path = key_path
+            if ssl and cert_path and key_path:
+                try:
+                    final_cert_path, final_key_path = install_nginx_ssl_cert(
+                        domain, cert_path, key_path, password=password
+                    )
+                except Exception as e:
+                    logger.warning(f"Could not install SSL certificate into /etc/nginx/ssl: {e}")
+
+            ensure_docroot_accessible(Path(root))
+
             mm = php_ver.replace(".", "")[:2] if "." in php_ver else php_ver
             selected_sock = NDEV_DIR / "run" / f"php{mm}.sock"
 
@@ -1228,8 +1242,8 @@ class NdevDashboard(App):
                 root=root,
                 selected_sock=selected_sock,
                 ssl=bool(ssl),
-                cert_path=cert_path,
-                key_path=key_path,
+                cert_path=final_cert_path,
+                key_path=final_key_path,
             )
             write_privileged_file(conf_file, tpl, password=password)
             if enabled_dir and enabled_dir != vhost_dir:

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/ndev_stack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.11
+Version: 0.3.12
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ndev-stack"
-version = "0.3.11"
+version = "0.3.12"
 description = "Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows"
 readme = "README.md"
 requires-python = ">=3.10"

{ndev_stack-0.3.11 → ndev_stack-0.3.12}/tests/test_opensuse_compat.py

@@ -255,6 +255,27 @@ class TestNginxHelper(unittest.TestCase):
                 mock_run.return_value = unittest.mock.MagicMock(returncode=1)
                 self.assertTrue(nginx_helper.check_sudo_needs_password())
 
+    def test_install_nginx_ssl_cert(self):
+        src_cert = self.test_dir / "src.crt"
+        src_key = self.test_dir / "src.key"
+        src_cert.write_text("CERT_CONTENT")
+        src_key.write_text("KEY_CONTENT")
+
+        fake_ssl_dir = self.test_dir / "nginx_ssl"
+        with patch("ndev.linux.runtime.nginx_helper.Path") as mock_path:
+            def fake_p(p):
+                if str(p) == "/etc/nginx/ssl":
+                    return fake_ssl_dir
+                return Path(p)
+            mock_path.side_effect = fake_p
+
+            with patch("os.geteuid", return_value=0):
+                dest_cert, dest_key = nginx_helper.install_nginx_ssl_cert("sample.local", src_cert, src_key)
+                self.assertTrue(dest_cert.exists())
+                self.assertTrue(dest_key.exists())
+                self.assertEqual(dest_cert.read_text(), "CERT_CONTENT")
+                self.assertEqual(dest_key.read_text(), "KEY_CONTENT")
+
     def test_fastcgi_snippet_opensuse(self):
         with patch.object(Path, "exists", autospec=True) as mock_exists:
             def side_effect_exists(p):