ndev-stack 0.3.11__tar.gz → 0.3.13__tar.gz

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.11
+Version: 0.3.13
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/ndev/__init__.py

@@ -1,7 +1,7 @@
 """
 ndev: Fast, cross-platform PHP developer environment for Windows and Linux.
 """
-__version__ = "0.3.11"
+__version__ = "0.3.13"
 
 from . import common as common
 from .common.logger import logger as logger

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/ndev/linux/commands/doctor.py

@@ -74,6 +74,22 @@ def doctor_cmd():
     else:
         table.add_row("mkcert Local SSL", "[yellow]NOT INSTALLED[/yellow]", "Optional for SSL. Run 'ndev upgrade mkcert' to install.")
 
+    try:
+        from ndev.linux.runtime.nginx_helper import is_selinux_enforcing, is_selinux_httpd_permissive
+        if is_selinux_enforcing():
+            if is_selinux_httpd_permissive():
+                table.add_row("SELinux Web Server Access", "[green]OK[/green]", "Enforcing mode, httpd_t is permissive")
+            else:
+                table.add_row(
+                    "SELinux Web Server Access",
+                    "[yellow]RESTRICTED[/yellow]",
+                    "Enforcing. Nginx cannot access ~/Sites or FastCGI sockets. Run: sudo /usr/sbin/semanage permissive -a httpd_t"
+                )
+        else:
+            table.add_row("SELinux Web Server Access", "[green]OK[/green]", "SELinux is permissive or disabled")
+    except Exception:
+        pass
+
     if NDEV_DIR.exists():
         table.add_row("Layout Directory (~/.ndev)", "[green]OK[/green]", f"Exists at {NDEV_DIR}")
     else:

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/ndev/linux/commands/setup.py

@@ -71,6 +71,12 @@ def setup_cmd():
             except Exception:
                 pass
 
+            try:
+                from ndev.linux.runtime.nginx_helper import ensure_selinux_httpd_permissions
+                ensure_selinux_httpd_permissions()
+            except Exception:
+                pass
+
             console.print("[bold green]MariaDB, Nginx, and Bubblewrap installed and configured successfully![/bold green]\n")
         else:
             # 1. Update Package Lists

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/ndev/linux/commands/vhost.py

@@ -319,6 +319,9 @@ def vhost_cmd(
         get_nginx_vhost_dirs,
         generate_vhost_config,
         ensure_nginx_sites_enabled_included,
+        install_nginx_ssl_cert,
+        ensure_docroot_accessible,
+        ensure_selinux_httpd_permissions,
         add_to_hosts_privileged,
         reload_nginx,
     )
@@ -338,14 +341,26 @@ def vhost_cmd(
     if enabled_dir:
         ensure_nginx_sites_enabled_included()
 
+    # Install SSL certificates into /etc/nginx/ssl for systemd / SELinux compatibility
+    final_cert_path = cert_path
+    final_key_path = key_path
+    if ssl and cert_path and key_path:
+        try:
+            final_cert_path, final_key_path = install_nginx_ssl_cert(domain, cert_path, key_path)
+        except Exception as e:
+            logger.warning(f"Could not install SSL certificate to /etc/nginx/ssl: {e}")
+
+    ensure_docroot_accessible(root_path)
+    ensure_selinux_httpd_permissions()
+
     conf_file = vhost_dir / f"{domain}.conf"
     config_template = generate_vhost_config(
         domain=domain,
-        root=root,
+        root=str(root_path),
         selected_sock=selected_sock,
         ssl=bool(ssl),
-        cert_path=cert_path,
-        key_path=key_path,
+        cert_path=final_cert_path,
+        key_path=final_key_path,
     )
 
     enabled_link = None
@@ -382,8 +397,8 @@ def vhost_cmd(
         if enabled_link:
             console.print(f"Symlink     : {enabled_link}")
         if ssl:
-            console.print(f"SSL Cert    : {cert_path}")
-            console.print(f"SSL Key     : {key_path}")
+            console.print(f"SSL Cert    : {final_cert_path}")
+            console.print(f"SSL Key     : {final_key_path}")
             console.print(f"\nOpen: https://{domain}")
         else:
             console.print(f"\nOpen: http://{domain}")

{ndev_stack-0.3.11 → ndev_stack-0.3.13}/ndev/linux/runtime/nginx_helper.py

@@ -66,6 +66,96 @@ def check_sudo_needs_password() -> bool:
         return True
 
 
+def run_privileged_command(
+    cmd: list[str],
+    password: Optional[str] = None,
+    check: bool = True,
+    timeout: int = 60,
+    capture_output: bool = True
+) -> subprocess.CompletedProcess:
+    """
+    Run a command with elevated privileges using sudo -n if non-root.
+    Validates sudo password first if provided to refresh the sudo credential timestamp.
+    """
+    full_cmd = list(cmd)
+    if os.geteuid() != 0:
+        if password:
+            validate_sudo_password(password)
+        full_cmd = ["sudo", "-n"] + full_cmd
+    return subprocess.run(
+        full_cmd,
+        check=check,
+        timeout=timeout,
+        capture_output=capture_output,
+        text=True
+    )
+
+
+def is_selinux_enforcing() -> bool:
+    """Check if SELinux is present and in Enforcing mode."""
+    enforce_file = Path("/sys/fs/selinux/enforce")
+    if enforce_file.exists():
+        try:
+            return enforce_file.read_text().strip() == "1"
+        except Exception:
+            pass
+    getenforce = shutil.which("getenforce") or "/usr/sbin/getenforce"
+    if Path(getenforce).exists():
+        try:
+            res = subprocess.run([getenforce], capture_output=True, text=True, timeout=2)
+            return res.stdout.strip().lower() == "enforcing"
+        except Exception:
+            pass
+    return False
+
+
+def is_selinux_httpd_permissive() -> bool:
+    """Check if httpd_t is in SELinux permissive types."""
+    if not is_selinux_enforcing():
+        return True
+    seinfo = shutil.which("seinfo") or "/usr/bin/seinfo"
+    if Path(seinfo).exists():
+        try:
+            res = subprocess.run([seinfo, "--permissive"], capture_output=True, text=True, timeout=3)
+            return "httpd_t" in res.stdout
+        except Exception:
+            pass
+    return False
+
+
+def ensure_selinux_httpd_permissions(password: Optional[str] = None) -> bool:
+    """
+    Ensure SELinux allows Nginx (httpd_t) to access user document roots and FastCGI sockets.
+    If SELinux is enforcing and httpd_t is not permissive, add httpd_t to permissive types
+    via semanage and enable relevant SELinux booleans.
+    """
+    if not is_selinux_enforcing() or is_selinux_httpd_permissive():
+        return True
+
+    success = False
+    semanage = shutil.which("semanage") or "/usr/sbin/semanage"
+    if Path(semanage).exists():
+        try:
+            run_privileged_command([semanage, "permissive", "-a", "httpd_t"], password=password, check=False)
+            success = is_selinux_httpd_permissive()
+        except Exception as e:
+            logger.warning(f"Failed to set httpd_t permissive via semanage: {e}")
+
+    # Also enable booleans as supplementary fallback
+    setsebool = shutil.which("setsebool") or "/usr/sbin/setsebool"
+    if Path(setsebool).exists():
+        try:
+            run_privileged_command(
+                [setsebool, "-P", "httpd_read_user_content=1", "httpd_enable_homedirs=1", "httpd_can_network_connect=1"],
+                password=password,
+                check=False
+            )
+        except Exception:
+            pass
+
+    return success or is_selinux_httpd_permissive()
+
+
 def write_privileged_file(target: Path, content: str, password: Optional[str] = None) -> None:
     """
     Write content to a file, using sudo tee if current process lacks permissions.
@@ -426,13 +516,24 @@ server {{
 
 def reload_nginx(password: Optional[str] = None) -> bool:
     """
-    Reload Nginx configuration safely using available init system or nginx CLI.
+    Reload Nginx configuration if active, or start Nginx if stopped.
     """
+    if os.geteuid() != 0 and password:
+        validate_sudo_password(password)
+
     cmd = None
     if shutil.which("systemctl"):
-        cmd = ["systemctl", "reload", "nginx"]
+        res = subprocess.run(["systemctl", "is-active", "--quiet", "nginx"])
+        if res.returncode == 0:
+            cmd = ["systemctl", "reload", "nginx"]
+        else:
+            cmd = ["systemctl", "start", "nginx"]
     elif shutil.which("service"):
-        cmd = ["service", "nginx", "reload"]
+        res = subprocess.run(["service", "nginx", "status"], capture_output=True)
+        if res.returncode == 0:
+            cmd = ["service", "nginx", "reload"]
+        else:
+            cmd = ["service", "nginx", "start"]
     else:
         nginx_bin = which_binary("nginx") or shutil.which("nginx")
         if nginx_bin:
@@ -442,18 +543,102 @@ def reload_nginx(password: Optional[str] = None) -> bool:
         return False
 
     if os.geteuid() != 0:
-        if password:
-            validate_sudo_password(password)
         cmd = ["sudo", "-n"] + cmd
 
     try:
         res = subprocess.run(cmd, capture_output=True, timeout=10)
         return res.returncode == 0
     except Exception as e:
-        logger.warning(f"Could not reload Nginx: {e}")
+        logger.warning(f"Could not reload/start Nginx: {e}")
         return False
 
 
+def install_nginx_ssl_cert(
+    domain: str,
+    src_cert: Path | str,
+    src_key: Path | str,
+    password: Optional[str] = None
+) -> Tuple[Path, Path]:
+    """
+    Install SSL certificate and key into /etc/nginx/ssl/{domain}.* with proper permissions and SELinux label.
+    Fixes 'BIO_new_file() failed (SSL: error:8000000d:system library:BIO_new_file:Permission denied)'
+    caused by systemd ProtectHome and SELinux restricting access to ~/.ndev/certs.
+    Returns (installed_cert_path, installed_key_path).
+    """
+    ssl_dir = Path("/etc/nginx/ssl")
+    dest_cert = ssl_dir / f"{domain}.crt"
+    dest_key = ssl_dir / f"{domain}.key"
+
+    cert_content = Path(src_cert).read_text(encoding="utf-8")
+    key_content = Path(src_key).read_text(encoding="utf-8")
+
+    write_privileged_file(dest_cert, cert_content, password=password)
+    write_privileged_file(dest_key, key_content, password=password)
+
+    if os.geteuid() == 0:
+        try:
+            os.chmod(str(dest_cert), 0o644)
+            os.chmod(str(dest_key), 0o644)
+        except Exception:
+            pass
+    else:
+        try:
+            os.chmod(str(dest_cert), 0o644)
+            os.chmod(str(dest_key), 0o644)
+        except (PermissionError, OSError):
+            subprocess.run(["sudo", "-n", "chmod", "644", str(dest_cert), str(dest_key)], check=False)
+
+    if shutil.which("restorecon"):
+        cmd = ["restorecon", "-Rv", str(ssl_dir)]
+        if os.geteuid() != 0:
+            cmd = ["sudo", "-n"] + cmd
+        try:
+            subprocess.run(cmd, capture_output=True)
+        except Exception:
+            pass
+
+    return dest_cert, dest_key
+
+
+def ensure_docroot_accessible(root_path: Path) -> None:
+    """
+    Ensure the parent directories up to root_path have execute permission (+x)
+    so the nginx worker process (e.g. user nginx) can traverse into document root.
+    """
+    home = Path.home()
+    sudo_user = os.environ.get("SUDO_USER")
+    if sudo_user:
+        try:
+            import pwd
+            home = Path(pwd.getpwnam(sudo_user).pw_dir)
+        except Exception:
+            pass
+
+    try:
+        resolved_root = root_path.resolve()
+        resolved_home = home.resolve()
+
+        # Traverse every directory from root_path up to home and ensure +x (0o001)
+        curr = resolved_root
+        while curr != curr.parent:
+            try:
+                st = curr.stat()
+                if not (st.st_mode & 0o001):
+                    os.chmod(str(curr), st.st_mode | 0o001)
+            except Exception:
+                pass
+            if curr == resolved_home:
+                break
+            curr = curr.parent
+
+        # Also ensure home directory itself has +x
+        st = resolved_home.stat()
+        if not (st.st_mode & 0o001):
+            os.chmod(str(resolved_home), st.st_mode | 0o001)
+    except Exception:
+        pass
+
+
 def list_vhosts() -> List[Dict[str, Any]]:
     """List all configured virtual hosts across all searched Nginx config directories."""
     vhosts = []
@@ -513,8 +698,11 @@ def remove_vhost(domain: str, password: Optional[str] = None) -> bool:
             except Exception as e:
                 logger.warning(f"Could not remove {conf_file}: {e}")
 
-    # Remove optional certificates
+    # Remove system and optional certificates
     for cert_ext in [".crt", ".key"]:
+        sys_cert = Path(f"/etc/nginx/ssl/{clean_domain}{cert_ext}")
+        unlink_privileged(sys_cert, password=password)
+
         cfile = NDEV_DIR / "certs" / f"{clean_domain}{cert_ext}"
         if cfile.exists():
             try: