ndev-stack 0.3.12__tar.gz → 0.3.14__tar.gz

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.12
+Version: 0.3.14
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/ndev/__init__.py

@@ -1,7 +1,7 @@
 """
 ndev: Fast, cross-platform PHP developer environment for Windows and Linux.
 """
-__version__ = "0.3.12"
+__version__ = "0.3.14"
 
 from . import common as common
 from .common.logger import logger as logger

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/ndev/linux/commands/doctor.py

@@ -74,6 +74,22 @@ def doctor_cmd():
     else:
         table.add_row("mkcert Local SSL", "[yellow]NOT INSTALLED[/yellow]", "Optional for SSL. Run 'ndev upgrade mkcert' to install.")
 
+    try:
+        from ndev.linux.runtime.nginx_helper import is_selinux_enforcing, is_selinux_httpd_permissive
+        if is_selinux_enforcing():
+            if is_selinux_httpd_permissive():
+                table.add_row("SELinux Web Server Access", "[green]OK[/green]", "Enforcing mode, httpd_t is permissive")
+            else:
+                table.add_row(
+                    "SELinux Web Server Access",
+                    "[yellow]RESTRICTED[/yellow]",
+                    "Enforcing. Nginx cannot access ~/Sites or FastCGI sockets. Run: sudo /usr/sbin/semanage permissive -a httpd_t"
+                )
+        else:
+            table.add_row("SELinux Web Server Access", "[green]OK[/green]", "SELinux is permissive or disabled")
+    except Exception:
+        pass
+
     if NDEV_DIR.exists():
         table.add_row("Layout Directory (~/.ndev)", "[green]OK[/green]", f"Exists at {NDEV_DIR}")
     else:

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/ndev/linux/commands/setup.py

@@ -51,9 +51,9 @@ def setup_cmd():
             console.print("[bold yellow]Refreshing openSUSE repositories (sudo zypper refresh)...[/bold yellow]")
             subprocess.run(["sudo", "zypper", "--non-interactive", "refresh"], check=True)
             
-            # 2. Install MariaDB, Nginx, curl, and Bubblewrap
-            console.print("\n[bold yellow]Installing MariaDB, Nginx, curl, and Bubblewrap (sudo zypper install)...[/bold yellow]")
-            packages = ["mariadb", "mariadb-client", "nginx", "curl", "bubblewrap"]
+            # 2. Install MariaDB, Nginx, curl, Bubblewrap, and SELinux tools
+            console.print("\n[bold yellow]Installing MariaDB, Nginx, curl, Bubblewrap, and system tools (sudo zypper install)...[/bold yellow]")
+            packages = ["mariadb", "mariadb-client", "nginx", "curl", "bubblewrap", "policycoreutils-python-utils"]
             subprocess.run(["sudo", "zypper", "--non-interactive", "install", "-y"] + packages, check=True)
 
             # Optional mkcert package
@@ -65,21 +65,16 @@ def setup_cmd():
             except Exception:
                 pass
 
-            try:
-                subprocess.run(["sudo", "systemctl", "enable", "--now", "mariadb"], check=False, capture_output=True)
-                subprocess.run(["sudo", "systemctl", "enable", "--now", "nginx"], check=False, capture_output=True)
-            except Exception:
-                pass
-
-            console.print("[bold green]MariaDB, Nginx, and Bubblewrap installed and configured successfully![/bold green]\n")
+            console.print("[bold green]System packages installed successfully![/bold green]\n")
         else:
             # 1. Update Package Lists
             console.print("[bold yellow]Updating package lists (sudo apt-get update)...[/bold yellow]")
             subprocess.run(["sudo", "apt-get", "update"], check=True)
             
             # 2. Install MariaDB and Nginx
-            console.print("\n[bold yellow]Installing MariaDB and Nginx (sudo apt-get install)...[/bold yellow]")
-            subprocess.run(["sudo", "apt-get", "install", "-y", "mariadb-server", "nginx", "curl"], check=True)
+            console.print("\n[bold yellow]Installing MariaDB, Nginx, curl, Bubblewrap, and system tools (sudo apt-get install)...[/bold yellow]")
+            packages = ["mariadb-server", "nginx", "curl", "bubblewrap", "policycoreutils-python-utils"]
+            subprocess.run(["sudo", "apt-get", "install", "-y"] + packages, check=True)
 
             # Optional mkcert package
             try:
@@ -90,9 +85,63 @@ def setup_cmd():
             except Exception:
                 pass
 
-            console.print("[bold green]MariaDB and Nginx installed successfully![/bold green]\n")
-        
-        # 3. Install Composer
+            console.print("[bold green]System packages installed successfully![/bold green]\n")
+
+        # 3. Auto-configure Stack Services, Permissions, SSL, and SELinux
+        console.print("[bold yellow]Auto-configuring stack services, directories, SSL, and SELinux...[/bold yellow]")
+        from ndev.linux.runtime.nginx_helper import (
+            ensure_selinux_httpd_permissions,
+            ensure_nginx_ssl_dir,
+            ensure_nginx_sites_enabled_included,
+            ensure_development_directories,
+            reload_nginx,
+        )
+
+        # Enable & start system services
+        try:
+            subprocess.run(["sudo", "systemctl", "enable", "--now", "mariadb"], check=False, capture_output=True)
+            subprocess.run(["sudo", "systemctl", "enable", "--now", "nginx"], check=False, capture_output=True)
+            console.print("  [bold green]✓[/bold green] Enabled and started MariaDB and Nginx system services.")
+        except Exception:
+            pass
+
+        # SELinux Permissions
+        try:
+            ok = ensure_selinux_httpd_permissions()
+            if ok:
+                console.print("  [bold green]✓[/bold green] Configured SELinux permissions for Nginx (httpd_t set to permissive).")
+        except Exception as e:
+            logger.warning(f"SELinux configuration notice: {e}")
+
+        # Nginx SSL Directory (/etc/nginx/ssl)
+        try:
+            ensure_nginx_ssl_dir()
+            console.print("  [bold green]✓[/bold green] Configured Nginx SSL certificate directory (/etc/nginx/ssl).")
+        except Exception as e:
+            logger.warning(f"SSL directory configuration notice: {e}")
+
+        # Nginx Sites-Enabled / Vhosts Bridge
+        try:
+            ensure_nginx_sites_enabled_included()
+            console.print("  [bold green]✓[/bold green] Configured Nginx sites-available/sites-enabled directory bridge.")
+        except Exception as e:
+            logger.warning(f"Nginx bridge configuration notice: {e}")
+
+        # Web development root permissions and docroot traversal
+        try:
+            ensure_development_directories()
+            console.print("  [bold green]✓[/bold green] Configured web development root permissions (~/Sites).")
+        except Exception as e:
+            logger.warning(f"Docroot permission notice: {e}")
+
+        # Reload Nginx
+        try:
+            reload_nginx()
+            console.print("  [bold green]✓[/bold green] Nginx web server configuration reloaded.")
+        except Exception:
+            pass
+
+        # 4. Install Composer
         local_bin = get_user_local_bin_dir()
         composer_bin = local_bin / "composer"
         if composer_bin.exists():
@@ -144,7 +193,12 @@ def setup_cmd():
             chown_to_sudo_user(ndev_link)
             console.print(f"[bold green]Created symlink {ndev_link} -> {ndev_venv_path}[/bold green]")
             
-        console.print("\n[bold green]System setup completed successfully![/bold green]")
+        console.print("\n[bold green]System setup completed successfully![/bold green]\n")
+        try:
+            from ndev.linux.commands.doctor import doctor_cmd
+            doctor_cmd()
+        except Exception:
+            pass
         
     except subprocess.CalledProcessError as e:
         logger.error(f"Command execution failed: {e}")

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/ndev/linux/commands/vhost.py

@@ -321,6 +321,7 @@ def vhost_cmd(
         ensure_nginx_sites_enabled_included,
         install_nginx_ssl_cert,
         ensure_docroot_accessible,
+        ensure_selinux_httpd_permissions,
         add_to_hosts_privileged,
         reload_nginx,
     )
@@ -350,6 +351,7 @@ def vhost_cmd(
             logger.warning(f"Could not install SSL certificate to /etc/nginx/ssl: {e}")
 
     ensure_docroot_accessible(root_path)
+    ensure_selinux_httpd_permissions()
 
     conf_file = vhost_dir / f"{domain}.conf"
     config_template = generate_vhost_config(

{ndev_stack-0.3.12 → ndev_stack-0.3.14}/ndev/linux/runtime/nginx_helper.py

@@ -66,6 +66,169 @@ def check_sudo_needs_password() -> bool:
         return True
 
 
+def run_privileged_command(
+    cmd: list[str],
+    password: Optional[str] = None,
+    check: bool = True,
+    timeout: int = 60,
+    capture_output: bool = True
+) -> subprocess.CompletedProcess:
+    """
+    Run a command with elevated privileges using sudo if non-root.
+    Validates sudo password first if provided to refresh the sudo credential timestamp.
+    If no password provided:
+      - Uses sudo -n if not in an interactive terminal or if sudo timestamp is active.
+      - Falls back to interactive sudo if in an interactive terminal.
+    """
+    full_cmd = list(cmd)
+    if os.geteuid() != 0:
+        if password:
+            validate_sudo_password(password)
+            full_cmd = ["sudo", "-n"] + full_cmd
+        else:
+            if not check_sudo_needs_password():
+                full_cmd = ["sudo", "-n"] + full_cmd
+            elif sys.stdin.isatty():
+                full_cmd = ["sudo"] + full_cmd
+                capture_output = False
+            else:
+                full_cmd = ["sudo", "-n"] + full_cmd
+
+    return subprocess.run(
+        full_cmd,
+        check=check,
+        timeout=timeout,
+        capture_output=capture_output,
+        text=True
+    )
+
+
+def is_selinux_enforcing() -> bool:
+    """Check if SELinux is present and in Enforcing mode."""
+    enforce_file = Path("/sys/fs/selinux/enforce")
+    if enforce_file.exists():
+        try:
+            return enforce_file.read_text().strip() == "1"
+        except Exception:
+            pass
+    getenforce = shutil.which("getenforce") or "/usr/sbin/getenforce"
+    if Path(getenforce).exists():
+        try:
+            res = subprocess.run([getenforce], capture_output=True, text=True, timeout=2)
+            return res.stdout.strip().lower() == "enforcing"
+        except Exception:
+            pass
+    return False
+
+
+def is_selinux_httpd_permissive() -> bool:
+    """Check if httpd_t is in SELinux permissive types."""
+    if not is_selinux_enforcing():
+        return True
+    seinfo = shutil.which("seinfo") or "/usr/bin/seinfo"
+    if Path(seinfo).exists():
+        try:
+            res = subprocess.run([seinfo, "--permissive"], capture_output=True, text=True, timeout=3)
+            return "httpd_t" in res.stdout
+        except Exception:
+            pass
+    return False
+
+
+def ensure_selinux_httpd_permissions(password: Optional[str] = None) -> bool:
+    """
+    Ensure SELinux allows Nginx (httpd_t) to access user document roots and FastCGI sockets.
+    If SELinux is enforcing and httpd_t is not permissive, add httpd_t to permissive types
+    via semanage and enable relevant SELinux booleans.
+    """
+    if not is_selinux_enforcing() or is_selinux_httpd_permissive():
+        return True
+
+    success = False
+    semanage = shutil.which("semanage") or "/usr/sbin/semanage"
+    if Path(semanage).exists():
+        try:
+            run_privileged_command([semanage, "permissive", "-a", "httpd_t"], password=password, check=False)
+            success = is_selinux_httpd_permissive()
+        except Exception as e:
+            logger.warning(f"Failed to set httpd_t permissive via semanage: {e}")
+
+    # Also enable booleans as supplementary fallback
+    setsebool = shutil.which("setsebool") or "/usr/sbin/setsebool"
+    if Path(setsebool).exists():
+        try:
+            run_privileged_command(
+                [setsebool, "-P", "httpd_read_user_content=1", "httpd_enable_homedirs=1", "httpd_can_network_connect=1"],
+                password=password,
+                check=False
+            )
+        except Exception:
+            pass
+
+    return success or is_selinux_httpd_permissive()
+
+
+def ensure_nginx_ssl_dir(password: Optional[str] = None) -> Path:
+    """
+    Ensure /etc/nginx/ssl directory exists with 0755 permissions and proper SELinux context.
+    """
+    ssl_dir = Path("/etc/nginx/ssl")
+    if os.geteuid() == 0:
+        ssl_dir.mkdir(parents=True, exist_ok=True)
+        try:
+            os.chmod(str(ssl_dir), 0o755)
+        except Exception:
+            pass
+    else:
+        run_privileged_command(["mkdir", "-p", str(ssl_dir)], password=password, check=False)
+        run_privileged_command(["chmod", "755", str(ssl_dir)], password=password, check=False)
+
+    if shutil.which("restorecon"):
+        run_privileged_command(["restorecon", "-Rv", str(ssl_dir)], password=password, check=False)
+
+    return ssl_dir
+
+
+def ensure_development_directories(password: Optional[str] = None) -> None:
+    """
+    Ensure the user home directory has +x traversal permissions,
+    ~/Sites directory exists with 0755 permissions, and any configured vhost docroots are accessible.
+    """
+    home = Path.home()
+    sudo_user = os.environ.get("SUDO_USER")
+    if sudo_user:
+        try:
+            import pwd
+            home = Path(pwd.getpwnam(sudo_user).pw_dir)
+        except Exception:
+            pass
+
+    # Ensure home has traversal (+x)
+    try:
+        st = home.stat()
+        if not (st.st_mode & 0o001):
+            os.chmod(str(home), st.st_mode | 0o001)
+    except Exception:
+        pass
+
+    # Ensure ~/Sites exists
+    sites_dir = home / "Sites"
+    try:
+        sites_dir.mkdir(parents=True, exist_ok=True)
+        os.chmod(str(sites_dir), 0o755)
+    except Exception:
+        pass
+
+    # Ensure all configured vhost docroots are accessible
+    try:
+        for vhost in list_vhosts():
+            docroot = vhost.get("root")
+            if docroot and Path(docroot).exists():
+                ensure_docroot_accessible(Path(docroot))
+    except Exception:
+        pass
+
+
 def write_privileged_file(target: Path, content: str, password: Optional[str] = None) -> None:
     """
     Write content to a file, using sudo tee if current process lacks permissions.
@@ -527,10 +690,24 @@ def ensure_docroot_accessible(root_path: Path) -> None:
     try:
         resolved_root = root_path.resolve()
         resolved_home = home.resolve()
-        if resolved_root == resolved_home or resolved_root.is_relative_to(resolved_home):
-            st = home.stat()
-            if not (st.st_mode & 0o001):
-                os.chmod(str(home), st.st_mode | 0o001)
+
+        # Traverse every directory from root_path up to home and ensure +x (0o001)
+        curr = resolved_root
+        while curr != curr.parent:
+            try:
+                st = curr.stat()
+                if not (st.st_mode & 0o001):
+                    os.chmod(str(curr), st.st_mode | 0o001)
+            except Exception:
+                pass
+            if curr == resolved_home:
+                break
+            curr = curr.parent
+
+        # Also ensure home directory itself has +x
+        st = resolved_home.stat()
+        if not (st.st_mode & 0o001):
+            os.chmod(str(resolved_home), st.st_mode | 0o001)
     except Exception:
         pass