|
|
|
@@ -0,0 +1,628 @@
|
|
|
|
|
import { spawnSync, type SpawnSyncReturns } from "node:child_process";
|
|
|
|
|
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
|
|
|
import { dirname } from "node:path";
|
|
|
|
|
import type { UniDeskConfig } from "./config";
|
|
|
|
|
import { rootPath } from "./config";
|
|
|
|
|
import type { RenderedCliResult } from "./output";
|
|
|
|
|
import { applyPk01CaddySiteBlock, caddyManagedBlockMarkers } from "./pk01-caddy";
|
|
|
|
|
import {
|
|
|
|
|
asRecord,
|
|
|
|
|
booleanField,
|
|
|
|
|
integerField,
|
|
|
|
|
parseOpsApplyOptions,
|
|
|
|
|
parseOpsCommonOptions,
|
|
|
|
|
readYamlRecord,
|
|
|
|
|
recordField,
|
|
|
|
|
stringField,
|
|
|
|
|
} from "./platform-infra-ops-library";
|
|
|
|
|
|
|
|
|
|
const configPath = rootPath("config", "platform-infra", "webterm.yaml");
|
|
|
|
|
const serviceName = "webterm";
|
|
|
|
|
|
|
|
|
|
interface WebtermConfig {
|
|
|
|
|
defaults: { targetId: string };
|
|
|
|
|
targets: WebtermTarget[];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
interface WebtermTarget {
|
|
|
|
|
id: string;
|
|
|
|
|
enabled: boolean;
|
|
|
|
|
runtime: {
|
|
|
|
|
mode: "host-docker";
|
|
|
|
|
workDir: string;
|
|
|
|
|
composePath: string;
|
|
|
|
|
composeProject: string;
|
|
|
|
|
serviceName: string;
|
|
|
|
|
containerName: string;
|
|
|
|
|
image: string;
|
|
|
|
|
envFile: string;
|
|
|
|
|
hostPort: number;
|
|
|
|
|
containerPort: number;
|
|
|
|
|
privileged: boolean;
|
|
|
|
|
pid: "host" | "container";
|
|
|
|
|
sourceMounts: Array<{ source: string; target: string; readOnly: boolean }>;
|
|
|
|
|
environment: Record<string, string>;
|
|
|
|
|
};
|
|
|
|
|
publicExposure: {
|
|
|
|
|
enabled: boolean;
|
|
|
|
|
publicBaseUrl: string;
|
|
|
|
|
dns: { hostname: string; expectedA: string; resolvers: string[] };
|
|
|
|
|
upstream: { host: string; port: number };
|
|
|
|
|
pk01: {
|
|
|
|
|
route: string;
|
|
|
|
|
caddyConfigPath: string;
|
|
|
|
|
caddyServiceName: string;
|
|
|
|
|
responseHeaderTimeoutSeconds: number;
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
export async function runWebtermCommand(config: UniDeskConfig, args: string[]): Promise<Record<string, unknown> | RenderedCliResult> {
|
|
|
|
|
const [action = "plan", ...rest] = args;
|
|
|
|
|
if (action === "plan") {
|
|
|
|
|
const result = plan(parseCommon(rest).targetId);
|
|
|
|
|
return wantsFull(rest) ? result : renderPlan(result);
|
|
|
|
|
}
|
|
|
|
|
if (action === "apply") {
|
|
|
|
|
const options = parseOpsApplyOptions(rest);
|
|
|
|
|
const result = await apply(config, options.targetId, options.confirm);
|
|
|
|
|
return options.full || options.raw ? result : renderApply(result);
|
|
|
|
|
}
|
|
|
|
|
if (action === "status") {
|
|
|
|
|
const options = parseCommon(rest);
|
|
|
|
|
const result = status(options.targetId);
|
|
|
|
|
return options.full || options.raw ? result : renderStatus(result);
|
|
|
|
|
}
|
|
|
|
|
if (action === "validate") {
|
|
|
|
|
const options = parseCommon(rest);
|
|
|
|
|
const result = validate(options.targetId);
|
|
|
|
|
return options.full || options.raw ? result : renderValidate(result);
|
|
|
|
|
}
|
|
|
|
|
return {
|
|
|
|
|
ok: false,
|
|
|
|
|
error: "unsupported-webterm-command",
|
|
|
|
|
args,
|
|
|
|
|
help: webtermHelp(),
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
export function webtermHelp(): Record<string, unknown> {
|
|
|
|
|
return {
|
|
|
|
|
command: "platform-infra webterm plan|apply|status|validate",
|
|
|
|
|
examples: [
|
|
|
|
|
"bun scripts/cli.ts platform-infra webterm plan",
|
|
|
|
|
"bun scripts/cli.ts platform-infra webterm apply --dry-run",
|
|
|
|
|
"bun scripts/cli.ts platform-infra webterm apply --confirm",
|
|
|
|
|
"bun scripts/cli.ts platform-infra webterm status",
|
|
|
|
|
"bun scripts/cli.ts platform-infra webterm validate",
|
|
|
|
|
],
|
|
|
|
|
configPath,
|
|
|
|
|
description: "Deploy the host-Docker Web Terminal from YAML and expose it through PK01 Caddy HTTPS without touching the existing 7682 service.",
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function plan(targetId: string | null): Record<string, unknown> {
|
|
|
|
|
const target = resolveTarget(targetId);
|
|
|
|
|
const compose = renderCompose(target);
|
|
|
|
|
return {
|
|
|
|
|
ok: true,
|
|
|
|
|
service: serviceName,
|
|
|
|
|
configPath,
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
compose: {
|
|
|
|
|
path: target.runtime.composePath,
|
|
|
|
|
project: target.runtime.composeProject,
|
|
|
|
|
service: target.runtime.serviceName,
|
|
|
|
|
container: target.runtime.containerName,
|
|
|
|
|
fingerprint: fingerprint(compose),
|
|
|
|
|
hostPort: target.runtime.hostPort,
|
|
|
|
|
containerPort: target.runtime.containerPort,
|
|
|
|
|
},
|
|
|
|
|
publicExposure: exposureSummary(target),
|
|
|
|
|
policy: policyChecks(target, compose),
|
|
|
|
|
next: {
|
|
|
|
|
dryRun: "bun scripts/cli.ts platform-infra webterm apply --dry-run",
|
|
|
|
|
apply: "bun scripts/cli.ts platform-infra webterm apply --confirm",
|
|
|
|
|
status: "bun scripts/cli.ts platform-infra webterm status",
|
|
|
|
|
validate: "bun scripts/cli.ts platform-infra webterm validate",
|
|
|
|
|
},
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
async function apply(config: UniDeskConfig, targetId: string | null, confirm: boolean): Promise<Record<string, unknown>> {
|
|
|
|
|
const target = resolveTarget(targetId);
|
|
|
|
|
const compose = renderCompose(target);
|
|
|
|
|
const policy = policyChecks(target, compose);
|
|
|
|
|
const failedPolicy = policy.filter((item) => item.ok === false);
|
|
|
|
|
if (!confirm) {
|
|
|
|
|
return {
|
|
|
|
|
ok: failedPolicy.length === 0,
|
|
|
|
|
mode: "dry-run",
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
compose: { path: target.runtime.composePath, fingerprint: fingerprint(compose), preview: compose },
|
|
|
|
|
publicExposure: exposureSummary(target),
|
|
|
|
|
policy,
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
if (failedPolicy.length > 0) {
|
|
|
|
|
return {
|
|
|
|
|
ok: false,
|
|
|
|
|
mode: "policy-blocked",
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
policy,
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
mkdirSync(dirname(target.runtime.composePath), { recursive: true });
|
|
|
|
|
writeFileSync(target.runtime.composePath, compose, { encoding: "utf8", mode: 0o644 });
|
|
|
|
|
const composeResult = spawnSync("docker", ["compose", "-f", target.runtime.composePath, "-p", target.runtime.composeProject, "up", "-d", "--force-recreate"], {
|
|
|
|
|
cwd: target.runtime.workDir,
|
|
|
|
|
encoding: "utf8",
|
|
|
|
|
});
|
|
|
|
|
const localProbe = localHttpProbeWithRetry(target.runtime.hostPort, "/login", 10, 500);
|
|
|
|
|
const caddy = target.publicExposure.enabled
|
|
|
|
|
? await applyPk01CaddySiteBlock(
|
|
|
|
|
config,
|
|
|
|
|
serviceName,
|
|
|
|
|
caddyExposure(target),
|
|
|
|
|
renderWebtermCaddySiteBlock({
|
|
|
|
|
hostname: target.publicExposure.dns.hostname,
|
|
|
|
|
upstream: `${target.publicExposure.upstream.host}:${target.publicExposure.upstream.port}`,
|
|
|
|
|
responseHeaderTimeoutSeconds: target.publicExposure.pk01.responseHeaderTimeoutSeconds,
|
|
|
|
|
}),
|
|
|
|
|
caddyManagedBlockMarkers(serviceName),
|
|
|
|
|
)
|
|
|
|
|
: { ok: true, action: "not-enabled" };
|
|
|
|
|
const publicProbe = target.publicExposure.enabled ? publicHttpProbeWithRetry(target.publicExposure.publicBaseUrl, "/login", 6, 1000) : { ok: true, skipped: true };
|
|
|
|
|
return {
|
|
|
|
|
ok: composeResult.status === 0 && localProbe.ok === true && caddy.ok !== false && publicProbe.ok === true,
|
|
|
|
|
mode: "confirmed",
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
compose: {
|
|
|
|
|
path: target.runtime.composePath,
|
|
|
|
|
project: target.runtime.composeProject,
|
|
|
|
|
fingerprint: fingerprint(compose),
|
|
|
|
|
up: commandSummary(composeResult),
|
|
|
|
|
},
|
|
|
|
|
localProbe,
|
|
|
|
|
pk01Caddy: caddy,
|
|
|
|
|
publicProbe,
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function status(targetId: string | null): Record<string, unknown> {
|
|
|
|
|
const target = resolveTarget(targetId);
|
|
|
|
|
const inspect = spawnSync("docker", ["inspect", target.runtime.containerName], { encoding: "utf8" });
|
|
|
|
|
const ps = spawnSync("docker", ["ps", "--filter", `name=^/${target.runtime.containerName}$`, "--format", "{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"], { encoding: "utf8" });
|
|
|
|
|
const localProbe = localHttpProbe(target.runtime.hostPort, "/login");
|
|
|
|
|
const publicProbe = target.publicExposure.enabled ? publicHttpProbe(target.publicExposure.publicBaseUrl, "/login") : { ok: true, skipped: true };
|
|
|
|
|
return {
|
|
|
|
|
ok: ps.status === 0 && ps.stdout.trim().length > 0 && localProbe.ok === true && publicProbe.ok === true,
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
compose: {
|
|
|
|
|
path: target.runtime.composePath,
|
|
|
|
|
exists: existsSync(target.runtime.composePath),
|
|
|
|
|
fingerprint: existsSync(target.runtime.composePath) ? fingerprint(readFileSync(target.runtime.composePath, "utf8")) : null,
|
|
|
|
|
},
|
|
|
|
|
container: {
|
|
|
|
|
exists: inspect.status === 0,
|
|
|
|
|
ps: ps.stdout.trim(),
|
|
|
|
|
},
|
|
|
|
|
localProbe,
|
|
|
|
|
publicProbe,
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function validate(targetId: string | null): Record<string, unknown> {
|
|
|
|
|
const target = resolveTarget(targetId);
|
|
|
|
|
const dns = dnsProbe(target.publicExposure.dns.hostname);
|
|
|
|
|
const localProbe = localHttpProbe(target.runtime.hostPort, "/login");
|
|
|
|
|
const publicProbe = target.publicExposure.enabled ? publicHttpProbe(target.publicExposure.publicBaseUrl, "/login") : { ok: true, skipped: true };
|
|
|
|
|
return {
|
|
|
|
|
ok: localProbe.ok === true && publicProbe.ok === true && dns.addresses.includes(target.publicExposure.dns.expectedA),
|
|
|
|
|
target: targetSummary(target),
|
|
|
|
|
dns,
|
|
|
|
|
localProbe,
|
|
|
|
|
publicProbe,
|
|
|
|
|
valuesPrinted: false,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function readWebtermConfig(): WebtermConfig {
|
|
|
|
|
const yaml = readYamlRecord(configPath, "platform-infra-webterm");
|
|
|
|
|
const defaults = recordField(yaml, "defaults", "webterm");
|
|
|
|
|
const targetsRaw = yaml.targets;
|
|
|
|
|
if (!Array.isArray(targetsRaw)) throw new Error("webterm.targets must be an array");
|
|
|
|
|
return {
|
|
|
|
|
defaults: { targetId: stringField(defaults, "targetId", "webterm.defaults") },
|
|
|
|
|
targets: targetsRaw.map((item, index) => parseTarget(asRecord(item, `webterm.targets[${index}]`), `webterm.targets[${index}]`)),
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parseTarget(record: Record<string, unknown>, path: string): WebtermTarget {
|
|
|
|
|
const runtime = recordField(record, "runtime", path);
|
|
|
|
|
const exposure = recordField(record, "publicExposure", path);
|
|
|
|
|
const dns = recordField(exposure, "dns", `${path}.publicExposure`);
|
|
|
|
|
const upstream = recordField(exposure, "upstream", `${path}.publicExposure`);
|
|
|
|
|
const pk01 = recordField(exposure, "pk01", `${path}.publicExposure`);
|
|
|
|
|
const environment = parseEnvironment(recordField(runtime, "environment", `${path}.runtime`), `${path}.runtime.environment`);
|
|
|
|
|
const sourceMounts = parseSourceMounts(runtime.sourceMounts, `${path}.runtime.sourceMounts`);
|
|
|
|
|
const target: WebtermTarget = {
|
|
|
|
|
id: stringField(record, "id", path),
|
|
|
|
|
enabled: booleanField(record, "enabled", path),
|
|
|
|
|
runtime: {
|
|
|
|
|
mode: parseLiteral(stringField(runtime, "mode", `${path}.runtime`), "host-docker", `${path}.runtime.mode`),
|
|
|
|
|
workDir: stringField(runtime, "workDir", `${path}.runtime`),
|
|
|
|
|
composePath: stringField(runtime, "composePath", `${path}.runtime`),
|
|
|
|
|
composeProject: stringField(runtime, "composeProject", `${path}.runtime`),
|
|
|
|
|
serviceName: stringField(runtime, "serviceName", `${path}.runtime`),
|
|
|
|
|
containerName: stringField(runtime, "containerName", `${path}.runtime`),
|
|
|
|
|
image: stringField(runtime, "image", `${path}.runtime`),
|
|
|
|
|
envFile: stringField(runtime, "envFile", `${path}.runtime`),
|
|
|
|
|
hostPort: portField(runtime, "hostPort", `${path}.runtime`),
|
|
|
|
|
containerPort: portField(runtime, "containerPort", `${path}.runtime`),
|
|
|
|
|
privileged: booleanField(runtime, "privileged", `${path}.runtime`),
|
|
|
|
|
pid: parsePid(stringField(runtime, "pid", `${path}.runtime`), `${path}.runtime.pid`),
|
|
|
|
|
sourceMounts,
|
|
|
|
|
environment,
|
|
|
|
|
},
|
|
|
|
|
publicExposure: {
|
|
|
|
|
enabled: booleanField(exposure, "enabled", `${path}.publicExposure`),
|
|
|
|
|
publicBaseUrl: stringField(exposure, "publicBaseUrl", `${path}.publicExposure`),
|
|
|
|
|
dns: {
|
|
|
|
|
hostname: stringField(dns, "hostname", `${path}.publicExposure.dns`),
|
|
|
|
|
expectedA: stringField(dns, "expectedA", `${path}.publicExposure.dns`),
|
|
|
|
|
resolvers: stringArray(dns.resolvers, `${path}.publicExposure.dns.resolvers`),
|
|
|
|
|
},
|
|
|
|
|
upstream: {
|
|
|
|
|
host: stringField(upstream, "host", `${path}.publicExposure.upstream`),
|
|
|
|
|
port: portField(upstream, "port", `${path}.publicExposure.upstream`),
|
|
|
|
|
},
|
|
|
|
|
pk01: {
|
|
|
|
|
route: stringField(pk01, "route", `${path}.publicExposure.pk01`),
|
|
|
|
|
caddyConfigPath: stringField(pk01, "caddyConfigPath", `${path}.publicExposure.pk01`),
|
|
|
|
|
caddyServiceName: stringField(pk01, "caddyServiceName", `${path}.publicExposure.pk01`),
|
|
|
|
|
responseHeaderTimeoutSeconds: integerField(pk01, "responseHeaderTimeoutSeconds", `${path}.publicExposure.pk01`),
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
};
|
|
|
|
|
if (target.runtime.hostPort === 7682) throw new Error(`${path}.runtime.hostPort must not reuse existing 7682`);
|
|
|
|
|
if (target.runtime.containerName === "web-terminal-7682") throw new Error(`${path}.runtime.containerName must not reuse web-terminal-7682`);
|
|
|
|
|
if (!target.publicExposure.publicBaseUrl.startsWith("https://")) throw new Error(`${path}.publicExposure.publicBaseUrl must be https`);
|
|
|
|
|
return target;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function resolveTarget(targetId: string | null): WebtermTarget {
|
|
|
|
|
const config = readWebtermConfig();
|
|
|
|
|
const id = targetId ?? config.defaults.targetId;
|
|
|
|
|
const target = config.targets.find((item) => item.id === id);
|
|
|
|
|
if (target === undefined) throw new Error(`unknown webterm target: ${id}`);
|
|
|
|
|
return target;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderCompose(target: WebtermTarget): string {
|
|
|
|
|
const envLines = Object.entries(target.runtime.environment)
|
|
|
|
|
.map(([key, value]) => ` ${key}: ${quoteYaml(value)}`)
|
|
|
|
|
.join("\n");
|
|
|
|
|
const volumeLines = target.runtime.sourceMounts
|
|
|
|
|
.map((mount) => ` - ${quoteYaml(`${mount.source}:${mount.target}${mount.readOnly ? ":ro" : ""}`)}`)
|
|
|
|
|
.join("\n");
|
|
|
|
|
return `name: ${target.runtime.composeProject}
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
${target.runtime.serviceName}:
|
|
|
|
|
image: ${target.runtime.image}
|
|
|
|
|
container_name: ${target.runtime.containerName}
|
|
|
|
|
restart: unless-stopped
|
|
|
|
|
ports:
|
|
|
|
|
- "${target.runtime.hostPort}:${target.runtime.containerPort}"
|
|
|
|
|
privileged: ${target.runtime.privileged ? "true" : "false"}
|
|
|
|
|
pid: ${target.runtime.pid}
|
|
|
|
|
env_file:
|
|
|
|
|
- ${target.runtime.envFile}
|
|
|
|
|
volumes:
|
|
|
|
|
${volumeLines}
|
|
|
|
|
environment:
|
|
|
|
|
${envLines}
|
|
|
|
|
`;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function policyChecks(target: WebtermTarget, compose: string): Array<Record<string, unknown> & { ok: boolean }> {
|
|
|
|
|
return [
|
|
|
|
|
{ name: "enabled", ok: target.enabled, detail: "target must be enabled" },
|
|
|
|
|
{ name: "no-7682-host-port", ok: target.runtime.hostPort !== 7682, detail: "existing 7682 service must not be reused" },
|
|
|
|
|
{ name: "no-7682-container", ok: target.runtime.containerName !== "web-terminal-7682", detail: "existing 7682 container must not be reused" },
|
|
|
|
|
{ name: "compose-path-7683", ok: target.runtime.composePath.includes("7683"), detail: target.runtime.composePath },
|
|
|
|
|
{ name: "public-https", ok: target.publicExposure.publicBaseUrl.startsWith("https://"), detail: target.publicExposure.publicBaseUrl },
|
|
|
|
|
{ name: "compose-renders-7683", ok: compose.includes(`"${target.runtime.hostPort}:${target.runtime.containerPort}"`), detail: `${target.runtime.hostPort}:${target.runtime.containerPort}` },
|
|
|
|
|
{ name: "source-mounts-present", ok: target.runtime.sourceMounts.length >= 3, detail: `mounts=${target.runtime.sourceMounts.length}` },
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function caddyExposure(target: WebtermTarget): Parameters<typeof applyPk01CaddySiteBlock>[2] {
|
|
|
|
|
return {
|
|
|
|
|
enabled: target.publicExposure.enabled,
|
|
|
|
|
dns: { hostname: target.publicExposure.dns.hostname },
|
|
|
|
|
frpc: { remotePort: target.publicExposure.upstream.port },
|
|
|
|
|
pk01: target.publicExposure.pk01,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderWebtermCaddySiteBlock(params: {
|
|
|
|
|
hostname: string;
|
|
|
|
|
upstream: string;
|
|
|
|
|
responseHeaderTimeoutSeconds: number;
|
|
|
|
|
}): string {
|
|
|
|
|
return `${params.hostname} {
|
|
|
|
|
reverse_proxy ${params.upstream} {
|
|
|
|
|
flush_interval -1
|
|
|
|
|
stream_close_delay 5m
|
|
|
|
|
transport http {
|
|
|
|
|
response_header_timeout ${params.responseHeaderTimeoutSeconds}s
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}`;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function targetSummary(target: WebtermTarget): Record<string, unknown> {
|
|
|
|
|
return {
|
|
|
|
|
id: target.id,
|
|
|
|
|
enabled: target.enabled,
|
|
|
|
|
mode: target.runtime.mode,
|
|
|
|
|
workDir: target.runtime.workDir,
|
|
|
|
|
composeProject: target.runtime.composeProject,
|
|
|
|
|
containerName: target.runtime.containerName,
|
|
|
|
|
image: target.runtime.image,
|
|
|
|
|
sourceMounts: target.runtime.sourceMounts.map((mount) => `${mount.source}->${mount.target}${mount.readOnly ? ":ro" : ""}`),
|
|
|
|
|
hostPort: target.runtime.hostPort,
|
|
|
|
|
containerPort: target.runtime.containerPort,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function exposureSummary(target: WebtermTarget): Record<string, unknown> {
|
|
|
|
|
return {
|
|
|
|
|
enabled: target.publicExposure.enabled,
|
|
|
|
|
publicBaseUrl: target.publicExposure.publicBaseUrl,
|
|
|
|
|
hostname: target.publicExposure.dns.hostname,
|
|
|
|
|
expectedA: target.publicExposure.dns.expectedA,
|
|
|
|
|
upstream: `${target.publicExposure.upstream.host}:${target.publicExposure.upstream.port}`,
|
|
|
|
|
pk01Route: target.publicExposure.pk01.route,
|
|
|
|
|
marker: caddyManagedBlockMarkers(serviceName).start,
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function localHttpProbe(port: number, path: string): Record<string, unknown> {
|
|
|
|
|
return httpProbe(`http://127.0.0.1:${port}`, path);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function publicHttpProbe(baseUrl: string, path: string): Record<string, unknown> {
|
|
|
|
|
return httpProbe(baseUrl, path);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function localHttpProbeWithRetry(port: number, path: string, attempts: number, delayMs: number): Record<string, unknown> {
|
|
|
|
|
return httpProbeWithRetry(() => localHttpProbe(port, path), attempts, delayMs);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function publicHttpProbeWithRetry(baseUrl: string, path: string, attempts: number, delayMs: number): Record<string, unknown> {
|
|
|
|
|
return httpProbeWithRetry(() => publicHttpProbe(baseUrl, path), attempts, delayMs);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function httpProbeWithRetry(run: () => Record<string, unknown>, attempts: number, delayMs: number): Record<string, unknown> {
|
|
|
|
|
let latest = run();
|
|
|
|
|
for (let attempt = 1; attempt < attempts && latest.ok !== true; attempt += 1) {
|
|
|
|
|
spawnSync("sleep", [(delayMs / 1000).toFixed(3)]);
|
|
|
|
|
latest = run();
|
|
|
|
|
}
|
|
|
|
|
return { ...latest, attempts };
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function httpProbe(baseUrl: string, path: string): Record<string, unknown> {
|
|
|
|
|
const url = `${baseUrl.replace(/\/+$/u, "")}${path}`;
|
|
|
|
|
const result = spawnSync("curl", ["-fsS", "-L", "--connect-timeout", "5", "--max-time", "15", "-o", "/dev/null", "-w", "%{http_code}", url], { encoding: "utf8" });
|
|
|
|
|
const status = Number(result.stdout.trim());
|
|
|
|
|
return {
|
|
|
|
|
ok: result.status === 0 && Number.isInteger(status) && status >= 200 && status < 500,
|
|
|
|
|
url,
|
|
|
|
|
status: Number.isInteger(status) ? status : null,
|
|
|
|
|
exitCode: result.status,
|
|
|
|
|
stderrTail: result.status === 0 ? "" : result.stderr.slice(-1000),
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function dnsProbe(hostname: string): Record<string, unknown> & { addresses: string[] } {
|
|
|
|
|
const result = spawnSync("getent", ["hosts", hostname], { encoding: "utf8" });
|
|
|
|
|
const addresses = result.stdout
|
|
|
|
|
.split(/\r?\n/u)
|
|
|
|
|
.map((line) => line.trim().split(/\s+/u)[0] ?? "")
|
|
|
|
|
.filter((value) => /^\d+\.\d+\.\d+\.\d+$/u.test(value));
|
|
|
|
|
return { ok: result.status === 0 && addresses.length > 0, hostname, addresses, exitCode: result.status };
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function commandSummary(result: SpawnSyncReturns<string>): Record<string, unknown> {
|
|
|
|
|
return {
|
|
|
|
|
exitCode: result.status,
|
|
|
|
|
stdoutTail: result.status === 0 ? result.stdout.slice(-2000) : result.stdout.slice(-4000),
|
|
|
|
|
stderrTail: result.status === 0 ? "" : result.stderr.slice(-4000),
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parseCommon(args: string[]): ReturnType<typeof parseOpsCommonOptions> {
|
|
|
|
|
return parseOpsCommonOptions(args);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function wantsFull(args: string[]): boolean {
|
|
|
|
|
return args.includes("--full") || args.includes("--raw");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parseEnvironment(record: Record<string, unknown>, path: string): Record<string, string> {
|
|
|
|
|
const result: Record<string, string> = {};
|
|
|
|
|
for (const [key, value] of Object.entries(record)) {
|
|
|
|
|
if (!/^[A-Z_][A-Z0-9_]*$/u.test(key)) throw new Error(`${path}.${key} must be an env key`);
|
|
|
|
|
if (typeof value !== "string") throw new Error(`${path}.${key} must be a string`);
|
|
|
|
|
result[key] = value;
|
|
|
|
|
}
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parseSourceMounts(value: unknown, path: string): WebtermTarget["runtime"]["sourceMounts"] {
|
|
|
|
|
if (!Array.isArray(value)) throw new Error(`${path} must be an array`);
|
|
|
|
|
return value.map((item, index) => {
|
|
|
|
|
const record = asRecord(item, `${path}[${index}]`);
|
|
|
|
|
return {
|
|
|
|
|
source: stringField(record, "source", `${path}[${index}]`),
|
|
|
|
|
target: stringField(record, "target", `${path}[${index}]`),
|
|
|
|
|
readOnly: booleanField(record, "readOnly", `${path}[${index}]`),
|
|
|
|
|
};
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parseLiteral<T extends string>(value: string, expected: T, path: string): T {
|
|
|
|
|
if (value !== expected) throw new Error(`${path} must be ${expected}`);
|
|
|
|
|
return expected;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function parsePid(value: string, path: string): "host" | "container" {
|
|
|
|
|
if (value !== "host" && value !== "container") throw new Error(`${path} must be host or container`);
|
|
|
|
|
return value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function portField(record: Record<string, unknown>, key: string, path: string): number {
|
|
|
|
|
const value = integerField(record, key, path);
|
|
|
|
|
if (value < 1 || value > 65535) throw new Error(`${path}.${key} must be a TCP port`);
|
|
|
|
|
return value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function stringArray(value: unknown, path: string): string[] {
|
|
|
|
|
if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0)) throw new Error(`${path} must be an array of strings`);
|
|
|
|
|
return value as string[];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function quoteYaml(value: string): string {
|
|
|
|
|
return JSON.stringify(value);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function fingerprint(value: string): string {
|
|
|
|
|
const result = spawnSync("sha256sum", { input: value, encoding: "utf8" });
|
|
|
|
|
return `sha256:${(result.stdout.split(/\s+/u)[0] ?? "").trim()}`;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderPlan(result: Record<string, unknown>): RenderedCliResult {
|
|
|
|
|
const target = rec(result.target);
|
|
|
|
|
const exposure = rec(result.publicExposure);
|
|
|
|
|
const failed = arr(result.policy).filter((item) => item.ok === false);
|
|
|
|
|
const lines = [
|
|
|
|
|
"PLATFORM-INFRA WEBTERM PLAN",
|
|
|
|
|
...table(["FIELD", "VALUE", "DETAIL", "VALUE"], [
|
|
|
|
|
["TARGET", str(target.id), "mode", str(target.mode)],
|
|
|
|
|
["PORT", str(target.hostPort), "container", str(target.containerName)],
|
|
|
|
|
["IMAGE", str(target.image), "compose", str(rec(result.compose).path)],
|
|
|
|
|
["PUBLIC", bool(exposure.enabled), "url", str(exposure.publicBaseUrl)],
|
|
|
|
|
["UPSTREAM", str(exposure.upstream), "pk01", str(exposure.pk01Route)],
|
|
|
|
|
["POLICY", failed.length === 0 ? "ok" : `failed=${failed.length}`, "valuesPrinted", "false"],
|
|
|
|
|
]),
|
|
|
|
|
"",
|
|
|
|
|
"NEXT",
|
|
|
|
|
" dry-run: bun scripts/cli.ts platform-infra webterm apply --dry-run",
|
|
|
|
|
" apply: bun scripts/cli.ts platform-infra webterm apply --confirm",
|
|
|
|
|
" status: bun scripts/cli.ts platform-infra webterm status",
|
|
|
|
|
];
|
|
|
|
|
return rendered(result, "platform-infra webterm plan", lines);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderApply(result: Record<string, unknown>): RenderedCliResult {
|
|
|
|
|
const target = rec(result.target);
|
|
|
|
|
const compose = rec(result.compose);
|
|
|
|
|
const localProbe = rec(result.localProbe);
|
|
|
|
|
const publicProbe = rec(result.publicProbe);
|
|
|
|
|
const caddy = rec(result.pk01Caddy);
|
|
|
|
|
const lines = [
|
|
|
|
|
"PLATFORM-INFRA WEBTERM APPLY",
|
|
|
|
|
...table(["TARGET", "PORT", "MODE", "STATUS"], [[str(target.id), str(target.hostPort), str(result.mode), result.ok === false ? "failed" : "ok"]]),
|
|
|
|
|
"",
|
|
|
|
|
"COMPOSE",
|
|
|
|
|
...table(["PATH", "PROJECT", "UP"], [[str(compose.path), str(target.composeProject), str(rec(compose.up).exitCode, "-")]]),
|
|
|
|
|
"",
|
|
|
|
|
"CHECKS",
|
|
|
|
|
...table(["CHECK", "OK", "DETAIL"], [
|
|
|
|
|
["local", bool(localProbe.ok), str(localProbe.url, "-")],
|
|
|
|
|
["pk01Caddy", bool(caddy.ok), str(caddy.action, str(caddy.hostname, "-"))],
|
|
|
|
|
["public", bool(publicProbe.ok), str(publicProbe.url, "-")],
|
|
|
|
|
]),
|
|
|
|
|
"",
|
|
|
|
|
"NEXT",
|
|
|
|
|
" status: bun scripts/cli.ts platform-infra webterm status",
|
|
|
|
|
" validate: bun scripts/cli.ts platform-infra webterm validate",
|
|
|
|
|
];
|
|
|
|
|
return rendered(result, "platform-infra webterm apply", lines);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderStatus(result: Record<string, unknown>): RenderedCliResult {
|
|
|
|
|
const target = rec(result.target);
|
|
|
|
|
const container = rec(result.container);
|
|
|
|
|
const localProbe = rec(result.localProbe);
|
|
|
|
|
const publicProbe = rec(result.publicProbe);
|
|
|
|
|
const lines = [
|
|
|
|
|
"PLATFORM-INFRA WEBTERM STATUS",
|
|
|
|
|
...table(["TARGET", "PORT", "CONTAINER", "STATUS"], [[str(target.id), str(target.hostPort), str(target.containerName), result.ok === false ? "failed" : "ok"]]),
|
|
|
|
|
"",
|
|
|
|
|
"CONTAINER",
|
|
|
|
|
str(container.ps, "-"),
|
|
|
|
|
"",
|
|
|
|
|
"CHECKS",
|
|
|
|
|
...table(["CHECK", "OK", "DETAIL"], [
|
|
|
|
|
["local", bool(localProbe.ok), str(localProbe.url, "-")],
|
|
|
|
|
["public", bool(publicProbe.ok), str(publicProbe.url, "-")],
|
|
|
|
|
]),
|
|
|
|
|
];
|
|
|
|
|
return rendered(result, "platform-infra webterm status", lines);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function renderValidate(result: Record<string, unknown>): RenderedCliResult {
|
|
|
|
|
const dns = rec(result.dns);
|
|
|
|
|
const localProbe = rec(result.localProbe);
|
|
|
|
|
const publicProbe = rec(result.publicProbe);
|
|
|
|
|
const lines = [
|
|
|
|
|
"PLATFORM-INFRA WEBTERM VALIDATE",
|
|
|
|
|
...table(["CHECK", "OK", "DETAIL"], [
|
|
|
|
|
["dns", bool(dns.ok), values(dns.addresses).map(String).join(",") || "-"],
|
|
|
|
|
["local", bool(localProbe.ok), str(localProbe.url, "-")],
|
|
|
|
|
["public", bool(publicProbe.ok), str(publicProbe.url, "-")],
|
|
|
|
|
]),
|
|
|
|
|
];
|
|
|
|
|
return rendered(result, "platform-infra webterm validate", lines);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function rendered(result: Record<string, unknown>, command: string, lines: string[]): RenderedCliResult {
|
|
|
|
|
return { ok: result.ok !== false, command, renderedText: lines.join("\n"), contentType: "text/plain" };
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function rec(value: unknown): Record<string, unknown> {
|
|
|
|
|
return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : {};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function arr(value: unknown): Record<string, unknown>[] {
|
|
|
|
|
return Array.isArray(value) ? value.map(rec) : [];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function values(value: unknown): unknown[] {
|
|
|
|
|
return Array.isArray(value) ? value : [];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function str(value: unknown, fallback = "-"): string {
|
|
|
|
|
return value === undefined || value === null || value === "" ? fallback : String(value);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function bool(value: unknown): string {
|
|
|
|
|
return value === true ? "yes" : value === false ? "no" : "-";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function table(headers: string[], rows: string[][]): string[] {
|
|
|
|
|
const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0)));
|
|
|
|
|
const renderRow = (row: string[]) => row.map((cell, index) => cell.padEnd(widths[index] ?? cell.length)).join(" ").trimEnd();
|
|
|
|
|
return [renderRow(headers), ...rows.map(renderRow)];
|
|
|
|
|
}
|
Codex