feat(proxy): idempotent interactive installer; retire credential-embedding legacy scripts
install.js (node, replaces install_proxy.sh + setup.js + update_*.sh + get_proxy.sh): - sections: preflight, deploy, config import/create, credentials, legacy migration, systemd unit, system-wide proxy (bashrc/apt/docker/snapd/ollama), verify - idempotent: re-run converges; tests prove a second non-interactive run shows zero CHANGED - imports existing /opt configs non-destructively; asks before changing - credentials: prompted when keyring entry missing; verified with ONE CONNECT round-trip before storing; 407 responses are never stored (anti-lockout); unreachable upstream stores nothing - legacy migration: removes bashrc #PROXY_A93JK2 line + plaintext-cred files, rewrites cred-embedding apt/snap/service drop-ins to the bridge URL - flags: --dry-run, --non-interactive (fails listing missing info), --no-systemd Tests cover dry-run-no-op, idempotency, verify-store-on-200, refuse-on-407.
This commit is contained in:
tke committed
1 parent
c514f32661
commit
3f9be30784
8 files changed
+711
-380
No files matched your search
@@ -0,0 +1,554 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
// Proxy Bridge installer — idempotent, interactive where information is missing.
|
||||
// Replaces the retired legacy scripts (install_proxy.sh, update_apt_proxy.sh,
|
||||
// update_bashrc_proxy.sh, update_service_proxy.sh, get_proxy.sh, setup.js).
|
||||
//
|
||||
// node install.js interactive install/repair (re-runnable)
|
||||
// node install.js --dry-run print the plan, change nothing
|
||||
// node install.js --non-interactive use existing/defaults; fail listing missing info
|
||||
// node install.js --no-systemd skip systemd user service + system service steps
|
||||
//
|
||||
// Hard rules honored here:
|
||||
// - Passwords are NEVER printed, logged, or stored in a file. Username goes to
|
||||
// user.json; the password goes to the keyring via secret-tool only AFTER a
|
||||
// single successful verification against the upstream (never on failure).
|
||||
// - Keyring presence is probed by `secret-tool lookup`'s exit code only.
|
||||
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const readline = require('readline');
|
||||
const { spawnSync, execFileSync } = require('child_process');
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// CLI parsing + paths
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
const args = process.argv.slice(2);
|
||||
const FLAGS = {
|
||||
dryRun: args.includes('--dry-run'),
|
||||
nonInteractive: args.includes('--non-interactive'),
|
||||
noSystemd: args.includes('--no-systemd'),
|
||||
};
|
||||
|
||||
const BRIDGE_DIR = process.env.PROXY_BRIDGE_DIR || '/opt/proxy-bridge';
|
||||
const BIN_DIR = process.env.PROXY_BRIDGE_BIN_DIR || path.join(os.homedir(), '.local', 'bin');
|
||||
const SYSTEMD_USER_DIR = process.env.PROXY_BRIDGE_SYSTEMD_USER_DIR || path.join(os.homedir(), '.config', 'systemd', 'user');
|
||||
const SRC_DIR = __dirname; // install.js lives next to bridge.js/proxyctl.js in the repo
|
||||
const BRIDGE_URL = 'http://127.0.0.1:8888/';
|
||||
const BASHRC = process.env.PROXY_BRIDGE_BASHRC || path.join(os.homedir(), '.bashrc');
|
||||
const APT_CONF = process.env.PROXY_BRIDGE_APT_CONF || '/etc/apt/apt.conf.d/80proxy-bridge';
|
||||
|
||||
const RUNTIME_FILES = ['config.json', 'user.json', 'profile.json', 'overrides.json', 'remotes.json'];
|
||||
const CODE_FILES = ['bridge.js', 'proxyctl.js'];
|
||||
|
||||
const sectionResults = []; // { section, status: CHANGED|OK|SKIPPED|FAILED, detail }
|
||||
function report(section, status, detail = '') {
|
||||
sectionResults.push({ section, status, detail });
|
||||
const color = { CHANGED: '\x1b[33m', OK: '\x1b[32m', SKIPPED: '\x1b[36m', FAILED: '\x1b[31m' }[status] || '';
|
||||
console.log(`${color}[${status}]\x1b[0m ${section}${detail ? ` — ${detail}` : ''}`);
|
||||
}
|
||||
|
||||
function run(cmd, args, opts = {}) {
|
||||
if (FLAGS.dryRun && !opts.readOnly) {
|
||||
return { status: 0, stdout: '', stderr: '', dryRun: true };
|
||||
}
|
||||
return spawnSync(cmd, args, { encoding: 'utf8', ...opts });
|
||||
}
|
||||
|
||||
function sudoOk() {
|
||||
const r = run('sudo', ['-n', 'true'], { readOnly: true });
|
||||
return r.status === 0;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Interactive prompting
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
let rl = null;
|
||||
function getRl() {
|
||||
if (!rl) rl = readline.createInterface({ input: process.stdin, output: process.stdout });
|
||||
return rl;
|
||||
}
|
||||
|
||||
function ask(question, defaultValue = '') {
|
||||
return new Promise((resolve) => {
|
||||
getRl().question(question + (defaultValue ? ` [${defaultValue}]: ` : ': '), (a) => {
|
||||
resolve(a.trim() || defaultValue);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function askSecret(question) {
|
||||
return new Promise((resolve) => {
|
||||
const r = getRl();
|
||||
const oldWrite = r._writeToOutput;
|
||||
r._writeToOutput = function (s) {
|
||||
if (s === '\n' || s === '\r' || s === '\r\n') r.output.write(s);
|
||||
else if (s.includes(question)) r.output.write(s); // initial prompt
|
||||
else r.output.write('*');
|
||||
};
|
||||
r.question(question + ': ', (a) => { r._writeToOutput = oldWrite; r.output.write('\n'); resolve(a.trim()); });
|
||||
});
|
||||
}
|
||||
|
||||
async function askConfirm(question, defaultYes = true) {
|
||||
if (FLAGS.nonInteractive) return defaultYes;
|
||||
const a = (await ask(`${question} (y/n)`, defaultYes ? 'y' : 'n')).toLowerCase();
|
||||
return a === 'y';
|
||||
}
|
||||
|
||||
function requireInfo(name, value) {
|
||||
if (value) return value;
|
||||
throw new Error(`MISSING_INFO:${name}`);
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: preflight
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function sectionPreflight() {
|
||||
const S = 'Preflight';
|
||||
if (process.getuid && process.getuid() === 0) {
|
||||
report(S, 'FAILED', 'run as your user, not root — sudo is invoked per-step when needed');
|
||||
return false;
|
||||
}
|
||||
const nodeV = run('node', ['--version'], { readOnly: true });
|
||||
if (nodeV.status !== 0) { report(S, 'FAILED', 'node not on PATH'); return false; }
|
||||
const st = run('which', ['secret-tool'], { readOnly: true });
|
||||
if (st.status !== 0) {
|
||||
if (FLAGS.nonInteractive) { report(S, 'FAILED', 'libsecret-tools missing (apt install -y libsecret-tools)'); return false; }
|
||||
report(S, 'CHANGED', 'libsecret-tools missing — will attempt install (sudo apt-get install -y libsecret-tools)');
|
||||
run('sudo', ['apt-get', 'install', '-y', 'libsecret-tools', '-qq']);
|
||||
if (run('which', ['secret-tool'], { readOnly: true }).status !== 0) {
|
||||
report(S, 'FAILED', 'libsecret-tools install failed');
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
report(S, 'OK', `node ${nodeV.stdout.trim()}, secret-tool present`);
|
||||
return true;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: deploy code to BRIDGE_DIR
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function sectionDeploy() {
|
||||
const S = 'Deploy code';
|
||||
let changed = false;
|
||||
|
||||
if (!FLAGS.dryRun) {
|
||||
fs.mkdirSync(BRIDGE_DIR, { recursive: true });
|
||||
}
|
||||
for (const f of CODE_FILES) {
|
||||
const src = path.join(SRC_DIR, f);
|
||||
const dst = path.join(BRIDGE_DIR, f);
|
||||
const srcBuf = fs.readFileSync(src);
|
||||
let dstBuf = null;
|
||||
try { dstBuf = fs.readFileSync(dst); } catch {}
|
||||
if (!dstBuf || !srcBuf.equals(dstBuf)) {
|
||||
changed = true;
|
||||
if (!FLAGS.dryRun) {
|
||||
fs.copyFileSync(src, dst);
|
||||
if (f === 'proxyctl.js') fs.chmodSync(dst, 0o755);
|
||||
}
|
||||
}
|
||||
}
|
||||
const cliLink = path.join(BIN_DIR, 'proxy-bridge');
|
||||
const wantTarget = path.join(BRIDGE_DIR, 'proxyctl.js');
|
||||
let current = null;
|
||||
try { current = fs.readlinkSync(cliLink); } catch {}
|
||||
if (current !== wantTarget) {
|
||||
changed = true;
|
||||
if (!FLAGS.dryRun) {
|
||||
fs.mkdirSync(BIN_DIR, { recursive: true });
|
||||
try { fs.unlinkSync(cliLink); } catch {}
|
||||
fs.symlinkSync(wantTarget, cliLink);
|
||||
}
|
||||
}
|
||||
report(S, changed ? 'CHANGED' : 'OK', changed ? 'code deployed to ' + BRIDGE_DIR : 'bridge.js/proxyctl.js identical, CLI symlink in place');
|
||||
return true;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: import / create runtime config (non-destructive)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; } }
|
||||
function fileExists(p) { try { fs.accessSync(p); return true; } catch { return false; } }
|
||||
|
||||
function keyringHasPassword(username) {
|
||||
if (!username) return false;
|
||||
const r = run('secret-tool', ['lookup', 'service', 'proxy-bridge', 'account', username], { readOnly: true });
|
||||
// Never inspect r.stdout — just the exit code.
|
||||
return r.status === 0 && !r.error;
|
||||
}
|
||||
|
||||
async function sectionConfig() {
|
||||
const S = 'Runtime config';
|
||||
const configPath = path.join(BRIDGE_DIR, 'config.json');
|
||||
const userPath = path.join(BRIDGE_DIR, 'user.json');
|
||||
const existingConfig = readJson(configPath);
|
||||
const existingUser = readJson(userPath);
|
||||
|
||||
// Import existing — show, ask before changing.
|
||||
if (existingConfig && existingConfig.host) {
|
||||
const enabled = existingConfig.enabled !== false;
|
||||
report(S, 'OK', `imported existing: ${enabled ? 'enabled' : 'disabled'} upstream ${existingConfig.host}:${existingConfig.port} (kept)`);
|
||||
if (!enabled) return { enabled: false };
|
||||
const username = existingUser && existingUser.username ? existingUser.username : null;
|
||||
return { enabled: true, host: existingConfig.host, port: String(existingConfig.port), username };
|
||||
}
|
||||
|
||||
// Nothing to import — ask.
|
||||
if (FLAGS.nonInteractive) {
|
||||
report(S, 'FAILED', 'no existing config.json to import and --non-interactive set (missing: upstream host/port or profiles mode)');
|
||||
return null;
|
||||
}
|
||||
console.log('\n--- Upstream proxy setup (no existing configuration found) ---');
|
||||
const enable = await askConfirm('Enable corporate upstream proxy?', true);
|
||||
if (!enable) {
|
||||
const cfg = { enabled: false };
|
||||
if (!FLAGS.dryRun) fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
|
||||
report(S, 'CHANGED', 'wrote config.json with upstream disabled');
|
||||
return { enabled: false };
|
||||
}
|
||||
const host = requireInfo('upstream-host', await ask('Corporate proxy hostname'));
|
||||
const port = await ask('Corporate proxy port', '8080');
|
||||
const username = requireInfo('username', await ask('Corporate username'));
|
||||
const cfg = { enabled: true, host, port };
|
||||
if (!FLAGS.dryRun) {
|
||||
fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2));
|
||||
fs.writeFileSync(userPath, JSON.stringify({ username }));
|
||||
}
|
||||
report(S, 'CHANGED', `wrote config.json (${host}:${port}) + user.json`);
|
||||
return { enabled: true, host, port: String(port), username };
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: credentials — verify before storing (anti-lockout)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// One single CONNECT attempt with candidate creds directly against the upstream.
|
||||
// NEVER retries, NEVER prints the password, resolves: ok | authfail | unreachable
|
||||
function verifyCredentials(host, port, username, password) {
|
||||
return new Promise((resolve) => {
|
||||
const net = require('net');
|
||||
const socket = net.connect(Number(port), host);
|
||||
let buf = Buffer.alloc(0);
|
||||
const finish = (r) => { try { socket.destroy(); } catch {} resolve(r); };
|
||||
socket.setTimeout(10000, () => finish('unreachable'));
|
||||
socket.once('connect', () => {
|
||||
const auth = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64');
|
||||
socket.write(`CONNECT 127.0.0.1:443 HTTP/1.1\r\nHost: 127.0.0.1:443\r\nProxy-Authorization: ${auth}\r\n\r\n`);
|
||||
});
|
||||
socket.on('data', (d) => {
|
||||
buf = Buffer.concat([buf, d]);
|
||||
const head = buf.toString('latin1').split('\r\n')[0] || '';
|
||||
const m = head.match(/^HTTP\/\d\.\d\s+(\d{3})/i);
|
||||
if (m || buf.includes('\r\n\r\n')) {
|
||||
const code = m ? Number(m[1]) : 0;
|
||||
// 200/4xx non-407 (e.g. 403 blocked target) = creds accepted; 407 = rejected.
|
||||
finish(code === 407 ? 'authfail' : (code > 0 ? 'ok' : 'unreachable'));
|
||||
}
|
||||
});
|
||||
socket.once('error', () => finish('unreachable'));
|
||||
socket.once('end', () => { if (buf.length === 0) finish('unreachable'); });
|
||||
});
|
||||
}
|
||||
|
||||
async function sectionCredentials(config) {
|
||||
const S = 'Credentials';
|
||||
if (!config || !config.enabled) { report(S, 'SKIPPED', 'upstream disabled'); return true; }
|
||||
|
||||
const username = config.username;
|
||||
if (username && keyringHasPassword(username)) {
|
||||
report(S, 'OK', `keyring entry present for account (not displayed)`);
|
||||
return true;
|
||||
}
|
||||
|
||||
if (FLAGS.nonInteractive) {
|
||||
report(S, 'FAILED', `keyring has no password for the configured account and --non-interactive set (missing: password)`);
|
||||
return false;
|
||||
}
|
||||
|
||||
console.log('\n--- Credential setup (one verification round-trip, result never stored on failure) ---');
|
||||
const user = username || requireInfo('username', await ask('Corporate username'));
|
||||
for (let attempt = 1; attempt <= 3; attempt++) {
|
||||
const pass = await askSecret(`Corporate password for ${user} (attempt ${attempt}/3)`);
|
||||
if (!pass) { console.log(' empty password, try again'); continue; }
|
||||
const verdict = await verifyCredentials(config.host, config.port, user, pass);
|
||||
if (verdict === 'ok') {
|
||||
if (!FLAGS.dryRun) {
|
||||
execFileSync('secret-tool', ['store', '--label=Proxy Bridge Credentials', 'service', 'proxy-bridge', 'account', user], { input: pass });
|
||||
}
|
||||
report(S, attempt > 1 ? 'CHANGED' : 'OK', 'credentials verified against upstream and stored in keyring');
|
||||
return true;
|
||||
}
|
||||
if (verdict === 'authfail') console.log(' upstream rejected these credentials (407). Not stored. Check the password.');
|
||||
else console.log(' could not reach the upstream proxy to verify. Credentials NOT stored (retry when online).');
|
||||
if (verdict === 'unreachable') return false; // don't re-prompt if we can't even verify
|
||||
}
|
||||
report(S, 'FAILED', 'credentials could not be verified after 3 attempts — nothing stored');
|
||||
return false;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: legacy artifact migration
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function sectionLegacy() {
|
||||
const S = 'Legacy migration';
|
||||
const findings = [];
|
||||
|
||||
// bashrc: legacy marker sourcing ~/.http_proxy (cred-bearing file from update_bashrc_proxy.sh)
|
||||
let bashrc = '';
|
||||
try { bashrc = fs.readFileSync(BASHRC, 'utf8'); } catch {}
|
||||
const legacyLineRe = /^.*#PROXY_A93JK2.*$/m;
|
||||
const legacyMatch = bashrc.match(legacyLineRe);
|
||||
const credFiles = ['.http_proxy', '.http_proxy.off', '.http_noproxy'].map(f => path.join(os.homedir(), f)).filter(fileExists);
|
||||
if (legacyMatch || credFiles.length > 0) {
|
||||
findings.push({ what: 'bashrc #PROXY_A93JK2 block' + (credFiles.length ? ` + ${credFiles.join(', ')} (contain PLAINTEXT credentials)` : ''), fix: 'remove legacy line' + (credFiles.length ? ' and delete cred files' : '') });
|
||||
}
|
||||
|
||||
// apt legacy file with userinfo
|
||||
const aptLegacy = '/etc/apt/apt.conf.d/80proxy';
|
||||
let aptLegacyHasCreds = false;
|
||||
try {
|
||||
const content = fs.readFileSync(aptLegacy, 'utf8');
|
||||
aptLegacyHasCreds = /:\/\/[^/\s]+:[^@\s]+@/.test(content); // presence only
|
||||
} catch {}
|
||||
if (aptLegacyHasCreds) findings.push({ what: `${aptLegacy} (contains embedded credentials)`, fix: 'delete (80proxy-bridge supersedes)' });
|
||||
|
||||
// snap proxy with userinfo
|
||||
const snapGet = run('snap', ['get', 'system', 'proxy.http', 'proxy.https'], { readOnly: true });
|
||||
if (snapGet.status === 0 && /:\/\/[^/\s]+:[^@\s]+@/.test(snapGet.stdout)) {
|
||||
findings.push({ what: 'snap system proxy.* (contain embedded credentials)', fix: 'point at bridge URL without creds (needs sudo)' });
|
||||
}
|
||||
|
||||
// systemd service drop-ins with userinfo
|
||||
for (const svc of ['docker', 'snapd', 'ollama']) {
|
||||
const f = `/etc/systemd/system/${svc}.service.d/http-proxy.conf`;
|
||||
try {
|
||||
const content = fs.readFileSync(f, 'utf8');
|
||||
if (/:\/\/[^/\s]+:[^@\s]+@/.test(content)) {
|
||||
findings.push({ what: `${f} (contains embedded credentials)`, fix: `rewrite to bridge URL (needs sudo)` });
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
|
||||
if (findings.length === 0) { report(S, 'OK', 'no legacy credential-embedding artifacts found'); return true; }
|
||||
|
||||
console.log('\nLegacy artifacts found:');
|
||||
findings.forEach((f, i) => console.log(` ${i + 1}. ${f.what}\n fix: ${f.fix}`));
|
||||
const proceed = await askConfirm('Migrate/remove these now?', true);
|
||||
if (!proceed) { report(S, 'SKIPPED', 'user deferred legacy migration'); return true; }
|
||||
|
||||
let changed = false;
|
||||
if (legacyMatch) {
|
||||
if (!FLAGS.dryRun) {
|
||||
const cleaned = bashrc.split('\n').filter((line, idx, arr) => {
|
||||
if (line.includes('#PROXY_A93JK2')) return false;
|
||||
return true;
|
||||
}).join('\n');
|
||||
fs.writeFileSync(BASHRC, cleaned);
|
||||
}
|
||||
changed = true;
|
||||
}
|
||||
if (credFiles.length > 0) {
|
||||
const del = await askConfirm(`Delete plaintext-credential file(s) ${credFiles.join(', ')}?`, true);
|
||||
if (del && !FLAGS.dryRun) credFiles.forEach(f => fs.rmSync(f, { force: true }));
|
||||
changed = changed || del;
|
||||
}
|
||||
if (aptLegacyHasCreds) {
|
||||
if (!FLAGS.dryRun) run('sudo', ['rm', '-f', aptLegacy]);
|
||||
changed = true;
|
||||
}
|
||||
if (findings.some(f => f.what.startsWith('snap system'))) {
|
||||
if (!FLAGS.dryRun) {
|
||||
run('sudo', ['snap', 'set', 'system', `proxy.http=${BRIDGE_URL}`, `proxy.https=${BRIDGE_URL}`]);
|
||||
}
|
||||
changed = true;
|
||||
}
|
||||
for (const svc of ['docker', 'snapd', 'ollama']) {
|
||||
const f = `/etc/systemd/system/${svc}.service.d/http-proxy.conf`;
|
||||
try {
|
||||
const content = fs.readFileSync(f, 'utf8');
|
||||
if (/:\/\/[^/\s]+:[^@\s]+@/.test(content)) {
|
||||
if (!FLAGS.dryRun) {
|
||||
const clean = `[Service]\nEnvironment="HTTP_PROXY=${BRIDGE_URL}"\nEnvironment="HTTPS_PROXY=${BRIDGE_URL}"\nEnvironment="NO_PROXY=localhost,127.0.0.1,::1"\n`;
|
||||
fs.writeFileSync(`/tmp/proxy-bridge-dropin.tmp`, clean);
|
||||
run('sudo', ['cp', `/tmp/proxy-bridge-dropin.tmp`, f]);
|
||||
fs.rmSync(`/tmp/proxy-bridge-dropin.tmp`, { force: true });
|
||||
}
|
||||
changed = true;
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
report(S, changed ? 'CHANGED' : 'OK', changed ? `migrated ${findings.length} artifact(s)` : 'no changes needed');
|
||||
return true;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: systemd user service
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
function sectionUnit() {
|
||||
const S = 'systemd service';
|
||||
if (FLAGS.noSystemd) { report(S, 'SKIPPED', '--no-systemd'); return true; }
|
||||
const unitPath = path.join(SYSTEMD_USER_DIR, 'proxy-bridge.service');
|
||||
const nodeBin = process.execPath;
|
||||
const want = `[Unit]\nDescription=Local Proxy Bridge (Keyring Auth)\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=${nodeBin} ${BRIDGE_DIR}/bridge.js\nRestart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
|
||||
let current = null;
|
||||
try { current = fs.readFileSync(unitPath, 'utf8'); } catch {}
|
||||
if (current === want) {
|
||||
report(S, 'OK', 'unit file up to date');
|
||||
return true;
|
||||
}
|
||||
if (!FLAGS.dryRun) {
|
||||
fs.mkdirSync(SYSTEMD_USER_DIR, { recursive: true });
|
||||
fs.writeFileSync(unitPath, want);
|
||||
run('systemctl', ['--user', 'daemon-reload']);
|
||||
run('systemctl', ['--user', 'enable', 'proxy-bridge.service']);
|
||||
}
|
||||
report(S, 'CHANGED', 'unit file written + enabled (restart happens in verify section with your consent)');
|
||||
return true;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: system-wide proxy point-at-bridge (idempotent)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function sectionSystemWide() {
|
||||
const S = 'System-wide proxy';
|
||||
let changed = false;
|
||||
|
||||
// bashrc bridge block (marker-guarded)
|
||||
let bashrc = '';
|
||||
try { bashrc = fs.readFileSync(BASHRC, 'utf8'); } catch {}
|
||||
const marker = '#PROXY_BRIDGE_CONFIG';
|
||||
const block = `\n# Local Proxy Bridge Configuration ${marker}\nexport http_proxy="${BRIDGE_URL}"\nexport https_proxy="${BRIDGE_URL}"\nexport HTTP_PROXY="${BRIDGE_URL}"\nexport HTTPS_PROXY="${BRIDGE_URL}"\nexport NO_PROXY="localhost,127.0.0.1,::1"\nexport no_proxy="localhost,127.0.0.1,::1"\n`;
|
||||
if (!bashrc.includes(marker)) {
|
||||
changed = true;
|
||||
if (!FLAGS.dryRun) fs.writeFileSync(BASHRC, bashrc.replace(/\n*$/, '\n') + block);
|
||||
}
|
||||
|
||||
// apt conf (needs sudo; content-compare via sudo cat is awkward — check existence + no-userinfo suffices for OK)
|
||||
let aptOk = false;
|
||||
try {
|
||||
const c = fs.readFileSync(APT_CONF, 'utf8');
|
||||
aptOk = c.includes('127.0.0.1:8888') && !/:\/\/[^/\s]+:[^@\s]+@/.test(c);
|
||||
} catch {}
|
||||
if (!aptOk) {
|
||||
const doIt = FLAGS.nonInteractive ? true : await askConfirm(`Write ${APT_CONF} with bridge URL (sudo)?`, true);
|
||||
if (doIt) {
|
||||
changed = true;
|
||||
if (!FLAGS.dryRun) {
|
||||
const tmpW = `/tmp/proxy-bridge-apt.tmp`;
|
||||
fs.writeFileSync(tmpW, `Acquire::http::Proxy "${BRIDGE_URL}";\nAcquire::https::Proxy "${BRIDGE_URL}";\n`);
|
||||
run('sudo', ['cp', tmpW, APT_CONF]);
|
||||
fs.rmSync(tmpW, { force: true });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// service drop-ins (docker/snapd/ollama) — bridge URL only
|
||||
for (const svc of ['docker', 'snapd', 'ollama']) {
|
||||
const f = `/etc/systemd/system/${svc}.service.d/http-proxy.conf`;
|
||||
let ok = false;
|
||||
try {
|
||||
const c = fs.readFileSync(f, 'utf8');
|
||||
ok = c.includes('127.0.0.1:8888') && !/:\/\/[^/\s]+:[^@\s]+@/.test(c);
|
||||
} catch {}
|
||||
if (!ok) {
|
||||
const svcExists = run('systemctl', ['list-unit-files', `${svc}.service`], { readOnly: true });
|
||||
if (svcExists.status !== 0 || !svcExists.stdout.includes(svc)) continue; // service not installed
|
||||
const doIt = FLAGS.nonInteractive ? true : await askConfirm(`Point ${svc} at the bridge (sudo + restart ${svc})?`, true);
|
||||
if (doIt) {
|
||||
changed = true;
|
||||
if (!FLAGS.dryRun) {
|
||||
const tmpW = `/tmp/proxy-bridge-dropin.tmp`;
|
||||
fs.writeFileSync(tmpW, `[Service]\nEnvironment="HTTP_PROXY=${BRIDGE_URL}"\nEnvironment="HTTPS_PROXY=${BRIDGE_URL}"\nEnvironment="NO_PROXY=localhost,127.0.0.1,::1"\n`);
|
||||
run('sudo', ['mkdir', '-p', path.dirname(f)]);
|
||||
run('sudo', ['cp', tmpW, f]);
|
||||
fs.rmSync(tmpW, { force: true });
|
||||
run('sudo', ['systemctl', 'daemon-reload']);
|
||||
run('sudo', ['systemctl', 'restart', svc]);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
report(S, changed ? 'CHANGED' : 'OK', changed ? 'system-wide proxy config updated' : 'bashrc/apt/services already point at the bridge');
|
||||
return true;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Section: verify (service restart happens here, with consent)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function sectionVerify() {
|
||||
const S = 'Verify';
|
||||
if (FLAGS.noSystemd) { report(S, 'SKIPPED', '--no-systemd (no restart/checks)'); return true; }
|
||||
|
||||
const active = run('systemctl', ['--user', 'is-active', 'proxy-bridge'], { readOnly: true }).stdout.trim();
|
||||
if (active !== 'active') {
|
||||
const doIt = FLAGS.nonInteractive ? true : await askConfirm('Start/restart proxy-bridge now? (drops bridged connectivity briefly)', true);
|
||||
if (doIt && !FLAGS.dryRun) {
|
||||
run('systemctl', ['--user', 'restart', 'proxy-bridge']);
|
||||
await new Promise(r => setTimeout(r, 1500));
|
||||
}
|
||||
}
|
||||
const state = run('systemctl', ['--user', 'is-active', 'proxy-bridge'], { readOnly: true }).stdout.trim();
|
||||
if (state !== 'active') { report(S, 'FAILED', `service state: ${state || 'unknown'}`); return false; }
|
||||
|
||||
// ports listening
|
||||
const ss = run('ss', ['-tln'], { readOnly: true });
|
||||
const ports = [8888, 8889, 8890, 8891];
|
||||
const listening = ports.filter(p => ss.stdout.includes(`127.0.0.1:${p}`));
|
||||
const allCore = listening.length === ports.length;
|
||||
report(S, allCore ? 'OK' : 'FAILED', `service active; core ports listening: ${listening.join(',') || 'none'}`);
|
||||
return allCore;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Main
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function main() {
|
||||
console.log(`=== Proxy Bridge installer ${FLAGS.dryRun ? '(DRY RUN) ' : ''}===`);
|
||||
console.log(`target: ${BRIDGE_DIR}`);
|
||||
const missingInfo = [];
|
||||
let credsFailed = false;
|
||||
try {
|
||||
if (!sectionPreflight()) throw new Error('PREFLIGHT_FAILED');
|
||||
if (!sectionDeploy()) throw new Error('DEPLOY_FAILED');
|
||||
const config = await sectionConfig();
|
||||
if (config === null) throw new Error('CONFIG_FAILED');
|
||||
credsFailed = !(await sectionCredentials(config));
|
||||
// Do not abort on credential failure: remaining sections show/prep what
|
||||
// else needs doing, and the summary still exits non-zero.
|
||||
if (!await sectionLegacy()) throw new Error('LEGACY_FAILED');
|
||||
if (!sectionUnit()) throw new Error('UNIT_FAILED');
|
||||
if (!await sectionSystemWide()) throw new Error('SYSWIDE_FAILED');
|
||||
if (!FLAGS.dryRun && !credsFailed) await sectionVerify();
|
||||
else report('Verify', 'SKIPPED', FLAGS.dryRun ? 'dry run' : 'credentials not verified; skipping restart');
|
||||
} catch (e) {
|
||||
if (String(e.message).startsWith('MISSING_INFO:')) {
|
||||
missingInfo.push(e.message.split(':')[1]);
|
||||
} else if (!['PREFLIGHT_FAILED', 'DEPLOY_FAILED', 'CONFIG_FAILED', 'CREDS_FAILED', 'LEGACY_FAILED', 'UNIT_FAILED', 'SYSWIDE_FAILED'].includes(e.message)) {
|
||||
throw e;
|
||||
}
|
||||
} finally {
|
||||
if (rl) rl.close();
|
||||
}
|
||||
const failed = sectionResults.filter(r => r.status === 'FAILED');
|
||||
console.log('\n=== Summary ===');
|
||||
sectionResults.forEach(r => console.log(` ${r.status.padEnd(8)} ${r.section}`));
|
||||
if (missingInfo.length) console.log(`\nMissing information for --non-interactive: ${missingInfo.join(', ')}`);
|
||||
if (FLAGS.dryRun) console.log('\nDry run: no changes were made.');
|
||||
process.exit(failed.length > 0 || missingInfo.length > 0 ? 1 : 0);
|
||||
}
|
||||
|
||||
main().catch(e => { console.error('installer error:', e.message); process.exit(1); });
|
||||
Reference in new issue
Block a user