Initial commit

Author: ddrayko

.env.example

@@ -0,0 +1,30 @@
+# Server
+PORT=3000
+NODE_ENV=development
+
+# JWT — Generate with: openssl rand -hex 64
+JWT_SECRET=change_me_to_a_random_hex_string
+JWT_EXPIRES_IN=2h
+
+# MariaDB
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_USER=zerohost
+DB_PASSWORD=change_me
+DB_NAME=zerohost_dashboard
+
+# Pterodactyl Panel (Application API)
+PTERO_URL=https://panel.your-domain.com
+PTERO_API_KEY=change_me
+
+# Encryption key for sensitive data — Generate with: openssl rand -hex 32
+ENCRYPTION_KEY=change_me_to_a_random_hex_string
+
+# Cloudflare Turnstile
+TURNSTILE_SECRET=change_me
+
+# Session & Cookie
+COOKIE_SECRET=change_me_to_a_random_string
+
+# Logging
+LOG_LEVEL=info

.github/workflows/deploy-beta.yml

@@ -0,0 +1,20 @@
+name: Deploy Beta
+
+on:
+  push:
+    branches: [beta]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: SSH and deploy
+        uses: appleboy/ssh-action@v1.2.0
+        with:
+          host: ${{ secrets.SSH_HOST }}
+          username: ${{ secrets.SSH_USER }}
+          password: ${{ secrets.SSH_PASSWORD }}
+          port: ${{ secrets.SSH_PORT || 22 }}
+          script: |
+            cd ${{ secrets.BETA_PATH }}
+            git pull

.github/workflows/deploy-main.yml

@@ -0,0 +1,20 @@
+name: Deploy Main
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: SSH and deploy
+        uses: appleboy/ssh-action@v1.2.0
+        with:
+          host: ${{ secrets.SSH_HOST }}
+          username: ${{ secrets.SSH_USER }}
+          password: ${{ secrets.SSH_PASSWORD }}
+          port: ${{ secrets.SSH_PORT || 22 }}
+          script: |
+            cd ${{ secrets.MAIN_PATH }}
+            git pull

.gitignore

@@ -0,0 +1,32 @@
+# Environnement
+.env
+
+# Node
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# OS
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+
+# IDE
+.idea/
+.vscode/
+*.sublime-project
+*.sublime-workspace
+
+# Logs
+logs/
+*.log
+
+# Runtime
+port.txt
+reboot.sh
+
+# Secrets (if any local dump)
+*.pem
+*.key

config/db.js

@@ -0,0 +1,47 @@
+import mariadb from 'mariadb';
+import dotenv from 'dotenv';
+import { fileURLToPath } from 'url';
+import { dirname, resolve } from 'path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: resolve(__dirname, '..', '.env') });
+
+const pool = mariadb.createPool({
+  host: process.env.DB_HOST,
+  port: parseInt(process.env.DB_PORT || '3306'),
+  user: process.env.DB_USER,
+  password: process.env.DB_PASSWORD,
+  database: process.env.DB_NAME,
+  connectionLimit: 10,
+  acquireTimeout: 10000,
+  insertIdAsNumber: true,
+});
+
+export async function query(sql, params = []) {
+  let lastErr;
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    let conn;
+    try {
+      conn = await pool.getConnection();
+      const rows = await conn.query(sql, params);
+      return rows;
+    } catch (err) {
+      lastErr = err;
+      if (err.code === 'ECONNRESET' || err.code === 'PROTOCOL_CONNECTION_LOST' || err.message?.includes('timeout')) {
+        console.error(`DB query attempt ${attempt}/3 failed:`, err.message);
+        if (attempt < 3) await new Promise(r => setTimeout(r, 100 * attempt));
+        continue;
+      }
+      throw err;
+    } finally {
+      if (conn) conn.release();
+    }
+  }
+  throw lastErr;
+}
+
+export async function getConnection() {
+  return await pool.getConnection();
+}
+
+export default pool;

config/migrate.js

@@ -0,0 +1,94 @@
+import { query } from './db.js';
+
+const tables = {
+  users: {
+    columns: [
+      { name: 'id', def: 'INT AUTO_INCREMENT PRIMARY KEY' },
+      { name: 'email', def: 'VARCHAR(255) NOT NULL' },
+      { name: 'username', def: 'VARCHAR(255) NOT NULL' },
+      { name: 'password_hash', def: 'VARCHAR(255) NOT NULL' },
+      { name: 'ptero_user_id', def: 'INT' },
+      { name: 'ptero_uuid', def: 'VARCHAR(255)' },
+      { name: 'first_name', def: 'VARCHAR(255)' },
+      { name: 'last_name', def: 'VARCHAR(255)' },
+      { name: 'password_set', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
+      { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
+    ],
+  },
+  server_meta: {
+    columns: [
+      { name: 'id', def: 'INT AUTO_INCREMENT PRIMARY KEY' },
+      { name: 'ptero_server_id', def: 'INT NOT NULL' },
+      { name: 'user_id', def: 'INT NOT NULL' },
+      { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
+      { name: 'expires_at', def: 'TIMESTAMP NOT NULL' },
+      { name: 'status', def: "ENUM('active', 'suspended', 'expired') DEFAULT 'active'" },
+    ],
+  },
+  user_ips: {
+    columns: [
+      { name: 'id', def: 'INT AUTO_INCREMENT PRIMARY KEY' },
+      { name: 'user_id', def: 'INT NOT NULL' },
+      { name: 'ip_address', def: 'VARCHAR(45) NOT NULL' },
+      { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },
+    ],
+  },
+
+};
+
+function escapeId(id) {
+  return '`' + String(id).replace(/`/g, '``') + '`';
+}
+
+function escapeLike(id) {
+  return String(id).replace(/[%_\\]/g, '\\$&');
+}
+
+const constraints = [
+  { table: 'server_meta', sql: 'ALTER TABLE server_meta ADD INDEX idx_expires (expires_at)', name: 'idx_expires' },
+  { table: 'server_meta', sql: 'ALTER TABLE server_meta ADD INDEX idx_user (user_id)', name: 'idx_user' },
+  { table: 'server_meta', sql: 'ALTER TABLE server_meta ADD INDEX idx_status (status)', name: 'idx_status' },
+  { table: 'user_ips', sql: 'ALTER TABLE user_ips ADD INDEX idx_ip (ip_address)', name: 'idx_ip' },
+  { table: 'user_ips', sql: 'ALTER TABLE user_ips ADD INDEX idx_user (user_id)', name: 'idx_user' },
+  { table: 'user_ips', sql: 'ALTER TABLE user_ips ADD CONSTRAINT fk_user_ips_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE', name: 'fk_user_ips_user' },
+
+];
+
+export async function migrate() {
+  for (const [table, schema] of Object.entries(tables)) {
+    try {
+      const safeTable = escapeId(table);
+      const exists = await query(`SHOW TABLES LIKE ?`, [escapeLike(table)]);
+      if (exists.length === 0) {
+        const colDefs = schema.columns.map(c => `${escapeId(c.name)} ${c.def}`).join(', ');
+        await query(`CREATE TABLE ${safeTable} (${colDefs})`);
+        console.log(`Created table: ${table}`);
+        continue;
+      }
+
+      for (const col of schema.columns) {
+        try {
+          const safeCol = escapeId(col.name);
+          const cols = await query(`SHOW COLUMNS FROM ${safeTable} LIKE ?`, [escapeLike(col.name)]);
+          if (cols.length === 0) {
+            await query(`ALTER TABLE ${safeTable} ADD COLUMN ${safeCol} ${col.def}`);
+            console.log(`Added column ${table}.${col.name}`);
+          }
+        } catch (err) {
+          console.error(`Migration error ${table}.${col.name}:`, err.message);
+        }
+      }
+    } catch (err) {
+      console.error(`Migration error for table ${table}:`, err.message);
+    }
+  }
+
+  for (const c of constraints) {
+    try {
+      await query(c.sql);
+      console.log(`Applied constraint: ${c.name}`);
+    } catch {
+      // Constraint already exists or table missing — safe to ignore
+    }
+  }
+}

config/pterodactyl.js

@@ -0,0 +1,18 @@
+export const PTERO_URL = process.env.PTERO_URL || 'https://panel.zero-host.org';
+export const PTERO_API_KEY = process.env.PTERO_API_KEY || '';
+
+export const SERVER_LIMITS = {
+  memory: 512,
+  swap: 0,
+  disk: 3072,
+  io: 500,
+  cpu: 50,
+};
+
+export const FEATURE_LIMITS = {
+  databases: 0,
+  allocations: 1,
+  backups: 1,
+};
+
+export const DEPLOY_LOCATIONS = [1];

config/turnstile.js

@@ -0,0 +1,30 @@
+const TURNSTILE_SECRET = process.env.TURNSTILE_SECRET;
+
+if (!TURNSTILE_SECRET) {
+  console.error('Missing TURNSTILE_SECRET environment variable');
+}
+
+async function fetchWithTimeout(url, options = {}, timeout = 10000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeout);
+  try {
+    return await fetch(url, { ...options, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function verifyTurnstile(token) {
+  if (!token) return false;
+  try {
+    const res = await fetchWithTimeout('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ secret: TURNSTILE_SECRET, response: token }),
+    });
+    const data = await res.json();
+    return data.success === true;
+  } catch {
+    return false;
+  }
+}

middleware/auth.js

@@ -0,0 +1,31 @@
+import jwt from 'jsonwebtoken';
+
+const JWT_SECRET = process.env.JWT_SECRET;
+
+if (!JWT_SECRET) {
+  console.error('Missing JWT_SECRET environment variable');
+}
+
+export function authenticateToken(req, res, next) {
+  const authHeader = req.headers['authorization'];
+  const token = authHeader && authHeader.split(' ')[1];
+
+  if (!token) {
+    return res.status(401).json({ error: 'Access token required' });
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    req.user = decoded;
+    next();
+  } catch {
+    return res.status(403).json({ error: 'Invalid or expired token' });
+  }
+}
+
+export function generateToken(payload) {
+  return jwt.sign(payload, JWT_SECRET, {
+    expiresIn: process.env.JWT_EXPIRES_IN || '2h',
+    algorithm: 'HS256',
+  });
+}