Harden accessories and registry secrets

Author: devalade

src/cli/commands/deploy.ts

@@ -1,13 +1,15 @@
 import chalk from 'chalk';
+import { Result, type Result as ResultType } from 'better-result';
 import { loadConfig } from '../../config/loader.js';
 import { DeployService } from '../../services/deploy.service.js';
 import { LoggingExecutor } from '../../infrastructure/ssh/logging-executor.js';
 import { runRemoteCommandForTargets } from '../runner.js';
 import { ui } from '../ui.js';
-import type { ShipnodeConfig, ShipnodeApp } from '../../shared/types.js';
+import type { AccessoryConfig, ShipnodeConfig, ShipnodeApp } from '../../shared/types.js';
 import { getPm2Name } from '../../domain/pm2/apps.js';
-import { configForAppResult, configForServer, getServerTargets, resolveServerName } from '../../domain/servers.js';
+import { configForAppResult, configForServer, getServerTargets, resolveServerName, resolveServerNameResult } from '../../domain/servers.js';
 import { generateBackendCaddyfile, generateFrontendCaddyfile } from '../../services/caddy.service.js';
+import { type ServerTargetError } from '../../shared/result-errors.js';
 
 export async function cmdDeploy(cwd: string, options: { dryRun?: boolean; skipBuild?: boolean; app?: string; config?: string }): Promise<void> {
   let config: ShipnodeConfig;
@@ -54,12 +56,14 @@ export async function cmdDeploy(cwd: string, options: { dryRun?: boolean; skipBu
       const deployer = new DeployService(new LoggingExecutor(executor), deployConfig);
       await deployer.execute(cwd, options.skipBuild ?? false);
 
-      const lines = [
+      const lines: string[] = [
         `host     ${config.ssh.user}@${config.ssh.host}`,
-        ...deployConfig.apps.filter((a) => a.domain).map((a) => `url      https://${a.domain}`),
-      ].filter(Boolean).join('\n');
+      ];
+      for (const deployedApp of deployConfig.apps) {
+        if (deployedApp.domain) lines.push(`url      https://${deployedApp.domain}`);
+      }
 
-      ui.note(lines, 'Done');
+      ui.note(lines.join('\n'), 'Done');
       ui.outro('Run shipnode status to check your app.');
     },
     { configPath: options.config },
@@ -96,6 +100,9 @@ function renderAppPlan(config: ShipnodeConfig, app: ShipnodeApp, skipBuild: bool
   }
 
   if (app.domain) serverRows.push(['Domain', app.domain]);
+  if (app.dependsOn?.length) serverRows.push(['Depends on', app.dependsOn.join(', ')]);
+
+  const dependencyWarnings = renderDependencyWarnings(config, app);
 
   const caddyPreview = renderCaddyPreview(config, app);
 
@@ -109,22 +116,21 @@ function renderAppPlan(config: ShipnodeConfig, app: ShipnodeApp, skipBuild: bool
     buildRows.push(['', chalk.dim('runs on remote server')]);
   }
 
-  const steps = [
+  const steps: string[] = [
     'Acquire deploy lock',
     'Create release directory',
     'Rsync files',
     'Install dependencies',
-    app.hooks?.preDeploy ? 'Run preDeploy hook' : '',
-    'Switch symlink (atomic)',
-    app.appType === 'backend' ? 'Reload PM2' : '',
-    app.healthCheck.enabled ? `Health check ${app.healthCheck.path}` : '',
-    'Record release',
-    'Clean old releases',
-    app.hooks?.postDeploy ? 'Run postDeploy hook' : '',
-    'Release lock',
-  ].filter(Boolean);
-
-  const flowRows: [string, string][] = steps.map((s, i) => [`${i + 1}.`, s as string]);
+  ];
+  if (app.hooks?.preDeploy) steps.push('Run preDeploy hook');
+  steps.push('Switch symlink (atomic)');
+  if (app.appType === 'backend') steps.push('Reload PM2');
+  if (app.healthCheck.enabled) steps.push(`Health check ${app.healthCheck.path}`);
+  steps.push('Record release', 'Clean old releases');
+  if (app.hooks?.postDeploy) steps.push('Run postDeploy hook');
+  steps.push('Release lock');
+
+  const flowRows: [string, string][] = steps.map((step, i) => [`${i + 1}.`, step]);
 
   return [
     chalk.bold(`App: ${app.name}`),
@@ -135,10 +141,28 @@ function renderAppPlan(config: ShipnodeConfig, app: ShipnodeApp, skipBuild: bool
     '',
     chalk.bold('  Deploy flow'),
     ...flowRows.map(([k, v]) => `    ${chalk.dim(k.padEnd(4))} ${v}`),
+    ...(dependencyWarnings.length ? ['', chalk.bold('  Dependency hints'), ...dependencyWarnings.map((line) => `    ${line}`)] : []),
     ...(caddyPreview ? ['', chalk.bold('  Caddy'), caddyPreview.split('\n').map((line) => `    ${line}`).join('\n')] : []),
   ].join('\n');
 }
 
+function renderDependencyWarnings(config: ShipnodeConfig, app: ShipnodeApp): string[] {
+  const dependencies = app.dependsOn ?? [];
+  if (dependencies.length === 0) return [];
+
+  const appServer = resolveServerName(config, app.on);
+  const warnings: string[] = [];
+  for (const name of dependencies) {
+    const accessory = config.accessories?.[name];
+    if (!accessory) continue;
+    const accessoryServer = resolveServerName(config, accessory.on);
+    if (appServer !== accessoryServer) {
+      warnings.push(`${name} runs on ${accessoryServer}; ${app.name} runs on ${appServer}. Confirm reachable networking.`);
+    }
+  }
+  return warnings;
+}
+
 function renderCaddyPreview(config: ShipnodeConfig, app: ShipnodeApp): string | null {
   if (!app.domain) return null;
   if (app.appType === 'frontend') {
@@ -166,5 +190,95 @@ export function printDryRun(config: ShipnodeConfig, skipBuild: boolean): void {
     .flatMap((targetConfig) => targetConfig.apps.map((app) => renderAppPlan(config, app, skipBuild)))
     .join('\n\n');
 
-  ui.note([header, '', perApp].join('\n'), 'Dry run — no changes will be made');
+  const accessories = renderAccessoriesPlan(config);
+  if (accessories.isErr()) {
+    ui.error(accessories.error.message);
+    process.exit(1);
+    return;
+  }
+
+  const output = [header, ''];
+  if (perApp) output.push(perApp);
+  if (accessories.value) output.push(accessories.value);
+  ui.note(output.join('\n'), 'Dry run — no changes will be made');
+}
+
+function renderAccessoriesPlan(config: ShipnodeConfig): ResultType<string, ServerTargetError> {
+  const accessories = Object.entries(config.accessories ?? {});
+  if (accessories.length === 0) return Result.ok('');
+
+  const rendered: string[] = [chalk.bold('Accessories')];
+  for (const [name, accessory] of accessories) {
+    const server = resolveAccessoryServer(config, accessory);
+    if (server.isErr()) return Result.err(server.error);
+
+    rendered.push(renderAccessoryPlan(name, accessory, server.value, config));
+  }
+
+  return Result.ok(rendered.join('\n\n'));
+}
+
+function resolveAccessoryServer(
+  config: ShipnodeConfig,
+  accessory: AccessoryConfig,
+): ResultType<string, ServerTargetError> {
+  return resolveServerNameResult(config, accessory.on);
+}
+
+function renderAccessoryPlan(
+  name: string,
+  accessory: AccessoryConfig,
+  serverName: string,
+  config: ShipnodeConfig,
+): string {
+  const registry = accessory.registry ?? config.registry;
+  const ports = Array.isArray(accessory.port) ? accessory.port : accessory.port ? [accessory.port] : [];
+  const rows: [string, string][] = [
+    ['Server', serverName],
+    ['Image', accessory.image],
+  ];
+
+  if (ports.length > 0) rows.push(['Ports', ports.join(', ')]);
+  if (accessory.directories?.length) rows.push(['Volumes', accessory.directories.join(', ')]);
+  if (accessory.networks?.length) rows.push(['Networks', accessory.networks.join(', ')]);
+  if (accessory.command) rows.push(['Command', Array.isArray(accessory.command) ? accessory.command.join(' ') : accessory.command]);
+  if (accessory.labels && Object.keys(accessory.labels).length > 0) rows.push(['Labels', Object.entries(accessory.labels).map(([key, value]) => `${key}=${value}`).join(', ')]);
+  if (accessory.restart) rows.push(['Restart', accessory.restart]);
+  if (accessory.resources) rows.push(['Resources', renderAccessoryResources(accessory.resources)]);
+  if (accessory.stopTimeout !== undefined) rows.push(['Stop timeout', `${accessory.stopTimeout}s`]);
+  if (registry) rows.push(['Registry', `${registry.server} (${registry.passwordEnv})`]);
+  if (accessory.healthCheck) rows.push(['Health check', accessory.healthCheck.command]);
+
+  const hasVolumeSetup = (accessory.directories ?? []).some((mount) => {
+    const [source] = mount.split(':');
+    return source !== undefined && source !== '' && !source.startsWith('/') && !source.startsWith('.') && !source.startsWith('~');
+  });
+  const hasNetworkSetup = (accessory.networks ?? []).length > 0;
+  const setupSteps = [
+    ...(hasVolumeSetup ? ['Inspect/create named Docker volumes'] : []),
+    ...(hasNetworkSetup ? ['Inspect/create Docker networks'] : []),
+  ];
+  const dockerSteps = [
+    registry ? `Login to ${registry.server} using $${registry.passwordEnv}` : 'Skip registry login',
+    ...setupSteps,
+    `Pull ${accessory.image}`,
+    `Recreate container shipnode-${name}`,
+    ...(accessory.healthCheck ? ['Run health check'] : []),
+  ];
+
+  return [
+    chalk.bold(`Accessory: ${name}`),
+    ...rows.map(([key, value]) => `  ${chalk.dim(key.padEnd(14))} ${value}`),
+    '',
+    chalk.bold('  Docker flow'),
+    ...dockerSteps.map((step, index) => `    ${chalk.dim(`${index + 1}.`.padEnd(4))} ${step}`),
+  ].join('\n');
+}
+
+function renderAccessoryResources(resources: NonNullable<AccessoryConfig['resources']>): string {
+  const parts: string[] = [];
+  if (resources.memory) parts.push(`memory=${resources.memory}`);
+  if (resources.memoryReservation) parts.push(`memoryReservation=${resources.memoryReservation}`);
+  if (resources.cpus) parts.push(`cpus=${resources.cpus}`);
+  return parts.join(', ');
 }

src/cli/commands/secrets.ts

@@ -0,0 +1,107 @@
+import { loadConfig } from '../../config/loader.js';
+import { getServerTargetResult } from '../../domain/servers.js';
+import { SshConnection } from '../../infrastructure/ssh/connection.js';
+import type { RegistryConfig, ShipnodeConfig } from '../../shared/types.js';
+import { ui } from '../ui.js';
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, "'\"'\"'")}'`;
+}
+
+function assertValidEnvName(name: string): void {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`Invalid secret name '${name}'. Use a valid shell environment variable name.`);
+  }
+}
+
+function secretSetCommand(name: string, value: string): string {
+  const quotedAssignment = shellQuote(`export ${name}=${shellQuote(value)}`);
+  return [
+    'mkdir -p ~/.shipnode',
+    'touch ~/.shipnode/secrets.env',
+    `grep -v '^export ${name}=' ~/.shipnode/secrets.env > ~/.shipnode/secrets.env.tmp || true`,
+    `printf '%s\\n' ${quotedAssignment} >> ~/.shipnode/secrets.env.tmp`,
+    'mv ~/.shipnode/secrets.env.tmp ~/.shipnode/secrets.env',
+    'chmod 600 ~/.shipnode/secrets.env',
+    'grep -q "shipnode/secrets.env" ~/.profile 2>/dev/null || printf \'\\n# shipnode secrets\\n[ -f ~/.shipnode/secrets.env ] && . ~/.shipnode/secrets.env\\n\' >> ~/.profile',
+  ].join(' && ');
+}
+
+function registryLoginCommand(registry: RegistryConfig): string {
+  return `. ~/.shipnode/secrets.env 2>/dev/null || true; ` +
+    `if [ -z "$${registry.passwordEnv}" ]; then echo "Registry password env ${registry.passwordEnv} is not set on the remote host" >&2; exit 1; fi; ` +
+    `printf '%s' "$${registry.passwordEnv}" | sudo docker login ${shellQuote(registry.server)} --username ${shellQuote(registry.username)} --password-stdin`;
+}
+
+async function runOnTarget(
+  config: ShipnodeConfig,
+  targetName: string | undefined,
+  command: string,
+): Promise<string> {
+  const target = getServerTargetResult(config, targetName);
+  if (target.isErr()) return target.error.message;
+
+  const ssh = new SshConnection();
+  try {
+    await ssh.connect(target.value.ssh);
+    await ssh.execOrThrow(command);
+    return '';
+  } finally {
+    ssh.disconnect();
+  }
+}
+
+export async function cmdSecretSet(
+  cwd: string,
+  name: string,
+  value: string | undefined,
+  options: { config?: string; on?: string },
+): Promise<void> {
+  try {
+    assertValidEnvName(name);
+    const secretValue = value ?? process.env[name];
+    if (secretValue === undefined) throw new Error(`Secret value missing. Pass value or set local ${name}.`);
+
+    const config = await loadConfig(cwd, options.config);
+    const error = await runOnTarget(config, options.on, secretSetCommand(name, secretValue));
+    if (error) {
+      ui.error(error);
+      process.exit(1);
+      return;
+    }
+    ui.success(`Secret '${name}' set`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ui.error(message);
+    process.exit(1);
+  }
+}
+
+export async function cmdRegistryLogin(cwd: string, options: { config?: string; on?: string }): Promise<void> {
+  try {
+    const config = await loadConfig(cwd, options.config);
+    if (!config.registry) throw new Error('No workspace registry configured.');
+
+    const value = process.env[config.registry.passwordEnv];
+    if (value !== undefined) {
+      const setError = await runOnTarget(config, options.on, secretSetCommand(config.registry.passwordEnv, value));
+      if (setError) {
+        ui.error(setError);
+        process.exit(1);
+        return;
+      }
+    }
+
+    const loginError = await runOnTarget(config, options.on, registryLoginCommand(config.registry));
+    if (loginError) {
+      ui.error(loginError);
+      process.exit(1);
+      return;
+    }
+    ui.success(`Logged in to ${config.registry.server}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ui.error(message);
+    process.exit(1);
+  }
+}

src/cli/index.ts

@@ -35,6 +35,7 @@ import {
   cmdAccessoryStatus,
   cmdAccessoryStop,
 } from './commands/accessory.js';
+import { cmdRegistryLogin, cmdSecretSet } from './commands/secrets.js';
 
 // Read version from package.json so `shipnode --version` stays in sync with the published
 // version automatically. The dist layout puts this file at dist/cli/index.js, so the
@@ -300,6 +301,24 @@ accessory.command('health <name>')
   .option('--config <path>', 'Use a specific config file')
   .action((name: string, opts) => cmdAccessoryHealth(process.cwd(), name, opts));
 
+// ── Secrets / Registry ───────────────────────────────────────────
+
+const secret = program.command('secret').description('Manage remote secrets');
+
+secret.command('set <name> [value]')
+  .description('Set a remote secret from an explicit value or local environment variable')
+  .option('--on <target>', 'Server target name')
+  .option('--config <path>', 'Use a specific config file')
+  .action((name: string, value: string | undefined, opts) => cmdSecretSet(process.cwd(), name, value, opts));
+
+const registry = program.command('registry').description('Manage Docker registry auth');
+
+registry.command('login')
+  .description('Store configured registry token on the target and run docker login')
+  .option('--on <target>', 'Server target name')
+  .option('--config <path>', 'Use a specific config file')
+  .action((opts) => cmdRegistryLogin(process.cwd(), opts));
+
 // ── Cloudflare ────────────────────────────────────────────────────
 
 const cloudflare = program.command('cloudflare').description('Cloudflare Tunnel integration');

src/config/builder.ts

@@ -42,6 +42,7 @@ type BuilderState = {
   sharedFiles?: string[];
   appRoot?: string;
   hooks?: { preDeploy?: HookFn; postDeploy?: HookFn };
+  dependsOn?: string[];
   apps?: Partial<ShipnodeApp>[];
 };
 
@@ -222,6 +223,11 @@ export class ShipnodeBuilder {
     return this;
   }
 
+  dependsOn(accessories: string[]): this {
+    this.config.dependsOn = accessories;
+    return this;
+  }
+
   registry(opts: RegistryConfig): this {
     this.config.registry = opts;
     return this;
@@ -379,6 +385,11 @@ export class ShipnodeAppBuilder {
     return this;
   }
 
+  dependsOn(accessories: string[]): this {
+    this.state.dependsOn = accessories;
+    return this;
+  }
+
   /** Internal: hand off the accumulated state to the workspace builder. */
   toApp(): Partial<ShipnodeApp> {
     return this.state as Partial<ShipnodeApp>;