feat(setup/harden): install pm2 for the deploy user, verify boot unit

devalade · devalade · commit c184fd8aaf57 · 2026-07-01T23:47:12.000+02:00
When setup bootstraps a deploy user, install mise/node/pm2 into that
user's home (via sudo -u &lt;user&gt; bash -lc) so pm2 processes are owned
by them and \`pm2-&lt;user&gt;.service\` matches. \`pm2 startup\` runs as root
but targets the deploy user; \`pm2 save\` runs as the deploy user so
their dump.pm2 is the one systemd resurrects at boot.

Add a "PM2 boot resurrection" section to harden: verifies
\`pm2-\${ssh.user}.service\` is installed, offers to refresh its dump,
and offers to disable any stale \`pm2-*.service\` units left over from
a prior root-scoped setup after switching ssh.user.
diff --git a/src/cli/commands/harden.ts b/src/cli/commands/harden.ts
@@ -6,8 +6,9 @@ import * as sec from '../../infrastructure/provisioning/security.js';
 export async function cmdHarden(cwd: string, options: { config?: string }): Promise<void> {
   await runRemoteCommand(
     cwd,
-    async ({ executor }) => {
+    async ({ config, executor }) => {
       const changes: string[] = [];
+      const currentUser = config.ssh.user;
 
       ui.heading('SSH Hardening');
       const sshActive = (await executor.exec(sec.sshCheckActiveCommand())).stdout.includes('active');
@@ -57,6 +58,43 @@ export async function cmdHarden(cwd: string, options: { config?: string }): Prom
         changes.push('UFW: configured (SSH, 80, 443 allowed)');
       }
 
+      ui.heading('PM2 boot resurrection');
+      // List installed pm2 systemd units so we can spot stale ones from a previous
+      // root-scoped setup after switching to a deploy user.
+      const unitsResult = await executor.exec(
+        `systemctl list-unit-files 'pm2-*.service' --no-legend 2>/dev/null | awk '{print $1}' || true`,
+      );
+      const units = unitsResult.stdout.trim().split('\n').filter(Boolean);
+      const wanted = `pm2-${currentUser}.service`;
+      const stale = units.filter((u) => u !== wanted);
+
+      if (units.includes(wanted)) {
+        ui.success(`${wanted} is installed`);
+        // Refresh the resurrection dump so the current process list is what boots.
+        if (await confirm(`Refresh ${wanted}'s saved process list (pm2 save)?`)) {
+          await executor.exec(
+            `bash -lc 'export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH" && pm2 save --force' || true`,
+          );
+          ui.success('pm2 save done');
+          changes.push(`PM2: refreshed dump for ${currentUser}`);
+        }
+      } else {
+        ui.warn(`No ${wanted} found. If you switched ssh.user recently, re-run 'shipnode setup' as the new user or install pm2 startup manually.`);
+      }
+
+      if (stale.length > 0) {
+        ui.warn(`Stale PM2 units detected: ${stale.join(', ')}`);
+        if (await confirm(`Disable stale unit(s) so only ${wanted} resurrects at boot?`)) {
+          for (const unit of stale) {
+            await executor.exec(
+              `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; $SUDO systemctl disable --now "${unit}" 2>/dev/null || true`,
+            );
+            changes.push(`PM2: disabled ${unit}`);
+          }
+          ui.success('Stale units disabled');
+        }
+      }
+
       ui.heading('Fail2ban');
       const f2b = (await executor.exec(sec.fail2banCheckActiveCommand())).stdout;
       if (!f2b.includes('ACTIVE')) {
diff --git a/src/cli/commands/setup.ts b/src/cli/commands/setup.ts
@@ -71,9 +71,23 @@ async function bootstrapDeployUser(
   return true;
 }
 
+/**
+ * Wrap a command so it runs as `user` when set, otherwise as the current SSH user.
+ * `bash -lc` gives the target user a login shell so $HOME/$PATH resolve to theirs.
+ */
+function asUser(user: string | null, cmd: string): string {
+  if (!user) return cmd;
+  const escaped = cmd.replace(/'/g, "'\\''");
+  return `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; $SUDO -u "${user}" bash -lc '${escaped}'`;
+}
+
 function buildTasks(executor: RemoteExecutor, config: ShipnodeConfig, ownerUser: string | null) {
   const nodeVersion = config.nodeVersion === 'lts' ? '24' : config.nodeVersion;
   const mise = `export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH"`;
+  // When a deploy user was bootstrapped, install mise/node/pm2 into their home
+  // so PM2 processes run as that user and `pm2-<user>.service` matches. Without
+  // this, everything lands in root's home and deploy has no pm2 on their PATH.
+  const targetHome = ownerUser ? `/home/${ownerUser}` : '$HOME';
 
   return new Listr(
     [
@@ -96,22 +110,25 @@ function buildTasks(executor: RemoteExecutor, config: ShipnodeConfig, ownerUser:
         ], { concurrent: false }),
       },
       {
-        title: 'Mise (version manager)',
+        title: `Mise (version manager)${ownerUser ? ` for ${ownerUser}` : ''}`,
         task: () =>
           executor.execOrThrow(
-            `if ! command -v mise &>/dev/null; then curl -fsSL https://mise.run | sh; fi`,
+            asUser(
+              ownerUser,
+              `if ! command -v mise &>/dev/null && [ ! -x "$HOME/.local/bin/mise" ]; then curl -fsSL https://mise.run | sh; fi`,
+            ),
           ),
       },
       {
         title: `Node.js ${config.nodeVersion}`,
         task: (_ctx: object, task: any) => task.newListr([
           {
             title: `Install node@${nodeVersion}`,
-            task: () => executor.execOrThrow(`${mise}; mise install -y "node@${nodeVersion}"`),
+            task: () => executor.execOrThrow(asUser(ownerUser, `${mise}; mise install -y "node@${nodeVersion}"`)),
           },
           {
             title: `Set node@${nodeVersion} as global default`,
-            task: () => executor.execOrThrow(`${mise}; mise use -g -y "node@${nodeVersion}"`),
+            task: () => executor.execOrThrow(asUser(ownerUser, `${mise}; mise use -g -y "node@${nodeVersion}"`)),
           },
         ], { concurrent: false }),
       },
@@ -121,18 +138,31 @@ function buildTasks(executor: RemoteExecutor, config: ShipnodeConfig, ownerUser:
           {
             title: 'Install pm2',
             task: () => executor.execOrThrow(
-              `${mise}; ` +
-              `if ! mise exec "node@${nodeVersion}" -- pm2 --version &>/dev/null; then ` +
-              `  mise exec "node@${nodeVersion}" -- npm install -g pm2; ` +
-              `fi`,
+              asUser(
+                ownerUser,
+                `${mise}; ` +
+                `if ! mise exec "node@${nodeVersion}" -- pm2 --version &>/dev/null; then ` +
+                `  mise exec "node@${nodeVersion}" -- npm install -g pm2; ` +
+                `fi`,
+              ),
             ),
           },
           {
-            title: 'Configure systemd startup',
+            // pm2 startup writes /etc/systemd/system/pm2-<user>.service — needs root
+            // to write the unit + enable it, but the unit targets the deploy user.
+            // pm2 save writes ~/.pm2/dump.pm2 for that user and must run as them.
+            title: `Configure systemd startup (${ownerUser ?? '$USER'})`,
             task: () => executor.execOrThrow(
-              `${mise}; ` +
-              `mise exec "node@${nodeVersion}" -- pm2 startup systemd -u $USER --hp $HOME || true; ` +
-              `mise exec "node@${nodeVersion}" -- pm2 save --force || true`,
+              (ownerUser
+                ? `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
+                  `PM2_BIN="${targetHome}/.local/share/mise/shims/pm2"; ` +
+                  `$SUDO env PATH="${targetHome}/.local/share/mise/shims:$PATH" "$PM2_BIN" startup systemd -u "${ownerUser}" --hp "${targetHome}" || true`
+                : `${mise}; mise exec "node@${nodeVersion}" -- pm2 startup systemd -u $USER --hp $HOME || true`) +
+              ` && ` +
+              asUser(
+                ownerUser,
+                `${mise}; mise exec "node@${nodeVersion}" -- pm2 save --force || true`,
+              ),
             ),
           },
         ], { concurrent: false }),
