Give apps an address for accessories on other servers

Docker networks are host-local, so --network connects nothing across
machines and no connection string was ever generated — the app got
whatever was in .env, and the shipnode default of localhost silently
pointed at nothing once the database moved to its own box.

Every app is now handed SHIPNODE_<ACCESSORY>_HOST for each accessory it
depends on: 127.0.0.1 when co-located, the host's privateHost when not.
The variable exists either way, so moving an accessory to its own server
is a config change and not a code change. Declared env wins, which is the
escape hatch for a managed database shipnode cannot see. Injection
happens during config assembly because scoping to one app or one server
drops the servers the dependencies are on — by then the address is
unknowable.

An accessory published only on loopback but consumed from another server
is now a config error: no connection string can reach 127.0.0.1 on
another machine. A missing privateHost stays a warning, since the user
may be supplying the address themselves.

harden gains the matching firewall rules — a non-standard replica port
for the load balancer, and accessory ports opened to the specific
privateHosts that consume them rather than to the internet. It also fans
out over every server instead of only the first; its seven prompts are
hoisted to one up-front answer set, which previously would have asked
each question once per server with earlier servers already changed.

Fixes deploy --dry-run --app <name> hiding cross-server dependency
warnings: it resolved them against the scoped config, which no longer
contains the accessory.

Author: devalade

src/cli/commands/deploy.ts

@@ -15,6 +15,7 @@ import { type ServerTargetError } from '../../shared/result-errors.js';
 import { runDeployWatch } from './deploy-watch.js';
 import type { BuildLocation } from '../../domain/deploy/hot-sync.js';
 import { rollFleet, type FleetEvent } from '../../domain/deploy/fleet.js';
+import { accessoryHostVar } from '../../domain/networking.js';
 import { newReleaseId } from '../../domain/deploy/orchestrator.js';
 import { SshConnection } from '../../infrastructure/ssh/connection.js';
 
@@ -47,7 +48,7 @@ export async function cmdDeploy(cwd: string, options: { dryRun?: boolean; skipBu
       process.exit(1);
       return;
     }
-    printDryRun(targetConfig, options.skipBuild ?? false);
+    printDryRun(targetConfig, options.skipBuild ?? false, config);
     return;
   }
 
@@ -322,7 +323,12 @@ async function startWatch(
   }
 }
 
-function renderAppPlan(config: ShipnodeConfig, app: ShipnodeApp, skipBuild: boolean): string {
+function renderAppPlan(
+  config: ShipnodeConfig,
+  app: ShipnodeApp,
+  skipBuild: boolean,
+  workspace: ShipnodeConfig = config,
+): string {
   const namespace = app.pm2?.apps[0]?.name;
   const web = app.pm2?.apps.find((a) => a.port !== undefined);
 
@@ -363,7 +369,7 @@ function renderAppPlan(config: ShipnodeConfig, app: ShipnodeApp, skipBuild: bool
   if (app.domain) serverRows.push(['Domain', app.domain]);
   if (app.dependsOn?.length) serverRows.push(['Depends on', app.dependsOn.join(', ')]);
 
-  const dependencyWarnings = renderDependencyWarnings(config, app);
+  const dependencyWarnings = renderDependencyWarnings(workspace, app);
   const fleetWarnings = renderFleetWarnings(app, replicas);
 
   const caddyPreview = renderCaddyPreview(config, app);
@@ -452,12 +458,18 @@ function renderDependencyWarnings(config: ShipnodeConfig, app: ShipnodeApp): str
     const [accessoryServer] = resolveServerNames(config, accessory.on);
     if (accessoryServer === undefined) continue;
     const strangers = appServers.filter((server) => server !== accessoryServer);
-    if (strangers.length > 0) {
-      warnings.push(
-        `${name} runs on ${accessoryServer}; ${app.name} runs on ${strangers.join(', ')}. ` +
-        `Confirm reachable networking.`,
-      );
-    }
+    if (strangers.length === 0) continue;
+
+    const privateHost = config.servers[accessoryServer]?.privateHost;
+    warnings.push(
+      privateHost
+        ? `${name} runs on ${accessoryServer}; ${app.name} runs on ${strangers.join(', ')}. ` +
+          `${accessoryHostVar(name)}=${privateHost} is set for ${app.name} — make sure your ` +
+          `connection string reads it, and that ${accessoryServer} accepts the connection.`
+        : `${name} runs on ${accessoryServer}; ${app.name} runs on ${strangers.join(', ')}, ` +
+          `and ${accessoryServer} has no privateHost — shipnode has no address to hand ${app.name}. ` +
+          `Add privateHost to ${accessoryServer}, or set the host yourself in ${app.envFile}.`,
+    );
   }
   return warnings;
 }
@@ -488,7 +500,19 @@ function renderCaddyPreview(config: ShipnodeConfig, app: ShipnodeApp): string |
   return generateBackendCaddyfile(app, web.port);
 }
 
-export function printDryRun(config: ShipnodeConfig, skipBuild: boolean): void {
+/**
+ * `workspace` is the *unscoped* config. `--app api` narrows `config` to that app
+ * and the servers it runs on, which drops the server a cross-server accessory
+ * lives on — and with it the warning that the app has to reach across the
+ * network. The real deploy path already resolves dependencies against the whole
+ * workspace; the preview has to as well or it is quietest exactly when it
+ * matters most.
+ */
+export function printDryRun(
+  config: ShipnodeConfig,
+  skipBuild: boolean,
+  workspace: ShipnodeConfig = config,
+): void {
   ui.banner();
 
   const servers = getServerTargets(config).map((target) => `${target.name}=${target.ssh.user}@${target.ssh.host}:${target.ssh.port}`).join(', ');
@@ -503,7 +527,7 @@ export function printDryRun(config: ShipnodeConfig, skipBuild: boolean): void {
   // Per app, not per server: a fleet app runs on several servers and would
   // otherwise be printed once for each of them.
   const perApp = config.apps
-    .map((app) => renderAppPlan(config, app, skipBuild))
+    .map((app) => renderAppPlan(config, app, skipBuild, workspace))
     .join('\n\n');
 
   const accessories = renderAccessoriesPlan(config);

src/cli/commands/harden.ts

@@ -1,64 +1,120 @@
 import { confirm } from '../prompt.js';
-import { runRemoteCommand } from '../runner.js';
+import { runRemoteCommandForTargets } from '../runner.js';
 import { ui } from '../ui.js';
 import * as sec from '../../infrastructure/provisioning/security.js';
+import { fleetFirewallRules } from '../../domain/networking.js';
 
-export async function cmdHarden(cwd: string, options: { config?: string }): Promise<void> {
-  await runRemoteCommand(
+/**
+ * What the operator wants done, decided once.
+ *
+ * Hardening fans out over every server, and the prompts used to live inside that
+ * loop — so a three-server workspace asked the same seven questions three times,
+ * and answering "no" on the second server left the first already changed. The
+ * answers are collected up front instead; each server then applies whatever its
+ * own state makes applicable, and says what it skipped.
+ */
+interface HardenChoices {
+  ssh: boolean;
+  disableRootLogin: boolean;
+  disablePasswordAuth: boolean;
+  installUfw: boolean;
+  configureUfw: boolean;
+  pm2Save: boolean;
+  disableStaleUnits: boolean;
+  fail2ban: boolean;
+}
+
+async function askChoices(serverCount: number): Promise<HardenChoices> {
+  if (serverCount > 1) {
+    ui.info(`These answers apply to all ${serverCount} servers in this workspace.`);
+  }
+
+  ui.heading('SSH Hardening');
+  const ssh = await confirm('Harden SSH?');
+  const disableRootLogin = ssh && (await confirm('Disable root login?'));
+  const disablePasswordAuth = ssh && (await confirm('Disable password auth (keys only)?'));
+
+  ui.heading('Firewall (UFW)');
+  const installUfw = await confirm('Install UFW where it is missing?');
+  const configureUfw = await confirm('Configure UFW (allow SSH/80/443 plus this workspace\'s own ports, deny all else)?');
+
+  ui.heading('PM2 boot resurrection');
+  const pm2Save = await confirm('Refresh the saved PM2 process list (pm2 save)?');
+  const disableStaleUnits = await confirm('Disable stale PM2 units so only the current user\'s resurrects at boot?');
+
+  ui.heading('Fail2ban');
+  const fail2ban = await confirm('Install and configure fail2ban where it is inactive?');
+
+  return { ssh, disableRootLogin, disablePasswordAuth, installUfw, configureUfw, pm2Save, disableStaleUnits, fail2ban };
+}
+
+export async function cmdHarden(cwd: string, options: { config?: string; on?: string }): Promise<void> {
+  const { loadConfig } = await import('../../config/loader.js');
+  const workspace = await loadConfig(cwd, options.config);
+  const serverCount = options.on ? 1 : Object.keys(workspace.servers).length;
+
+  const choices = await askChoices(serverCount);
+  if (!Object.values(choices).some(Boolean)) {
+    ui.info('Nothing selected — no changes made.');
+    return;
+  }
+
+  await runRemoteCommandForTargets(
     cwd,
-    async ({ config, executor }) => {
+    async ({ config, executor, serverName }) => {
       const changes: string[] = [];
       const currentUser = config.ssh.user;
 
-      ui.heading('SSH Hardening');
-      const sshActive = (await executor.exec(sec.sshCheckActiveCommand())).stdout.includes('active');
-      ui.info(`SSH service: ${sshActive ? 'active' : 'inactive'}`);
-      const sshdResult = await executor.exec(sec.sshCheckConfigCommand());
-      ui.info(`Current SSH config:\n  ${sshdResult.stdout.split('\n').join('\n  ')}`);
-
-      if (await confirm('Harden SSH?')) {
-        const sudoUsers = (await executor.exec(sec.sshCheckSudoUsersCommand())).stdout.trim();
-        if (sudoUsers) {
-          ui.info(`Sudo users: ${sudoUsers.split('\n').join(', ')}`);
-          if (await confirm('Disable root login?')) {
+      ui.heading(`${serverName} (${currentUser}@${config.ssh.host})`);
+
+      if (choices.ssh) {
+        const sshdResult = await executor.exec(sec.sshCheckConfigCommand());
+        ui.info(`Current SSH config:\n  ${sshdResult.stdout.split('\n').join('\n  ')}`);
+
+        if (choices.disableRootLogin) {
+          const sudoUsers = (await executor.exec(sec.sshCheckSudoUsersCommand())).stdout.trim();
+          if (sudoUsers) {
             await executor.exec(sec.sshDisableRootLoginCommand());
             await executor.exec(sec.sshRestartCommand());
-            ui.success('Root login disabled');
             changes.push('SSH: PermitRootLogin set to no');
+          } else {
+            ui.warn('No sudo users — skipping root disable (would lock you out).');
           }
-        } else {
-          ui.warn('No sudo users — skipping root disable (would lock you out).');
         }
-        if (await confirm('Disable password auth (keys only)?')) {
+
+        if (choices.disablePasswordAuth) {
           await executor.exec(sec.sshDisablePasswordAuthCommand());
           await executor.exec(sec.sshRestartCommand());
-          ui.success('Password auth disabled');
           changes.push('SSH: PasswordAuthentication set to no');
         }
       }
 
-      ui.heading('Firewall (UFW)');
       const ufwResult = await executor.exec(sec.ufwCheckInstalledCommand());
-      if (ufwResult.stdout.includes('NOT_INSTALLED')) {
-        ui.warn('UFW not installed.');
-        if (await confirm('Install UFW?')) {
-          await executor.exec(sec.ufwInstallCommand());
-          ui.success('UFW installed');
-          changes.push('UFW: installed');
-        }
-      } else {
-        ui.info(`UFW status:\n  ${ufwResult.stdout.split('\n').slice(0, 3).join('\n  ')}`);
+      const ufwMissing = ufwResult.stdout.includes('NOT_INSTALLED');
+      if (ufwMissing && choices.installUfw) {
+        await executor.exec(sec.ufwInstallCommand());
+        changes.push('UFW: installed');
+      } else if (ufwMissing) {
+        ui.warn('UFW not installed — skipping firewall configuration.');
       }
 
-      if (await confirm('Configure UFW (allow SSH/80/443, deny all else)?')) {
-        for (const cmd of sec.ufwConfigureCommands()) {
+      if (choices.configureUfw && (!ufwMissing || choices.installUfw)) {
+        // Rules derived from the workspace, not from this server alone: which
+        // holes this box needs depends on where the apps that consume it run.
+        const extra = fleetFirewallRules(workspace, serverName);
+        for (const cmd of sec.ufwConfigureCommands(extra)) {
           await executor.exec(cmd);
         }
-        ui.success('UFW configured and enabled');
-        changes.push('UFW: configured (SSH, 80, 443 allowed)');
+        changes.push(
+          extra.length === 0
+            ? 'UFW: configured (SSH, 80, 443 allowed)'
+            : `UFW: configured (SSH, 80, 443, plus ${extra.length} workspace rule(s))`,
+        );
+        for (const rule of extra) {
+          ui.info(`  allowed ${rule.port}/tcp${rule.from ? ` from ${rule.from}` : ''} — ${rule.comment}`);
+        }
       }
 
-      ui.heading('PM2 boot resurrection');
       // List installed pm2 systemd units so we can spot stale ones from a previous
       // root-scoped setup after switching to a deploy user.
       const unitsResult = await executor.exec(
@@ -69,54 +125,47 @@ export async function cmdHarden(cwd: string, options: { config?: string }): Prom
       const stale = units.filter((u) => u !== wanted);
 
       if (units.includes(wanted)) {
-        ui.success(`${wanted} is installed`);
-        // Refresh the resurrection dump so the current process list is what boots.
-        if (await confirm(`Refresh ${wanted}'s saved process list (pm2 save)?`)) {
+        if (choices.pm2Save) {
+          // Refresh the resurrection dump so the current process list is what boots.
           await executor.exec(
             `bash -lc 'export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH" && pm2 save --force' || true`,
           );
-          ui.success('pm2 save done');
           changes.push(`PM2: refreshed dump for ${currentUser}`);
         }
       } else {
         ui.warn(`No ${wanted} found. If you switched ssh.user recently, re-run 'shipnode setup' as the new user or install pm2 startup manually.`);
       }
 
-      if (stale.length > 0) {
-        ui.warn(`Stale PM2 units detected: ${stale.join(', ')}`);
-        if (await confirm(`Disable stale unit(s) so only ${wanted} resurrects at boot?`)) {
-          for (const unit of stale) {
-            await executor.exec(
-              `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; $SUDO systemctl disable --now "${unit}" 2>/dev/null || true`,
-            );
-            changes.push(`PM2: disabled ${unit}`);
-          }
-          ui.success('Stale units disabled');
+      if (stale.length > 0 && choices.disableStaleUnits) {
+        for (const unit of stale) {
+          await executor.exec(
+            `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; $SUDO systemctl disable --now "${unit}" 2>/dev/null || true`,
+          );
+          changes.push(`PM2: disabled ${unit}`);
         }
+      } else if (stale.length > 0) {
+        ui.warn(`Stale PM2 units left in place: ${stale.join(', ')}`);
       }
 
-      ui.heading('Fail2ban');
-      const f2b = (await executor.exec(sec.fail2banCheckActiveCommand())).stdout;
-      if (!sec.isFail2banActive(f2b)) {
-        ui.warn('Fail2ban not active.');
-        if (await confirm('Install and configure fail2ban?')) {
+      if (choices.fail2ban) {
+        const f2b = (await executor.exec(sec.fail2banCheckActiveCommand())).stdout;
+        if (!sec.isFail2banActive(f2b)) {
           await executor.execOrThrow(sec.fail2banInstallCommand());
           await executor.execOrThrow(sec.fail2banApplyConfigCommand());
           await executor.execOrThrow(sec.fail2banEnableCommand());
-          ui.success('Fail2ban installed');
           changes.push('Fail2ban: installed, sshd jail enabled');
+        } else {
+          ui.success('Fail2ban already active');
         }
-      } else {
-        ui.success('Fail2ban already active');
       }
 
       if (changes.length === 0) {
-        ui.info('No changes made.');
+        ui.info(`${serverName}: no changes made.`);
       } else {
         changes.forEach((c) => ui.success(c));
-        ui.info(`${changes.length} change(s) applied.`);
+        ui.info(`${serverName}: ${changes.length} change(s) applied.`);
       }
     },
-    { configPath: options.config },
+    { configPath: options.config, serverName: options.on },
   );
 }

src/cli/index.ts

@@ -181,6 +181,7 @@ program
 program
   .command('harden')
   .description('Apply server security hardening (SSH, firewall, fail2ban)')
+  .option('--on <server>', 'Harden one server instead of every server in the workspace')
   .option('--config <path>', 'Use a specific config file')
   .action((opts) => cmdHarden(process.cwd(), opts));