homeio

1import "server-only";
2
3import { execFile } from "node:child_process";
4import { mkdir, readFile, writeFile } from "node:fs/promises";
5import path from "node:path";
6import { memoizeAsync } from "@/lib/server/cache/memoize-async";
7import {
8  SYSTEM_SECURITY_BAN_DURATION_MAX,
9  SYSTEM_SECURITY_BAN_DURATION_MIN,
10  SYSTEM_SECURITY_MAX_RETRIES_MAX,
11  SYSTEM_SECURITY_MAX_RETRIES_MIN,
12  SYSTEM_SECURITY_POLICY_OPTIONS,
13  type SystemSecurityPolicy,
14  type SystemSecuritySettings,
15} from "@/lib/shared/contracts/system";
16
17const SECURITY_POLICY_SET = new Set<SystemSecurityPolicy>(SYSTEM_SECURITY_POLICY_OPTIONS);
18const DEFAULT_FIREWALL_INCOMING_POLICY: SystemSecurityPolicy = "deny";
19const DEFAULT_FIREWALL_OUTGOING_POLICY: SystemSecurityPolicy = "allow";
20const DEFAULT_FAIL2BAN_MAX_RETRIES = 5;
21const DEFAULT_FAIL2BAN_BAN_DURATION_SECONDS = 3_600;
22const SECURITY_CACHE_TTL_MS = 30_000;
23
24function resolveFail2BanOverridePath() {
25  return process.env.HOMEIO_FAIL2BAN_OVERRIDE_PATH ?? "/etc/fail2ban/jail.d/homeio.local";
26}
27
28function normalizeSecurityPolicy(value: string, fieldName: string): SystemSecurityPolicy {
29  const normalized = value.trim().toLowerCase() as SystemSecurityPolicy;
30  if (!SECURITY_POLICY_SET.has(normalized)) {
31    throw new Error(`Invalid ${fieldName}. Choose allow, deny, or reject.`);
32  }
33  return normalized;
34}
35
36function normalizeBoundedInteger(
37  fieldName: string,
38  value: number,
39  min: number,
40  max: number,
41) {
42  if (!Number.isInteger(value) || value < min || value > max) {
43    throw new Error(`${fieldName} must be an integer between ${min} and ${max}.`);
44  }
45  return value;
46}
47
48function toErrorMessage(error: unknown) {
49  if (error instanceof Error) return error.message;
50  return String(error);
51}
52
53function getExecFailureDetails(error: unknown) {
54  if (!error || typeof error !== "object") {
55    return { stdout: "", stderr: "", message: String(error ?? "") };
56  }
57
58  const execError = error as Error & { stdout?: string; stderr?: string };
59  return {
60    stdout: execError.stdout ?? "",
61    stderr: execError.stderr ?? "",
62    message: execError.message,
63  };
64}
65
66function isToolUnavailable(error: unknown) {
67  const { stdout, stderr, message } = getExecFailureDetails(error);
68  const haystack = `${message}\n${stdout}\n${stderr}`.toLowerCase();
69  return (
70    haystack.includes("enoent") ||
71    haystack.includes("not found") ||
72    haystack.includes("not-found") ||
73    haystack.includes("could not be found") ||
74    haystack.includes("no such file") ||
75    haystack.includes("unit fail2ban.service could not be found")
76  );
77}
78
79async function readCommandOutput(command: string, args: string[]) {
80  const { stdout } = await execFileAsync(command, args);
81  return stdout.trim();
82}
83
84function execFileAsync(command: string, args: string[]) {
85  return new Promise<{ stdout: string; stderr: string }>((resolve, reject) => {
86    execFile(command, args, (error, stdout = "", stderr = "") => {
87      if (error) {
88        const execError = error as Error & { stdout?: string; stderr?: string };
89        execError.stdout = stdout;
90        execError.stderr = stderr;
91        reject(execError);
92        return;
93      }
94
95      resolve({ stdout, stderr });
96    });
97  });
98}
99
100async function readUfwStatus() {
101  let stdout = "";
102
103  try {
104    stdout = await readCommandOutput("ufw", ["status", "verbose"]);
105  } catch (error) {
106    if (isToolUnavailable(error)) {
107      return null;
108    }
109    throw error;
110  }
111
112  const enabled = /^status:\s+active$/im.test(stdout);
113  const defaultLine = stdout.match(/^default:\s+(.+)$/im)?.[1]?.toLowerCase() ?? "";
114  const incomingPolicy =
115    (defaultLine.match(/(allow|deny|reject)\s+\(incoming\)/)?.[1] as
116      | SystemSecurityPolicy
117      | undefined) ?? DEFAULT_FIREWALL_INCOMING_POLICY;
118  const outgoingPolicy =
119    (defaultLine.match(/(allow|deny|reject)\s+\(outgoing\)/)?.[1] as
120      | SystemSecurityPolicy
121      | undefined) ?? DEFAULT_FIREWALL_OUTGOING_POLICY;
122
123  return {
124    enabled,
125    incomingPolicy,
126    outgoingPolicy,
127  };
128}
129
130async function readFail2BanEnabled() {
131  try {
132    const state = await readCommandOutput("systemctl", ["is-enabled", "fail2ban"]);
133    return state === "enabled";
134  } catch (error) {
135    const { stdout } = getExecFailureDetails(error);
136    const normalizedStdout = stdout.trim().toLowerCase();
137    if (["disabled", "masked", "indirect", "static", "not-found"].includes(normalizedStdout)) {
138      return false;
139    }
140
141    if (isToolUnavailable(error)) {
142      return false; // systemctl not available (e.g. Alpine / non-systemd host)
143    }
144
145    throw error;
146  }
147}
148
149function parseFail2BanOverride(content: string) {
150  const maxRetries = Number.parseInt(
151    content.match(/^\s*maxretry\s*=\s*(\d+)\s*$/im)?.[1] ??
152      String(DEFAULT_FAIL2BAN_MAX_RETRIES),
153    10,
154  );
155  const banDuration = Number.parseInt(
156    content.match(/^\s*bantime\s*=\s*(\d+)\s*$/im)?.[1] ??
157      String(DEFAULT_FAIL2BAN_BAN_DURATION_SECONDS),
158    10,
159  );
160
161  return {
162    maxRetries: Number.isFinite(maxRetries) ? maxRetries : DEFAULT_FAIL2BAN_MAX_RETRIES,
163    banDuration:
164      Number.isFinite(banDuration) ? banDuration : DEFAULT_FAIL2BAN_BAN_DURATION_SECONDS,
165  };
166}
167
168async function readFail2BanSettings() {
169  const enabled = await readFail2BanEnabled();
170  const overridePath = resolveFail2BanOverridePath();
171
172  try {
173    const content = await readFile(overridePath, "utf8");
174    const parsed = parseFail2BanOverride(content);
175    return {
176      enabled,
177      maxRetries: parsed.maxRetries,
178      banDuration: parsed.banDuration,
179    };
180  } catch (error) {
181    const errorCode = (error as NodeJS.ErrnoException | undefined)?.code;
182    if (errorCode === "ENOENT") {
183      return {
184        enabled,
185        maxRetries: DEFAULT_FAIL2BAN_MAX_RETRIES,
186        banDuration: DEFAULT_FAIL2BAN_BAN_DURATION_SECONDS,
187      };
188    }
189    throw error;
190  }
191}
192
193export function buildFail2BanOverrideContent(input: {
194  maxRetries: number;
195  banDurationSeconds: number;
196}) {
197  return [
198    "[DEFAULT]",
199    `maxretry = ${input.maxRetries}`,
200    `bantime = ${input.banDurationSeconds}`,
201    "",
202  ].join("\n");
203}
204
205async function writeFail2BanOverrideFile(input: {
206  maxRetries: number;
207  banDurationSeconds: number;
208}) {
209  const overridePath = resolveFail2BanOverridePath();
210  await mkdir(path.dirname(overridePath), { recursive: true });
211  await writeFile(overridePath, buildFail2BanOverrideContent(input), "utf8");
212}
213
214async function applyFail2BanSettings(input: {
215  enabled: boolean;
216  maxRetries: number;
217  banDurationSeconds: number;
218}) {
219  try {
220    await writeFail2BanOverrideFile(input);
221
222    if (input.enabled) {
223      await execFileAsync("systemctl", ["enable", "--now", "fail2ban"]);
224      await execFileAsync("systemctl", ["restart", "fail2ban"]);
225      return;
226    }
227
228    await execFileAsync("systemctl", ["disable", "--now", "fail2ban"]);
229  } catch (error) {
230    if (isToolUnavailable(error)) {
231      throw new Error("Fail2Ban is not installed or unavailable on this host.");
232    }
233    throw error;
234  }
235}
236
237async function applyFirewallSettings(input: {
238  enabled: boolean;
239  incomingPolicy: SystemSecurityPolicy;
240  outgoingPolicy: SystemSecurityPolicy;
241}) {
242  try {
243    await execFileAsync("ufw", ["default", input.incomingPolicy, "incoming"]);
244    await execFileAsync("ufw", ["default", input.outgoingPolicy, "outgoing"]);
245    await execFileAsync("ufw", ["--force", input.enabled ? "enable" : "disable"]);
246  } catch (error) {
247    if (isToolUnavailable(error)) {
248      throw new Error("UFW is not installed or unavailable on this host.");
249    }
250    throw error;
251  }
252}
253
254function normalizeSecuritySettings(input: SystemSecuritySettings): SystemSecuritySettings {
255  return {
256    firewallEnabled: Boolean(input.firewallEnabled),
257    firewallIncomingPolicy: normalizeSecurityPolicy(
258      input.firewallIncomingPolicy,
259      "incoming policy",
260    ),
261    firewallOutgoingPolicy: normalizeSecurityPolicy(
262      input.firewallOutgoingPolicy,
263      "outgoing policy",
264    ),
265    fail2banEnabled: Boolean(input.fail2banEnabled),
266    fail2banMaxRetries: normalizeBoundedInteger(
267      "Fail2Ban max retries",
268      input.fail2banMaxRetries,
269      SYSTEM_SECURITY_MAX_RETRIES_MIN,
270      SYSTEM_SECURITY_MAX_RETRIES_MAX,
271    ),
272    fail2banBanDurationSeconds: normalizeBoundedInteger(
273      "Fail2Ban ban duration",
274      input.fail2banBanDurationSeconds,
275      SYSTEM_SECURITY_BAN_DURATION_MIN,
276      SYSTEM_SECURITY_BAN_DURATION_MAX,
277    ),
278  };
279}
280
281async function readSystemSecuritySettings(): Promise<SystemSecuritySettings> {
282  const [firewall, fail2ban] = await Promise.all([readUfwStatus(), readFail2BanSettings()]);
283
284  return {
285    firewallEnabled: firewall?.enabled ?? false,
286    firewallIncomingPolicy: firewall?.incomingPolicy ?? DEFAULT_FIREWALL_INCOMING_POLICY,
287    firewallOutgoingPolicy: firewall?.outgoingPolicy ?? DEFAULT_FIREWALL_OUTGOING_POLICY,
288    fail2banEnabled: fail2ban.enabled,
289    fail2banMaxRetries: fail2ban.maxRetries,
290    fail2banBanDurationSeconds: fail2ban.banDuration,
291  };
292}
293
294// Settings reads these on every open, and each read spawns ufw, iptables and
295// systemctl. They change through updateSystemSecuritySettings, which drops the
296// cache, or at the shell, which the TTL catches up with.
297const cachedSecuritySettings = memoizeAsync(readSystemSecuritySettings, SECURITY_CACHE_TTL_MS);
298
299export async function getSystemSecuritySettings(): Promise<SystemSecuritySettings> {
300  return { ...(await cachedSecuritySettings()) };
301}
302
303export function resetSecuritySettingsCacheForTests() {
304  cachedSecuritySettings.invalidate();
305}
306
307export async function updateSystemSecuritySettings(input: SystemSecuritySettings) {
308  const next = normalizeSecuritySettings(input);
309
310  try {
311    await applyFirewallSettings({
312      enabled: next.firewallEnabled,
313      incomingPolicy: next.firewallIncomingPolicy,
314      outgoingPolicy: next.firewallOutgoingPolicy,
315    });
316    await applyFail2BanSettings({
317      enabled: next.fail2banEnabled,
318      maxRetries: next.fail2banMaxRetries,
319      banDurationSeconds: next.fail2banBanDurationSeconds,
320    });
321  } catch (error) {
322    throw new Error(toErrorMessage(error));
323  } finally {
324    cachedSecuritySettings.invalidate();
325  }
326
327  return getSystemSecuritySettings();
328}
329