feat: add orphan EC2 cleanup on startup, fix SetupWizard routing, fix SSH key gen
- On startup, scan for EC2 instances with pp:managed=true and terminate any orphans - SetupWizard now renders as full-page (no Layout wrapper) - Fixed SSH RSA key generation (generateKeyPairSync with spki format) - Removed unused import in orphanCleanup.ts - Frontend rebuild with App.tsx routing fix Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vendored
+2
@@ -36,6 +36,7 @@ var import_errors = require("./lib/errors");
|
||||
var import_jobWorker = require("./workers/jobWorker");
|
||||
var import_cronWorker = require("./workers/cronWorker");
|
||||
var import_adminSettings = require("./lib/adminSettings");
|
||||
var import_orphanCleanup = require("./services/orphanCleanup");
|
||||
var import_auth2 = require("./routes/auth");
|
||||
var import_webhook = require("./routes/webhook");
|
||||
var import_user = require("./routes/api/user");
|
||||
@@ -110,6 +111,7 @@ server.start().then(async (port) => {
|
||||
await (0, import_adminSettings.getAdminSettings)();
|
||||
(0, import_jobWorker.startJobWorker)();
|
||||
(0, import_cronWorker.startCronWorkers)();
|
||||
(0, import_orphanCleanup.runOrphanCleanup)().catch((e) => import_logger.logger.warn(e, "Orphan cleanup error"));
|
||||
import_logger.logger.info("All workers started");
|
||||
}).catch((err) => import_logger.logger.error(err, "Server failed to start"));
|
||||
// Annotate the CommonJS export names for ESM import in node:
|
||||
|
||||
Vendored
+2
-2
File diff suppressed because one or more lines are too long
Vendored
+37
-42
@@ -84,41 +84,29 @@ async function validateAwsCredentials(user) {
|
||||
}
|
||||
}
|
||||
function generateSshKeyPair() {
|
||||
const { privateKey, publicKey } = (0, import_crypto.generateKeyPairSync)("rsa", {
|
||||
const { privateKey: privKeyPem, publicKey: pubKeyPem } = (0, import_crypto.generateKeyPairSync)("rsa", {
|
||||
modulusLength: 2048,
|
||||
publicKeyEncoding: { type: "pkcs1", format: "pem" },
|
||||
publicKeyEncoding: { type: "spki", format: "pem" },
|
||||
privateKeyEncoding: { type: "pkcs1", format: "pem" }
|
||||
});
|
||||
const pubKeyOpenSsh = rsaPemToOpenSsh(publicKey);
|
||||
return { privateKey, publicKey: pubKeyOpenSsh };
|
||||
}
|
||||
function rsaPemToOpenSsh(pem) {
|
||||
const { publicKeyEncoding } = (0, import_crypto.generateKeyPairSync)("rsa", {
|
||||
modulusLength: 2048,
|
||||
publicKeyEncoding: { type: "pkcs8", format: "pem" },
|
||||
privateKeyEncoding: { type: "pkcs8", format: "pem" }
|
||||
});
|
||||
void publicKeyEncoding;
|
||||
const der = Buffer.from(
|
||||
pem.replace(/-----BEGIN RSA PUBLIC KEY-----/, "").replace(/-----END RSA PUBLIC KEY-----/, "").replace(/\n/g, ""),
|
||||
"base64"
|
||||
);
|
||||
const type = Buffer.from("ssh-rsa");
|
||||
function encodeBuffer(buf) {
|
||||
const len = Buffer.allocUnsafe(4);
|
||||
len.writeUInt32BE(buf.length, 0);
|
||||
return Buffer.concat([len, buf]);
|
||||
const pubKeyObj = (0, import_crypto.createPublicKey)(pubKeyPem);
|
||||
const pubKeyDer = pubKeyObj.export({ type: "spki", format: "der" });
|
||||
function sshEncodeBuffer(buf) {
|
||||
const lenBuf = Buffer.allocUnsafe(4);
|
||||
lenBuf.writeUInt32BE(buf.length, 0);
|
||||
return Buffer.concat([lenBuf, buf]);
|
||||
}
|
||||
const typeEncoded = encodeBuffer(type);
|
||||
const rsaKeyData = der;
|
||||
const base64Key = Buffer.concat([typeEncoded, rsaKeyData]).toString("base64");
|
||||
return `ssh-rsa ${base64Key} pp-generated`;
|
||||
const keyTypeStr = Buffer.from("ssh-rsa");
|
||||
const keyTypeEncoded = sshEncodeBuffer(keyTypeStr);
|
||||
const base64Encoded = pubKeyDer.toString("base64");
|
||||
const openSshKey = `ssh-rsa ${Buffer.concat([keyTypeEncoded]).toString("base64")} pp-generated`;
|
||||
return { privateKey: privKeyPem, publicKeyOpenssh: `ssh-rsa ${base64Encoded} pp-generated` };
|
||||
}
|
||||
async function generateAndImportKeyPair(ec2, keyName) {
|
||||
const { privateKey, publicKey } = generateSshKeyPair();
|
||||
const { privateKey, publicKeyOpenssh } = generateSshKeyPair();
|
||||
await ec2.send(new import_client_ec2.ImportKeyPairCommand({
|
||||
KeyName: keyName,
|
||||
PublicKeyMaterial: Buffer.from(publicKey)
|
||||
PublicKeyMaterial: Buffer.from(publicKeyOpenssh)
|
||||
}));
|
||||
return { privateKey };
|
||||
}
|
||||
@@ -134,22 +122,25 @@ async function createPreviewSecurityGroup(ec2, groupName, port) {
|
||||
Description: `PP Preview security group: ${groupName}`
|
||||
}));
|
||||
const groupId = res.GroupId;
|
||||
const ingress = [
|
||||
{
|
||||
IpProtocol: "tcp",
|
||||
FromPort: 22,
|
||||
ToPort: 22,
|
||||
IpRanges: [{ CidrIp: "0.0.0.0/0" }]
|
||||
}
|
||||
];
|
||||
if (port !== 22) {
|
||||
ingress.push({
|
||||
IpProtocol: "tcp",
|
||||
FromPort: port,
|
||||
ToPort: port,
|
||||
IpRanges: [{ CidrIp: "0.0.0.0/0" }]
|
||||
});
|
||||
}
|
||||
await ec2.send(new import_client_ec2.AuthorizeSecurityGroupIngressCommand({
|
||||
GroupId: groupId,
|
||||
IpPermissions: [
|
||||
{
|
||||
IpProtocol: "tcp",
|
||||
FromPort: 22,
|
||||
ToPort: 22,
|
||||
IpRanges: [{ CidrIp: "0.0.0.0/0" }]
|
||||
},
|
||||
{
|
||||
IpProtocol: "tcp",
|
||||
FromPort: port,
|
||||
ToPort: port,
|
||||
IpRanges: [{ CidrIp: "0.0.0.0/0" }]
|
||||
}
|
||||
]
|
||||
IpPermissions: ingress
|
||||
}));
|
||||
return groupId;
|
||||
}
|
||||
@@ -216,6 +207,7 @@ async function deleteSecurityGroupAws(ec2, groupName) {
|
||||
}));
|
||||
const groupId = describe.SecurityGroups?.[0]?.GroupId;
|
||||
if (groupId) {
|
||||
await sleep(5e3);
|
||||
await ec2.send(new import_client_ec2.DeleteSecurityGroupCommand({ GroupId: groupId }));
|
||||
}
|
||||
} catch (e) {
|
||||
@@ -224,7 +216,10 @@ async function deleteSecurityGroupAws(ec2, groupName) {
|
||||
}
|
||||
async function describeAllManagedInstances(ec2) {
|
||||
const res = await ec2.send(new import_client_ec2.DescribeInstancesCommand({
|
||||
Filters: [{ Name: "tag:pp:managed", Values: ["true"] }, { Name: "instance-state-name", Values: ["running", "pending", "stopping", "stopped"] }]
|
||||
Filters: [
|
||||
{ Name: "tag:pp:managed", Values: ["true"] },
|
||||
{ Name: "instance-state-name", Values: ["running", "pending", "stopping"] }
|
||||
]
|
||||
}));
|
||||
return (res.Reservations ?? []).flatMap((r) => r.Instances ?? []);
|
||||
}
|
||||
|
||||
Vendored
+2
-2
File diff suppressed because one or more lines are too long
+74
@@ -0,0 +1,74 @@
|
||||
"use strict";
|
||||
var __defProp = Object.defineProperty;
|
||||
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
||||
var __getOwnPropNames = Object.getOwnPropertyNames;
|
||||
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
||||
var __export = (target, all) => {
|
||||
for (var name in all)
|
||||
__defProp(target, name, { get: all[name], enumerable: true });
|
||||
};
|
||||
var __copyProps = (to, from, except, desc) => {
|
||||
if (from && typeof from === "object" || typeof from === "function") {
|
||||
for (let key of __getOwnPropNames(from))
|
||||
if (!__hasOwnProp.call(to, key) && key !== except)
|
||||
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
||||
}
|
||||
return to;
|
||||
};
|
||||
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
||||
var orphanCleanup_exports = {};
|
||||
__export(orphanCleanup_exports, {
|
||||
runOrphanCleanup: () => runOrphanCleanup
|
||||
});
|
||||
module.exports = __toCommonJS(orphanCleanup_exports);
|
||||
var import_db = require("../lib/db");
|
||||
var import_logger = require("../lib/logger");
|
||||
var import_ec2 = require("./ec2");
|
||||
const log = (0, import_logger.createLogger)("ORPHAN_CLEANUP");
|
||||
async function runOrphanCleanup() {
|
||||
log.info("Running orphan EC2 instance cleanup");
|
||||
const users = await import_db.prisma.user.findMany({
|
||||
where: {
|
||||
awsAccessKeyId: { not: null },
|
||||
awsSecretAccessKey: { not: null },
|
||||
awsRegion: { not: null }
|
||||
}
|
||||
});
|
||||
const activePreviews = await import_db.prisma.preview.findMany({
|
||||
where: { status: { notIn: ["STOPPED", "IGNORED"] }, instanceId: { not: null } },
|
||||
select: { id: true, instanceId: true }
|
||||
});
|
||||
const activeInstanceIds = new Set(activePreviews.map((p) => p.instanceId));
|
||||
for (const user of users) {
|
||||
try {
|
||||
const ec2 = (0, import_ec2.makeEc2Client)(user);
|
||||
const instances = await (0, import_ec2.describeAllManagedInstances)(ec2);
|
||||
for (const inst of instances) {
|
||||
const instanceId = inst.InstanceId;
|
||||
if (!instanceId) continue;
|
||||
const tags = Object.fromEntries((inst.Tags || []).map((t) => [t.Key, t.Value]));
|
||||
const previewId = parseInt(tags["pp:previewId"] || "0", 10);
|
||||
if (!activeInstanceIds.has(instanceId)) {
|
||||
log.info({ instanceId, previewId }, "Terminating orphan instance");
|
||||
try {
|
||||
const keyName = `pp-preview-${previewId}`;
|
||||
const sgName = `pp-preview-${previewId}`;
|
||||
await (0, import_ec2.deleteKeyPairAws)(ec2, keyName);
|
||||
await (0, import_ec2.terminateInstance)(ec2, instanceId);
|
||||
setTimeout(() => (0, import_ec2.deleteSecurityGroupAws)(ec2, sgName), 3e4);
|
||||
} catch (e) {
|
||||
log.warn({ e, instanceId }, "Failed to terminate orphan");
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (e) {
|
||||
log.warn({ e, userId: user.id }, "Failed to check orphans for user");
|
||||
}
|
||||
}
|
||||
log.info("Orphan cleanup complete");
|
||||
}
|
||||
// Annotate the CommonJS export names for ESM import in node:
|
||||
0 && (module.exports = {
|
||||
runOrphanCleanup
|
||||
});
|
||||
//# sourceMappingURL=orphanCleanup.js.map
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
{
|
||||
"version": 3,
|
||||
"sources": ["../../src/services/orphanCleanup.ts"],
|
||||
"sourcesContent": ["import { prisma } from \"../lib/db\";\nimport { createLogger } from \"../lib/logger\";\nimport { makeEc2Client, describeAllManagedInstances, terminateInstance, deleteKeyPairAws, deleteSecurityGroupAws } from \"./ec2\";\n\nconst log = createLogger(\"ORPHAN_CLEANUP\");\n\nexport async function runOrphanCleanup() {\n log.info(\"Running orphan EC2 instance cleanup\");\n\n const users = await prisma.user.findMany({\n where: {\n awsAccessKeyId: { not: null },\n awsSecretAccessKey: { not: null },\n awsRegion: { not: null },\n },\n });\n\n const activePreviews = await prisma.preview.findMany({\n where: { status: { notIn: [\"STOPPED\", \"IGNORED\"] }, instanceId: { not: null } },\n select: { id: true, instanceId: true },\n });\n const activeInstanceIds = new Set(activePreviews.map(p => p.instanceId!));\n\n for (const user of users) {\n try {\n const ec2 = makeEc2Client(user as any);\n const instances = await describeAllManagedInstances(ec2);\n\n for (const inst of instances) {\n const instanceId = inst.InstanceId;\n if (!instanceId) continue;\n\n const tags = Object.fromEntries((inst.Tags || []).map((t: any) => [t.Key, t.Value]));\n const previewId = parseInt(tags[\"pp:previewId\"] || \"0\", 10);\n\n if (!activeInstanceIds.has(instanceId)) {\n log.info({ instanceId, previewId }, \"Terminating orphan instance\");\n try {\n const keyName = `pp-preview-${previewId}`;\n const sgName = `pp-preview-${previewId}`;\n await deleteKeyPairAws(ec2, keyName);\n await terminateInstance(ec2, instanceId);\n setTimeout(() => deleteSecurityGroupAws(ec2, sgName), 30_000);\n } catch (e) {\n log.warn({ e, instanceId }, \"Failed to terminate orphan\");\n }\n }\n }\n } catch (e) {\n log.warn({ e, userId: user.id }, \"Failed to check orphans for user\");\n }\n }\n\n log.info(\"Orphan cleanup complete\");\n}\n"],
|
||||
"mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAuB;AACvB,oBAA6B;AAC7B,iBAAwH;AAExH,MAAM,UAAM,4BAAa,gBAAgB;AAEzC,eAAsB,mBAAmB;AACvC,MAAI,KAAK,qCAAqC;AAE9C,QAAM,QAAQ,MAAM,iBAAO,KAAK,SAAS;AAAA,IACvC,OAAO;AAAA,MACL,gBAAgB,EAAE,KAAK,KAAK;AAAA,MAC5B,oBAAoB,EAAE,KAAK,KAAK;AAAA,MAChC,WAAW,EAAE,KAAK,KAAK;AAAA,IACzB;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,MAAM,iBAAO,QAAQ,SAAS;AAAA,IACnD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,SAAS,EAAE,GAAG,YAAY,EAAE,KAAK,KAAK,EAAE;AAAA,IAC9E,QAAQ,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACvC,CAAC;AACD,QAAM,oBAAoB,IAAI,IAAI,eAAe,IAAI,OAAK,EAAE,UAAW,CAAC;AAExE,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,UAAM,0BAAc,IAAW;AACrC,YAAM,YAAY,UAAM,wCAA4B,GAAG;AAEvD,iBAAW,QAAQ,WAAW;AAC5B,cAAM,aAAa,KAAK;AACxB,YAAI,CAAC,WAAY;AAEjB,cAAM,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAW,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACnF,cAAM,YAAY,SAAS,KAAK,cAAc,KAAK,KAAK,EAAE;AAE1D,YAAI,CAAC,kBAAkB,IAAI,UAAU,GAAG;AACtC,cAAI,KAAK,EAAE,YAAY,UAAU,GAAG,6BAA6B;AACjE,cAAI;AACF,kBAAM,UAAU,cAAc,SAAS;AACvC,kBAAM,SAAS,cAAc,SAAS;AACtC,sBAAM,6BAAiB,KAAK,OAAO;AACnC,sBAAM,8BAAkB,KAAK,UAAU;AACvC,uBAAW,UAAM,mCAAuB,KAAK,MAAM,GAAG,GAAM;AAAA,UAC9D,SAAS,GAAG;AACV,gBAAI,KAAK,EAAE,GAAG,WAAW,GAAG,4BAA4B;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,UAAI,KAAK,EAAE,GAAG,QAAQ,KAAK,GAAG,GAAG,kCAAkC;AAAA,IACrE;AAAA,EACF;AAEA,MAAI,KAAK,yBAAyB;AACpC;",
|
||||
"names": []
|
||||
}
|
||||
Reference in New Issue
Block a user