mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 16:47:01 +09:00
Juan DenisandClaude Opus 4.8
754bfb4a67
Critical install/update/uninstall hotfixes from the hardening plan (docs/plans/INSTALLER_UPDATER_UNINSTALLER_HARDENING_PLAN.md §4): - Firewall automation (G1): new sourceable scripts/lib/firewall.sh detects firewalld/ufw/nftables/iptables and opens 80/443; install.sh runs configure_firewall, update.sh re-ensures it idempotently. Exactly what we open is recorded in /etc/serverkit/install-state.json (scripts/lib/state.sh) so uninstall undoes only our rules. Fixes the #1 "installed but unreachable" failure on fresh RHEL-family boxes. - Accept Python 3.11 OR 3.12 (G2): locate_python now iterates python3.12/3.11/3 and provision_python installs the distro package (python3.11 on Debian 12, 3.12 on Ubuntu/Fedora, 3.11/3.12 on RHEL) before ever falling back to a source compile. - Use $PYTHON_BIN for secret generation instead of a bare python3. - Distro-first Node 20 (replacing unconditional NodeSource): install the distro nodejs+npm, fall back to NodeSource only when it's missing or < 18, and validate node>=18 before continuing. - Unify uninstall (G4): new scripts/lib/uninstall.sh is the single canonical teardown routine shared by uninstall.sh and `serverkit uninstall` (they had drifted — one ran `down -v`, one didn't). Default preserves user data (volumes kept, DB snapshotted to backups); --purge/--delete-volumes removes volumes+DB+data dirs; --keep-data preserves /etc + /var/lib + backups; --yes/--dry-run added; honors SERVERKIT_DIR. Removes the apt lock-wait drop-in on uninstall. Tests: new scripts/test/test_install.sh (11 cases, source-able install.sh) covers python/node detection, firewall dry-run + state, and the uninstall data-handling matrix. Existing test_update.sh still green. shellcheck clean (error + warning) on all new/changed shell. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>