wip: not working yet...

the docker user is changed from commander to root due to #168 pr.
Use absolute path instead of relative path to prevent false detection.

.env.prod.sample

@@ -0,0 +1,50 @@
+HOST=localhost
+PORT=3000
+BASE_URL=https://example.com
+SECRET_KEY=YOU_SHOULD_CHANGE_THIS
+BACKEND_URL=http://backend:3000
+DOCKER_NETWORK=linux-odyssey-players
+
+MONGO_ROOT_PASSWORD=adminpassword
+MONGO_USER=commander
+MONGO_PASS=commander
+MONGO_DB=linux-odyssey
+MONGO_URL=mongodb://commander:commander@db:27017/linux-odyssey
+
+# Admin user credentials for analytics
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=admin
+ADMIN_HOST=0.0.0.0
+ADMIN_PORT=3001
+# ADMIN_BASE_URL=http://0.0.0.0:3001
+
+# Optional
+# CONTAINER_EXPIRY=60     # 60 minutes
+# SESSION_MAX_AGE=168      # 7 days
+# TRUSTED_PROXIES=1.2.3.4    
+# valid configurations see isIP & isIPRange in  https://github.com/validatorjs/validator.js?tab=readme-ov-file#validators
+
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
+# GITHUB_CLIENT_ID=
+# GITHUB_CLIENT_SECRET=
+# SURVEY_URL=
+# BUG_REPORT_URL=
+
+# SURVEY_URL=
+# BUG_REPORT_URL=
+
+# Docker related config
+# DOCKER_NETWORK=host
+# QUEST_IMAGE=linuxodyssey/quest-base
+# DOCKER_PREFIX=linuxodyssey/quest-
+
+# To mount quest folder from host into container, for development purpose
+# MOUNT_QUEST=true
+
+# LOG_PATH=
+
+# Testing, create a user with the following credentials, disable rate limiting
+# TESTING=true
+# TESTING_USERNAME=alex
+# TESTING_PASSWORD=Alex1234

.env.sample

@@ -0,0 +1,38 @@
+HOST=localhost
+PORT=3000
+BASE_URL=http://localhost:5173
+MONGO_URL=mongodb://localhost:27017/odyssey-test
+SECRET_KEY=sample-secret
+DOCKER_NETWORK=linux-odyssey-players-dev
+
+# Optional
+# BACKEND_URL=http://host.docker.internal:3000
+# CONTAINER_EXPIRY=60     # 60 minutes
+# SESSION_MAX_AGE=168      # 7 days
+# TRUSTED_PROXIES=1.2.3.4    
+# valid configurations see isIP & isIPRange in  https://github.com/validatorjs/validator.js?tab=readme-ov-file#validators
+
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
+# GITHUB_CLIENT_ID=
+# GITHUB_CLIENT_SECRET=
+# SURVEY_URL=
+# BUG_REPORT_URL=
+
+# SURVEY_URL=
+# BUG_REPORT_URL=
+
+# Docker related config
+# DOCKER_NETWORK=host
+# QUEST_IMAGE=linuxodyssey/quest-base
+# DOCKER_PREFIX=linuxodyssey/quest-
+
+# To mount quest folder from host into container, for development purpose
+# MOUNT_QUEST=true
+
+# LOG_PATH=
+
+# Testing, create a user with the following credentials, disable rate limiting
+# TESTING=true
+# TESTING_USERNAME=alex
+# TESTING_PASSWORD=Alex1234

.gitignore

@@ -1,3 +1,5 @@
+config 
+
 # Logs
 logs
 *.log
@@ -85,6 +87,7 @@ built
 .env.test.local
 .env.production.local
 .env.local
+.env.prod
 
 # parcel-bundler cache (https://parceljs.org/)
 .cache

README.md

@@ -5,9 +5,15 @@
 
 ## Requirements
 
-- NodeJS
+- NodeJS v20+
 - Docker
-- Yarn
+- Yarn: v1.22
+
+## Known Issues
+
+- MongoDB requires x86 architecture to run for v5+ versions. You can track [this issue](https://github.com/linux-odyssey/linux-odyssey/issues/166) for updates.
+
+Windows user please refer to [docs/windows-setup.md](docs/windows-setup.md) for setup instructions.
 
 ## Installation
 
@@ -15,30 +21,66 @@
     cd linux-odyssey
     yarn install
 
-## Development
+## Project Structures
 
-Run mongoDB first:
+1. **app**: frontend
+2. **server**: backend
+3. **quests**: tutorials scripts for each quest
+4. **packages**: other packages
+   1. **analytics**: admin dashboard to analyze collected data
+   2. **constants**: some shared config values for app and server
+   3. **container**: the script run in container to capture users' command
+   4. **file-graph**: the algorithm to construct and modify file graph, used in both app and server
+   5. **models**: definitions of MondoDB collections (data schema)
+   6. **utils**: other utility code shared between packages
+   7. **game (in the future)**: core logic of game playing, will be extracted from server
+
+## Configuration
+
+The configuration is stored in the `.env` file. You can copy from the sample file.
+
+    cp .env.sample .env
+
+The backend will use a SSH key pair to login to the player's container. The private key is on the host, and the public key is copied to the player's container.
+
+The key pair is stored in `./config/ssh_key` and `./config/ssh_key.pub`. If it doesn't exist, the backend will generate a new pair and store them.
+
+## Docker Setup
+
+### Docker compose files explaination
+
+1. **docker-compose.yml**: The one used for development. It sets up MongoDB and builds base quest image.
+2. **docker-compose.prod.yml**: The one used for production deployment. It has a Nginx service, a backend, a database, an analytics service, and creates isolated networks for player containers.
+3. **docker-compose.testing.yml**: Similar to production config, but sets up an one-time environment for end-to-end testing.
+
+### Common Development Setup
+
+This sets up a development database, and running development server for frontend and backend.
+
+Pull the latest images:
+
+    docker compose pull
+
+Start the containers:
 
     docker compose up -d
 
-The db will automatically restarts by Docker.
+This will start the db. it will automatically restarts by Docker.
 
-Build up dependencies:
+Building quest images:
 
-    yarn build:deps
+    docker compose build base
+    yarn build:quests
 
-Run dev server (frontend, backend):
+### Build Quest Images in Details
 
-    yarn dev
+In each quest folder, there is a `game.yml` file, which is the quest definition.
 
-If you want to enable social login, you should have OAuth client token in a `.env` file:
+If you want to include additional files, put them in a `home` folder. The files in `home` will be copied to the user's home on container creation automatically.
-
-### Build Quest Images
-
-In each quest folder, there is a `game.yml` file, which is the quest definition. And a optional `Dockerfile` to overwrite the base image. If you want to include additional files, put them in a `home` folder. The files in `home` will **not** be copied to the image automatically, you have to copy them in the `Dockerfile`.
 
     quests/
     ├── Dockerfile      # Base image
+    ├── entrypoint.sh   # Entrypoint for the container
     ├── discover
     │   └── game.yml
     ├── helloworld
@@ -54,14 +96,55 @@ In each quest folder, there is a `game.yml` file, which is the quest definition.
         └── home
             └── ancient_scroll.txt
 
+An optional `Dockerfile` can overwrite the base image. You can use this to install additional dependencies or modify the environment.
+
+Customized `entrypoint.sh` for each quest is not yet supported.
+
 To build all quests:
 
     yarn build:quests
 
 The base image is built with docker-compose, so you can use `docker compose build base` to rebuild it. Once you rebuild the base image, you have to rebuild all quests.
 
+### Optional: Mounting Host Directory
+
+To improve the development experience, we can mount the host directory to the container in the pattern:
+
+    /path/to/linux-odyssey/quests/${quest_id}/home:/home/commander
+    /path/to/linux-odyssey/packages/container:/usr/local/lib/container
+
+You can edit the files on your host, and the changes will be reflected in the container. This is disabled by default. To enable it, you can set the following environment variables:
+
+    MOUNT_QUEST=true
+
+## Development
+
+Copy `.env.sample` to `.env` and customize it for your needs.
+
+Build the whole project for the first time:
+
+    yarn build
+
+This will build the typescript for each package and the server.
+
+Run dev server (frontend, backend):
+
+    yarn dev
+
+**IMPORTANT NOTE**: only the app and server have hot-reloading, other packages require manually running `yarn dev` in each package.
+
+To develop analytics dashboard:
+
+    yarn analytics
+
+The default username and password is `alex` and `Alex1234`.
+
 ## Testing
 
+Unit tests:
+
+    yarn test:unit
+
 Run Cypress locally, using the current development containers:
 
     docker compose up -d
@@ -78,76 +161,22 @@ Run Cypress in container, create brand-new containers along with it:
     # tearing off the containers
     ./docker-scripts.sh down
 
-### Deployment
+## Deployment
 
+    # Build the images (only allowed for maintainers)
     docker compose -f docker-compose.prod.yml build
     docker compose -f docker-compose.prod.yml push
 
     # Server side
     docker compose -f docker-compose.prod.yml pull
+    yarn build:quests
     docker compose -f docker-compose.prod.yml up -d
 
+### Necessary Configuration
+
 To enable social login, you should have OAuth client token in a `.env` file:
-You can copy from `example.env`
+You can copy from `.env.sample`
 
-    # .env
+**YOU MUST CHANGE THE SECRET_KEY** in `.env` file.
-    BASE_URL=https://example.com
-    GOOGLE_CLIENT_ID=...
-    GOOGLE_CLIENT_SECRET=...
 
-To enable it:
+    SECRET_KEY=your-secret-key
-
-    docker compose --env-file .env -f docker-compose.prod.yml up -d
-
-## Standalone App (without Docker)
-
-Source: `app/`
-
-    # Connect to dev server (https://odyssey.wancat.cc)
-    yarn app
-
-    # Connect to localhost (http://localhost:3000)
-    yarn app:local
-
-    # Connect to anyhost
-    API_ENDPOINT=http://example.com yarn app:local
-
-## Swagger
-
-    docker compose up -d swagger
-
-Open http://localhost:8080 to open Swagger
-
-## CLI terminal client (Docker not required)
-
-    yarn cli
-    Usage: client [options] [command]
-
-    Options:
-    -s, --session <string>  Session ID
-    -c, --create            Create a new session
-    -h, --host <string>     Server host (default: "http://localhost:3000")
-    --help                  display help for command
-
-    Commands:
-    list                    List all sessions
-
-connet to recent session:
-
-    yarn cli
-
-connect to new session:
-
-    yarn cli -c
-
-connect to specific session:
-
-    yarn cli -s 64d0de0367459c13004bc83f
-
-connect to other host:
-
-    yarn cli -h https://example.com
-
-list sessions:
-
-    yarn cli list

docker-compose.prod.yml

@@ -1,4 +1,3 @@
-version: '3'
 services:
   app:
     image: linuxodyssey/frontend
@@ -29,15 +28,14 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./logs:/app/logs
+      - ./config:/app/config
+      - ./quests:/app/quests:ro
     env_file:
       - .env
     environment:
-      - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASSWORD}@db:27017/${MONGO_DB}
       - DOCKER_NETWORK=linux-odyssey-players
-      - SECRET_KEY=${SECRET_KEY}
-      - TRUSTED_PROXIES=${TRUSTED_PROXIES}
       - BACKEND_URL=http://backend:3000
-      - BASE_URL=${BASE_URL}
+      - HOST_PROJECT_ROOT=${PWD}
 
   analytics:
     image: linuxodyssey/analytics
@@ -52,13 +50,11 @@ services:
       - internal
     ports:
       - '3001:3001'
-    environment:
+    env_file:
-      - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASSWORD}@db:27017/${MONGO_DB}
+      - .env
-      - ADMIN_USERNAME=${ADMIN_USERNAME}
-      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
 
   db:
-    image: mongo
+    image: mongo:6
     restart: always
     networks:
       - internal
@@ -67,19 +63,8 @@ services:
     volumes:
       - mongo:/data/db
       - ./mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
-    environment:
+    env_file:
-      - BASE_URL=${BASE_URL}
+      - .env
-      - MONGO_INITDB_ROOT_USERNAME=admin
-      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD}
-      - MONGO_USER=${MONGO_USER}
-      - MONGO_PASS=${MONGO_PASSWORD}
-      - MONGO_DB=${MONGO_DB}
-      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
-      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
-      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
-      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
-      - SURVEY_URL=${SURVEY_URL}
-      - BUG_REPORT_URL=${BUG_REPORT_URL}
 
   base:
     image: linuxodyssey/quest-base

docker-compose.yml

@@ -1,7 +1,7 @@
 version: '3'
 services:
   db:
-    image: mongo
+    image: mongo:6
     restart: always
     networks:
       - internal
@@ -12,12 +12,16 @@ services:
 
   base:
     image: linuxodyssey/quest-base
+    networks:
+      - players-dev
     build:
       context: .
       dockerfile: ./quests/Dockerfile
+    extra_hosts:
+      - 'host.docker.internal:host-gateway'
 
 networks:
   internal:
-  players:
+  players-dev:
-    name: linux-odyssey-players
+    name: linux-odyssey-players-dev
-    internal: true
+    internal: false

docker-scripts.sh

@@ -32,15 +32,16 @@ down() {
 dump() {
   # Define service name and dump directory name
   SERVICE_NAME="db"
+  COMPOSE_FILE="docker-compose.prod.yml"
   DUMP_NAME="mongodump-$(date --iso).archive"
-  CONTAINER_ID=$(docker compose ps -q $SERVICE_NAME)
+  CONTAINER_ID=$(docker compose -f $COMPOSE_FILE ps -q $SERVICE_NAME)
 
   # Fetch credentials from Docker environment variables
-  MONGO_URL=$(docker compose exec -T backend printenv MONGO_URL)
+  MONGO_URL=$(docker compose -f $COMPOSE_FILE exec -T backend printenv MONGO_URL)
   echo mongo uri: $MONGO_URL
 
   # Dump MongoDB data using credentials
-  docker compose exec -T $SERVICE_NAME sh -c "mongodump --gzip --archive=/tmp/$DUMP_NAME -d odyssey-test" &&
+  docker compose -f $COMPOSE_FILE exec -T $SERVICE_NAME sh -c "mongodump --gzip --archive=/tmp/$DUMP_NAME --uri=$MONGO_URL" &&
 
   # Copy the dump from the container to the host
   # Note: You will need to know the exact container name for this step

docs/windows-setup.md

@@ -0,0 +1,141 @@
+# Windows Environment Setup
+
+## Install WSL and Ubuntu
+
+Please refer to the Official [Setup WSL](https://learn.microsoft.com/en-us/windows/wsl/setup/environment) on Microsoft's website.
+
+Run the following command in PowerShell as Administrator:
+
+    wsl --install
+
+Then restart the computer. After restarting, you can open Ubuntu terminal by searching "Ubuntu" in Start menu. You will be prompted to create a new user account. Once you have done that, you can continue with the following steps.
+
+## Setup Environment (In Ubuntu terminal)
+
+1. Update and upgrade
+
+   ```
+   sudo apt-get update
+   sudo apt-get upgrade
+   ```
+
+1. Install Git
+
+   ```
+   sudo apt-get install git
+   ```
+
+1. Install Node.js (Version 20.x)
+
+   ```
+   curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
+   sudo apt-get install nodejs
+   sudo apt install build-essential
+   sudo npm install -g yarn
+   ```
+
+## Install Docker
+
+(Refer to [get.docker.com](https://get.docker.com/))
+
+To install the latest stable versions of Docker CLI, Docker Engine, and their
+dependencies:
+
+1. Download the script
+
+   ```
+   curl -fsSL https://get.docker.com -o install-docker.sh
+   ```
+
+1. verify the script's content
+
+   ```
+   cat install-docker.sh
+   ```
+
+1. run the script with --dry-run to verify the steps it executes
+
+   ```
+   sh install-docker.sh --dry-run
+   ```
+
+**NOTE: the script will recommend you to use Docker Desktop instead, but we need to use Docker inside WSL for the backend to work.** Just ignore it and wait for the installation to finish.
+
+1. run the script either as root, or using sudo to perform the installation.
+
+   ```
+   sudo sh install-docker.sh
+   ```
+
+1. Verify the installation
+
+   ```
+   docker --version
+   ```
+
+1. Add your user to the docker group
+
+   ```
+   sudo usermod -aG docker $USER
+   ```
+
+   **NOTE: You need to create a new WSL terminal to apply the changes.**
+
+1. Verify the installation
+
+   ```
+   docker ps
+   ```
+   This should return something like:
+
+   CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
+
+## Run the Project (In Ubuntu terminal)
+
+1.  Clone the repository
+
+    ```
+    git clone https://github.com/lancatlin/linux-odyssey.git
+    cd linux-odyssey
+    ```
+
+    Optional: To open the project in VSCode, run the following command inside the project folder:
+
+    ```
+    code .
+    ```
+
+1. Install dependencies
+
+    ```
+    yarn install
+    ```
+    It is ok if there are some warnings and `gyp: ERR` errors, just verify there is `done` at the end.
+
+1. Copy the environment variables
+
+    ```
+    cp .env.sample .env
+    ```
+
+1.  Docker setup
+
+    ```
+    docker compose pull
+    docker compose build
+    docker compose up -d db
+    ```
+
+    <!-- Check folder ./config exist and is empty -->
+    <!-- Check .env file exist -->
+
+1.  Run the project
+
+    ```
+    yarn build
+    yarn dev
+    ```
+
+    <!-- Check ./config/ssh_key.pub is a file not a folder -->
+
+Enjoy!

package.json

@@ -56,5 +56,6 @@
   "dependencies": {
     "latest": "^0.2.0",
     "typescript-eslint": "^7.4.0"
-  }
+  },
+  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

packages/analytics/src/config.ts

@@ -21,14 +21,16 @@ interface Config {
 }
 
 const config: Config = {
-  host: process.env.HOST || 'localhost',
+  host: process.env.ADMIN_HOST || 'localhost',
-  port: process.env.PORT ? parseInt(process.env.PORT, 10) : 3001,
+  port: process.env.ADMIN_PORT ? parseInt(process.env.ADMIN_PORT, 10) : 3001,
   db: process.env.MONGO_URL || 'mongodb://localhost:27017/odyssey-test',
   username: getOrFailed('ADMIN_USERNAME'),
   password: getOrFailed('ADMIN_PASSWORD'),
   baseUrl:
-    process.env.BASE_URL ||
+    process.env.ADMIN_BASE_URL ||
-    `http://${process.env.HOST || 'localhost'}:${process.env.PORT ? parseInt(process.env.PORT, 10) : 3001}`,
+    `http://${process.env.ADMIN_HOST || 'localhost'}:${
+      process.env.ADMIN_PORT ? parseInt(process.env.ADMIN_PORT, 10) : 3001
+    }`,
 }
 
 export default config

quests/.includes/sshd_config

@@ -0,0 +1,121 @@
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+Include /etc/ssh/sshd_config.d/*.conf
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+AuthorizedKeysFile     /etc/ssh/authorized_keys/%u
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+KbdInteractiveAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_* NODE_PATH ZDOTDIR API_ENDPOINT TOKEN
+
+# override default of no subsystems
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       PermitTTY no
+#       ForceCommand cvs server

quests/.includes/zshrc

@@ -1,24 +1,39 @@
 PROMPT='%F{2}%n%f:%F{6}%~%f $ '
 unsetopt CASE_GLOB
 setopt CHASE_LINKS
-emulate bash
+# emulate bash
 
 set +o prompt_cr
 
 preexec() {
     export CMD_START_TIME=$(date +%s%N)      # capture start time
-    export CMD_NAME=$1                   # capture command
+    export CMD_NAME="$1"                   # capture command
+    export CMD_PID=$$
 
-    # A list of interactive commands
+    # # A list of interactive commands
-    interactive_commands=("vim" "nano" "top" "ssh" "less" "zsh" "bash")
+    # readlink /proc/$PPID/exe
+    interactive_commands=("vim" "nano" "top" "ssh" "less" "zsh" "bash" "script" "exec")
+    # # if [[ $CMD_EXECUTED = 1 ]]; then
+    # #     export CMD_EXECUTED=0
+    # #     return
+    # # fi
 
-    # Check if the command is in the list of interactive commands
+    # # Check if the command is in the list of interactive commands
     if [[ " ${interactive_commands[@]} " =~ " $1 " ]]; then
         # If it is, just execute it normally
-        exec
+        # exec
+        # echo IF
+        return
     else
         # If it's not, execute it and redirect its output to a file
-        exec > >(tee /tmp/cmd.out) 2> >(tee /tmp/cmd.error >&2)
+        # exec > >(tee /tmp/cmd.out) 2> >(tee /tmp/cmd.error >&2)
+        # echo ELSE
+        # export CMD_EXECUTED=1
+        # eval >&1 >/tmp/cmd.out 
+        # exec >&1
+        # exec
+        script --quiet -O /tmp/cmd.out -c "$CMD_NAME"
+        return 1
     fi
 }
 
@@ -29,7 +44,12 @@ precmd() {
     export CMD_ERROR_FILE=/tmp/cmd.error
 
     # Now run your Node.js script with the result as an argument
-    node /usr/local/lib/container/cli.js; rm /tmp/cmd.out /tmp/cmd.error 2>/dev/null
+    node /usr/local/lib/container/cli.js
+    if [[ -n $CMD_PID ]]; then
+        # echo $CMD_PID
+        # kill $CMD_PID
+    fi
+    # rm /tmp/cmd.out /tmp/cmd.error 2>/dev/null
 
     # Reset variables
     unset CMD_START_TIME
@@ -38,5 +58,6 @@ precmd() {
     unset CMD_OUTPUT_FILE
     unset CMD_ERROR_FILE
     unset CMD_NAME
+    export CMD_EXECUTED=0
 }
 

quests/Dockerfile

@@ -1,26 +1,32 @@
-FROM alpine:3.18
+FROM debian:bookworm-slim
 
 LABEL maintainer="wancat@wancat.cc"
 
-RUN apk add --no-cache \
+RUN apt-get update && apt-get install -y \
   vim \
   zsh \
-  nodejs \
+  curl \
-  yarn 
+  openssh-server
+
+
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x -o nodesource_setup.sh
+RUN bash nodesource_setup.sh
+RUN apt-get install -y nodejs
+RUN npm install -g yarn
+RUN node -v && yarn -v
 
 WORKDIR /usr/local/lib/container
-
 COPY ./packages/container/package.json ./yarn.lock ./
 RUN yarn install --modules-folder /usr/src/node_modules
 ENV NODE_PATH=/usr/src/node_modules
 COPY ./packages/container /usr/local/lib/container
 COPY ./quests/.includes/zshrc /etc/zsh/zshrc
+RUN rm -f /etc/motd /etc/issue /etc/issue.net /etc/update-motd.d/*
+RUN rm -rf /etc/skel && mkdir -p /etc/skel
+RUN mkdir -p /etc/ssh/authorized_keys && chmod 755 /etc/ssh/authorized_keys
+COPY ./quests/.includes/sshd_config /etc/ssh/sshd_config
+COPY ./quests/entrypoint.sh /entrypoint.sh
 
-ENV USERNAME=commander
+EXPOSE 22
 
-RUN adduser --disabled-password --gecos '' --shell /bin/zsh ${USERNAME}
+ENTRYPOINT ["/bin/sh", "/entrypoint.sh"]
-
-USER ${USERNAME}
-
-WORKDIR /home/${USERNAME}
-CMD [ "/bin/zsh" ]

quests/checkpoint-01/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/checkpoint-02/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/checkpoint-03/Dockerfile

@@ -1,7 +0,0 @@
-FROM linuxodyssey/quest-base
-
-USER root
-COPY home .
-RUN chown -R ${USERNAME}:${USERNAME} .
-
-USER ${USERNAME}

quests/copy/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/copy/game.yml

@@ -164,7 +164,7 @@ stages:
       command:
         - ^cp hello.txt hello2.txt$
       files:
-        - path: hello2.txt
+        - path: /home/commander/hello2.txt
           type: file
     exceptions:
       - condition:
@@ -224,7 +224,7 @@ stages:
       command:
         - ^cp world.txt world2.txt$
       files:
-        - path: world2.txt
+        - path: /home/commander/world2.txt
           type: file
     exceptions:
       - condition:
@@ -292,9 +292,9 @@ stages:
       command:
         - ^cp
       files:
-        - path: notes2
+        - path: /home/commander/notes2
           type: directory
-        - path: notes2/note.txt
+        - path: /home/commander/notes2/note.txt
           type: file
     exceptions:
       - condition:

quests/create/game.yml

@@ -44,12 +44,12 @@ stages:
       - ls
     condition:
       files:
-        - path: hello.txt
+        - path: /home/commander/hello.txt
           type: file
     exceptions:
       - condition:
           files:
-            - path: hello$
+            - path: /home/commander/hello
               type: file
         responses:
           - type: narrative
@@ -107,12 +107,12 @@ stages:
       - ls-touch
     condition:
       files:
-        - path: world.txt
+        - path: /home/commander/world.txt
           type: file
     exceptions:
       - condition:
           files:
-            - path: world$
+            - path: /home/commander/world
               type: file
         responses:
           - type: narrative
@@ -154,7 +154,7 @@ stages:
       - ls-2
     condition:
       files:
-        - path: notes
+        - path: /home/commander/notes
           type: folder
     responses:
       - type: narrative
@@ -203,7 +203,7 @@ stages:
       - cd-notes
     condition:
       files:
-        - path: notes/note.txt
+        - path: /home/commander/notes/note.txt
           type: file
     responses:
       - type: narrative

quests/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+USERNAME=commander
+
+echo "Initializing container for $USERNAME"
+
+if ! id -u ${USERNAME} >/dev/null 2>&1; then
+  echo "Adding user $USERNAME"
+  adduser --disabled-password --gecos '' --shell /bin/zsh ${USERNAME} && \
+  find / -name ".gitkeep" -type f -exec rm -f {} +
+
+  echo "Adding public key for $USERNAME"
+  echo "Public key: $PUB_KEY"
+  PUB_KEY_PATH=/etc/ssh/authorized_keys/${USERNAME}
+  echo $PUB_KEY > ${PUB_KEY_PATH}
+  chmod 644 ${PUB_KEY_PATH}
+fi
+
+mkdir -p /run/sshd
+echo "Starting SSH server"
+/usr/sbin/sshd -D -e

quests/execute/Dockerfile

@@ -1,6 +0,0 @@
-FROM linuxodyssey/quest-base
-
-USER root
-COPY home ${HOME}
-
-USER commander

quests/explore/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/helloworld/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/move/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY --chown=${USERNAME} home ${HOME}

quests/move/game.yml

@@ -49,9 +49,9 @@ stages:
       command:
         - ^mv hello.txt notes$
       files:
-        - path: notes/hello.txt
+        - path: /home/commander/notes/hello.txt
           type: file
-        - path: hello.txt
+        - path: /home/commander/hello.txt
           exists: false
     responses:
       - type: narrative
@@ -106,9 +106,9 @@ stages:
       command:
         - ^mv
       files:
-        - path: wow.txt
+        - path: /home/commander/wow.txt
           type: file
-        - path: world.txt
+        - path: /home/commander/world.txt
           exists: false
     responses:
       - type: narrative
@@ -148,9 +148,9 @@ stages:
       command:
         - ^mv
       files:
-        - path: docs
+        - path: /home/commander/docs
           type: directory
-        - path: notes
+        - path: /home/commander/notes
           exists: false
     responses:
       - type: narrative
@@ -187,9 +187,9 @@ stages:
       command:
         - ^mv
       files:
-        - path: hi.txt
+        - path: /home/commander/hi.txt
           type: file
-        - path: docs/hello.txt
+        - path: /home/commander/docs/hello.txt
           exists: false
     exceptions:
       - condition:

quests/path/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/read/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

quests/remove/Dockerfile

@@ -1,4 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY --chown=${USERNAME} home ${HOME}
-RUN mkdir empty

quests/remove/game.yml

@@ -44,7 +44,7 @@ stages:
       command:
         - ^rm\s
       files:
-        - path: hello.txt
+        - path: /home/commander/hello.txt
           exists: false
     responses:
       - content: |
@@ -58,7 +58,7 @@ stages:
       command:
         - ^ls$
       files:
-        - path: hello.txt
+        - path: /home/commander/hello.txt
           exists: false
     responses:
       - content: |
@@ -78,9 +78,9 @@ stages:
       command:
         - ^rm
       files:
-        - path: world.txt
+        - path: /home/commander/world.txt
           exists: false
-        - path: wow.txt
+        - path: /home/commander/wow.txt
           exists: false
     responses:
       - content: |
@@ -111,7 +111,7 @@ stages:
       command:
         - ^rmdir empty$
       files:
-        - path: empty
+        - path: /home/commander/empty
           exists: false
     responses:
       - content: |
@@ -139,7 +139,7 @@ stages:
       command:
         - ^rmdir notes$
       files:
-        - path: notes
+        - path: /home/commander/notes
           type: folder
           exists: true
     responses:
@@ -161,10 +161,10 @@ stages:
       command:
         - ^rm
       files:
-        - path: notes
+        - path: /home/commander/notes
           type: folder
           exists: true
-        - path: notes/note.txt
+        - path: /home/commander/notes/note.txt
           exists: false
     exceptions:
       - condition:
@@ -203,7 +203,7 @@ stages:
     task: 使用 `rmdir` 刪除 `notes` 資料夾
     condition:
       files:
-        - path: notes
+        - path: /home/commander/notes
           exists: false
     responses:
       - content: |
@@ -238,7 +238,7 @@ stages:
       command:
         - ^rm -r trash$
       files:
-        - path: trash
+        - path: /home/commander/trash
           exists: false
     responses:
       - content: |

quests/tab/Dockerfile

@@ -1,3 +0,0 @@
-FROM linuxodyssey/quest-base
-
-COPY home ${HOME}

server/package.json

@@ -40,6 +40,7 @@
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
     "socket.io": "^4.7.1",
+    "ssh2": "^1.16.0",
     "swagger-ui-express": "^5.0.0",
     "validator": "^13.11.0",
     "winston": "^3.11.0",
@@ -61,6 +62,7 @@
     "@types/passport-local": "^1.0.38",
     "@types/passport-oauth2": "^1.4.15",
     "@types/source-map-support": "^0",
+    "@types/ssh2": "^1.15.1",
     "@types/swagger-ui-express": "^4.1.6",
     "@types/validator": "^13.11.9",
     "concurrently": "^8.2.2",

server/src/api/controllers/commandController.ts

@@ -8,6 +8,7 @@ import { asyncHandler } from '../../middleware/error.js'
 
 export const newCommand = asyncHandler(async (req: Request, res: Response) => {
   const { command, pwd, output, error, params } = matchedData(req)
+  console.log(command, output, error)
 
   const { sessionId } = req.user as any
   const session = await Session.findById(sessionId)

server/src/api/socket.ts

@@ -1,8 +1,9 @@
 import { Server } from 'socket.io'
 import type { Socket } from 'socket.io'
+import { Duplex } from 'stream'
 import validator from 'validator'
 import type { Server as HttpServer } from 'http'
-import { Session } from '@linux-odyssey/models'
+import { ISession, Session } from '@linux-odyssey/models'
 import { getAndStartContainer, attachContainer } from '../containers/docker.js'
 import SessionMiddleware from '../middleware/session.js'
 import { genJWT } from '../utils/auth.js'
@@ -77,30 +78,34 @@ async function connectContainer(socket: Socket, next: (err?: Error) => void) {
       stream,
     }
     next()
-  } catch {
+  } catch (err) {
-    next(new Error('Failed to start container.'))
+    logger.error(err)
+    next(new Error('Failed to connect to container.'))
   }
 }
 
 function onConnect(socket: Socket) {
-  const { session, stream } = socket.data.context
+  const { session, stream } = socket.data.context as {
-  stream.socket.on('data', (chunk: Buffer) => {
+    session: ISession
+    stream: Duplex
+  }
+  stream.on('data', (chunk: Buffer) => {
     socket.emit('terminal', chunk.toString())
   })
 
   socket.on('terminal', function incoming(message) {
-    stream.socket.write(message)
+    stream.write(message)
   })
 
   const socketCallback = (event: string, ...data: any[]) => {
     socket.emit(event, ...data)
   }
 
-  listenToSession(session.id, socketCallback)
+  listenToSession(session._id.toString(), socketCallback)
 
   socket.on('disconnect', () => {
-    stream.socket.write('exit\n')
+    stream.write('exit\n')
-    removeFromSession(session.id, socketCallback)
+    removeFromSession(session._id.toString(), socketCallback)
     stream.destroy()
   })
 }

server/src/config.ts

@@ -1,6 +1,9 @@
 import validator from 'validator'
 import dotenv from 'dotenv'
+import { fileURLToPath } from 'node:url'
+import path from 'path'
 import { get } from './utils/env.js'
+import { loadOrCreateKeyPair } from './utils/crypto.js'
 
 // Import dotenv and load ../.env
 dotenv.config({ path: '../.env' })
@@ -29,22 +32,31 @@ function getUrl(key: string): string {
 
 function createConfig() {
   const isProduction = process.env.NODE_ENV === 'production'
-  const host = get('HOST', 'localhost')
+  const host = get('HOST', '0.0.0.0')
   const port = Number(get('PORT', 3000))
   const baseUrl = get('BASE_URL', `http://${host}:${port}`)
+  const backendUrl = get('BACKEND_URL', `http://host.docker.internal:${port}`)
   const url = new URL(baseUrl)
+  const projectRoot = getProjectRoot()
+  const keypairPath = get(
+    'KEYPAIR_PATH',
+    path.join(projectRoot, 'config', 'ssh_key')
+  )
+  const keypair = loadOrCreateKeyPair(keypairPath)
+
   return {
     host,
     port,
     baseUrl,
     domain: url.hostname,
     protocol: url.protocol,
-    backendUrl: get('BACKEND_URL', baseUrl),
+    backendUrl,
     db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'),
     secret: get('SECRET_KEY', ''),
     isProduction: process.env.NODE_ENV === 'production',
-    containerExpiry: get('EXPIRY', 1000 * 60 * 60),
+    containerExpiry: Number(process.env.CONTAINER_EXPIRY ?? 60) * 1000 * 60,
-    sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
+    sessionMaxAge:
+      Number(process.env.SESSION_MAX_AGE ?? 7 * 24) * 1000 * 60 * 60,
     google: {
       clientID: get('GOOGLE_CLIENT_ID', ''),
       clientSecret: get('GOOGLE_CLIENT_SECRET', ''),
@@ -57,16 +69,20 @@ function createConfig() {
     surveyUrl: getUrl('SURVEY_URL'),
     bugReportUrl: getUrl('BUG_REPORT_URL'),
 
+    projectRoot,
+
     docker: {
-      network: get('DOCKER_NETWORK', 'host'),
+      network: get('DOCKER_NETWORK', 'linux-odyssey-players-dev'),
       defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'),
       imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'),
-      mountQuest: get('MOUNT_QUEST', ''),
+      mountQuest: process.env.MOUNT_QUEST === 'true',
-      hostPwd: get('HOST_PWD', ''),
+      hostProjectRoot: get('HOST_PROJECT_ROOT', projectRoot),
+      keypairPath,
+      keypair,
     },
 
     log: {
-      path: get('LOG_PATH', '../logs'),
+      path: get('LOG_PATH', path.join(projectRoot, 'logs')),
     },
     testing: {
       enabled: !isProduction && process.env.TESTING === 'true',
@@ -76,9 +92,16 @@ function createConfig() {
   }
 }
 
+function getProjectRoot(): string {
+  const filename = fileURLToPath(import.meta.url)
+  const root = path.join(path.dirname(filename), '..', '..')
+  return root
+}
+
 const config = createConfig()
 
 export function getQuestImage(id: string): string {
+  // TODO: handle staging images (add version tag)
   return `${config.docker.imagePrefix}${id}`
 }
 

server/src/containers/docker.ts

@@ -1,41 +1,80 @@
+import fs from 'fs/promises'
+import { Duplex } from 'stream'
 import Docker from 'dockerode'
 import config, { getQuestImage } from '../config.js'
 import logger from '../utils/logger.js'
+import { connectToSSH } from './ssh.js'
 
 const engine = new Docker()
 
-const containerOptions = {
+const newContainerOptions = (
-  AttachStdin: true,
+  name: string,
-  AttachStdout: true,
+  imageId: string,
-  AttachStderr: true,
+  options: {
-  Tty: true,
+    binds?: string[]
-  OpenStdin: true,
+  } = {}
-  StdinOnce: false,
+): Docker.ContainerCreateOptions => ({
+  name,
+  Image: getQuestImage(imageId),
   HostConfig: {
     NetworkMode: config.docker.network,
+    Binds: options.binds,
+    ExtraHosts: ['host.docker.internal:host-gateway'],
   },
-} as Docker.ContainerCreateOptions
+  ExposedPorts: {
+    '22/tcp': {},
+  },
+  Env: [`PUB_KEY=${config.docker.keypair.publicKey}`],
+})
 
-export function createContainer(
+export async function createContainer(
   name: string,
-  questId: string
+  questId: string,
+  imageId: string
 ): Promise<Docker.Container> {
-  const option = {
+  let binds: string[] = []
-    ...containerOptions,
+  binds.push(
-    name,
+    `${config.docker.hostProjectRoot}/quests/.includes/zshrc:/etc/zsh/zshrc`
-    Image: getQuestImage(questId),
+  )
+  if (await questHomeExists(questId)) {
+    logger.info('Mounting quest home', questId)
+    binds.push(
+      `${config.docker.hostProjectRoot}/quests/${questId}/home:/etc/skel:ro`
+    )
   }
-  const { hostPwd, mountQuest } = config.docker
+  if (!config.isProduction && config.docker.mountQuest && imageId !== 'base') {
-  if (!config.isProduction && hostPwd && mountQuest === questId) {
+    logger.info('Mounting quest folder', questId)
-    logger.info('Mounting quest folder', mountQuest)
+    binds = [
-    option.HostConfig!.Binds = [
+      `${config.docker.hostProjectRoot}/quests/${questId}/home:/home/commander`,
-      `${hostPwd}/quests/${mountQuest}/home:/home/commander`,
+      `${config.docker.hostProjectRoot}/packages/container:/usr/local/lib/container`,
-      `${hostPwd}/packages/container:/usr/local/lib/container`,
     ]
   }
+  const option = newContainerOptions(name, imageId, { binds })
+  await createNetworkIfNotExists(config.docker.network)
   return engine.createContainer(option)
 }
 
+async function createNetworkIfNotExists(network: string) {
+  const dockerNetworks = await engine.listNetworks({
+    filters: {
+      name: [network],
+    },
+  })
+  if (dockerNetworks.length === 0) {
+    logger.log('Creating player network', network)
+    await engine.createNetwork({ Name: network })
+  }
+}
+
+async function questHomeExists(imageId: string) {
+  try {
+    const stat = await fs.stat(`${config.projectRoot}/quests/${imageId}/home`)
+    return stat.isDirectory()
+  } catch {
+    return false
+  }
+}
+
 export async function getAndStartContainer(
   id: string
 ): Promise<Docker.Container> {
@@ -53,26 +92,26 @@ export async function getAndStartContainer(
 export async function attachContainer(
   container: Docker.Container,
   { token }: { token: string }
-) {
+): Promise<Duplex> {
-  const exec = await container.exec({
+  const containerIp = (await container.inspect()).NetworkSettings.Networks[
-    AttachStdin: true,
+    config.docker.network
-    AttachStdout: true,
+  ].IPAddress
-    AttachStderr: true,
-    Cmd: ['/bin/zsh'],
-    Tty: true,
-    Env: [
-      `TOKEN=${token}`,
-      `API_ENDPOINT=${config.backendUrl}`,
-      'ZDOTDIR=/etc/zsh',
-    ],
-  })
 
-  const execOutput = await exec.start({
+  let error: Error | null = null
-    Detach: false,
+  for (let i = 0; i < 10; i++) {
-    Tty: true,
+    try {
-  })
+      // eslint-disable-next-line no-await-in-loop
-
+      const stream = await connectToSSH(containerIp, { token })
-  return execOutput
+      return stream
+    } catch (err) {
+      error = err as Error
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise((resolve) => {
+        setTimeout(resolve, 1000)
+      })
+    }
+  }
+  throw new Error('Failed to connect to SSH', { cause: error })
 }
 
 export async function deleteContainer(id: string) {

server/src/containers/ssh.ts

@@ -0,0 +1,45 @@
+import { Client } from 'ssh2'
+import { Duplex } from 'stream'
+import config from '../config.js'
+
+export async function connectToSSH(
+  containerIp: string,
+  { token }: { token: string }
+): Promise<Duplex> {
+  const conn = new Client()
+
+  return new Promise((resolve, reject) => {
+    conn
+      .on('ready', () => {
+        conn.shell(
+          {
+            env: {
+              TOKEN: token,
+              API_ENDPOINT: config.backendUrl,
+              ZDOTDIR: '/etc/zsh',
+              NODE_PATH: '/usr/src/node_modules',
+            },
+          },
+          (err, stream) => {
+            if (err) {
+              reject(err)
+            }
+            stream.on('close', () => {
+              conn.end()
+            })
+            resolve(stream)
+          }
+        )
+      })
+      .on('error', (err) => {
+        reject(err)
+      })
+      .connect({
+        host: containerIp,
+        port: 22,
+        username: 'commander',
+        privateKey: config.docker.keypair.privateKey,
+        timeout: 5000,
+      })
+  })
+}

server/src/index.ts

@@ -72,7 +72,7 @@ async function main() {
   app.use('/api/v1', apiRouter)
   app.use(errorHandler)
 
-  server.listen(config.port, config.host, () => {
+  server.listen(config.port, '0.0.0.0', () => {
     logger.info(`Server listening at ${config.baseUrl}`)
   })
 }

server/src/models/sessionManager.ts

@@ -43,6 +43,7 @@ export async function createNewSession(
 
   const container = await createContainer(
     `quest-${quest.id}-${user.username}-${Date.now()}`,
+    quest.id,
     quest.image
   )
 

server/src/utils/crypto.ts

@@ -0,0 +1,39 @@
+import fs from 'fs'
+import path from 'path'
+import ssh2 from 'ssh2'
+
+const {
+  utils: { generateKeyPairSync },
+} = ssh2
+
+type KeyPair = {
+  privateKey: string
+  publicKey: string
+}
+
+export function loadOrCreateKeyPair(privateKeyPath: string): KeyPair {
+  const publicKeyPath = `${privateKeyPath}.pub`
+  if (fs.existsSync(privateKeyPath) && fs.existsSync(publicKeyPath)) {
+    const privateKey = fs.readFileSync(privateKeyPath, 'utf8')
+    const publicKey = fs.readFileSync(publicKeyPath, 'utf8')
+    return { privateKey, publicKey }
+  }
+  const dir = path.dirname(privateKeyPath)
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true })
+  }
+  const keyPair = generateKeyPair()
+  fs.writeFileSync(privateKeyPath, keyPair.privateKey, {
+    mode: 0o600,
+  })
+  fs.writeFileSync(publicKeyPath, keyPair.publicKey, {
+    mode: 0o600,
+  })
+  return keyPair
+}
+
+export function generateKeyPair(): KeyPair {
+  const { private: privateKey, public: publicKey } =
+    generateKeyPairSync('ed25519')
+  return { privateKey, publicKey }
+}

server/tests/utils/crypto.test.ts

@@ -0,0 +1,9 @@
+import { generateKeyPair } from '../../src/utils/crypto'
+
+describe('generateKeyPair', () => {
+  it('should generate a key pair', () => {
+    const keyPair = generateKeyPair()
+    expect(keyPair).toHaveProperty('privateKey')
+    expect(keyPair).toHaveProperty('publicKey')
+  })
+})

yarn.lock

@@ -2067,6 +2067,13 @@
   dependencies:
     "@types/node" "^18.11.18"
 
+"@types/ssh2@^1.15.1":
+  version "1.15.1"
+  resolved "https://registry.yarnpkg.com/@types/ssh2/-/ssh2-1.15.1.tgz#4db4b6864abca09eb299fe5354fa591add412223"
+  integrity sha512-ZIbEqKAsi5gj35y4P4vkJYly642wIbY6PqoN0xiyQGshKUGXR9WQjF/iF9mXBQ8uBKy3ezfsCkcoHKhd0BzuDA==
+  dependencies:
+    "@types/node" "^18.11.18"
+
 "@types/stack-utils@^2.0.0":
   version "2.0.3"
   resolved "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz"
@@ -3579,6 +3586,14 @@ cors@~2.8.5:
     object-assign "^4"
     vary "^1"
 
+cpu-features@~0.0.10:
+  version "0.0.10"
+  resolved "https://registry.yarnpkg.com/cpu-features/-/cpu-features-0.0.10.tgz#9aae536db2710c7254d7ed67cb3cbc7d29ad79c5"
+  integrity sha512-9IkYqtX3YHPCzoVg1Py+o9057a3i0fp7S530UWokCSaFVTc7CwXPRiOjRjBQQ18ZCNafx78YfnG+HALxtVmOGA==
+  dependencies:
+    buildcheck "~0.0.6"
+    nan "^2.19.0"
+
 cpu-features@~0.0.9:
   version "0.0.9"
   resolved "https://registry.npmjs.org/cpu-features/-/cpu-features-0.0.9.tgz"
@@ -6823,6 +6838,11 @@ nan@^2.17.0, nan@^2.18.0:
   resolved "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz"
   integrity sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w==
 
+nan@^2.19.0, nan@^2.20.0:
+  version "2.21.0"
+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.21.0.tgz#203ab765a02e6676c8cb92e1cad9503e7976d55b"
+  integrity sha512-MCpOGmdWvAOMi4RWnpxS5G24l7dVMtdSHtV87I3ltjaLdFOTO74HVJ+DfYiAXjxGKsYR/UCmm1rBwhMN7KqS1A==
+
 nanoid@^3.3.7:
   version "3.3.7"
   resolved "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz"
@@ -8584,6 +8604,17 @@ ssh2@^1.11.0:
     cpu-features "~0.0.9"
     nan "^2.18.0"
 
+ssh2@^1.16.0:
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/ssh2/-/ssh2-1.16.0.tgz#79221d40cbf4d03d07fe881149de0a9de928c9f0"
+  integrity sha512-r1X4KsBGedJqo7h8F5c4Ybpcr5RjyP+aWIG007uBPRjmdQWfEiVLzSK71Zji1B9sKxwaCvD8y8cwSkYrlLiRRg==
+  dependencies:
+    asn1 "^0.2.6"
+    bcrypt-pbkdf "^1.0.2"
+  optionalDependencies:
+    cpu-features "~0.0.10"
+    nan "^2.20.0"
+
 sshpk@^1.14.1, sshpk@^1.7.0:
   version "1.18.0"
   resolved "https://registry.npmjs.org/sshpk/-/sshpk-1.18.0.tgz"
@@ -8631,7 +8662,7 @@ string-length@^4.0.1:
     char-regex "^1.0.2"
     strip-ansi "^6.0.0"
 
-"string-width-cjs@npm:string-width@^4.2.0", "string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0":
   version "4.2.3"
   resolved "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -8649,6 +8680,15 @@ string-width@^1.0.1:
     is-fullwidth-code-point "^1.0.0"
     strip-ansi "^3.0.0"
 
+"string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+  version "4.2.3"
+  resolved "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz"
+  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^6.0.1"
+
 string-width@^5.0.1, string-width@^5.1.2:
   version "5.1.2"
   resolved "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz"
@@ -8709,7 +8749,7 @@ stringstream@~0.0.4:
   resolved "https://registry.yarnpkg.com/stringstream/-/stringstream-0.0.6.tgz#7880225b0d4ad10e30927d167a1d6f2fd3b33a72"
   integrity sha512-87GEBAkegbBcweToUrdzf3eLhWNg06FJTebl4BVJz/JgWy8CvEr9dRtX5qWphiynMSQlxxi+QqN0z5T32SLlhA==
 
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
   version "6.0.1"
   resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz"
   integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
@@ -8723,6 +8763,13 @@ strip-ansi@^3.0.0, strip-ansi@^3.0.1, strip-ansi@~3.0.1:
   dependencies:
     ansi-regex "^2.0.0"
 
+strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz"
+  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
+  dependencies:
+    ansi-regex "^5.0.1"
+
 strip-ansi@^7.0.1:
   version "7.1.0"
   resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz"
@@ -9575,7 +9622,7 @@ wordwrap@^1.0.0:
   resolved "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz"
   integrity sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==
 
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
   version "7.0.0"
   resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz"
   integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
@@ -9593,6 +9640,15 @@ wrap-ansi@^6.2.0:
     string-width "^4.1.0"
     strip-ansi "^6.0.0"
 
+wrap-ansi@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz"
+  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
+  dependencies:
+    ansi-styles "^4.0.0"
+    string-width "^4.1.0"
+    strip-ansi "^6.0.0"
+
 wrap-ansi@^8.1.0:
   version "8.1.0"
   resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz"