feat(servers): apply security hardening from the Security tab, with a live log

[agentHits]

Why

The Security tab only showed UFW, SSH and Fail2Ban checks. The hardening script ran only inside Setup Server, and only when the panel had DOKPLOY_SERVER_HARDENING set. On a panel without it, Setup Server skipped hardening silently and every item stayed red.

What

• Apply hardening button in Setup Server → Security. A dialog with three checkboxes: UFW, SSH keys only, Fail2Ban. Items the check marked red are preselected.
  • The SSH item shows a warning that password login stops working for everyone.
  • The UFW item notes that Docker-published ports bypass UFW, and lists the swarm ports to open for multi-node swarms.
• Live log in the dialog. It is also saved as a "Security hardening" deployment of the server (Settings → Deployments). The check refreshes when the run finishes.
• server.hardenWithLogs subscription:
  • server.execute permission, server access and organization checks, audit entry.
  • Items are validated against a fixed enum.
  • Classified as write, the same as setupWithLogs.
• Shared commands: the hardening commands moved to packages/server/src/setup/server-hardening.ts and are used by both Setup Server and the button.
• Standalone script: checks for root or passwordless sudo and refreshes apt lists first.
• apt lock: apt waits up to 5 minutes for its lock (DPkg::Lock::Timeout=300), since unattended-upgrades often holds it on a fresh VPS.
• Fail2Ban: if jail.local exists but has no [sshd] section, the section is appended. Before, the step was skipped and the check stayed red. An existing [sshd] section is still left unchanged.
• SSH runner: moved from server-components.ts to ssh-command.ts, so both modules use it without an import cycle.
• Ports: UFW opens SSH and 443 tcp/udp only. Port 80 stays closed.
• Docs: docs/server-hardening.md describes the button and a rollback note for a pre-existing jail.local.

Tests

• server-hardening.test.ts:
  • the script passes bash -n for every item subset;
  • only the selected items are included;
  • port 80 is never opened;
  • the script stops without root or passwordless sudo;
  • DOKPLOY_SERVER_HARDENING still controls step 15 of Setup Server;
  • the Fail2Ban step runs against a temporary jail.local in three cases: created, appended, existing [sshd] kept.
• Router: an inaccessible server is rejected before any side effect, and unknown items are rejected.
• Typecheck of packages/server and apps/dokploy passes. All __test__/server, api, security and settings suites pass locally.
• Not run yet: a real hardening run against a VPS from the UI. That needs this image deployed.

🤖 Generated with Claude Code