The jail's /etc/passwd listed every hosting username (no passwords — shadow isn't
in the jail — but it enumerated tenants). The launcher now binds a per-session
/etc/passwd|group (root + the current user only) inside each session's mount
namespace, and the shared jail passwd no longer carries hosting users.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Inside the jail, 'cd ..' from the home landed in a non-listable /home (Permission
denied). Mount a per-session tmpfs over the jail's /home containing only the
user's own directory, so 'ls /home' shows just their folder — no other tenants
leaked, confinement unchanged. (Live host launcher already updated.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Accounts whose node has an ssh_private_key take the remote branch, which still
launched an unjailed 'runuser' shell — leaving the breach open. Route it through
the same jailkit launcher (no sudo; provider connects as root). Now every
terminal session is chrooted to the customer's own home.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The terminal Alpine component + xterm/xterm-addon-fit only ever existed in an
out-of-band build; committed source never had them, so clean CI rebuilds shipped
a bundle WITHOUT the terminal (blank panel). Add resources/js/hosting-terminal.js
(window.hostingInteractiveTerminal, recovered from the last working build), import
it from app.js, and add xterm deps to package.json/lock. Verified: a clean
'npm ci && vite build' now includes the component + xterm.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createSession only waited 2.5s for the worker to flip starting->running, but
the worker cold-boots the framework (php artisan) + opens the shell, which under
load exceeds that. On timeout it also overwrote the (healthy) worker's metadata
to status=failed, so customers saw 'Terminal worker failed to start' even though
the shell was live. Wait up to 8s and return early once status is known; never
fabricate a failure — the worker records real boot errors itself.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Push the customer's connected domain to the central connected-domains registry
so it appears under My Domains (with Transfer in if not registered with Ladill).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ladill Accounting is now live at accounting.ladill.com; add its row + icon to
the shared app launcher (byte-identical across all Ladill apps).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
InjectBootSplash middleware shows a self-branded loading splash once per session
while the app boots, then fades out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
