VPS Initialize

Instructions

Implementation Reference

• src/tools/nginx-manager.ts:18-67 (handler)

  Core handler implementing the nginx_setup tool logic: creates Nginx site config, tests and reloads Nginx, sets up SSL with Certbot if requested, and configures firewall.

  async setupNginx(config: NginxConfig): Promise<NginxResult> {
    try {
      logger.info('Setting up Nginx configuration', { domain: config.domain, port: config.port });
  
      // Create Nginx configuration
      const nginxConfigResult = await this.createNginxConfig(config);
      if (!nginxConfigResult.success) {
        return nginxConfigResult;
      }
  
      // Test and reload Nginx
      const testResult = await this.sshService.executeCommand('nginx -t');
      if (!testResult.success) {
        return {
          success: false,
          message: `Nginx configuration test failed: ${testResult.stderr}`,
        };
      }
  
      const reloadResult = await this.sshService.executeCommand('systemctl reload nginx');
      if (!reloadResult.success) {
        return {
          success: false,
          message: `Failed to reload Nginx: ${reloadResult.stderr}`,
        };
      }
  
      // Setup SSL if requested
      if (config.ssl) {
        const sslResult = await this.setupSSL(config.domain);
        if (!sslResult.success) {
          return sslResult;
        }
      }
  
      // Configure firewall
      await this.configureFirewall();
  
      return {
        success: true,
        message: `Nginx configured successfully for ${config.domain}${config.ssl ? ' with SSL' : ''}`,
      };
    } catch (error) {
      logger.error('Nginx setup failed', { error, config });
      return {
        success: false,
        message: `Nginx setup failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
      };
    }
  }

• src/services/mcp-server.ts:246-266 (handler)

  MCP server wrapper handler for 'nginx_setup' tool that validates input with Zod schema and delegates to NginxManager.setupNginx.

  private async handleNginxSetup(
    args: unknown
  ): Promise<{ content: Array<{ type: 'text'; text: string }> }> {
    if (!this.nginxManager) {
      throw new Error('SSH connection not established. Please connect first.');
    }
  
    const config = NginxConfigSchema.parse(args);
    const result = await this.nginxManager.setupNginx(config);
  
    return {
      content: [
        {
          type: 'text',
          text: result.success
            ? `Nginx configured successfully for ${config.domain}`
            : `Nginx setup failed: ${result.message}`,
        },
      ],
    };
  }

• src/services/mcp-server.ts:109-121 (registration)

  Registration of the 'nginx_setup' tool in the MCP server's listTools response, defining name, description, and input schema.

  {
    name: 'nginx_setup',
    description: 'Configure Nginx with domain, reverse proxy, and SSL',
    inputSchema: {
      type: 'object',
      properties: {
        domain: { type: 'string', description: 'Domain name' },
        port: { type: 'number', description: 'Backend port to proxy to' },
        ssl: { type: 'boolean', description: 'Enable SSL with Certbot' },
      },
      required: ['domain', 'port'],
    },
  },

• src/services/mcp-server.ts:34-38 (schema)

  Zod schema for validating nginx_setup tool input parameters.

  const NginxConfigSchema = z.object({
    domain: z.string().describe('Domain name for Nginx configuration'),
    port: z.number().describe('Backend port to proxy to'),
    ssl: z.boolean().optional().default(true).describe('Enable SSL with Certbot'),
  });

• src/tools/nginx-manager.ts:112-163 (helper)

  Helper method that generates the Nginx server block configuration template with reverse proxy, security headers, gzip, and static file optimization.

    private generateNginxConfig(config: NginxConfig): string {
      return `server {
      listen 80;
      server_name ${config.domain} www.${config.domain};
  
      # Security headers
      add_header X-Frame-Options "SAMEORIGIN" always;
      add_header X-XSS-Protection "1; mode=block" always;
      add_header X-Content-Type-Options "nosniff" always;
      add_header Referrer-Policy "no-referrer-when-downgrade" always;
      add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
  
      # Gzip compression
      gzip on;
      gzip_vary on;
      gzip_min_length 1024;
      gzip_proxied expired no-cache no-store private must-revalidate auth;
      gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
  
      location / {
          proxy_pass http://127.0.0.1:${config.port};
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection 'upgrade';
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_cache_bypass $http_upgrade;
          proxy_read_timeout 86400;
      }
  
      # Deny access to hidden files
      location ~ /\\. {
          deny all;
      }
  
      # Optimize static file serving
      location ~* \\.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|svg)$ {
          expires 1y;
          add_header Cache-Control "public, immutable";
          try_files $uri @proxy;
      }
  
      location @proxy {
          proxy_pass http://127.0.0.1:${config.port};
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
      }
  }`;