From d1445e5f5494bc20367425a2de480bea98f9ff15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?=
 <mateusz.gruszczynski@firma.interia.pl>
Date: Sat, 6 Jun 2026 00:09:10 +0200
Subject: [PATCH] fix install v2.15.X

---
 npm_install.py | 64 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 63 insertions(+), 1 deletion(-)

diff --git a/npm_install.py b/npm_install.py
index 50d12a5..25ea0d2 100644
--- a/npm_install.py
+++ b/npm_install.py
@@ -592,6 +592,56 @@ def github_latest_release_tag(repo: str, override: str = None) -> str:
     return tag.lstrip("v")
 
 
+
+def ensure_angie_log_include_files():
+    """Ensure split log include files required by ANGIE_CONF_TEMPLATE exist.
+
+    Older installs may only have /etc/angie/conf.d/include/log.conf from the
+    upstream NPM rootfs. The Angie template used by this installer includes
+    log-proxy.conf in http{} and log-stream.conf in stream{}, so update mode
+    must create them before running `angie -t`.
+    """
+    include_dir = Path("/etc/angie/conf.d/include")
+    include_dir.mkdir(parents=True, exist_ok=True)
+
+    log_conf = include_dir / "log.conf"
+    log_proxy = include_dir / "log-proxy.conf"
+    log_stream = include_dir / "log-stream.conf"
+
+    default_proxy = """log_format proxy '[$time_local] $upstream_cache_status $upstream_status $status - $request_method $scheme $host "$request_uri" [Client $remote_addr] [Length $body_bytes_sent] [Gzip $gzip_ratio] [Sent-to $server] "$http_user_agent" "$http_referer"';
+log_format standard '[$time_local] $status - $request_method $scheme $host "$request_uri" [Client $remote_addr] [Length $body_bytes_sent] [Gzip $gzip_ratio] "$http_user_agent" "$http_referer"';
+
+access_log /data/logs/fallback_access.log proxy;
+"""
+
+    default_stream = """log_format stream '[$time_local] [Client $remote_addr:$remote_port] $protocol $status $bytes_sent $bytes_received $session_time [Sent-to $upstream_addr] [Sent $upstream_bytes_sent] [Received $upstream_bytes_received] [Time $upstream_connect_time] $ssl_protocol $ssl_cipher';
+
+access_log /data/logs/fallback_stream_access.log stream;
+"""
+
+    try:
+        if not log_proxy.exists():
+            if log_conf.exists():
+                txt = log_conf.read_text(encoding="utf-8")
+                # Upstream log.conf is the HTTP/proxy log include in older installs.
+                write_file(log_proxy, txt if txt.strip() else default_proxy, 0o644)
+            else:
+                write_file(log_proxy, default_proxy, 0o644)
+            print(f"  ✓ Created missing {log_proxy.name}")
+
+        if not log_stream.exists():
+            write_file(log_stream, default_stream, 0o644)
+            print(f"  ✓ Created missing {log_stream.name}")
+
+        # Keep legacy log.conf present for compatibility with older/custom configs.
+        if not log_conf.exists():
+            write_file(log_conf, default_proxy, 0o644)
+            print(f"  ✓ Created missing {log_conf.name}")
+
+        run(["chown", "root:root", str(log_proxy), str(log_stream), str(log_conf)], check=False)
+    except Exception as e:
+        print(f"  ⚠ Warning: could not ensure log include files: {e}")
+
 def write_resolvers_conf(ipv6_enabled: bool):
     ns_v4, ns_v6 = [], []
     try:
@@ -1709,6 +1759,7 @@ def setup_angie(ipv6_enabled: bool):
         modules_dir = Path("/etc/nginx/modules")
         modules_dir.mkdir(parents=True, exist_ok=True)
         write_file(Path("/etc/angie/angie.conf"), ANGIE_CONF_TEMPLATE, 0o644)
+        ensure_angie_log_include_files()
 
         WRAP = """#!/bin/sh
 exec sudo -n /usr/sbin/angie "$@"
@@ -3087,6 +3138,9 @@ def create_systemd_units(ipv6_enabled: bool):
         write_file(Path("/etc/systemd/system/npm.service"), "\n".join(unit_lines), 0o644)
         write_file(Path("/etc/systemd/system/angie.service"), ANGIE_UNIT, 0o644)
         subprocess.run(["systemctl", "daemon-reload"], check=False)
+        ensure_angie_log_include_files()
+        if NPM_ADMIN_ENABLE_SSL:
+            generate_selfsigned_cert()
 
         # Validate configuration before touching the running service.
         run(["/usr/sbin/angie", "-t"], check=True)
@@ -3866,6 +3920,8 @@ def update_only(
                 "exploits.conf",
                 "hsts.conf",
                 "log.conf",
+                "log-proxy.conf",
+                "log-stream.conf",
             ]
             
             for conf_file in include_src.glob("*.conf"):
@@ -3898,6 +3954,8 @@ def update_only(
             except Exception:
                 pass
 
+        ensure_angie_log_include_files()
+
     # ========== UPDATE MAIN ANGIE.CONF ==========
     with step("Updating main Angie configuration /etc/angie/angie.conf"):
         angieconfpath = Path("/etc/angie/angie.conf")
@@ -3918,7 +3976,11 @@ def update_only(
                     run(["angie", "-t"], check=True)
                     print("  ✓ Config syntax OK")
                 except subprocess.CalledProcessError:
-                    print("  ✖ Config syntax failed - keeping backup for manual rollback")
+                    if backuppath and backuppath.exists():
+                        shutil.copy2(backuppath, angieconfpath)
+                        print(f"  ✖ Config syntax failed - restored {backuppath.name}")
+                    else:
+                        print("  ✖ Config syntax failed - no backup available")
                     raise
         else:
             if DEBUG: