@lamalibre/create-lamaste

One-command setup for secure reverse tunnels with a management dashboard.

Quick Start

ssh root@<droplet-ip> "apt install -y npm && npx @lamalibre/create-lamaste"

The installer runs unattended on a fresh Ubuntu 24.04 droplet and provisions the full Lamaste stack with zero prompts. When finished it prints:

• An SCP command to download the mTLS client certificate (.p12)
• The p12 password
• The panel URL (https://<ip>:9292)

Import the certificate into your browser and open the URL to begin onboarding.

JSON Mode

For programmatic use (e.g. from the Lamaste desktop app), pass --json to replace the interactive Listr2 terminal UI with NDJSON progress lines on stdout:

npx @lamalibre/create-lamaste --json

The --json flag implies --yes (no prompts) and --dev (accept private IPs). Each line is a JSON object with one of these shapes:

{"event":"step","step":"check_environment","status":"running"}
{"event":"step","step":"harden_system","status":"complete"}
{"event":"step","step":"install_node","status":"skipped"}
{"event":"complete","server":{"ip":"...","panelUrl":"...","p12Path":"...","p12PasswordPath":"..."}}
{"event":"error","message":"...","recoverable":false}

What It Provisions

• OS hardening — swap, UFW, fail2ban, SSH lockdown
• Node.js 20 LTS
• mTLS PKI — CA, server cert, client cert + PKCS12 bundle
• nginx — TLS on port 9292 with ssl_verify_client on, and a port-80 catch-all (lamalibre-lamaste-http-redirect) that redirects plain HTTP to HTTPS without getting in the way of Let's Encrypt HTTP-01 challenges
• Panel server + client — systemd service, lamaste-server CLI, static frontend, docs and the gatekeeper, in a root-owned /opt/lamalibre/lamaste (read-only for the lamaste user the panel runs as)
• Chisel and Authelia — the pinned releases (Chisel 1.12.0, Authelia 4.39.28) in /usr/local/bin, verified against pinned SHA-256 digests before unpacking (a newer installed Authelia is kept, never downgraded), with hardened systemd units. Onboarding only configures and starts them
• Service accounts — the lamaste-chisel group (Chisel runs as nobody:lamaste-chisel; the panel user is a member so it can write the 0640 Chisel authfile without sudo) and the unprivileged lamaste-authelia account Authelia runs as
• Ownership — /var/www/lamaste (lamaste:www-data, setgid), /etc/authelia (lamaste:lamaste-authelia, setgid), /var/log/authelia, the Chisel key and the PKI directory, so the panel manages them without privileges
• Root-owned programs in /usr/local/sbin/ — lamaste-priv (installs the panel's nginx vhosts after checking every directive against an allow-list, stores Authelia TOTP secrets as the Authelia account, starts a self-update), lamaste-certbot and lamaste-cert-info (certbot / openssl with a fixed argument vector)
• Sudoers — /etc/sudoers.d/lamaste with no wildcards: fixed systemctl lines, nginx -t, and the three programs above. Staged, checked with visudo -c, then renamed into place

Re-running the installer on an existing server (redeploy — also what the panel's self-update runs) refreshes the panel, CLI, UI, docs and gatekeeper, the pinned binaries, the panel, Chisel and Authelia units, the accounts and ownership, the programs and sudoers rules, and the port-80 redirect; it removes the retired lamaste-sign-csr / lamaste-pki-rename wrappers and converts an install directory left lamaste-owned by an older version. Upgrade agents before the server.

Domain setup, Chisel tunnels, Authelia, and Let's Encrypt certificates are configured through the browser-based onboarding wizard after installation.

Requirements

| Requirement | Details | | ----------- | ----------------------- | | OS | Ubuntu 24.04 LTS | | Access | root | | Node.js | >= 20.0.0 | | RAM | 512 MB minimum | | Recommended | DigitalOcean $4 droplet |

Further Reading

See the main repository for architecture, development plan, and full documentation: https://github.com/lamalibre/lamaste

Disclaimer

This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.

Lamaste is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.

You are solely responsible for what you expose through Lamaste. By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:

• Arbitrary code execution: If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
• Data exposure: Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
• Lateral movement: A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
• Resource abuse: Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.

Lamaste provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Lamaste bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.

License

Polyform Noncommercial 1.0.0 — see LICENSE.md for details.