Split host setup into explicit entity actions

engine/lib/crowdsec.py

@@ -1,5 +1,5 @@
 # engine/lib/crowdsec.py
-"""ctx.crowdsec — install + config deploy + collections (port of configure/crowdsec)."""
+"""ctx.crowdsec — install + config deploy + collections (port of config/crowdsec)."""
 from __future__ import annotations
 import os
 import shutil

engine/lib/host.py

@@ -125,13 +125,13 @@ class Host:
     # --- read/write with sudo awareness ---
     def _read(self, path: str, sudo: bool = False) -> str:
         if sudo:
-            cp = self.sys.run(["sudo", "cat", path], check=True, capture=True)
+            cp = self.sys.sudo(["cat", path], check=True, capture=True)
             return cp.stdout or ""
         with open(path, encoding="utf-8") as f:
             return f.read()
 
     def backup(self, path: str, sudo: bool = False) -> Optional[str]:
-        exists = (self.sys.ok(["sudo", "test", "-f", path]) if sudo
+        exists = (self.sys.sudo(["test", "-f", path], check=False).returncode == 0 if sudo
                   else os.path.isfile(path))
         if not exists:
             return None
@@ -154,7 +154,7 @@ class Host:
                      anchor: Optional[str] = None,
                      old_pairs: Sequence[Tuple[str, str]] = (),
                      dry_run: bool = False, sudo: bool = True) -> bool:
-        exists = (self.sys.ok(["sudo", "test", "-f", target]) if sudo
+        exists = (self.sys.sudo(["test", "-f", target], check=False).returncode == 0 if sudo
                   else os.path.isfile(target))
         if not exists:
             self.log.error(f"Target file does not exist: {target}")

engine/lib/sys.py

@@ -1,6 +1,7 @@
 # engine/lib/sys.py
 """ctx.sys — command execution + systemd service management (port of root_sys.sh)."""
 from __future__ import annotations
+import os
 import shutil
 import subprocess
 import time
@@ -21,6 +22,8 @@ class Sys:
                               stderr=subprocess.PIPE if capture else None)
 
     def sudo(self, cmd: Sequence[str], **kw) -> subprocess.CompletedProcess:
+        if os.geteuid() == 0 and shutil.which("sudo") is None:
+            return self.run(cmd, **kw)
         return self.run(["sudo", *cmd], **kw)
 
     def ok(self, cmd: Sequence[str], **kw) -> bool:

engine/lib/ufw.py

@@ -67,10 +67,10 @@ class Ufw:
             self.log.warn("Neither docker nor host ufw rules directory found; nothing to apply.")
             return
         if not self.sys.ok(["sudo", "ufw", "--version"]):
-            self.log.error("ufw not installed/working via sudo. Run configure/base first.")
+            self.log.error("ufw not installed/working via sudo. Run config/packages first.")
             raise SystemExit(1)
         if not (os.path.isfile(UFW_DOCKER_BIN) and os.access(UFW_DOCKER_BIN, os.X_OK)):
-            self.log.error(f"ufw-docker not found at {UFW_DOCKER_BIN}. Run configure/base first.")
+            self.log.error(f"ufw-docker not found at {UFW_DOCKER_BIN}. Run config/ufw-docker first.")
             raise SystemExit(1)
 
         if config_dir: