fix(certificates): simplify approach
This commit is contained in:
86
ts/proxies/smart-proxy/cert-store.ts
Normal file
86
ts/proxies/smart-proxy/cert-store.ts
Normal file
@ -0,0 +1,86 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { ICertificateData } from './certificate-manager.js';
|
||||
|
||||
export class CertStore {
|
||||
constructor(private certDir: string) {}
|
||||
|
||||
public async initialize(): Promise<void> {
|
||||
await plugins.smartfile.fs.ensureDirSync(this.certDir);
|
||||
}
|
||||
|
||||
public async getCertificate(routeName: string): Promise<ICertificateData | null> {
|
||||
const certPath = this.getCertPath(routeName);
|
||||
const metaPath = `${certPath}/meta.json`;
|
||||
|
||||
if (!await plugins.smartfile.fs.fileExistsSync(metaPath)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
try {
|
||||
const metaFile = await plugins.smartfile.SmartFile.fromFilePath(metaPath);
|
||||
const meta = JSON.parse(metaFile.contents.toString());
|
||||
|
||||
const certFile = await plugins.smartfile.SmartFile.fromFilePath(`${certPath}/cert.pem`);
|
||||
const cert = certFile.contents.toString();
|
||||
|
||||
const keyFile = await plugins.smartfile.SmartFile.fromFilePath(`${certPath}/key.pem`);
|
||||
const key = keyFile.contents.toString();
|
||||
|
||||
let ca: string | undefined;
|
||||
const caPath = `${certPath}/ca.pem`;
|
||||
if (await plugins.smartfile.fs.fileExistsSync(caPath)) {
|
||||
const caFile = await plugins.smartfile.SmartFile.fromFilePath(caPath);
|
||||
ca = caFile.contents.toString();
|
||||
}
|
||||
|
||||
return {
|
||||
cert,
|
||||
key,
|
||||
ca,
|
||||
expiryDate: new Date(meta.expiryDate),
|
||||
issueDate: new Date(meta.issueDate)
|
||||
};
|
||||
} catch (error) {
|
||||
console.error(`Failed to load certificate for ${routeName}: ${error}`);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
public async saveCertificate(
|
||||
routeName: string,
|
||||
certData: ICertificateData
|
||||
): Promise<void> {
|
||||
const certPath = this.getCertPath(routeName);
|
||||
await plugins.smartfile.fs.ensureDirSync(certPath);
|
||||
|
||||
// Save certificate files
|
||||
await plugins.smartfile.memory.toFs(certData.cert, `${certPath}/cert.pem`);
|
||||
await plugins.smartfile.memory.toFs(certData.key, `${certPath}/key.pem`);
|
||||
|
||||
if (certData.ca) {
|
||||
await plugins.smartfile.memory.toFs(certData.ca, `${certPath}/ca.pem`);
|
||||
}
|
||||
|
||||
// Save metadata
|
||||
const meta = {
|
||||
expiryDate: certData.expiryDate.toISOString(),
|
||||
issueDate: certData.issueDate.toISOString(),
|
||||
savedAt: new Date().toISOString()
|
||||
};
|
||||
|
||||
await plugins.smartfile.memory.toFs(JSON.stringify(meta, null, 2), `${certPath}/meta.json`);
|
||||
}
|
||||
|
||||
public async deleteCertificate(routeName: string): Promise<void> {
|
||||
const certPath = this.getCertPath(routeName);
|
||||
if (await plugins.smartfile.fs.fileExistsSync(certPath)) {
|
||||
await plugins.smartfile.fs.removeManySync([certPath]);
|
||||
}
|
||||
}
|
||||
|
||||
private getCertPath(routeName: string): string {
|
||||
// Sanitize route name for filesystem
|
||||
const safeName = routeName.replace(/[^a-zA-Z0-9-_]/g, '_');
|
||||
return `${this.certDir}/${safeName}`;
|
||||
}
|
||||
}
|
||||
517
ts/proxies/smart-proxy/certificate-manager.ts
Normal file
517
ts/proxies/smart-proxy/certificate-manager.ts
Normal file
@ -0,0 +1,517 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import { NetworkProxy } from '../network-proxy/index.js';
|
||||
import type { IRouteConfig, IRouteTls } from './models/route-types.js';
|
||||
import { CertStore } from './cert-store.js';
|
||||
|
||||
export interface ICertStatus {
|
||||
domain: string;
|
||||
status: 'valid' | 'pending' | 'expired' | 'error';
|
||||
expiryDate?: Date;
|
||||
issueDate?: Date;
|
||||
source: 'static' | 'acme';
|
||||
error?: string;
|
||||
}
|
||||
|
||||
export interface ICertificateData {
|
||||
cert: string;
|
||||
key: string;
|
||||
ca?: string;
|
||||
expiryDate: Date;
|
||||
issueDate: Date;
|
||||
}
|
||||
|
||||
export class SmartCertManager {
|
||||
private certStore: CertStore;
|
||||
private smartAcme: plugins.smartacme.SmartAcme | null = null;
|
||||
private networkProxy: NetworkProxy | null = null;
|
||||
private renewalTimer: NodeJS.Timeout | null = null;
|
||||
private pendingChallenges: Map<string, string> = new Map();
|
||||
|
||||
// Track certificate status by route name
|
||||
private certStatus: Map<string, ICertStatus> = new Map();
|
||||
|
||||
// Callback to update SmartProxy routes for challenges
|
||||
private updateRoutesCallback?: (routes: IRouteConfig[]) => Promise<void>;
|
||||
|
||||
constructor(
|
||||
private routes: IRouteConfig[],
|
||||
private certDir: string = './certs',
|
||||
private acmeOptions?: {
|
||||
email?: string;
|
||||
useProduction?: boolean;
|
||||
port?: number;
|
||||
}
|
||||
) {
|
||||
this.certStore = new CertStore(certDir);
|
||||
}
|
||||
|
||||
public setNetworkProxy(networkProxy: NetworkProxy): void {
|
||||
this.networkProxy = networkProxy;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set callback for updating routes (used for challenge routes)
|
||||
*/
|
||||
public setUpdateRoutesCallback(callback: (routes: IRouteConfig[]) => Promise<void>): void {
|
||||
this.updateRoutesCallback = callback;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize certificate manager and provision certificates for all routes
|
||||
*/
|
||||
public async initialize(): Promise<void> {
|
||||
// Create certificate directory if it doesn't exist
|
||||
await this.certStore.initialize();
|
||||
|
||||
// Initialize SmartAcme if we have any ACME routes
|
||||
const hasAcmeRoutes = this.routes.some(r =>
|
||||
r.action.tls?.certificate === 'auto'
|
||||
);
|
||||
|
||||
if (hasAcmeRoutes && this.acmeOptions?.email) {
|
||||
// Create SmartAcme instance with our challenge handler
|
||||
this.smartAcme = new plugins.smartacme.SmartAcme({
|
||||
accountEmail: this.acmeOptions.email,
|
||||
environment: this.acmeOptions.useProduction ? 'production' : 'integration',
|
||||
certManager: new InMemoryCertManager()
|
||||
});
|
||||
|
||||
// The challenge handler is now embedded in the SmartAcme config above
|
||||
// SmartAcme will handle the challenge internally
|
||||
|
||||
await this.smartAcme.start();
|
||||
}
|
||||
|
||||
// Provision certificates for all routes
|
||||
await this.provisionAllCertificates();
|
||||
|
||||
// Start renewal timer
|
||||
this.startRenewalTimer();
|
||||
}
|
||||
|
||||
/**
|
||||
* Provision certificates for all routes that need them
|
||||
*/
|
||||
private async provisionAllCertificates(): Promise<void> {
|
||||
const certRoutes = this.routes.filter(r =>
|
||||
r.action.tls?.mode === 'terminate' ||
|
||||
r.action.tls?.mode === 'terminate-and-reencrypt'
|
||||
);
|
||||
|
||||
for (const route of certRoutes) {
|
||||
try {
|
||||
await this.provisionCertificate(route);
|
||||
} catch (error) {
|
||||
console.error(`Failed to provision certificate for route ${route.name}: ${error}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provision certificate for a single route
|
||||
*/
|
||||
public async provisionCertificate(route: IRouteConfig): Promise<void> {
|
||||
const tls = route.action.tls;
|
||||
if (!tls || (tls.mode !== 'terminate' && tls.mode !== 'terminate-and-reencrypt')) {
|
||||
return;
|
||||
}
|
||||
|
||||
const domains = this.extractDomainsFromRoute(route);
|
||||
if (domains.length === 0) {
|
||||
console.warn(`Route ${route.name} has TLS termination but no domains`);
|
||||
return;
|
||||
}
|
||||
|
||||
const primaryDomain = domains[0];
|
||||
|
||||
if (tls.certificate === 'auto') {
|
||||
// ACME certificate
|
||||
await this.provisionAcmeCertificate(route, domains);
|
||||
} else if (typeof tls.certificate === 'object') {
|
||||
// Static certificate
|
||||
await this.provisionStaticCertificate(route, primaryDomain, tls.certificate);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provision ACME certificate
|
||||
*/
|
||||
private async provisionAcmeCertificate(
|
||||
route: IRouteConfig,
|
||||
domains: string[]
|
||||
): Promise<void> {
|
||||
if (!this.smartAcme) {
|
||||
throw new Error('SmartAcme not initialized');
|
||||
}
|
||||
|
||||
const primaryDomain = domains[0];
|
||||
const routeName = route.name || primaryDomain;
|
||||
|
||||
// Check if we already have a valid certificate
|
||||
const existingCert = await this.certStore.getCertificate(routeName);
|
||||
if (existingCert && this.isCertificateValid(existingCert)) {
|
||||
console.log(`Using existing valid certificate for ${primaryDomain}`);
|
||||
await this.applyCertificate(primaryDomain, existingCert);
|
||||
this.updateCertStatus(routeName, 'valid', 'acme', existingCert);
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`Requesting ACME certificate for ${domains.join(', ')}`);
|
||||
this.updateCertStatus(routeName, 'pending', 'acme');
|
||||
|
||||
try {
|
||||
// Use smartacme to get certificate
|
||||
const cert = await this.smartAcme.getCertificateForDomain(primaryDomain);
|
||||
|
||||
// smartacme returns a Cert object with these properties
|
||||
const certData: ICertificateData = {
|
||||
cert: cert.publicKey,
|
||||
key: cert.privateKey,
|
||||
ca: cert.publicKey, // Use same as cert for now
|
||||
expiryDate: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000), // 90 days
|
||||
issueDate: new Date()
|
||||
};
|
||||
|
||||
await this.certStore.saveCertificate(routeName, certData);
|
||||
await this.applyCertificate(primaryDomain, certData);
|
||||
this.updateCertStatus(routeName, 'valid', 'acme', certData);
|
||||
|
||||
console.log(`Successfully provisioned ACME certificate for ${primaryDomain}`);
|
||||
} catch (error) {
|
||||
console.error(`Failed to provision ACME certificate for ${primaryDomain}: ${error}`);
|
||||
this.updateCertStatus(routeName, 'error', 'acme', undefined, error.message);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Provision static certificate
|
||||
*/
|
||||
private async provisionStaticCertificate(
|
||||
route: IRouteConfig,
|
||||
domain: string,
|
||||
certConfig: { key: string; cert: string; keyFile?: string; certFile?: string }
|
||||
): Promise<void> {
|
||||
const routeName = route.name || domain;
|
||||
|
||||
try {
|
||||
let key: string = certConfig.key;
|
||||
let cert: string = certConfig.cert;
|
||||
|
||||
// Load from files if paths are provided
|
||||
if (certConfig.keyFile) {
|
||||
const keyFile = await plugins.smartfile.SmartFile.fromFilePath(certConfig.keyFile);
|
||||
key = keyFile.contents.toString();
|
||||
}
|
||||
if (certConfig.certFile) {
|
||||
const certFile = await plugins.smartfile.SmartFile.fromFilePath(certConfig.certFile);
|
||||
cert = certFile.contents.toString();
|
||||
}
|
||||
|
||||
// Parse certificate to get dates
|
||||
// Parse certificate to get dates - for now just use defaults
|
||||
// TODO: Implement actual certificate parsing if needed
|
||||
const certInfo = { validTo: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000), validFrom: new Date() };
|
||||
|
||||
const certData: ICertificateData = {
|
||||
cert,
|
||||
key,
|
||||
expiryDate: certInfo.validTo,
|
||||
issueDate: certInfo.validFrom
|
||||
};
|
||||
|
||||
// Save to store for consistency
|
||||
await this.certStore.saveCertificate(routeName, certData);
|
||||
await this.applyCertificate(domain, certData);
|
||||
this.updateCertStatus(routeName, 'valid', 'static', certData);
|
||||
|
||||
console.log(`Successfully loaded static certificate for ${domain}`);
|
||||
} catch (error) {
|
||||
console.error(`Failed to provision static certificate for ${domain}: ${error}`);
|
||||
this.updateCertStatus(routeName, 'error', 'static', undefined, error.message);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply certificate to NetworkProxy
|
||||
*/
|
||||
private async applyCertificate(domain: string, certData: ICertificateData): Promise<void> {
|
||||
if (!this.networkProxy) {
|
||||
console.warn('NetworkProxy not set, cannot apply certificate');
|
||||
return;
|
||||
}
|
||||
|
||||
// Apply certificate to NetworkProxy
|
||||
this.networkProxy.updateCertificate(domain, certData.cert, certData.key);
|
||||
|
||||
// Also apply for wildcard if it's a subdomain
|
||||
if (domain.includes('.') && !domain.startsWith('*.')) {
|
||||
const parts = domain.split('.');
|
||||
if (parts.length >= 2) {
|
||||
const wildcardDomain = `*.${parts.slice(-2).join('.')}`;
|
||||
this.networkProxy.updateCertificate(wildcardDomain, certData.cert, certData.key);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract domains from route configuration
|
||||
*/
|
||||
private extractDomainsFromRoute(route: IRouteConfig): string[] {
|
||||
if (!route.match.domains) {
|
||||
return [];
|
||||
}
|
||||
|
||||
const domains = Array.isArray(route.match.domains)
|
||||
? route.match.domains
|
||||
: [route.match.domains];
|
||||
|
||||
// Filter out wildcards and patterns
|
||||
return domains.filter(d =>
|
||||
!d.includes('*') &&
|
||||
!d.includes('{') &&
|
||||
d.includes('.')
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if certificate is valid
|
||||
*/
|
||||
private isCertificateValid(cert: ICertificateData): boolean {
|
||||
const now = new Date();
|
||||
const expiryThreshold = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000); // 30 days
|
||||
|
||||
return cert.expiryDate > expiryThreshold;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create ACME challenge route
|
||||
* NOTE: SmartProxy already handles path-based routing and priority
|
||||
*/
|
||||
private createChallengeRoute(): IRouteConfig {
|
||||
return {
|
||||
name: 'acme-challenge',
|
||||
priority: 1000, // High priority to ensure it's checked first
|
||||
match: {
|
||||
ports: 80,
|
||||
path: '/.well-known/acme-challenge/*'
|
||||
},
|
||||
action: {
|
||||
type: 'static',
|
||||
handler: async (context) => {
|
||||
const token = context.path?.split('/').pop();
|
||||
const keyAuth = token ? this.pendingChallenges.get(token) : undefined;
|
||||
|
||||
if (keyAuth) {
|
||||
return {
|
||||
status: 200,
|
||||
headers: { 'Content-Type': 'text/plain' },
|
||||
body: keyAuth
|
||||
};
|
||||
} else {
|
||||
return {
|
||||
status: 404,
|
||||
body: 'Not found'
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Add challenge route to SmartProxy
|
||||
*/
|
||||
private async addChallengeRoute(): Promise<void> {
|
||||
if (!this.updateRoutesCallback) {
|
||||
throw new Error('No route update callback set');
|
||||
}
|
||||
|
||||
const challengeRoute = this.createChallengeRoute();
|
||||
const updatedRoutes = [...this.routes, challengeRoute];
|
||||
|
||||
await this.updateRoutesCallback(updatedRoutes);
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove challenge route from SmartProxy
|
||||
*/
|
||||
private async removeChallengeRoute(): Promise<void> {
|
||||
if (!this.updateRoutesCallback) {
|
||||
return;
|
||||
}
|
||||
|
||||
const filteredRoutes = this.routes.filter(r => r.name !== 'acme-challenge');
|
||||
await this.updateRoutesCallback(filteredRoutes);
|
||||
}
|
||||
|
||||
/**
|
||||
* Start renewal timer
|
||||
*/
|
||||
private startRenewalTimer(): void {
|
||||
// Check for renewals every 12 hours
|
||||
this.renewalTimer = setInterval(() => {
|
||||
this.checkAndRenewCertificates();
|
||||
}, 12 * 60 * 60 * 1000);
|
||||
|
||||
// Also do an immediate check
|
||||
this.checkAndRenewCertificates();
|
||||
}
|
||||
|
||||
/**
|
||||
* Check and renew certificates that are expiring
|
||||
*/
|
||||
private async checkAndRenewCertificates(): Promise<void> {
|
||||
for (const route of this.routes) {
|
||||
if (route.action.tls?.certificate === 'auto') {
|
||||
const routeName = route.name || this.extractDomainsFromRoute(route)[0];
|
||||
const cert = await this.certStore.getCertificate(routeName);
|
||||
|
||||
if (cert && !this.isCertificateValid(cert)) {
|
||||
console.log(`Certificate for ${routeName} needs renewal`);
|
||||
try {
|
||||
await this.provisionCertificate(route);
|
||||
} catch (error) {
|
||||
console.error(`Failed to renew certificate for ${routeName}: ${error}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update certificate status
|
||||
*/
|
||||
private updateCertStatus(
|
||||
routeName: string,
|
||||
status: ICertStatus['status'],
|
||||
source: ICertStatus['source'],
|
||||
certData?: ICertificateData,
|
||||
error?: string
|
||||
): void {
|
||||
this.certStatus.set(routeName, {
|
||||
domain: routeName,
|
||||
status,
|
||||
source,
|
||||
expiryDate: certData?.expiryDate,
|
||||
issueDate: certData?.issueDate,
|
||||
error
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get certificate status for a route
|
||||
*/
|
||||
public getCertificateStatus(routeName: string): ICertStatus | undefined {
|
||||
return this.certStatus.get(routeName);
|
||||
}
|
||||
|
||||
/**
|
||||
* Force renewal of a certificate
|
||||
*/
|
||||
public async renewCertificate(routeName: string): Promise<void> {
|
||||
const route = this.routes.find(r => r.name === routeName);
|
||||
if (!route) {
|
||||
throw new Error(`Route ${routeName} not found`);
|
||||
}
|
||||
|
||||
// Remove existing certificate to force renewal
|
||||
await this.certStore.deleteCertificate(routeName);
|
||||
await this.provisionCertificate(route);
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle ACME challenge
|
||||
*/
|
||||
private async handleChallenge(token: string, keyAuth: string): Promise<void> {
|
||||
this.pendingChallenges.set(token, keyAuth);
|
||||
|
||||
// Add challenge route if it's the first challenge
|
||||
if (this.pendingChallenges.size === 1) {
|
||||
await this.addChallengeRoute();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Cleanup ACME challenge
|
||||
*/
|
||||
private async cleanupChallenge(token: string): Promise<void> {
|
||||
this.pendingChallenges.delete(token);
|
||||
|
||||
// Remove challenge route if no more challenges
|
||||
if (this.pendingChallenges.size === 0) {
|
||||
await this.removeChallengeRoute();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop certificate manager
|
||||
*/
|
||||
public async stop(): Promise<void> {
|
||||
if (this.renewalTimer) {
|
||||
clearInterval(this.renewalTimer);
|
||||
this.renewalTimer = null;
|
||||
}
|
||||
|
||||
if (this.smartAcme) {
|
||||
await this.smartAcme.stop();
|
||||
}
|
||||
|
||||
// Remove any active challenge routes
|
||||
if (this.pendingChallenges.size > 0) {
|
||||
this.pendingChallenges.clear();
|
||||
await this.removeChallengeRoute();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get ACME options (for recreating after route updates)
|
||||
*/
|
||||
public getAcmeOptions(): { email?: string; useProduction?: boolean; port?: number } | undefined {
|
||||
return this.acmeOptions;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Simple in-memory certificate manager for SmartAcme
|
||||
* We only use this to satisfy SmartAcme's interface - actual storage is handled by CertStore
|
||||
*/
|
||||
class InMemoryCertManager implements plugins.smartacme.ICertManager {
|
||||
private store = new Map<string, any>();
|
||||
|
||||
// Required methods from ICertManager interface
|
||||
public async init(): Promise<void> {
|
||||
// Initialization if needed
|
||||
}
|
||||
|
||||
public async retrieveCertificate(domainName: string): Promise<plugins.smartacme.Cert | null> {
|
||||
return this.store.get(domainName) || null;
|
||||
}
|
||||
|
||||
public async storeCertificate(cert: plugins.smartacme.Cert): Promise<void> {
|
||||
this.store.set(cert.domainName, cert);
|
||||
}
|
||||
|
||||
public async deleteCertificate(domainName: string): Promise<void> {
|
||||
this.store.delete(domainName);
|
||||
}
|
||||
|
||||
public async getCertificates(): Promise<plugins.smartacme.Cert[]> {
|
||||
return Array.from(this.store.values());
|
||||
}
|
||||
|
||||
public async stop(): Promise<void> {
|
||||
// Cleanup if needed
|
||||
}
|
||||
|
||||
public async close(): Promise<void> {
|
||||
// Required by interface
|
||||
await this.stop();
|
||||
}
|
||||
|
||||
public async wipe(): Promise<void> {
|
||||
// Required by interface
|
||||
this.store.clear();
|
||||
}
|
||||
}
|
||||
@ -73,15 +73,42 @@ export interface IRouteTarget {
|
||||
port: number | 'preserve' | ((context: IRouteContext) => number); // Port with optional function for dynamic mapping (use 'preserve' to keep the incoming port)
|
||||
}
|
||||
|
||||
/**
|
||||
* ACME configuration for automatic certificate provisioning
|
||||
*/
|
||||
export interface IRouteAcme {
|
||||
email: string; // Contact email for ACME account
|
||||
useProduction?: boolean; // Use production ACME servers (default: false)
|
||||
challengePort?: number; // Port for HTTP-01 challenges (default: 80)
|
||||
renewBeforeDays?: number; // Days before expiry to renew (default: 30)
|
||||
}
|
||||
|
||||
/**
|
||||
* Static route handler response
|
||||
*/
|
||||
export interface IStaticResponse {
|
||||
status: number;
|
||||
headers?: Record<string, string>;
|
||||
body: string | Buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* TLS configuration for route actions
|
||||
*/
|
||||
export interface IRouteTls {
|
||||
mode: TTlsMode;
|
||||
certificate?: 'auto' | { // Auto = use ACME
|
||||
key: string;
|
||||
cert: string;
|
||||
certificate?: 'auto' | { // Auto = use ACME
|
||||
key: string; // PEM-encoded private key
|
||||
cert: string; // PEM-encoded certificate
|
||||
ca?: string; // PEM-encoded CA chain
|
||||
keyFile?: string; // Path to key file (overrides key)
|
||||
certFile?: string; // Path to cert file (overrides cert)
|
||||
};
|
||||
acme?: IRouteAcme; // ACME options when certificate is 'auto'
|
||||
versions?: string[]; // Allowed TLS versions (e.g., ['TLSv1.2', 'TLSv1.3'])
|
||||
ciphers?: string; // OpenSSL cipher string
|
||||
honorCipherOrder?: boolean; // Use server's cipher preferences
|
||||
sessionTimeout?: number; // TLS session timeout in seconds
|
||||
}
|
||||
|
||||
/**
|
||||
@ -266,6 +293,9 @@ export interface IRouteAction {
|
||||
|
||||
// NFTables-specific options
|
||||
nftables?: INfTablesOptions;
|
||||
|
||||
// Handler function for static routes
|
||||
handler?: (context: IRouteContext) => Promise<IStaticResponse>;
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@ -1,100 +1,13 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import { NetworkProxy } from '../network-proxy/index.js';
|
||||
import { Port80Handler } from '../../http/port80/port80-handler.js';
|
||||
import { subscribeToPort80Handler } from '../../core/utils/event-utils.js';
|
||||
import type { ICertificateData } from '../../certificate/models/certificate-types.js';
|
||||
import type { IConnectionRecord, ISmartProxyOptions } from './models/interfaces.js';
|
||||
import type { IRouteConfig } from './models/route-types.js';
|
||||
|
||||
/**
|
||||
* Manages NetworkProxy integration for TLS termination
|
||||
*
|
||||
* NetworkProxyBridge connects SmartProxy with NetworkProxy to handle TLS termination.
|
||||
* It directly passes route configurations to NetworkProxy and manages the physical
|
||||
* connection piping between SmartProxy and NetworkProxy for TLS termination.
|
||||
*
|
||||
* It is used by SmartProxy for routes that have:
|
||||
* - TLS mode of 'terminate' or 'terminate-and-reencrypt'
|
||||
* - Certificate set to 'auto' or custom certificate
|
||||
*/
|
||||
export class NetworkProxyBridge {
|
||||
private networkProxy: NetworkProxy | null = null;
|
||||
private port80Handler: Port80Handler | null = null;
|
||||
|
||||
constructor(private settings: ISmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Set the Port80Handler to use for certificate management
|
||||
*/
|
||||
public setPort80Handler(handler: Port80Handler): void {
|
||||
this.port80Handler = handler;
|
||||
|
||||
// Subscribe to certificate events
|
||||
subscribeToPort80Handler(handler, {
|
||||
onCertificateIssued: this.handleCertificateEvent.bind(this),
|
||||
onCertificateRenewed: this.handleCertificateEvent.bind(this)
|
||||
});
|
||||
|
||||
// If NetworkProxy is already initialized, connect it with Port80Handler
|
||||
if (this.networkProxy) {
|
||||
this.networkProxy.setExternalPort80Handler(handler);
|
||||
}
|
||||
|
||||
console.log('Port80Handler connected to NetworkProxyBridge');
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize NetworkProxy instance
|
||||
*/
|
||||
public async initialize(): Promise<void> {
|
||||
if (!this.networkProxy && this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
|
||||
// Configure NetworkProxy options based on SmartProxy settings
|
||||
const networkProxyOptions: any = {
|
||||
port: this.settings.networkProxyPort!,
|
||||
portProxyIntegration: true,
|
||||
logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info',
|
||||
useExternalPort80Handler: !!this.port80Handler // Use Port80Handler if available
|
||||
};
|
||||
|
||||
this.networkProxy = new NetworkProxy(networkProxyOptions);
|
||||
|
||||
console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
|
||||
|
||||
// Connect Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
this.networkProxy.setExternalPort80Handler(this.port80Handler);
|
||||
}
|
||||
|
||||
// Apply route configurations to NetworkProxy
|
||||
await this.syncRoutesToNetworkProxy(this.settings.routes || []);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle certificate issuance or renewal events
|
||||
*/
|
||||
private handleCertificateEvent(data: ICertificateData): void {
|
||||
if (!this.networkProxy) return;
|
||||
|
||||
console.log(`Received certificate for ${data.domain} from Port80Handler, updating NetworkProxy`);
|
||||
|
||||
// Apply certificate directly to NetworkProxy
|
||||
this.networkProxy.updateCertificate(data.domain, data.certificate, data.privateKey);
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply an external (static) certificate into NetworkProxy
|
||||
*/
|
||||
public applyExternalCertificate(data: ICertificateData): void {
|
||||
if (!this.networkProxy) {
|
||||
console.log(`NetworkProxy not initialized: cannot apply external certificate for ${data.domain}`);
|
||||
return;
|
||||
}
|
||||
|
||||
// Apply certificate directly to NetworkProxy
|
||||
this.networkProxy.updateCertificate(data.domain, data.certificate, data.privateKey);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the NetworkProxy instance
|
||||
*/
|
||||
@ -103,10 +16,119 @@ export class NetworkProxyBridge {
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the NetworkProxy port
|
||||
* Initialize NetworkProxy instance
|
||||
*/
|
||||
public getNetworkProxyPort(): number {
|
||||
return this.networkProxy ? this.networkProxy.getListeningPort() : this.settings.networkProxyPort || 8443;
|
||||
public async initialize(): Promise<void> {
|
||||
if (!this.networkProxy && this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
|
||||
const networkProxyOptions: any = {
|
||||
port: this.settings.networkProxyPort!,
|
||||
portProxyIntegration: true,
|
||||
logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info'
|
||||
};
|
||||
|
||||
this.networkProxy = new NetworkProxy(networkProxyOptions);
|
||||
console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
|
||||
|
||||
// Apply route configurations to NetworkProxy
|
||||
await this.syncRoutesToNetworkProxy(this.settings.routes || []);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Sync routes to NetworkProxy
|
||||
*/
|
||||
public async syncRoutesToNetworkProxy(routes: IRouteConfig[]): Promise<void> {
|
||||
if (!this.networkProxy) return;
|
||||
|
||||
// Convert routes to NetworkProxy format
|
||||
const networkProxyConfigs = routes
|
||||
.filter(route => {
|
||||
// Check if this route matches any of the specified network proxy ports
|
||||
const routePorts = Array.isArray(route.match.ports)
|
||||
? route.match.ports
|
||||
: [route.match.ports];
|
||||
|
||||
return routePorts.some(port =>
|
||||
this.settings.useNetworkProxy?.includes(port)
|
||||
);
|
||||
})
|
||||
.map(route => this.routeToNetworkProxyConfig(route));
|
||||
|
||||
// Apply configurations to NetworkProxy
|
||||
await this.networkProxy.updateRouteConfigs(networkProxyConfigs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert route to NetworkProxy configuration
|
||||
*/
|
||||
private routeToNetworkProxyConfig(route: IRouteConfig): any {
|
||||
// Convert route to NetworkProxy domain config format
|
||||
return {
|
||||
domain: route.match.domains?.[0] || '*',
|
||||
target: route.action.target,
|
||||
tls: route.action.tls,
|
||||
security: route.action.security
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if connection should use NetworkProxy
|
||||
*/
|
||||
public shouldUseNetworkProxy(connection: IConnectionRecord, routeMatch: any): boolean {
|
||||
// Only use NetworkProxy for TLS termination
|
||||
return (
|
||||
routeMatch.route.action.tls?.mode === 'terminate' ||
|
||||
routeMatch.route.action.tls?.mode === 'terminate-and-reencrypt'
|
||||
) && this.networkProxy !== null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Forward connection to NetworkProxy
|
||||
*/
|
||||
public async forwardToNetworkProxy(
|
||||
connectionId: string,
|
||||
socket: plugins.net.Socket,
|
||||
record: IConnectionRecord,
|
||||
initialChunk: Buffer,
|
||||
networkProxyPort: number,
|
||||
cleanupCallback: (reason: string) => void
|
||||
): Promise<void> {
|
||||
if (!this.networkProxy) {
|
||||
throw new Error('NetworkProxy not initialized');
|
||||
}
|
||||
|
||||
const proxySocket = new plugins.net.Socket();
|
||||
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
proxySocket.connect(networkProxyPort, 'localhost', () => {
|
||||
console.log(`[${connectionId}] Connected to NetworkProxy for termination`);
|
||||
resolve();
|
||||
});
|
||||
|
||||
proxySocket.on('error', reject);
|
||||
});
|
||||
|
||||
// Send initial chunk if present
|
||||
if (initialChunk) {
|
||||
proxySocket.write(initialChunk);
|
||||
}
|
||||
|
||||
// Pipe the sockets together
|
||||
socket.pipe(proxySocket);
|
||||
proxySocket.pipe(socket);
|
||||
|
||||
// Handle cleanup
|
||||
const cleanup = (reason: string) => {
|
||||
socket.unpipe(proxySocket);
|
||||
proxySocket.unpipe(socket);
|
||||
proxySocket.destroy();
|
||||
cleanupCallback(reason);
|
||||
};
|
||||
|
||||
socket.on('end', () => cleanup('socket_end'));
|
||||
socket.on('error', () => cleanup('socket_error'));
|
||||
proxySocket.on('end', () => cleanup('proxy_end'));
|
||||
proxySocket.on('error', () => cleanup('proxy_error'));
|
||||
}
|
||||
|
||||
/**
|
||||
@ -115,7 +137,6 @@ export class NetworkProxyBridge {
|
||||
public async start(): Promise<void> {
|
||||
if (this.networkProxy) {
|
||||
await this.networkProxy.start();
|
||||
console.log(`NetworkProxy started on port ${this.settings.networkProxyPort}`);
|
||||
}
|
||||
}
|
||||
|
||||
@ -124,182 +145,8 @@ export class NetworkProxyBridge {
|
||||
*/
|
||||
public async stop(): Promise<void> {
|
||||
if (this.networkProxy) {
|
||||
try {
|
||||
console.log('Stopping NetworkProxy...');
|
||||
await this.networkProxy.stop();
|
||||
console.log('NetworkProxy stopped successfully');
|
||||
} catch (err) {
|
||||
console.log(`Error stopping NetworkProxy: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Forwards a TLS connection to a NetworkProxy for handling
|
||||
*/
|
||||
public forwardToNetworkProxy(
|
||||
connectionId: string,
|
||||
socket: plugins.net.Socket,
|
||||
record: IConnectionRecord,
|
||||
initialData: Buffer,
|
||||
customProxyPort?: number,
|
||||
onError?: (reason: string) => void
|
||||
): void {
|
||||
// Ensure NetworkProxy is initialized
|
||||
if (!this.networkProxy) {
|
||||
console.log(
|
||||
`[${connectionId}] NetworkProxy not initialized. Cannot forward connection.`
|
||||
);
|
||||
if (onError) {
|
||||
onError('network_proxy_not_initialized');
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Use the custom port if provided, otherwise use the default NetworkProxy port
|
||||
const proxyPort = customProxyPort || this.networkProxy.getListeningPort();
|
||||
const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
|
||||
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(
|
||||
`[${connectionId}] Forwarding TLS connection to NetworkProxy at ${proxyHost}:${proxyPort}`
|
||||
);
|
||||
}
|
||||
|
||||
// Create a connection to the NetworkProxy
|
||||
const proxySocket = plugins.net.connect({
|
||||
host: proxyHost,
|
||||
port: proxyPort,
|
||||
});
|
||||
|
||||
// Store the outgoing socket in the record
|
||||
record.outgoing = proxySocket;
|
||||
record.outgoingStartTime = Date.now();
|
||||
record.usingNetworkProxy = true;
|
||||
|
||||
// Set up error handlers
|
||||
proxySocket.on('error', (err) => {
|
||||
console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
|
||||
if (onError) {
|
||||
onError('network_proxy_connect_error');
|
||||
}
|
||||
});
|
||||
|
||||
// Handle connection to NetworkProxy
|
||||
proxySocket.on('connect', () => {
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
|
||||
}
|
||||
|
||||
// First send the initial data that contains the TLS ClientHello
|
||||
proxySocket.write(initialData);
|
||||
|
||||
// Now set up bidirectional piping between client and NetworkProxy
|
||||
socket.pipe(proxySocket);
|
||||
proxySocket.pipe(socket);
|
||||
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${connectionId}] TLS connection successfully forwarded to NetworkProxy`);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Synchronizes routes to NetworkProxy
|
||||
*
|
||||
* This method directly passes route configurations to NetworkProxy without any
|
||||
* intermediate conversion. NetworkProxy natively understands route configurations.
|
||||
*
|
||||
* @param routes The route configurations to sync to NetworkProxy
|
||||
*/
|
||||
public async syncRoutesToNetworkProxy(routes: IRouteConfig[]): Promise<void> {
|
||||
if (!this.networkProxy) {
|
||||
console.log('Cannot sync configurations - NetworkProxy not initialized');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
// Filter only routes that are applicable to NetworkProxy (TLS termination)
|
||||
const networkProxyRoutes = routes.filter(route => {
|
||||
return (
|
||||
route.action.type === 'forward' &&
|
||||
route.action.tls &&
|
||||
(route.action.tls.mode === 'terminate' || route.action.tls.mode === 'terminate-and-reencrypt')
|
||||
);
|
||||
});
|
||||
|
||||
// Pass routes directly to NetworkProxy
|
||||
await this.networkProxy.updateRouteConfigs(networkProxyRoutes);
|
||||
console.log(`Synced ${networkProxyRoutes.length} routes directly to NetworkProxy`);
|
||||
} catch (err) {
|
||||
console.log(`Error syncing routes to NetworkProxy: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Request a certificate for a specific domain
|
||||
*
|
||||
* @param domain The domain to request a certificate for
|
||||
* @param routeName Optional route name to associate with this certificate
|
||||
*/
|
||||
public async requestCertificate(domain: string, routeName?: string): Promise<boolean> {
|
||||
// Delegate to Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
// Check if the domain is already registered
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
if (cert) {
|
||||
console.log(`Certificate already exists for ${domain}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Build the domain options
|
||||
const domainOptions: any = {
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true,
|
||||
};
|
||||
|
||||
// Add route reference if available
|
||||
if (routeName) {
|
||||
domainOptions.routeReference = {
|
||||
routeName
|
||||
};
|
||||
}
|
||||
|
||||
// Register the domain for certificate issuance
|
||||
this.port80Handler.addDomain(domainOptions);
|
||||
|
||||
console.log(`Domain ${domain} registered for certificate issuance`);
|
||||
return true;
|
||||
} catch (err) {
|
||||
console.log(`Error requesting certificate: ${err}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Fall back to NetworkProxy if Port80Handler is not available
|
||||
if (!this.networkProxy) {
|
||||
console.log('Cannot request certificate - NetworkProxy not initialized');
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!this.settings.acme?.enabled) {
|
||||
console.log('Cannot request certificate - ACME is not enabled');
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const result = await this.networkProxy.requestCertificate(domain);
|
||||
if (result) {
|
||||
console.log(`Certificate request for ${domain} submitted successfully`);
|
||||
} else {
|
||||
console.log(`Certificate request for ${domain} failed`);
|
||||
}
|
||||
return result;
|
||||
} catch (err) {
|
||||
console.log(`Error requesting certificate: ${err}`);
|
||||
return false;
|
||||
await this.networkProxy.stop();
|
||||
this.networkProxy = null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -365,6 +365,10 @@ export class RouteConnectionHandler {
|
||||
case 'block':
|
||||
return this.handleBlockAction(socket, record, route);
|
||||
|
||||
case 'static':
|
||||
this.handleStaticAction(socket, record, route);
|
||||
return;
|
||||
|
||||
default:
|
||||
console.log(`[${connectionId}] Unknown action type: ${(route.action as any).type}`);
|
||||
socket.end();
|
||||
@ -528,7 +532,7 @@ export class RouteConnectionHandler {
|
||||
|
||||
// If we have an initial chunk with TLS data, start processing it
|
||||
if (initialChunk && record.isTLS) {
|
||||
return this.networkProxyBridge.forwardToNetworkProxy(
|
||||
this.networkProxyBridge.forwardToNetworkProxy(
|
||||
connectionId,
|
||||
socket,
|
||||
record,
|
||||
@ -536,6 +540,7 @@ export class RouteConnectionHandler {
|
||||
this.settings.networkProxyPort,
|
||||
(reason) => this.connectionManager.initiateCleanupOnce(record, reason)
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
// This shouldn't normally happen - we should have TLS data at this point
|
||||
@ -706,6 +711,64 @@ export class RouteConnectionHandler {
|
||||
this.connectionManager.initiateCleanupOnce(record, 'route_blocked');
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle a static action for a route
|
||||
*/
|
||||
private async handleStaticAction(
|
||||
socket: plugins.net.Socket,
|
||||
record: IConnectionRecord,
|
||||
route: IRouteConfig
|
||||
): Promise<void> {
|
||||
const connectionId = record.id;
|
||||
|
||||
if (!route.action.handler) {
|
||||
console.error(`[${connectionId}] Static route '${route.name}' has no handler`);
|
||||
socket.end();
|
||||
this.connectionManager.cleanupConnection(record, 'no_handler');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
// Build route context
|
||||
const context: IRouteContext = {
|
||||
port: record.localPort,
|
||||
domain: record.lockedDomain,
|
||||
clientIp: record.remoteIP,
|
||||
serverIp: socket.localAddress!,
|
||||
path: undefined, // Will need to be extracted from HTTP request
|
||||
isTls: record.isTLS,
|
||||
tlsVersion: record.tlsVersion,
|
||||
routeName: route.name,
|
||||
routeId: route.name,
|
||||
timestamp: Date.now(),
|
||||
connectionId
|
||||
};
|
||||
|
||||
// Call the handler
|
||||
const response = await route.action.handler(context);
|
||||
|
||||
// Send HTTP response
|
||||
const headers = response.headers || {};
|
||||
headers['Content-Length'] = Buffer.byteLength(response.body).toString();
|
||||
|
||||
let httpResponse = `HTTP/1.1 ${response.status} ${getStatusText(response.status)}\r\n`;
|
||||
for (const [key, value] of Object.entries(headers)) {
|
||||
httpResponse += `${key}: ${value}\r\n`;
|
||||
}
|
||||
httpResponse += '\r\n';
|
||||
|
||||
socket.write(httpResponse);
|
||||
socket.write(response.body);
|
||||
socket.end();
|
||||
|
||||
this.connectionManager.cleanupConnection(record, 'completed');
|
||||
} catch (error) {
|
||||
console.error(`[${connectionId}] Error in static handler: ${error}`);
|
||||
socket.end();
|
||||
this.connectionManager.cleanupConnection(record, 'handler_error');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets up a direct connection to the target
|
||||
*/
|
||||
@ -1131,4 +1194,14 @@ export class RouteConnectionHandler {
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Helper function for status text
|
||||
function getStatusText(status: number): string {
|
||||
const statusTexts: Record<number, string> = {
|
||||
200: 'OK',
|
||||
404: 'Not Found',
|
||||
500: 'Internal Server Error'
|
||||
};
|
||||
return statusTexts[status] || 'Unknown';
|
||||
}
|
||||
@ -11,12 +11,8 @@ import { RouteManager } from './route-manager.js';
|
||||
import { RouteConnectionHandler } from './route-connection-handler.js';
|
||||
import { NFTablesManager } from './nftables-manager.js';
|
||||
|
||||
// External dependencies
|
||||
import { Port80Handler } from '../../http/port80/port80-handler.js';
|
||||
import { CertProvisioner } from '../../certificate/providers/cert-provisioner.js';
|
||||
import type { ICertificateData } from '../../certificate/models/certificate-types.js';
|
||||
import { buildPort80Handler } from '../../certificate/acme/acme-factory.js';
|
||||
import { createPort80HandlerOptions } from '../../common/port80-adapter.js';
|
||||
// Certificate manager
|
||||
import { SmartCertManager, type ICertStatus } from './certificate-manager.js';
|
||||
|
||||
// Import types and utilities
|
||||
import type {
|
||||
@ -53,10 +49,8 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
private routeConnectionHandler: RouteConnectionHandler;
|
||||
private nftablesManager: NFTablesManager;
|
||||
|
||||
// Port80Handler for ACME certificate management
|
||||
private port80Handler: Port80Handler | null = null;
|
||||
// CertProvisioner for unified certificate workflows
|
||||
private certProvisioner?: CertProvisioner;
|
||||
// Certificate manager for ACME and static certificates
|
||||
private certManager: SmartCertManager | null = null;
|
||||
|
||||
/**
|
||||
* Constructor for SmartProxy
|
||||
@ -180,29 +174,53 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
public settings: ISmartProxyOptions;
|
||||
|
||||
/**
|
||||
* Initialize the Port80Handler for ACME certificate management
|
||||
* Initialize certificate manager
|
||||
*/
|
||||
private async initializePort80Handler(): Promise<void> {
|
||||
const config = this.settings.acme!;
|
||||
if (!config.enabled) {
|
||||
console.log('ACME is disabled in configuration');
|
||||
private async initializeCertificateManager(): Promise<void> {
|
||||
// Extract global ACME options if any routes use auto certificates
|
||||
const autoRoutes = this.settings.routes.filter(r =>
|
||||
r.action.tls?.certificate === 'auto'
|
||||
);
|
||||
|
||||
if (autoRoutes.length === 0 && !this.hasStaticCertRoutes()) {
|
||||
console.log('No routes require certificate management');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
// Build and start the Port80Handler
|
||||
this.port80Handler = buildPort80Handler({
|
||||
...config,
|
||||
httpsRedirectPort: config.httpsRedirectPort || 443
|
||||
});
|
||||
|
||||
// Share Port80Handler with NetworkProxyBridge before start
|
||||
this.networkProxyBridge.setPort80Handler(this.port80Handler);
|
||||
await this.port80Handler.start();
|
||||
console.log(`Port80Handler started on port ${config.port}`);
|
||||
} catch (err) {
|
||||
console.log(`Error initializing Port80Handler: ${err}`);
|
||||
// Use the first auto route's ACME config as defaults
|
||||
const defaultAcme = autoRoutes[0]?.action.tls?.acme;
|
||||
|
||||
this.certManager = new SmartCertManager(
|
||||
this.settings.routes,
|
||||
'./certs', // Certificate directory
|
||||
defaultAcme ? {
|
||||
email: defaultAcme.email,
|
||||
useProduction: defaultAcme.useProduction,
|
||||
port: defaultAcme.challengePort || 80
|
||||
} : undefined
|
||||
);
|
||||
|
||||
// Connect with NetworkProxy
|
||||
if (this.networkProxyBridge.getNetworkProxy()) {
|
||||
this.certManager.setNetworkProxy(this.networkProxyBridge.getNetworkProxy());
|
||||
}
|
||||
|
||||
// Set route update callback for ACME challenges
|
||||
this.certManager.setUpdateRoutesCallback(async (routes) => {
|
||||
await this.updateRoutes(routes);
|
||||
});
|
||||
|
||||
await this.certManager.initialize();
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if we have routes with static certificates
|
||||
*/
|
||||
private hasStaticCertRoutes(): boolean {
|
||||
return this.settings.routes.some(r =>
|
||||
r.action.tls?.certificate &&
|
||||
r.action.tls.certificate !== 'auto'
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -215,51 +233,18 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
return;
|
||||
}
|
||||
|
||||
// Pure route-based configuration - no domain configs needed
|
||||
|
||||
// Initialize Port80Handler if enabled
|
||||
await this.initializePort80Handler();
|
||||
|
||||
// Initialize CertProvisioner for unified certificate workflows
|
||||
if (this.port80Handler) {
|
||||
const acme = this.settings.acme!;
|
||||
|
||||
// Setup route forwards
|
||||
const routeForwards = acme.routeForwards?.map(f => f) || [];
|
||||
|
||||
// Create CertProvisioner with appropriate parameters
|
||||
// No longer need to support multiple configuration types
|
||||
// Just pass the routes directly
|
||||
this.certProvisioner = new CertProvisioner(
|
||||
this.settings.routes,
|
||||
this.port80Handler,
|
||||
this.networkProxyBridge,
|
||||
this.settings.certProvisionFunction,
|
||||
acme.renewThresholdDays!,
|
||||
acme.renewCheckIntervalHours!,
|
||||
acme.autoRenew!,
|
||||
routeForwards
|
||||
);
|
||||
|
||||
// Register certificate event handler
|
||||
this.certProvisioner.on('certificate', (certData) => {
|
||||
this.emit('certificate', {
|
||||
domain: certData.domain,
|
||||
publicKey: certData.certificate,
|
||||
privateKey: certData.privateKey,
|
||||
expiryDate: certData.expiryDate,
|
||||
source: certData.source,
|
||||
isRenewal: certData.isRenewal
|
||||
});
|
||||
});
|
||||
|
||||
await this.certProvisioner.start();
|
||||
console.log('CertProvisioner started');
|
||||
}
|
||||
// Initialize certificate manager before starting servers
|
||||
await this.initializeCertificateManager();
|
||||
|
||||
// Initialize and start NetworkProxy if needed
|
||||
if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
|
||||
await this.networkProxyBridge.initialize();
|
||||
|
||||
// Connect NetworkProxy with certificate manager
|
||||
if (this.certManager) {
|
||||
this.certManager.setNetworkProxy(this.networkProxyBridge.getNetworkProxy());
|
||||
}
|
||||
|
||||
await this.networkProxyBridge.start();
|
||||
}
|
||||
|
||||
@ -371,27 +356,16 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
this.isShuttingDown = true;
|
||||
this.portManager.setShuttingDown(true);
|
||||
|
||||
// Stop CertProvisioner if active
|
||||
if (this.certProvisioner) {
|
||||
await this.certProvisioner.stop();
|
||||
console.log('CertProvisioner stopped');
|
||||
// Stop certificate manager
|
||||
if (this.certManager) {
|
||||
await this.certManager.stop();
|
||||
console.log('Certificate manager stopped');
|
||||
}
|
||||
|
||||
// Stop NFTablesManager
|
||||
await this.nftablesManager.stop();
|
||||
console.log('NFTablesManager stopped');
|
||||
|
||||
// Stop the Port80Handler if running
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
await this.port80Handler.stop();
|
||||
console.log('Port80Handler stopped');
|
||||
this.port80Handler = null;
|
||||
} catch (err) {
|
||||
console.log(`Error stopping Port80Handler: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Stop the connection logger
|
||||
if (this.connectionLogger) {
|
||||
clearInterval(this.connectionLogger);
|
||||
@ -498,104 +472,60 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
await this.networkProxyBridge.syncRoutesToNetworkProxy(newRoutes);
|
||||
}
|
||||
|
||||
// If Port80Handler is running, provision certificates based on routes
|
||||
if (this.port80Handler && this.settings.acme?.enabled) {
|
||||
// Register all eligible domains from routes
|
||||
this.port80Handler.addDomainsFromRoutes(newRoutes);
|
||||
|
||||
// Handle static certificates from certProvisionFunction if available
|
||||
if (this.settings.certProvisionFunction) {
|
||||
for (const route of newRoutes) {
|
||||
// Skip routes without domains
|
||||
if (!route.match.domains) continue;
|
||||
|
||||
// Skip non-forward routes
|
||||
if (route.action.type !== 'forward') continue;
|
||||
|
||||
// Skip routes without TLS termination
|
||||
if (!route.action.tls ||
|
||||
route.action.tls.mode === 'passthrough' ||
|
||||
!route.action.target) continue;
|
||||
|
||||
// Skip certificate provisioning if certificate is not auto
|
||||
if (route.action.tls.certificate !== 'auto') continue;
|
||||
|
||||
const domains = Array.isArray(route.match.domains)
|
||||
? route.match.domains
|
||||
: [route.match.domains];
|
||||
|
||||
for (const domain of domains) {
|
||||
try {
|
||||
const provision = await this.settings.certProvisionFunction(domain);
|
||||
|
||||
// Skip http01 as those are handled by Port80Handler
|
||||
if (provision !== 'http01') {
|
||||
// Handle static certificate (e.g., DNS-01 provisioned)
|
||||
const certObj = provision as plugins.tsclass.network.ICert;
|
||||
const certData: ICertificateData = {
|
||||
domain: certObj.domainName,
|
||||
certificate: certObj.publicKey,
|
||||
privateKey: certObj.privateKey,
|
||||
expiryDate: new Date(certObj.validUntil),
|
||||
routeReference: {
|
||||
routeName: route.name
|
||||
}
|
||||
};
|
||||
this.networkProxyBridge.applyExternalCertificate(certData);
|
||||
console.log(`Applied static certificate for ${domain} from certProvider`);
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`certProvider error for ${domain}: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
// Update certificate manager with new routes
|
||||
if (this.certManager) {
|
||||
await this.certManager.stop();
|
||||
|
||||
this.certManager = new SmartCertManager(
|
||||
newRoutes,
|
||||
'./certs',
|
||||
this.certManager.getAcmeOptions()
|
||||
);
|
||||
|
||||
if (this.networkProxyBridge.getNetworkProxy()) {
|
||||
this.certManager.setNetworkProxy(this.networkProxyBridge.getNetworkProxy());
|
||||
}
|
||||
|
||||
console.log('Provisioned certificates for new routes');
|
||||
|
||||
await this.certManager.initialize();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Request a certificate for a specific domain
|
||||
*
|
||||
* @param domain The domain to request a certificate for
|
||||
* @param routeName Optional route name to associate with the certificate
|
||||
* Manually provision a certificate for a route
|
||||
*/
|
||||
public async requestCertificate(domain: string, routeName?: string): Promise<boolean> {
|
||||
// Validate domain format
|
||||
if (!this.isValidDomain(domain)) {
|
||||
console.log(`Invalid domain format: ${domain}`);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Use Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
// Check if we already have a certificate
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
if (cert) {
|
||||
console.log(`Certificate already exists for ${domain}, valid until ${cert.expiryDate.toISOString()}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Register domain for certificate issuance
|
||||
this.port80Handler.addDomain({
|
||||
domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true,
|
||||
routeReference: routeName ? { routeName } : undefined
|
||||
});
|
||||
|
||||
console.log(`Domain ${domain} registered for certificate issuance` + (routeName ? ` for route '${routeName}'` : ''));
|
||||
return true;
|
||||
} catch (err) {
|
||||
console.log(`Error registering domain with Port80Handler: ${err}`);
|
||||
return false;
|
||||
}
|
||||
public async provisionCertificate(routeName: string): Promise<void> {
|
||||
if (!this.certManager) {
|
||||
throw new Error('Certificate manager not initialized');
|
||||
}
|
||||
|
||||
// Fall back to NetworkProxyBridge
|
||||
return this.networkProxyBridge.requestCertificate(domain);
|
||||
const route = this.settings.routes.find(r => r.name === routeName);
|
||||
if (!route) {
|
||||
throw new Error(`Route ${routeName} not found`);
|
||||
}
|
||||
|
||||
await this.certManager.provisionCertificate(route);
|
||||
}
|
||||
|
||||
/**
|
||||
* Force renewal of a certificate
|
||||
*/
|
||||
public async renewCertificate(routeName: string): Promise<void> {
|
||||
if (!this.certManager) {
|
||||
throw new Error('Certificate manager not initialized');
|
||||
}
|
||||
|
||||
await this.certManager.renewCertificate(routeName);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get certificate status for a route
|
||||
*/
|
||||
public getCertificateStatus(routeName: string): ICertStatus | undefined {
|
||||
if (!this.certManager) {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
return this.certManager.getCertificateStatus(routeName);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -685,8 +615,8 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
keepAliveConnections,
|
||||
networkProxyConnections,
|
||||
terminationStats,
|
||||
acmeEnabled: !!this.port80Handler,
|
||||
port80HandlerPort: this.port80Handler ? this.settings.acme?.port : null,
|
||||
acmeEnabled: !!this.certManager,
|
||||
port80HandlerPort: this.certManager ? 80 : null,
|
||||
routes: this.routeManager.getListeningPorts().length,
|
||||
listeningPorts: this.portManager.getListeningPorts(),
|
||||
activePorts: this.portManager.getListeningPorts().length
|
||||
@ -735,51 +665,4 @@ export class SmartProxy extends plugins.EventEmitter {
|
||||
return this.nftablesManager.getStatus();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get status of certificates managed by Port80Handler
|
||||
*/
|
||||
public getCertificateStatus(): any {
|
||||
if (!this.port80Handler) {
|
||||
return {
|
||||
enabled: false,
|
||||
message: 'Port80Handler is not enabled'
|
||||
};
|
||||
}
|
||||
|
||||
// Get eligible domains
|
||||
const eligibleDomains = this.getEligibleDomainsForCertificates();
|
||||
const certificateStatus: Record<string, any> = {};
|
||||
|
||||
// Check each domain
|
||||
for (const domain of eligibleDomains) {
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
|
||||
if (cert) {
|
||||
const now = new Date();
|
||||
const expiryDate = cert.expiryDate;
|
||||
const daysRemaining = Math.floor((expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000));
|
||||
|
||||
certificateStatus[domain] = {
|
||||
status: 'valid',
|
||||
expiryDate: expiryDate.toISOString(),
|
||||
daysRemaining,
|
||||
renewalNeeded: daysRemaining <= (this.settings.acme?.renewThresholdDays ?? 0)
|
||||
};
|
||||
} else {
|
||||
certificateStatus[domain] = {
|
||||
status: 'missing',
|
||||
message: 'No certificate found'
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const acme = this.settings.acme!;
|
||||
return {
|
||||
enabled: true,
|
||||
port: acme.port!,
|
||||
useProduction: acme.useProduction!,
|
||||
autoRenew: acme.autoRenew!,
|
||||
certificates: certificateStatus
|
||||
};
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user