Compare commits
35 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 7ce09c53ca | |||
| 69be2295f1 | |||
| 018efa32f6 | |||
| 2530918dc6 | |||
| 0b09ea1573 | |||
| 21157477b4 | |||
| fcf36e5cd5 | |||
| f5740fa565 | |||
| 4a9fba53a9 | |||
| da61adc9a2 | |||
| 616066ffd0 | |||
| bd5cccb405 | |||
| fbade85cda | |||
| 9060d26f3a | |||
| c889141ec3 | |||
| fb472f353c | |||
| 090bd747e1 | |||
| 4d77a94bbb | |||
| 7f5284b10f | |||
| 9cd5db2d81 | |||
| de0b7d1fe0 | |||
| 4e32745a8f | |||
| 121573de2f | |||
| cd957526e2 | |||
| 7aa5f07731 | |||
| 5b6f7b30c3 | |||
| 18cc21a49e | |||
| 46fa2f6ade | |||
| 0a6315f177 | |||
| 841f99e19d | |||
| 8e9de46cd2 | |||
| 2d44528345 | |||
| 28a38252da | |||
| dfb268bbfc | |||
| 6532c7ff22 |
140
changelog.md
140
changelog.md
@@ -1,5 +1,145 @@
|
||||
# Changelog
|
||||
|
||||
## 2026-02-17 - 6.6.0 - feat(remoteingress)
|
||||
derive effective remote ingress listen ports from route configs and expose them via ops API
|
||||
|
||||
- Derive listen ports from SmartProxy route configs with remoteIngress.enabled; supports optional edgeFilter to target edges by id or tags.
|
||||
- Add RemoteIngressManager.setRoutes(), derivePortsForEdge(), and getEffectiveListenPorts() which falls back to manual listenPorts when present.
|
||||
- dcrouter now supplies route configs to RemoteIngressManager during initialization and when updating SmartProxy configuration to keep derived ports in sync.
|
||||
- Ops API now returns effectiveListenPorts for edges; createRemoteIngress.listenPorts is optional and createEdge defaults listenPorts to an empty array.
|
||||
- Bump dependency @serve.zone/remoteingress to ^3.0.4 to align types/behavior.
|
||||
|
||||
## 2026-02-16 - 6.5.0 - feat(ops-view-remoteingress)
|
||||
add 'Create Edge Node' header action to remote ingress table and remove duplicate createNewAction
|
||||
|
||||
- Add a 'Create Edge Node' header action in dataActions that opens DeesModal to collect name, listenPorts and tags
|
||||
- Parse comma-separated listenPorts into integer array and normalize optional tags
|
||||
- Dispatch appstate.createRemoteIngressAction with the collected payload
|
||||
- Remove the previously duplicated createNewAction prop from the dees-table
|
||||
|
||||
## 2026-02-16 - 6.4.5 - fix(remoteingress)
|
||||
mark remote ingress data actions as row actions and bump @design.estate/dees-catalog dependency
|
||||
|
||||
- Add type:['row'] to 'Regenerate Secret' and 'Delete' dataActions in ts_web/elements/ops-view-remoteingress.ts to ensure they are treated as row actions in the UI
|
||||
- Bump @design.estate/dees-catalog from ^3.42.0 to ^3.42.2 in package.json
|
||||
|
||||
## 2026-02-16 - 6.4.4 - fix(deps)
|
||||
bump @push.rocks/smartproxy to ^25.7.3
|
||||
|
||||
- Updated @push.rocks/smartproxy from ^25.7.2 to ^25.7.3 in package.json
|
||||
|
||||
## 2026-02-16 - 6.4.3 - fix(deps)
|
||||
bump @push.rocks/smartproxy to ^25.7.2
|
||||
|
||||
- Updated package.json: @push.rocks/smartproxy ^25.7.1 -> ^25.7.2 (patch dependency update)
|
||||
|
||||
## 2026-02-16 - 6.4.2 - fix(smartproxy)
|
||||
bump @push.rocks/smartproxy to ^25.7.1
|
||||
|
||||
- Updated dependency @push.rocks/smartproxy from ^25.7.0 to ^25.7.1 in package.json
|
||||
- No other source changes; dependency patch bump only
|
||||
|
||||
## 2026-02-16 - 6.4.1 - fix(deps)
|
||||
bump dependencies: @push.rocks/smartproxy to ^25.7.0 and @serve.zone/remoteingress to ^3.0.2
|
||||
|
||||
- Bumped @push.rocks/smartproxy from ^25.5.0 to ^25.7.0
|
||||
- Bumped @serve.zone/remoteingress from ^3.0.1 to ^3.0.2
|
||||
- Package current version is 6.4.0 — recommended patch release
|
||||
|
||||
## 2026-02-16 - 6.4.0 - feat(remoteingress)
|
||||
add Remote Ingress hub and management for edge tunnel nodes, including backend managers, tunnel hub integration, opsserver handlers, typedrequest APIs, and web UI
|
||||
|
||||
- Introduce RemoteIngressManager for CRUD and persistent storage of edge registrations
|
||||
- Introduce TunnelManager to run the RemoteIngressHub, track connected edge statuses, and sync allowed edges to the hub
|
||||
- Integrate remote ingress into DcRouter (options.remoteIngressConfig, setupRemoteIngress, startup/shutdown handling, and startup summary)
|
||||
- Add OpsServer RemoteIngressHandler exposing typedrequest APIs (create/update/delete/regenerate/get/status)
|
||||
- Add web UI: Remote Ingress view, app state parts, actions and components to manage edges and display runtime statuses
|
||||
- Add typedrequest and data interfaces for remoteingress and export the remoteingress module; add @serve.zone/remoteingress dependency in package.json
|
||||
|
||||
## 2026-02-16 - 6.3.0 - feat(dcrouter)
|
||||
add configurable baseDir and centralized path resolution; use resolved data paths for storage, cache and DNS
|
||||
|
||||
- Introduce IDcRouterOptions.baseDir to allow configuring base directory for dcrouter data (defaults to ~/.serve.zone/dcrouter).
|
||||
- Add DcRouter.resolvedPaths and resolvePaths(baseDir) in ts/paths.ts to centralize computation of dcrouterHomeDir, dataDir, defaultTsmDbPath, defaultStoragePath and dnsRecordsDir.
|
||||
- Use resolvedPaths throughout DcRouter: default filesystem storage fsPath, CacheDb storagePath, and DNS records loading now reference resolved paths.
|
||||
- Replace ensureDirectories() behavior with ensureDataDirectories(resolvedPaths) to only create data-related directories; keep legacy ensureDirectories wrapper delegating to the new function.
|
||||
- Simplify paths module by removing unused legacy path constants and adding a focused API for path resolution and directory creation.
|
||||
- Remove an unused import (paths) in contentscanner, cleaning up imports.
|
||||
|
||||
## 2026-02-16 - 6.2.4 - fix(deps)
|
||||
bump @push.rocks/smartproxy to ^25.5.0
|
||||
|
||||
- Updated @push.rocks/smartproxy from ^25.4.0 to ^25.5.0 in package.json
|
||||
|
||||
## 2026-02-16 - 6.2.3 - fix(dcrouter)
|
||||
persist proxy certificate validity dates and improve certificate status initialization
|
||||
|
||||
- Bump @push.rocks/smartacme dependency from ^9.0.0 to ^9.1.3
|
||||
- Store validFrom and validUntil alongside proxy cert entries (/proxy-certs) when saving, extracting values by parsing PEM where possible
|
||||
- Use stored cert entries (domain, publicKey, validUntil, validFrom) to populate certificateStatusMap at startup
|
||||
- Fallback to SmartAcme /certs/ metadata and finally to parsing X.509 from stored PEM to determine expiry/issuedAt when initializing status
|
||||
- Update opsserver certificate handler to parse publicKey PEM from cert-store and set expiry/issuedAt and issuer accordingly
|
||||
- Adjust variable names and logging to reflect stored cert entry usage
|
||||
|
||||
## 2026-02-16 - 6.2.2 - fix(certs)
|
||||
Populate certificate status for cert-store-loaded certificates after SmartProxy startup and check proxy-certs in opsserver certificate handler
|
||||
|
||||
- Track domains loaded from storageManager '/proxy-certs/' and populate certificateStatusMap with status, routeNames, expiryDate and issuedAt (when available) after SmartProxy starts
|
||||
- Opsserver certificate handler now falls back to '/proxy-certs/{domain}' if '/certs/{cleanDomain}' is missing and marks cert-store-only entries as valid with issuer 'cert-store'
|
||||
- Bump @push.rocks/smartproxy dependency from ^25.3.1 to ^25.4.0
|
||||
|
||||
## 2026-02-16 - 6.2.1 - fix(smartacme,storage)
|
||||
Respect wildcard domain requests when retrieving certificates and treat empty/whitespace storage values as null in getJSON
|
||||
|
||||
- Pass includeWildcard flag to smartAcme.getCertificateForDomain to avoid incorrectly including/excluding wildcard certificates based on whether the requested domain itself is a wildcard
|
||||
- Detect wildcard domains via domain.startsWith('*.') and set includeWildcard to false for wildcard requests
|
||||
- Treat empty or whitespace-only stored values as null in StorageManager.getJSON to avoid parsing empty strings as JSON and potential errors
|
||||
|
||||
## 2026-02-16 - 6.2.0 - feat(ts_web)
|
||||
add Certificate Management documentation and ops-view-certificates reference
|
||||
|
||||
- Adds a new 'Certificate Management' section to ts_web/readme.md describing domain-centric overview, certificate sources (ACME/provision/static), expiry monitoring, per-domain backoff, and one-click reprovisioning
|
||||
- Adds ops-view-certificates.ts entry to the ops UI file list
|
||||
- Documents new route mapping '/certificates' in the readme navigation
|
||||
|
||||
## 2026-02-16 - 6.1.0 - feat(certs)
|
||||
integrate smartacme v9 for ACME certificate provisioning and add certificate management features, docs, dashboard views, API endpoints, and per-domain backoff scheduler
|
||||
|
||||
- Bump dependency: @push.rocks/smartacme -> ^9.0.0
|
||||
- Add Certificate Management documentation, examples, and a new Certificates view in the OpsServer dashboard (status, source, expiry, backoff, one‑click reprovision)
|
||||
- Integrate smartacme v9 features: per-domain deduplication, global concurrency control, account rate limiting, structured errors, and clean shutdown behavior
|
||||
- Introduce per-domain exponential backoff persisted via StorageManager (CertProvisionScheduler) and remove the older serial stagger queue (smartacme v9 handles concurrency/deduping)
|
||||
- Expose new typedrequest API methods: getCertificateOverview, reprovisionCertificate (legacy), reprovisionCertificateDomain (preferred)
|
||||
- DcRouter now surfaces smartAcme, certProvisionScheduler, and certificateStatusMap; cert provisioning paths call smartAcme directly and clear backoff on success
|
||||
- Docs updated to note parallel shutdown/cleanup of HTTP agents and DNS clients
|
||||
|
||||
## 2026-02-15 - 6.0.0 - BREAKING CHANGE(certs)
|
||||
Introduce domain-centric certificate provisioning with per-domain exponential backoff and a staggered serial scheduler; add domain-based reprovision API and UI backoff display; change certificate overview API to be domain-first and include backoff info; bump related deps.
|
||||
|
||||
- Add CertProvisionScheduler: persistent per-domain exponential backoff, retry calculation, and an in-memory serial stagger queue.
|
||||
- Integrate scheduler with SmartAcme certProvisionFunction: enqueue provisions, clear backoff on success, record failures to drive backoff.
|
||||
- Switch certificate event tracking to be keyed by domain (certificateStatusMap now keyed by domain) and add findRouteNamesForDomain helper.
|
||||
- BREAKING: ICertificateInfo shape changed — replaced routeName/domains with domain and routeNames; added optional backoffInfo (failures, retryAfter, lastError).
|
||||
- Add domain-based reprovision endpoint (reprovisionCertificateDomain) while retaining legacy route-based reprovision for backward compatibility (internal rename to reprovisionCertificateByRoute).
|
||||
- Web UI updated to domain-centric certificate overview, displays route pills, backoff indicator and retry timing, and uses domain-based reprovision action.
|
||||
- Dependency bumps: @push.rocks/smartlog -> ^3.1.11, @push.rocks/smartproxy -> ^25.3.1.
|
||||
|
||||
## 2026-02-14 - 5.5.0 - feat(certs)
|
||||
persist ACME certificates in StorageManager, add storage-backed cert manager, default storage to filesystem, and improve certificate status reporting
|
||||
|
||||
- Add StorageBackedCertManager to persist SmartAcme certificates under /certs/ via StorageManager
|
||||
- Default storage to filesystem path (dcrouterHomeDir/storage) when options.storage is not provided
|
||||
- Wire SmartAcme to use StorageBackedCertManager and provide SmartProxy certStore handlers that load/save/remove certs under /proxy-certs/
|
||||
- Ops server certificate handler reads persisted cert data to report expiry/issued dates and treats acme/provision-function routes with no cert data as provisioning
|
||||
- Bump @push.rocks/smartproxy dependency to ^25.3.0
|
||||
|
||||
## 2026-02-14 - 5.4.6 - fix(deps)
|
||||
bump @push.rocks/smartproxy dependency to ^25.2.2
|
||||
|
||||
- Updated dependency @push.rocks/smartproxy: ^25.2.0 → ^25.2.2
|
||||
- Change is a dependency-only patch update, no source code modifications
|
||||
- Current package version is 5.4.5; recommend a patch release
|
||||
|
||||
## 2026-02-14 - 5.4.5 - fix(dcrouter)
|
||||
bump patch for release pipeline consistency - no code changes
|
||||
|
||||
|
||||
11
package.json
11
package.json
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "@serve.zone/dcrouter",
|
||||
"private": false,
|
||||
"version": "5.4.5",
|
||||
"version": "6.6.0",
|
||||
"description": "A multifaceted routing service handling mail and SMS delivery functions.",
|
||||
"type": "module",
|
||||
"exports": {
|
||||
@@ -32,30 +32,31 @@
|
||||
"@api.global/typedserver": "^8.3.0",
|
||||
"@api.global/typedsocket": "^4.1.0",
|
||||
"@apiclient.xyz/cloudflare": "^7.1.0",
|
||||
"@design.estate/dees-catalog": "^3.42.0",
|
||||
"@design.estate/dees-catalog": "^3.42.2",
|
||||
"@design.estate/dees-element": "^2.1.6",
|
||||
"@push.rocks/projectinfo": "^5.0.2",
|
||||
"@push.rocks/qenv": "^6.1.3",
|
||||
"@push.rocks/smartacme": "^8.0.0",
|
||||
"@push.rocks/smartacme": "^9.1.3",
|
||||
"@push.rocks/smartdata": "^7.0.15",
|
||||
"@push.rocks/smartdns": "^7.8.1",
|
||||
"@push.rocks/smartfile": "^13.1.2",
|
||||
"@push.rocks/smartguard": "^3.1.0",
|
||||
"@push.rocks/smartjwt": "^2.2.1",
|
||||
"@push.rocks/smartlog": "^3.1.10",
|
||||
"@push.rocks/smartlog": "^3.1.11",
|
||||
"@push.rocks/smartmetrics": "^2.0.10",
|
||||
"@push.rocks/smartmongo": "^5.1.0",
|
||||
"@push.rocks/smartmta": "^5.2.2",
|
||||
"@push.rocks/smartnetwork": "^4.4.0",
|
||||
"@push.rocks/smartpath": "^6.0.0",
|
||||
"@push.rocks/smartpromise": "^4.2.3",
|
||||
"@push.rocks/smartproxy": "^25.2.0",
|
||||
"@push.rocks/smartproxy": "^25.7.3",
|
||||
"@push.rocks/smartradius": "^1.1.1",
|
||||
"@push.rocks/smartrequest": "^5.0.1",
|
||||
"@push.rocks/smartrx": "^3.0.10",
|
||||
"@push.rocks/smartstate": "^2.0.30",
|
||||
"@push.rocks/smartunique": "^3.0.9",
|
||||
"@serve.zone/interfaces": "^5.3.0",
|
||||
"@serve.zone/remoteingress": "^3.0.4",
|
||||
"@tsclass/tsclass": "^9.3.0",
|
||||
"lru-cache": "^11.2.6",
|
||||
"uuid": "^13.0.0"
|
||||
|
||||
506
pnpm-lock.yaml
generated
506
pnpm-lock.yaml
generated
File diff suppressed because it is too large
Load Diff
102
readme.md
102
readme.md
@@ -21,6 +21,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
|
||||
- [Email System](#email-system)
|
||||
- [DNS Server](#dns-server)
|
||||
- [RADIUS Server](#radius-server)
|
||||
- [Certificate Management](#certificate-management)
|
||||
- [Storage & Caching](#storage--caching)
|
||||
- [Security Features](#security-features)
|
||||
- [OpsServer Dashboard](#opsserver-dashboard)
|
||||
@@ -46,7 +47,9 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
|
||||
- **Hierarchical rate limiting** — global, per-domain, per-sender
|
||||
|
||||
### 🔒 Enterprise Security
|
||||
- **Automatic TLS certificates** via ACME with Cloudflare DNS-01 challenges
|
||||
- **Automatic TLS certificates** via ACME (smartacme v9) with Cloudflare DNS-01 challenges
|
||||
- **Smart certificate scheduling** — per-domain deduplication, controlled parallelism, and account rate limiting handled automatically
|
||||
- **Per-domain exponential backoff** — failed provisioning attempts are tracked and backed off to avoid hammering ACME servers
|
||||
- **IP reputation checking** with caching and configurable thresholds
|
||||
- **Content scanning** for spam, viruses, and malicious attachments
|
||||
- **Security event logging** with structured audit trails
|
||||
@@ -73,7 +76,8 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
|
||||
### 🖥️ OpsServer Dashboard
|
||||
- **Web-based management interface** with real-time monitoring
|
||||
- **JWT authentication** with session persistence
|
||||
- **Live views** for connections, email queues, DNS queries, RADIUS sessions, and security events
|
||||
- **Live views** for connections, email queues, DNS queries, RADIUS sessions, certificates, and security events
|
||||
- **Domain-centric certificate overview** with backoff status and one-click reprovisioning
|
||||
- **Read-only configuration display** — DcRouter is configured through code
|
||||
|
||||
## Installation
|
||||
@@ -250,7 +254,7 @@ graph TB
|
||||
ES[smartmta Email Server<br/><i>TypeScript + Rust</i>]
|
||||
DS[SmartDNS Server<br/><i>Rust-powered</i>]
|
||||
RS[SmartRadius Server]
|
||||
CM[Certificate Manager]
|
||||
CM[Certificate Manager<br/><i>smartacme v9</i>]
|
||||
OS[OpsServer Dashboard]
|
||||
MM[Metrics Manager]
|
||||
SM[Storage Manager]
|
||||
@@ -297,6 +301,7 @@ graph TB
|
||||
| **SmartProxy** | `@push.rocks/smartproxy` | High-performance HTTP/HTTPS and TCP/SNI proxy with route-based config (Rust engine) |
|
||||
| **UnifiedEmailServer** | `@push.rocks/smartmta` | Full SMTP server with pattern-based routing, DKIM, queue management (TypeScript + Rust) |
|
||||
| **DNS Server** | `@push.rocks/smartdns` | Authoritative DNS with dynamic records and DKIM TXT auto-generation (Rust engine) |
|
||||
| **SmartAcme** | `@push.rocks/smartacme` | ACME certificate management with per-domain dedup, concurrency control, and rate limiting |
|
||||
| **RADIUS Server** | `@push.rocks/smartradius` | Network authentication with MAB, VLAN assignment, and accounting |
|
||||
| **OpsServer** | `@api.global/typedserver` | Web dashboard + TypedRequest API for monitoring and management |
|
||||
| **MetricsManager** | `@push.rocks/smartmetrics` | Real-time metrics collection (CPU, memory, email, DNS, security) |
|
||||
@@ -308,8 +313,8 @@ graph TB
|
||||
DcRouter acts purely as an **orchestrator** — it doesn't implement protocols itself. Instead, it wires together best-in-class packages for each protocol:
|
||||
|
||||
1. **On `start()`**: DcRouter initializes OpsServer (port 3000), then spins up SmartProxy, smartmta, SmartDNS, and SmartRadius based on which configs are provided.
|
||||
2. **During operation**: Each service handles its own protocol independently. SmartProxy uses a Rust-powered engine for maximum throughput. smartmta uses a hybrid TypeScript + Rust architecture for reliable email delivery.
|
||||
3. **On `stop()`**: All services are gracefully shut down in reverse order.
|
||||
2. **During operation**: Each service handles its own protocol independently. SmartProxy uses a Rust-powered engine for maximum throughput. smartmta uses a hybrid TypeScript + Rust architecture for reliable email delivery. SmartAcme v9 handles all certificate operations with built-in concurrency control and rate limiting.
|
||||
3. **On `stop()`**: All services are gracefully shut down in parallel, including cleanup of HTTP agents and DNS clients.
|
||||
|
||||
### Rust-Powered Architecture
|
||||
|
||||
@@ -584,15 +589,6 @@ match: { sizeRange: { min: 1000, max: 5000000 }, hasAttachments: true }
|
||||
match: { subject: /invoice|receipt/i }
|
||||
```
|
||||
|
||||
### Socket-Handler Mode 🔌
|
||||
|
||||
When `useSocketHandler: true` is set, SmartProxy passes sockets directly to the email server — no internal port binding, lower latency, and fewer open ports:
|
||||
|
||||
```
|
||||
Traditional: External Port → SmartProxy → Internal Port → Email Server
|
||||
Socket Mode: External Port → SmartProxy → (direct socket) → Email Server
|
||||
```
|
||||
|
||||
### Email Security Stack
|
||||
|
||||
- **DKIM** — Automatic key generation, signing, and rotation for all domains
|
||||
@@ -705,6 +701,73 @@ RADIUS is fully manageable at runtime via the OpsServer API:
|
||||
- Session monitoring and forced disconnects
|
||||
- Accounting summaries and statistics
|
||||
|
||||
## Certificate Management
|
||||
|
||||
DcRouter uses [`@push.rocks/smartacme`](https://code.foss.global/push.rocks/smartacme) v9 for ACME certificate provisioning. smartacme v9 brings significant improvements over previous versions:
|
||||
|
||||
### How It Works
|
||||
|
||||
When a `dnsChallenge` is configured (e.g. with a Cloudflare API key), DcRouter creates a SmartAcme instance that handles DNS-01 challenges for automatic certificate provisioning. SmartProxy calls the `certProvisionFunction` whenever a route needs a TLS certificate, and SmartAcme takes care of the rest.
|
||||
|
||||
```typescript
|
||||
const router = new DcRouter({
|
||||
smartProxyConfig: {
|
||||
routes: [
|
||||
{
|
||||
name: 'secure-app',
|
||||
match: { domains: ['app.example.com'], ports: [443] },
|
||||
action: {
|
||||
type: 'forward',
|
||||
targets: [{ host: '192.168.1.10', port: 8080 }],
|
||||
tls: { mode: 'terminate', certificate: 'auto' } // ← triggers ACME provisioning
|
||||
}
|
||||
}
|
||||
],
|
||||
acme: { email: 'admin@example.com', enabled: true, useProduction: true }
|
||||
},
|
||||
tls: { contactEmail: 'admin@example.com' },
|
||||
dnsChallenge: { cloudflareApiKey: process.env.CLOUDFLARE_API_KEY }
|
||||
});
|
||||
```
|
||||
|
||||
### smartacme v9 Features
|
||||
|
||||
| Feature | Description |
|
||||
|---------|-------------|
|
||||
| **Per-domain deduplication** | Concurrent requests for the same domain share a single ACME operation |
|
||||
| **Global concurrency cap** | Default 5 parallel ACME operations to prevent overload |
|
||||
| **Account rate limiting** | Sliding window (250 orders / 3 hours) to stay within ACME provider limits |
|
||||
| **Structured errors** | `AcmeError` with `isRetryable`, `isRateLimited`, `retryAfter` fields |
|
||||
| **Clean shutdown** | `stop()` properly destroys HTTP agents and DNS clients |
|
||||
|
||||
### Per-Domain Backoff
|
||||
|
||||
DcRouter's `CertProvisionScheduler` adds **per-domain exponential backoff** on top of smartacme's built-in protections. If a DNS-01 challenge fails for a domain:
|
||||
|
||||
1. The failure is recorded (persisted to storage)
|
||||
2. The domain enters backoff: `min(failures² × 1 hour, 24 hours)`
|
||||
3. Subsequent requests for that domain are rejected until the backoff expires
|
||||
4. On success, the backoff is cleared
|
||||
|
||||
This prevents hammering ACME servers for domains with persistent issues (e.g. missing DNS delegation).
|
||||
|
||||
### Fallback to HTTP-01
|
||||
|
||||
If DNS-01 fails, the `certProvisionFunction` returns `'http01'` to tell SmartProxy to fall back to HTTP-01 challenge validation. This provides a safety net for domains where DNS-01 isn't viable.
|
||||
|
||||
### Certificate Storage
|
||||
|
||||
Certificates are persisted via the `StorageBackedCertManager` which uses DcRouter's `StorageManager`. This means certs survive restarts and don't need to be re-provisioned unless they expire.
|
||||
|
||||
### Dashboard
|
||||
|
||||
The OpsServer includes a **Certificates** view showing:
|
||||
- All domains with their certificate status (valid, expiring, expired, failed)
|
||||
- Certificate source (ACME, provision function, static)
|
||||
- Expiry dates and issuer information
|
||||
- Backoff status for failed domains
|
||||
- One-click reprovisioning per domain
|
||||
|
||||
## Storage & Caching
|
||||
|
||||
### StorageManager
|
||||
@@ -725,7 +788,7 @@ storage: {
|
||||
// Simply omit the storage config
|
||||
```
|
||||
|
||||
Used for: DKIM keys, email routes, bounce/suppression lists, IP reputation data, domain configs.
|
||||
Used for: TLS certificates, DKIM keys, email routes, bounce/suppression lists, IP reputation data, domain configs, cert backoff state.
|
||||
|
||||
### Cache Database
|
||||
|
||||
@@ -811,6 +874,7 @@ The OpsServer provides a web-based management interface served on port 3000. It'
|
||||
| 📊 **Overview** | Real-time server stats, CPU/memory, connection counts, email throughput |
|
||||
| 🌐 **Network** | Active connections, top IPs, throughput rates, SmartProxy metrics |
|
||||
| 📧 **Email** | Queue monitoring (queued/sent/failed), bounce records, security incidents |
|
||||
| 🔐 **Certificates** | Domain-centric certificate overview, status, backoff info, reprovisioning |
|
||||
| 📜 **Logs** | Real-time log viewer with level filtering and search |
|
||||
| ⚙️ **Configuration** | Read-only view of current system configuration |
|
||||
| 🛡️ **Security** | IP reputation, rate limit status, blocked connections |
|
||||
@@ -838,6 +902,11 @@ All management is done via TypedRequest over HTTP POST to `/typedrequest`:
|
||||
'getBounceRecords' // Bounce records
|
||||
'removeFromSuppressionList' // Unsuppress an address
|
||||
|
||||
// Certificates
|
||||
'getCertificateOverview' // Domain-centric certificate status
|
||||
'reprovisionCertificate' // Reprovision by route name (legacy)
|
||||
'reprovisionCertificateDomain' // Reprovision by domain (preferred)
|
||||
|
||||
// Configuration (read-only)
|
||||
'getConfiguration' // Current system config
|
||||
|
||||
@@ -884,6 +953,7 @@ const router = new DcRouter(options: IDcRouterOptions);
|
||||
|----------|------|-------------|
|
||||
| `options` | `IDcRouterOptions` | Current configuration |
|
||||
| `smartProxy` | `SmartProxy` | SmartProxy instance |
|
||||
| `smartAcme` | `SmartAcme` | SmartAcme v9 certificate manager instance |
|
||||
| `emailServer` | `UnifiedEmailServer` | Email server instance (from smartmta) |
|
||||
| `dnsServer` | `DnsServer` | DNS server instance |
|
||||
| `radiusServer` | `RadiusServer` | RADIUS server instance |
|
||||
@@ -891,6 +961,8 @@ const router = new DcRouter(options: IDcRouterOptions);
|
||||
| `opsServer` | `OpsServer` | OpsServer/dashboard instance |
|
||||
| `metricsManager` | `MetricsManager` | Metrics collector |
|
||||
| `cacheDb` | `CacheDb` | Cache database instance |
|
||||
| `certProvisionScheduler` | `CertProvisionScheduler` | Per-domain backoff scheduler for cert provisioning |
|
||||
| `certificateStatusMap` | `Map<string, ...>` | Domain-keyed certificate status from SmartProxy events |
|
||||
|
||||
### Re-exported Types
|
||||
|
||||
|
||||
@@ -3,6 +3,6 @@
|
||||
*/
|
||||
export const commitinfo = {
|
||||
name: '@serve.zone/dcrouter',
|
||||
version: '5.4.5',
|
||||
version: '6.6.0',
|
||||
description: 'A multifaceted routing service handling mail and SMS delivery functions.'
|
||||
}
|
||||
|
||||
130
ts/classes.cert-provision-scheduler.ts
Normal file
130
ts/classes.cert-provision-scheduler.ts
Normal file
@@ -0,0 +1,130 @@
|
||||
import { logger } from './logger.js';
|
||||
import type { StorageManager } from './storage/index.js';
|
||||
|
||||
interface IBackoffEntry {
|
||||
failures: number;
|
||||
lastFailure: string; // ISO string
|
||||
retryAfter: string; // ISO string
|
||||
lastError?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Manages certificate provisioning scheduling with:
|
||||
* - Per-domain exponential backoff persisted in StorageManager
|
||||
*
|
||||
* Note: Serial stagger queue was removed — smartacme v9 handles
|
||||
* concurrency, per-domain dedup, and rate limiting internally.
|
||||
*/
|
||||
export class CertProvisionScheduler {
|
||||
private storageManager: StorageManager;
|
||||
private maxBackoffHours: number;
|
||||
|
||||
// In-memory backoff cache (mirrors storage for fast lookups)
|
||||
private backoffCache = new Map<string, IBackoffEntry>();
|
||||
|
||||
constructor(
|
||||
storageManager: StorageManager,
|
||||
options?: { maxBackoffHours?: number }
|
||||
) {
|
||||
this.storageManager = storageManager;
|
||||
this.maxBackoffHours = options?.maxBackoffHours ?? 24;
|
||||
}
|
||||
|
||||
/**
|
||||
* Storage key for a domain's backoff entry
|
||||
*/
|
||||
private backoffKey(domain: string): string {
|
||||
const clean = domain.replace(/\*/g, '_wildcard_').replace(/[^a-zA-Z0-9._-]/g, '_');
|
||||
return `/cert-backoff/${clean}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load backoff entry from storage (with in-memory cache)
|
||||
*/
|
||||
private async loadBackoff(domain: string): Promise<IBackoffEntry | null> {
|
||||
const cached = this.backoffCache.get(domain);
|
||||
if (cached) return cached;
|
||||
|
||||
const entry = await this.storageManager.getJSON<IBackoffEntry>(this.backoffKey(domain));
|
||||
if (entry) {
|
||||
this.backoffCache.set(domain, entry);
|
||||
}
|
||||
return entry;
|
||||
}
|
||||
|
||||
/**
|
||||
* Save backoff entry to both cache and storage
|
||||
*/
|
||||
private async saveBackoff(domain: string, entry: IBackoffEntry): Promise<void> {
|
||||
this.backoffCache.set(domain, entry);
|
||||
await this.storageManager.setJSON(this.backoffKey(domain), entry);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a domain is currently in backoff
|
||||
*/
|
||||
async isInBackoff(domain: string): Promise<boolean> {
|
||||
const entry = await this.loadBackoff(domain);
|
||||
if (!entry) return false;
|
||||
|
||||
const retryAfter = new Date(entry.retryAfter);
|
||||
return retryAfter.getTime() > Date.now();
|
||||
}
|
||||
|
||||
/**
|
||||
* Record a provisioning failure for a domain.
|
||||
* Sets exponential backoff: min(failures^2 * 1h, maxBackoffHours)
|
||||
*/
|
||||
async recordFailure(domain: string, error?: string): Promise<void> {
|
||||
const existing = await this.loadBackoff(domain);
|
||||
const failures = (existing?.failures ?? 0) + 1;
|
||||
|
||||
// Exponential backoff: failures^2 hours, capped
|
||||
const backoffHours = Math.min(failures * failures, this.maxBackoffHours);
|
||||
const retryAfter = new Date(Date.now() + backoffHours * 60 * 60 * 1000);
|
||||
|
||||
const entry: IBackoffEntry = {
|
||||
failures,
|
||||
lastFailure: new Date().toISOString(),
|
||||
retryAfter: retryAfter.toISOString(),
|
||||
lastError: error,
|
||||
};
|
||||
|
||||
await this.saveBackoff(domain, entry);
|
||||
logger.log('warn', `Cert backoff for ${domain}: ${failures} failures, retry after ${retryAfter.toISOString()}`);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear backoff for a domain (on success or manual override)
|
||||
*/
|
||||
async clearBackoff(domain: string): Promise<void> {
|
||||
this.backoffCache.delete(domain);
|
||||
try {
|
||||
await this.storageManager.delete(this.backoffKey(domain));
|
||||
} catch {
|
||||
// Ignore delete errors (key may not exist)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get backoff info for UI display
|
||||
*/
|
||||
async getBackoffInfo(domain: string): Promise<{
|
||||
failures: number;
|
||||
retryAfter?: string;
|
||||
lastError?: string;
|
||||
} | null> {
|
||||
const entry = await this.loadBackoff(domain);
|
||||
if (!entry) return null;
|
||||
|
||||
// Only return if still in backoff
|
||||
const retryAfter = new Date(entry.retryAfter);
|
||||
if (retryAfter.getTime() <= Date.now()) return null;
|
||||
|
||||
return {
|
||||
failures: entry.failures,
|
||||
retryAfter: entry.retryAfter,
|
||||
lastError: entry.lastError,
|
||||
};
|
||||
}
|
||||
}
|
||||
@@ -13,14 +13,20 @@ import {
|
||||
import { logger } from './logger.js';
|
||||
// Import storage manager
|
||||
import { StorageManager, type IStorageConfig } from './storage/index.js';
|
||||
import { StorageBackedCertManager } from './classes.storage-cert-manager.js';
|
||||
import { CertProvisionScheduler } from './classes.cert-provision-scheduler.js';
|
||||
// Import cache system
|
||||
import { CacheDb, CacheCleaner, type ICacheDbOptions } from './cache/index.js';
|
||||
|
||||
import { OpsServer } from './opsserver/index.js';
|
||||
import { MetricsManager } from './monitoring/index.js';
|
||||
import { RadiusServer, type IRadiusServerConfig } from './radius/index.js';
|
||||
import { RemoteIngressManager, TunnelManager } from './remoteingress/index.js';
|
||||
|
||||
export interface IDcRouterOptions {
|
||||
/** Base directory for all dcrouter data. Defaults to ~/.serve.zone/dcrouter */
|
||||
baseDir?: string;
|
||||
|
||||
/**
|
||||
* Direct SmartProxy configuration - gives full control over HTTP/HTTPS and TCP/SNI traffic
|
||||
* This is the preferred way to configure HTTP/HTTPS and general TCP/SNI traffic
|
||||
@@ -150,6 +156,22 @@ export interface IDcRouterOptions {
|
||||
* Enables MAC Authentication Bypass (MAB) and VLAN assignment
|
||||
*/
|
||||
radiusConfig?: IRadiusServerConfig;
|
||||
|
||||
/**
|
||||
* Remote Ingress configuration for edge tunnel nodes
|
||||
* Enables edge nodes to accept incoming connections and tunnel them to this DcRouter
|
||||
*/
|
||||
remoteIngressConfig?: {
|
||||
/** Enable remote ingress hub (default: false) */
|
||||
enabled?: boolean;
|
||||
/** Port for tunnel connections from edge nodes (default: 8443) */
|
||||
tunnelPort?: number;
|
||||
/** TLS configuration for the tunnel server */
|
||||
tls?: {
|
||||
certPath?: string;
|
||||
keyPath?: string;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -168,6 +190,7 @@ export interface PortProxyRuleContext {
|
||||
|
||||
export class DcRouter {
|
||||
public options: IDcRouterOptions;
|
||||
public resolvedPaths: ReturnType<typeof paths.resolvePaths>;
|
||||
|
||||
// Core services
|
||||
public smartProxy?: plugins.smartproxy.SmartProxy;
|
||||
@@ -183,16 +206,23 @@ export class DcRouter {
|
||||
public cacheDb?: CacheDb;
|
||||
public cacheCleaner?: CacheCleaner;
|
||||
|
||||
// Certificate status tracking from SmartProxy events
|
||||
// Remote Ingress
|
||||
public remoteIngressManager?: RemoteIngressManager;
|
||||
public tunnelManager?: TunnelManager;
|
||||
|
||||
// Certificate status tracking from SmartProxy events (keyed by domain)
|
||||
public certificateStatusMap = new Map<string, {
|
||||
status: 'valid' | 'failed';
|
||||
domain: string;
|
||||
routeNames: string[];
|
||||
expiryDate?: string;
|
||||
issuedAt?: string;
|
||||
source?: string;
|
||||
error?: string;
|
||||
}>();
|
||||
|
||||
// Certificate provisioning scheduler with per-domain backoff
|
||||
public certProvisionScheduler?: CertProvisionScheduler;
|
||||
|
||||
// TypedRouter for API endpoints
|
||||
public typedrouter = new plugins.typedrequest.TypedRouter();
|
||||
|
||||
@@ -205,6 +235,16 @@ export class DcRouter {
|
||||
...optionsArg
|
||||
};
|
||||
|
||||
// Resolve all data paths from baseDir
|
||||
this.resolvedPaths = paths.resolvePaths(this.options.baseDir);
|
||||
|
||||
// Default storage to filesystem if not configured
|
||||
if (!this.options.storage) {
|
||||
this.options.storage = {
|
||||
fsPath: this.resolvedPaths.defaultStoragePath,
|
||||
};
|
||||
}
|
||||
|
||||
// Initialize storage manager
|
||||
this.storageManager = new StorageManager(this.options.storage);
|
||||
}
|
||||
@@ -247,6 +287,11 @@ export class DcRouter {
|
||||
await this.setupRadiusServer();
|
||||
}
|
||||
|
||||
// Set up Remote Ingress hub if configured
|
||||
if (this.options.remoteIngressConfig?.enabled) {
|
||||
await this.setupRemoteIngress();
|
||||
}
|
||||
|
||||
this.logStartupSummary();
|
||||
} catch (error) {
|
||||
console.error('❌ Error starting DcRouter:', error);
|
||||
@@ -333,6 +378,16 @@ export class DcRouter {
|
||||
console.log(` └─ Accounting: ${this.options.radiusConfig.accounting?.enabled ? 'Enabled' : 'Disabled'}`);
|
||||
}
|
||||
|
||||
// Remote Ingress summary
|
||||
if (this.tunnelManager && this.options.remoteIngressConfig?.enabled) {
|
||||
console.log('\n🌐 Remote Ingress:');
|
||||
console.log(` ├─ Tunnel Port: ${this.options.remoteIngressConfig.tunnelPort || 8443}`);
|
||||
const edgeCount = this.remoteIngressManager?.getAllEdges().length || 0;
|
||||
const connectedCount = this.tunnelManager.getConnectedCount();
|
||||
console.log(` ├─ Registered Edges: ${edgeCount}`);
|
||||
console.log(` └─ Connected Edges: ${connectedCount}`);
|
||||
}
|
||||
|
||||
// Storage summary
|
||||
if (this.storageManager && this.options.storage) {
|
||||
console.log('\n💾 Storage:');
|
||||
@@ -360,7 +415,7 @@ export class DcRouter {
|
||||
|
||||
// Initialize CacheDb singleton
|
||||
this.cacheDb = CacheDb.getInstance({
|
||||
storagePath: cacheConfig.storagePath || paths.defaultTsmDbPath,
|
||||
storagePath: cacheConfig.storagePath || this.resolvedPaths.defaultTsmDbPath,
|
||||
dbName: cacheConfig.dbName || 'dcrouter',
|
||||
debug: false,
|
||||
});
|
||||
@@ -433,33 +488,81 @@ export class DcRouter {
|
||||
if (routes.length > 0 || this.options.smartProxyConfig) {
|
||||
console.log('Setting up SmartProxy with combined configuration');
|
||||
|
||||
// Track cert entries loaded from cert store so we can populate certificateStatusMap after start
|
||||
const loadedCertEntries: Array<{domain: string; publicKey: string; validUntil?: number; validFrom?: number}> = [];
|
||||
|
||||
// Create SmartProxy configuration
|
||||
const smartProxyConfig: plugins.smartproxy.ISmartProxyOptions = {
|
||||
...this.options.smartProxyConfig,
|
||||
routes,
|
||||
acme: acmeConfig
|
||||
acme: acmeConfig,
|
||||
certStore: {
|
||||
loadAll: async () => {
|
||||
const keys = await this.storageManager.list('/proxy-certs/');
|
||||
const certs: Array<{ domain: string; publicKey: string; privateKey: string; ca?: string }> = [];
|
||||
for (const key of keys) {
|
||||
const data = await this.storageManager.getJSON(key);
|
||||
if (data) {
|
||||
certs.push(data);
|
||||
loadedCertEntries.push({ domain: data.domain, publicKey: data.publicKey, validUntil: data.validUntil, validFrom: data.validFrom });
|
||||
}
|
||||
}
|
||||
return certs;
|
||||
},
|
||||
save: async (domain: string, publicKey: string, privateKey: string, ca?: string) => {
|
||||
let validUntil: number | undefined;
|
||||
let validFrom: number | undefined;
|
||||
try {
|
||||
const x509 = new plugins.crypto.X509Certificate(publicKey);
|
||||
validUntil = new Date(x509.validTo).getTime();
|
||||
validFrom = new Date(x509.validFrom).getTime();
|
||||
} catch { /* PEM parsing failed */ }
|
||||
await this.storageManager.setJSON(`/proxy-certs/${domain}`, {
|
||||
domain, publicKey, privateKey, ca, validUntil, validFrom,
|
||||
});
|
||||
},
|
||||
remove: async (domain: string) => {
|
||||
await this.storageManager.delete(`/proxy-certs/${domain}`);
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
// Initialize cert provision scheduler
|
||||
this.certProvisionScheduler = new CertProvisionScheduler(this.storageManager);
|
||||
|
||||
// If we have DNS challenge handlers, create SmartAcme and wire to certProvisionFunction
|
||||
if (challengeHandlers.length > 0) {
|
||||
this.smartAcme = new plugins.smartacme.SmartAcme({
|
||||
accountEmail: acmeConfig?.accountEmail || this.options.tls?.contactEmail || 'admin@example.com',
|
||||
certManager: new plugins.smartacme.certmanagers.MemoryCertManager(),
|
||||
certManager: new StorageBackedCertManager(this.storageManager),
|
||||
environment: 'production',
|
||||
challengeHandlers: challengeHandlers,
|
||||
challengePriority: ['dns-01'],
|
||||
});
|
||||
await this.smartAcme.start();
|
||||
|
||||
const scheduler = this.certProvisionScheduler;
|
||||
smartProxyConfig.certProvisionFunction = async (domain, eventComms) => {
|
||||
// Check backoff before attempting provision
|
||||
if (await scheduler.isInBackoff(domain)) {
|
||||
const info = await scheduler.getBackoffInfo(domain);
|
||||
const msg = `Domain ${domain} is in backoff (${info?.failures} failures), retry after ${info?.retryAfter}`;
|
||||
eventComms.warn(msg);
|
||||
throw new Error(msg);
|
||||
}
|
||||
|
||||
try {
|
||||
// smartacme v9 handles concurrency, per-domain dedup, and rate limiting internally
|
||||
eventComms.log(`Attempting DNS-01 via SmartAcme for ${domain}`);
|
||||
eventComms.setSource('smartacme-dns-01');
|
||||
const cert = await this.smartAcme.getCertificateForDomain(domain);
|
||||
const isWildcardDomain = domain.startsWith('*.');
|
||||
const cert = await this.smartAcme.getCertificateForDomain(domain, {
|
||||
includeWildcard: !isWildcardDomain,
|
||||
});
|
||||
if (cert.validUntil) {
|
||||
eventComms.setExpiryDate(new Date(cert.validUntil));
|
||||
}
|
||||
return {
|
||||
const result = {
|
||||
id: cert.id,
|
||||
domainName: cert.domainName,
|
||||
created: cert.created,
|
||||
@@ -468,7 +571,13 @@ export class DcRouter {
|
||||
publicKey: cert.publicKey,
|
||||
csr: cert.csr,
|
||||
};
|
||||
|
||||
// Success — clear any backoff
|
||||
await scheduler.clearBackoff(domain);
|
||||
return result;
|
||||
} catch (err) {
|
||||
// Record failure for backoff tracking
|
||||
await scheduler.recordFailure(domain, err.message);
|
||||
eventComms.warn(`SmartAcme DNS-01 failed for ${domain}: ${err.message}, falling back to http-01`);
|
||||
return 'http01';
|
||||
}
|
||||
@@ -492,39 +601,34 @@ export class DcRouter {
|
||||
});
|
||||
|
||||
// Always listen for certificate events — emitted by both ACME and certProvisionFunction paths
|
||||
// Events are keyed by domain for domain-centric certificate tracking
|
||||
this.smartProxy.on('certificate-issued', (event: plugins.smartproxy.ICertificateIssuedEvent) => {
|
||||
console.log(`[DcRouter] Certificate issued for ${event.domain} via ${event.source}, expires ${event.expiryDate}`);
|
||||
const routeName = this.findRouteNameForDomain(event.domain);
|
||||
if (routeName) {
|
||||
this.certificateStatusMap.set(routeName, {
|
||||
status: 'valid', domain: event.domain,
|
||||
const routeNames = this.findRouteNamesForDomain(event.domain);
|
||||
this.certificateStatusMap.set(event.domain, {
|
||||
status: 'valid', routeNames,
|
||||
expiryDate: event.expiryDate, issuedAt: new Date().toISOString(),
|
||||
source: event.source,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
this.smartProxy.on('certificate-renewed', (event: plugins.smartproxy.ICertificateIssuedEvent) => {
|
||||
console.log(`[DcRouter] Certificate renewed for ${event.domain} via ${event.source}, expires ${event.expiryDate}`);
|
||||
const routeName = this.findRouteNameForDomain(event.domain);
|
||||
if (routeName) {
|
||||
this.certificateStatusMap.set(routeName, {
|
||||
status: 'valid', domain: event.domain,
|
||||
const routeNames = this.findRouteNamesForDomain(event.domain);
|
||||
this.certificateStatusMap.set(event.domain, {
|
||||
status: 'valid', routeNames,
|
||||
expiryDate: event.expiryDate, issuedAt: new Date().toISOString(),
|
||||
source: event.source,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
this.smartProxy.on('certificate-failed', (event: plugins.smartproxy.ICertificateFailedEvent) => {
|
||||
console.error(`[DcRouter] Certificate failed for ${event.domain} (${event.source}):`, event.error);
|
||||
const routeName = this.findRouteNameForDomain(event.domain);
|
||||
if (routeName) {
|
||||
this.certificateStatusMap.set(routeName, {
|
||||
status: 'failed', domain: event.domain, error: event.error,
|
||||
const routeNames = this.findRouteNamesForDomain(event.domain);
|
||||
this.certificateStatusMap.set(event.domain, {
|
||||
status: 'failed', routeNames, error: event.error,
|
||||
source: event.source,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
// Start SmartProxy
|
||||
@@ -532,6 +636,59 @@ export class DcRouter {
|
||||
await this.smartProxy.start();
|
||||
console.log('[DcRouter] SmartProxy started successfully');
|
||||
|
||||
// Populate certificateStatusMap for certs loaded from store at startup
|
||||
for (const entry of loadedCertEntries) {
|
||||
if (!this.certificateStatusMap.has(entry.domain)) {
|
||||
const routeNames = this.findRouteNamesForDomain(entry.domain);
|
||||
let expiryDate: string | undefined;
|
||||
let issuedAt: string | undefined;
|
||||
|
||||
// Use validUntil/validFrom from stored proxy-certs data if available
|
||||
if (entry.validUntil) {
|
||||
expiryDate = new Date(entry.validUntil).toISOString();
|
||||
}
|
||||
if (entry.validFrom) {
|
||||
issuedAt = new Date(entry.validFrom).toISOString();
|
||||
}
|
||||
|
||||
// Try SmartAcme /certs/ metadata as secondary source
|
||||
if (!expiryDate) {
|
||||
try {
|
||||
const cleanDomain = entry.domain.replace(/^\*\.?/, '');
|
||||
const certMeta = await this.storageManager.getJSON(`/certs/${cleanDomain}`);
|
||||
if (certMeta?.validUntil) {
|
||||
expiryDate = new Date(certMeta.validUntil).toISOString();
|
||||
}
|
||||
if (certMeta?.created && !issuedAt) {
|
||||
issuedAt = new Date(certMeta.created).toISOString();
|
||||
}
|
||||
} catch { /* no metadata available */ }
|
||||
}
|
||||
|
||||
// Fallback: parse X509 from PEM to get expiry
|
||||
if (!expiryDate && entry.publicKey) {
|
||||
try {
|
||||
const x509 = new plugins.crypto.X509Certificate(entry.publicKey);
|
||||
expiryDate = new Date(x509.validTo).toISOString();
|
||||
if (!issuedAt) {
|
||||
issuedAt = new Date(x509.validFrom).toISOString();
|
||||
}
|
||||
} catch { /* PEM parsing failed */ }
|
||||
}
|
||||
|
||||
this.certificateStatusMap.set(entry.domain, {
|
||||
status: 'valid',
|
||||
routeNames,
|
||||
expiryDate,
|
||||
issuedAt,
|
||||
source: 'cert-store',
|
||||
});
|
||||
}
|
||||
}
|
||||
if (loadedCertEntries.length > 0) {
|
||||
console.log(`[DcRouter] Populated certificate status for ${loadedCertEntries.length} store-loaded domain(s)`);
|
||||
}
|
||||
|
||||
console.log(`SmartProxy started with ${routes.length} routes`);
|
||||
}
|
||||
}
|
||||
@@ -697,7 +854,7 @@ export class DcRouter {
|
||||
}
|
||||
|
||||
/**
|
||||
* Find the route name that matches a given domain
|
||||
* Find the first route name that matches a given domain
|
||||
*/
|
||||
private findRouteNameForDomain(domain: string): string | undefined {
|
||||
if (!this.smartProxy) return undefined;
|
||||
@@ -713,6 +870,27 @@ export class DcRouter {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/**
|
||||
* Find ALL route names that match a given domain
|
||||
*/
|
||||
public findRouteNamesForDomain(domain: string): string[] {
|
||||
if (!this.smartProxy) return [];
|
||||
const names: string[] = [];
|
||||
for (const route of this.smartProxy.routeManager.getRoutes()) {
|
||||
if (!route.match.domains || !route.name) continue;
|
||||
const routeDomains = Array.isArray(route.match.domains)
|
||||
? route.match.domains
|
||||
: [route.match.domains];
|
||||
for (const pattern of routeDomains) {
|
||||
if (this.isDomainMatch(domain, pattern)) {
|
||||
names.push(route.name);
|
||||
break; // This route already matched, no need to check other patterns
|
||||
}
|
||||
}
|
||||
}
|
||||
return names;
|
||||
}
|
||||
|
||||
public async stop() {
|
||||
console.log('Stopping DcRouter services...');
|
||||
|
||||
@@ -744,6 +922,11 @@ export class DcRouter {
|
||||
// Stop RADIUS server if running
|
||||
this.radiusServer ?
|
||||
this.radiusServer.stop().catch(err => console.error('Error stopping RADIUS server:', err)) :
|
||||
Promise.resolve(),
|
||||
|
||||
// Stop Remote Ingress tunnel manager if running
|
||||
this.tunnelManager ?
|
||||
this.tunnelManager.stop().catch(err => console.error('Error stopping TunnelManager:', err)) :
|
||||
Promise.resolve()
|
||||
]);
|
||||
|
||||
@@ -773,6 +956,11 @@ export class DcRouter {
|
||||
// Update configuration
|
||||
this.options.smartProxyConfig = config;
|
||||
|
||||
// Update routes on RemoteIngressManager so derived ports stay in sync
|
||||
if (this.remoteIngressManager && config.routes) {
|
||||
this.remoteIngressManager.setRoutes(config.routes as any[]);
|
||||
}
|
||||
|
||||
// Start new SmartProxy with updated configuration (will include email routes if configured)
|
||||
await this.setupSmartProxy();
|
||||
|
||||
@@ -1171,7 +1359,7 @@ export class DcRouter {
|
||||
|
||||
try {
|
||||
// Ensure paths are imported
|
||||
const dnsDir = paths.dnsRecordsDir;
|
||||
const dnsDir = this.resolvedPaths.dnsRecordsDir;
|
||||
|
||||
// Check if directory exists
|
||||
if (!plugins.fs.existsSync(dnsDir)) {
|
||||
@@ -1235,7 +1423,7 @@ export class DcRouter {
|
||||
}
|
||||
|
||||
// Ensure necessary directories exist
|
||||
paths.ensureDirectories();
|
||||
paths.ensureDataDirectories(this.resolvedPaths);
|
||||
|
||||
// Generate DKIM keys for each email domain
|
||||
for (const domainConfig of this.options.emailConfig.domains) {
|
||||
@@ -1390,6 +1578,35 @@ export class DcRouter {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up Remote Ingress hub for edge tunnel connections
|
||||
*/
|
||||
private async setupRemoteIngress(): Promise<void> {
|
||||
if (!this.options.remoteIngressConfig?.enabled) {
|
||||
return;
|
||||
}
|
||||
|
||||
logger.log('info', 'Setting up Remote Ingress hub...');
|
||||
|
||||
// Initialize the edge registration manager
|
||||
this.remoteIngressManager = new RemoteIngressManager(this.storageManager);
|
||||
await this.remoteIngressManager.initialize();
|
||||
|
||||
// Pass current routes so the manager can derive edge ports from remoteIngress-tagged routes
|
||||
const currentRoutes = this.options.smartProxyConfig?.routes || [];
|
||||
this.remoteIngressManager.setRoutes(currentRoutes as any[]);
|
||||
|
||||
// Create and start the tunnel manager
|
||||
this.tunnelManager = new TunnelManager(this.remoteIngressManager, {
|
||||
tunnelPort: this.options.remoteIngressConfig.tunnelPort ?? 8443,
|
||||
targetHost: '127.0.0.1',
|
||||
});
|
||||
await this.tunnelManager.start();
|
||||
|
||||
const edgeCount = this.remoteIngressManager.getAllEdges().length;
|
||||
logger.log('info', `Remote Ingress hub started on port ${this.options.remoteIngressConfig.tunnelPort || 8443} with ${edgeCount} registered edge(s)`);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up RADIUS server for network authentication
|
||||
*/
|
||||
|
||||
46
ts/classes.storage-cert-manager.ts
Normal file
46
ts/classes.storage-cert-manager.ts
Normal file
@@ -0,0 +1,46 @@
|
||||
import * as plugins from './plugins.js';
|
||||
import { StorageManager } from './storage/index.js';
|
||||
|
||||
/**
|
||||
* ICertManager implementation backed by StorageManager.
|
||||
* Persists SmartAcme certificates under a /certs/ key prefix so they
|
||||
* survive process restarts without re-hitting ACME.
|
||||
*/
|
||||
export class StorageBackedCertManager implements plugins.smartacme.ICertManager {
|
||||
private keyPrefix = '/certs/';
|
||||
|
||||
constructor(private storageManager: StorageManager) {}
|
||||
|
||||
async init(): Promise<void> {}
|
||||
|
||||
async retrieveCertificate(domainName: string): Promise<plugins.smartacme.Cert | null> {
|
||||
const data = await this.storageManager.getJSON(this.keyPrefix + domainName);
|
||||
if (!data) return null;
|
||||
return new plugins.smartacme.Cert(data);
|
||||
}
|
||||
|
||||
async storeCertificate(cert: plugins.smartacme.Cert): Promise<void> {
|
||||
await this.storageManager.setJSON(this.keyPrefix + cert.domainName, {
|
||||
id: cert.id,
|
||||
domainName: cert.domainName,
|
||||
created: cert.created,
|
||||
privateKey: cert.privateKey,
|
||||
publicKey: cert.publicKey,
|
||||
csr: cert.csr,
|
||||
validUntil: cert.validUntil,
|
||||
});
|
||||
}
|
||||
|
||||
async deleteCertificate(domainName: string): Promise<void> {
|
||||
await this.storageManager.delete(this.keyPrefix + domainName);
|
||||
}
|
||||
|
||||
async close(): Promise<void> {}
|
||||
|
||||
async wipe(): Promise<void> {
|
||||
const keys = await this.storageManager.list(this.keyPrefix);
|
||||
for (const key of keys) {
|
||||
await this.storageManager.delete(key);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -10,4 +10,7 @@ export * from './classes.dcrouter.js';
|
||||
// RADIUS module
|
||||
export * from './radius/index.js';
|
||||
|
||||
// Remote Ingress module
|
||||
export * from './remoteingress/index.js';
|
||||
|
||||
export const runCli = async () => {};
|
||||
|
||||
@@ -19,6 +19,7 @@ export class OpsServer {
|
||||
private radiusHandler: handlers.RadiusHandler;
|
||||
private emailOpsHandler: handlers.EmailOpsHandler;
|
||||
private certificateHandler: handlers.CertificateHandler;
|
||||
private remoteIngressHandler: handlers.RemoteIngressHandler;
|
||||
|
||||
constructor(dcRouterRefArg: DcRouter) {
|
||||
this.dcRouterRef = dcRouterRefArg;
|
||||
@@ -59,6 +60,7 @@ export class OpsServer {
|
||||
this.radiusHandler = new handlers.RadiusHandler(this);
|
||||
this.emailOpsHandler = new handlers.EmailOpsHandler(this);
|
||||
this.certificateHandler = new handlers.CertificateHandler(this);
|
||||
this.remoteIngressHandler = new handlers.RemoteIngressHandler(this);
|
||||
|
||||
console.log('✅ OpsServer TypedRequest handlers initialized');
|
||||
}
|
||||
|
||||
@@ -23,24 +23,45 @@ export class CertificateHandler {
|
||||
)
|
||||
);
|
||||
|
||||
// Reprovision Certificate
|
||||
// Legacy route-based reprovision (backward compat)
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ReprovisionCertificate>(
|
||||
'reprovisionCertificate',
|
||||
async (dataArg) => {
|
||||
return this.reprovisionCertificate(dataArg.routeName);
|
||||
return this.reprovisionCertificateByRoute(dataArg.routeName);
|
||||
}
|
||||
)
|
||||
);
|
||||
|
||||
// Domain-based reprovision (preferred)
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ReprovisionCertificateDomain>(
|
||||
'reprovisionCertificateDomain',
|
||||
async (dataArg) => {
|
||||
return this.reprovisionCertificateDomain(dataArg.domain);
|
||||
}
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build domain-centric certificate overview.
|
||||
* Instead of one row per route, we produce one row per unique domain.
|
||||
*/
|
||||
private async buildCertificateOverview(): Promise<interfaces.requests.ICertificateInfo[]> {
|
||||
const dcRouter = this.opsServerRef.dcRouterRef;
|
||||
const smartProxy = dcRouter.smartProxy;
|
||||
if (!smartProxy) return [];
|
||||
|
||||
const routes = smartProxy.routeManager.getRoutes();
|
||||
const certificates: interfaces.requests.ICertificateInfo[] = [];
|
||||
|
||||
// Phase 1: Collect unique domains with their associated route info
|
||||
const domainMap = new Map<string, {
|
||||
routeNames: string[];
|
||||
source: interfaces.requests.TCertificateSource;
|
||||
tlsMode: 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
|
||||
canReprovision: boolean;
|
||||
}>();
|
||||
|
||||
for (const route of routes) {
|
||||
if (!route.name) continue;
|
||||
@@ -58,7 +79,6 @@ export class CertificateHandler {
|
||||
// Determine source
|
||||
let source: interfaces.requests.TCertificateSource = 'none';
|
||||
if (tls.certificate === 'auto') {
|
||||
// Check if a certProvisionFunction is configured
|
||||
if ((smartProxy.settings as any).certProvisionFunction) {
|
||||
source = 'provision-function';
|
||||
} else {
|
||||
@@ -68,15 +88,44 @@ export class CertificateHandler {
|
||||
source = 'static';
|
||||
}
|
||||
|
||||
// Start with unknown status
|
||||
const canReprovision = source === 'acme' || source === 'provision-function';
|
||||
const tlsMode = tls.mode as 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
|
||||
|
||||
for (const domain of routeDomains) {
|
||||
const existing = domainMap.get(domain);
|
||||
if (existing) {
|
||||
// Add this route name to the existing domain entry
|
||||
if (!existing.routeNames.includes(route.name)) {
|
||||
existing.routeNames.push(route.name);
|
||||
}
|
||||
// Upgrade source if more specific
|
||||
if (existing.source === 'none' && source !== 'none') {
|
||||
existing.source = source;
|
||||
existing.canReprovision = canReprovision;
|
||||
}
|
||||
} else {
|
||||
domainMap.set(domain, {
|
||||
routeNames: [route.name],
|
||||
source,
|
||||
tlsMode,
|
||||
canReprovision,
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Phase 2: Resolve status for each unique domain
|
||||
const certificates: interfaces.requests.ICertificateInfo[] = [];
|
||||
|
||||
for (const [domain, info] of domainMap) {
|
||||
let status: interfaces.requests.TCertificateStatus = 'unknown';
|
||||
let expiryDate: string | undefined;
|
||||
let issuedAt: string | undefined;
|
||||
let issuer: string | undefined;
|
||||
let error: string | undefined;
|
||||
|
||||
// Check event-based status from DcRouter's certificateStatusMap
|
||||
const eventStatus = dcRouter.certificateStatusMap.get(route.name);
|
||||
// Check event-based status from certificateStatusMap (now keyed by domain)
|
||||
const eventStatus = dcRouter.certificateStatusMap.get(domain);
|
||||
if (eventStatus) {
|
||||
status = eventStatus.status;
|
||||
expiryDate = eventStatus.expiryDate;
|
||||
@@ -87,10 +136,10 @@ export class CertificateHandler {
|
||||
}
|
||||
}
|
||||
|
||||
// Try Rust-side certificate status if no event data
|
||||
if (status === 'unknown') {
|
||||
// Try SmartProxy certificate status if no event data
|
||||
if (status === 'unknown' && info.routeNames.length > 0) {
|
||||
try {
|
||||
const rustStatus = await smartProxy.getCertificateStatus(route.name);
|
||||
const rustStatus = await smartProxy.getCertificateStatus(info.routeNames[0]);
|
||||
if (rustStatus) {
|
||||
if (rustStatus.expiryDate) expiryDate = rustStatus.expiryDate;
|
||||
if (rustStatus.issuer) issuer = rustStatus.issuer;
|
||||
@@ -104,7 +153,36 @@ export class CertificateHandler {
|
||||
}
|
||||
}
|
||||
|
||||
// Compute status from expiry date if we have one and status is still valid/unknown
|
||||
// Check persisted cert data from StorageManager
|
||||
if (status === 'unknown') {
|
||||
const cleanDomain = domain.replace(/^\*\.?/, '');
|
||||
let certData = await dcRouter.storageManager.getJSON(`/certs/${cleanDomain}`);
|
||||
if (!certData) {
|
||||
// Also check certStore path (proxy-certs)
|
||||
certData = await dcRouter.storageManager.getJSON(`/proxy-certs/${domain}`);
|
||||
}
|
||||
if (certData?.validUntil) {
|
||||
expiryDate = new Date(certData.validUntil).toISOString();
|
||||
if (certData.created) {
|
||||
issuedAt = new Date(certData.created).toISOString();
|
||||
}
|
||||
issuer = 'smartacme-dns-01';
|
||||
} else if (certData?.publicKey) {
|
||||
// certStore has the cert — parse PEM for expiry
|
||||
try {
|
||||
const x509 = new plugins.crypto.X509Certificate(certData.publicKey);
|
||||
expiryDate = new Date(x509.validTo).toISOString();
|
||||
issuedAt = new Date(x509.validFrom).toISOString();
|
||||
} catch { /* PEM parsing failed */ }
|
||||
status = 'valid';
|
||||
issuer = 'cert-store';
|
||||
} else if (certData) {
|
||||
status = 'valid';
|
||||
issuer = 'cert-store';
|
||||
}
|
||||
}
|
||||
|
||||
// Compute status from expiry date
|
||||
if (expiryDate && (status === 'valid' || status === 'unknown')) {
|
||||
const expiry = new Date(expiryDate);
|
||||
const now = new Date();
|
||||
@@ -120,23 +198,36 @@ export class CertificateHandler {
|
||||
}
|
||||
|
||||
// Static certs with no other info default to 'valid'
|
||||
if (source === 'static' && status === 'unknown') {
|
||||
if (info.source === 'static' && status === 'unknown') {
|
||||
status = 'valid';
|
||||
}
|
||||
|
||||
const canReprovision = source === 'acme' || source === 'provision-function';
|
||||
// ACME/provision-function routes with no cert data are still provisioning
|
||||
if (status === 'unknown' && (info.source === 'acme' || info.source === 'provision-function')) {
|
||||
status = 'provisioning';
|
||||
}
|
||||
|
||||
// Phase 3: Attach backoff info
|
||||
let backoffInfo: interfaces.requests.ICertificateInfo['backoffInfo'];
|
||||
if (dcRouter.certProvisionScheduler) {
|
||||
const bi = await dcRouter.certProvisionScheduler.getBackoffInfo(domain);
|
||||
if (bi) {
|
||||
backoffInfo = bi;
|
||||
}
|
||||
}
|
||||
|
||||
certificates.push({
|
||||
routeName: route.name,
|
||||
domains: routeDomains,
|
||||
domain,
|
||||
routeNames: info.routeNames,
|
||||
status,
|
||||
source,
|
||||
tlsMode: tls.mode as 'terminate' | 'terminate-and-reencrypt' | 'passthrough',
|
||||
source: info.source,
|
||||
tlsMode: info.tlsMode,
|
||||
expiryDate,
|
||||
issuer,
|
||||
issuedAt,
|
||||
error,
|
||||
canReprovision,
|
||||
canReprovision: info.canReprovision,
|
||||
backoffInfo,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -166,7 +257,10 @@ export class CertificateHandler {
|
||||
return summary;
|
||||
}
|
||||
|
||||
private async reprovisionCertificate(routeName: string): Promise<{ success: boolean; message?: string }> {
|
||||
/**
|
||||
* Legacy route-based reprovisioning
|
||||
*/
|
||||
private async reprovisionCertificateByRoute(routeName: string): Promise<{ success: boolean; message?: string }> {
|
||||
const dcRouter = this.opsServerRef.dcRouterRef;
|
||||
const smartProxy = dcRouter.smartProxy;
|
||||
|
||||
@@ -176,11 +270,58 @@ export class CertificateHandler {
|
||||
|
||||
try {
|
||||
await smartProxy.provisionCertificate(routeName);
|
||||
// Clear event-based status so it gets refreshed
|
||||
dcRouter.certificateStatusMap.delete(routeName);
|
||||
// Clear event-based status for domains in this route
|
||||
for (const [domain, entry] of dcRouter.certificateStatusMap) {
|
||||
if (entry.routeNames.includes(routeName)) {
|
||||
dcRouter.certificateStatusMap.delete(domain);
|
||||
}
|
||||
}
|
||||
return { success: true, message: `Certificate reprovisioning triggered for route '${routeName}'` };
|
||||
} catch (err) {
|
||||
return { success: false, message: err.message || 'Failed to reprovision certificate' };
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Domain-based reprovisioning — clears backoff first, then triggers provision
|
||||
*/
|
||||
private async reprovisionCertificateDomain(domain: string): Promise<{ success: boolean; message?: string }> {
|
||||
const dcRouter = this.opsServerRef.dcRouterRef;
|
||||
const smartProxy = dcRouter.smartProxy;
|
||||
|
||||
if (!smartProxy) {
|
||||
return { success: false, message: 'SmartProxy is not running' };
|
||||
}
|
||||
|
||||
// Clear backoff for this domain (user override)
|
||||
if (dcRouter.certProvisionScheduler) {
|
||||
await dcRouter.certProvisionScheduler.clearBackoff(domain);
|
||||
}
|
||||
|
||||
// Clear status map entry so it gets refreshed
|
||||
dcRouter.certificateStatusMap.delete(domain);
|
||||
|
||||
// Try to provision via SmartAcme directly
|
||||
if (dcRouter.smartAcme) {
|
||||
try {
|
||||
await dcRouter.smartAcme.getCertificateForDomain(domain);
|
||||
return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}'` };
|
||||
} catch (err) {
|
||||
return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
|
||||
}
|
||||
}
|
||||
|
||||
// Fallback: try provisioning via the first matching route
|
||||
const routeNames = dcRouter.findRouteNamesForDomain(domain);
|
||||
if (routeNames.length > 0) {
|
||||
try {
|
||||
await smartProxy.provisionCertificate(routeNames[0]);
|
||||
return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}' via route '${routeNames[0]}'` };
|
||||
} catch (err) {
|
||||
return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
|
||||
}
|
||||
}
|
||||
|
||||
return { success: false, message: `No routes found for domain '${domain}'` };
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,3 +6,4 @@ export * from './stats.handler.js';
|
||||
export * from './radius.handler.js';
|
||||
export * from './email-ops.handler.js';
|
||||
export * from './certificate.handler.js';
|
||||
export * from './remoteingress.handler.js';
|
||||
164
ts/opsserver/handlers/remoteingress.handler.ts
Normal file
164
ts/opsserver/handlers/remoteingress.handler.ts
Normal file
@@ -0,0 +1,164 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { OpsServer } from '../classes.opsserver.js';
|
||||
import * as interfaces from '../../../ts_interfaces/index.js';
|
||||
|
||||
export class RemoteIngressHandler {
|
||||
public typedrouter = new plugins.typedrequest.TypedRouter();
|
||||
|
||||
constructor(private opsServerRef: OpsServer) {
|
||||
this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
|
||||
this.registerHandlers();
|
||||
}
|
||||
|
||||
private registerHandlers(): void {
|
||||
// Get all remote ingress edges
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetRemoteIngresses>(
|
||||
'getRemoteIngresses',
|
||||
async (dataArg, toolsArg) => {
|
||||
const manager = this.opsServerRef.dcRouterRef.remoteIngressManager;
|
||||
if (!manager) {
|
||||
return { edges: [] };
|
||||
}
|
||||
// Return edges without secrets, enriched with effective listen ports
|
||||
const edges = manager.getAllEdges().map((e) => ({
|
||||
...e,
|
||||
secret: '********', // Never expose secrets via API
|
||||
effectiveListenPorts: manager.getEffectiveListenPorts(e),
|
||||
}));
|
||||
return { edges };
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
// Create a new remote ingress edge
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_CreateRemoteIngress>(
|
||||
'createRemoteIngress',
|
||||
async (dataArg, toolsArg) => {
|
||||
const manager = this.opsServerRef.dcRouterRef.remoteIngressManager;
|
||||
const tunnelManager = this.opsServerRef.dcRouterRef.tunnelManager;
|
||||
|
||||
if (!manager) {
|
||||
return {
|
||||
success: false,
|
||||
edge: null as any,
|
||||
};
|
||||
}
|
||||
|
||||
const edge = await manager.createEdge(
|
||||
dataArg.name,
|
||||
dataArg.listenPorts || [],
|
||||
dataArg.tags,
|
||||
);
|
||||
|
||||
// Sync allowed edges with the hub
|
||||
if (tunnelManager) {
|
||||
await tunnelManager.syncAllowedEdges();
|
||||
}
|
||||
|
||||
return { success: true, edge };
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
// Delete a remote ingress edge
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_DeleteRemoteIngress>(
|
||||
'deleteRemoteIngress',
|
||||
async (dataArg, toolsArg) => {
|
||||
const manager = this.opsServerRef.dcRouterRef.remoteIngressManager;
|
||||
const tunnelManager = this.opsServerRef.dcRouterRef.tunnelManager;
|
||||
|
||||
if (!manager) {
|
||||
return { success: false, message: 'RemoteIngress not configured' };
|
||||
}
|
||||
|
||||
const deleted = await manager.deleteEdge(dataArg.id);
|
||||
if (deleted && tunnelManager) {
|
||||
await tunnelManager.syncAllowedEdges();
|
||||
}
|
||||
|
||||
return {
|
||||
success: deleted,
|
||||
message: deleted ? undefined : 'Edge not found',
|
||||
};
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
// Update a remote ingress edge
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_UpdateRemoteIngress>(
|
||||
'updateRemoteIngress',
|
||||
async (dataArg, toolsArg) => {
|
||||
const manager = this.opsServerRef.dcRouterRef.remoteIngressManager;
|
||||
const tunnelManager = this.opsServerRef.dcRouterRef.tunnelManager;
|
||||
|
||||
if (!manager) {
|
||||
return { success: false, edge: null as any };
|
||||
}
|
||||
|
||||
const edge = await manager.updateEdge(dataArg.id, {
|
||||
name: dataArg.name,
|
||||
listenPorts: dataArg.listenPorts,
|
||||
enabled: dataArg.enabled,
|
||||
tags: dataArg.tags,
|
||||
});
|
||||
|
||||
if (!edge) {
|
||||
return { success: false, edge: null as any };
|
||||
}
|
||||
|
||||
// Sync allowed edges if enabled status changed
|
||||
if (tunnelManager && dataArg.enabled !== undefined) {
|
||||
await tunnelManager.syncAllowedEdges();
|
||||
}
|
||||
|
||||
return { success: true, edge: { ...edge, secret: '********' } };
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
// Regenerate secret for an edge
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_RegenerateRemoteIngressSecret>(
|
||||
'regenerateRemoteIngressSecret',
|
||||
async (dataArg, toolsArg) => {
|
||||
const manager = this.opsServerRef.dcRouterRef.remoteIngressManager;
|
||||
const tunnelManager = this.opsServerRef.dcRouterRef.tunnelManager;
|
||||
|
||||
if (!manager) {
|
||||
return { success: false, secret: '' };
|
||||
}
|
||||
|
||||
const secret = await manager.regenerateSecret(dataArg.id);
|
||||
if (!secret) {
|
||||
return { success: false, secret: '' };
|
||||
}
|
||||
|
||||
// Sync allowed edges since secret changed
|
||||
if (tunnelManager) {
|
||||
await tunnelManager.syncAllowedEdges();
|
||||
}
|
||||
|
||||
return { success: true, secret };
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
// Get runtime status of all edges
|
||||
this.typedrouter.addTypedHandler(
|
||||
new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetRemoteIngressStatus>(
|
||||
'getRemoteIngressStatus',
|
||||
async (dataArg, toolsArg) => {
|
||||
const tunnelManager = this.opsServerRef.dcRouterRef.tunnelManager;
|
||||
if (!tunnelManager) {
|
||||
return { statuses: [] };
|
||||
}
|
||||
return { statuses: tunnelManager.getEdgeStatuses() };
|
||||
},
|
||||
),
|
||||
);
|
||||
}
|
||||
}
|
||||
63
ts/paths.ts
63
ts/paths.ts
@@ -1,7 +1,6 @@
|
||||
import * as plugins from './plugins.js';
|
||||
|
||||
// Base directories
|
||||
export const baseDir = process.cwd();
|
||||
// Code/asset paths (not affected by baseDir)
|
||||
export const packageDir = plugins.path.join(
|
||||
plugins.smartpath.get.dirnameFromImportMetaUrl(import.meta.url),
|
||||
'../'
|
||||
@@ -20,35 +19,37 @@ export const dataDir = process.env.DATA_DIR
|
||||
// Default TsmDB path for CacheDb
|
||||
export const defaultTsmDbPath = plugins.path.join(dcrouterHomeDir, 'tsmdb');
|
||||
|
||||
// MTA directories
|
||||
export const keysDir = plugins.path.join(dataDir, 'keys');
|
||||
// DNS records directory (only surviving MTA directory reference)
|
||||
export const dnsRecordsDir = plugins.path.join(dataDir, 'dns');
|
||||
export const sentEmailsDir = plugins.path.join(dataDir, 'emails', 'sent');
|
||||
export const receivedEmailsDir = plugins.path.join(dataDir, 'emails', 'received');
|
||||
export const failedEmailsDir = plugins.path.join(dataDir, 'emails', 'failed'); // For failed emails
|
||||
export const logsDir = plugins.path.join(dataDir, 'logs'); // For logs
|
||||
|
||||
// Email template directories
|
||||
export const emailTemplatesDir = plugins.path.join(dataDir, 'templates', 'email');
|
||||
export const MtaAttachmentsDir = plugins.path.join(dataDir, 'attachments'); // For email attachments
|
||||
|
||||
// Configuration path
|
||||
export const configPath = process.env.CONFIG_PATH
|
||||
? process.env.CONFIG_PATH
|
||||
: plugins.path.join(baseDir, 'config.json');
|
||||
|
||||
// Create directories if they don't exist
|
||||
export function ensureDirectories() {
|
||||
// Ensure data directories
|
||||
plugins.fsUtils.ensureDirSync(dataDir);
|
||||
plugins.fsUtils.ensureDirSync(keysDir);
|
||||
plugins.fsUtils.ensureDirSync(dnsRecordsDir);
|
||||
plugins.fsUtils.ensureDirSync(sentEmailsDir);
|
||||
plugins.fsUtils.ensureDirSync(receivedEmailsDir);
|
||||
plugins.fsUtils.ensureDirSync(failedEmailsDir);
|
||||
plugins.fsUtils.ensureDirSync(logsDir);
|
||||
|
||||
// Ensure email template directories
|
||||
plugins.fsUtils.ensureDirSync(emailTemplatesDir);
|
||||
plugins.fsUtils.ensureDirSync(MtaAttachmentsDir);
|
||||
/**
|
||||
* Resolve all data paths from a given baseDir.
|
||||
* When no baseDir is provided, falls back to ~/.serve.zone/dcrouter.
|
||||
* Specific overrides (e.g. DATA_DIR env) take precedence.
|
||||
*/
|
||||
export function resolvePaths(baseDir?: string) {
|
||||
const root = baseDir ?? plugins.path.join(plugins.os.homedir(), '.serve.zone', 'dcrouter');
|
||||
const resolvedDataDir = process.env.DATA_DIR ?? plugins.path.join(root, 'data');
|
||||
return {
|
||||
dcrouterHomeDir: root,
|
||||
dataDir: resolvedDataDir,
|
||||
defaultTsmDbPath: plugins.path.join(root, 'tsmdb'),
|
||||
defaultStoragePath: plugins.path.join(root, 'storage'),
|
||||
dnsRecordsDir: plugins.path.join(resolvedDataDir, 'dns'),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure only the data directories that are actually used exist.
|
||||
*/
|
||||
export function ensureDataDirectories(resolvedPaths: ReturnType<typeof resolvePaths>) {
|
||||
plugins.fsUtils.ensureDirSync(resolvedPaths.dataDir);
|
||||
plugins.fsUtils.ensureDirSync(resolvedPaths.dnsRecordsDir);
|
||||
}
|
||||
|
||||
/**
|
||||
* Legacy wrapper — delegates to ensureDataDirectories with module-level defaults.
|
||||
*/
|
||||
export function ensureDirectories() {
|
||||
ensureDataDirectories(resolvePaths());
|
||||
}
|
||||
@@ -23,9 +23,11 @@ export {
|
||||
|
||||
// @serve.zone scope
|
||||
import * as servezoneInterfaces from '@serve.zone/interfaces';
|
||||
import * as remoteingress from '@serve.zone/remoteingress';
|
||||
|
||||
export {
|
||||
servezoneInterfaces
|
||||
servezoneInterfaces,
|
||||
remoteingress,
|
||||
}
|
||||
|
||||
// @api.global scope
|
||||
|
||||
230
ts/remoteingress/classes.remoteingress-manager.ts
Normal file
230
ts/remoteingress/classes.remoteingress-manager.ts
Normal file
@@ -0,0 +1,230 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import type { StorageManager } from '../storage/classes.storagemanager.js';
|
||||
import type { IRemoteIngress, IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
|
||||
|
||||
const STORAGE_PREFIX = '/remote-ingress/';
|
||||
|
||||
/**
|
||||
* Flatten a port range (number | number[] | Array<{from, to}>) to a sorted unique number array.
|
||||
*/
|
||||
function extractPorts(portRange: number | number[] | Array<{ from: number; to: number }>): number[] {
|
||||
const ports = new Set<number>();
|
||||
if (typeof portRange === 'number') {
|
||||
ports.add(portRange);
|
||||
} else if (Array.isArray(portRange)) {
|
||||
for (const entry of portRange) {
|
||||
if (typeof entry === 'number') {
|
||||
ports.add(entry);
|
||||
} else if (typeof entry === 'object' && 'from' in entry && 'to' in entry) {
|
||||
for (let p = entry.from; p <= entry.to; p++) {
|
||||
ports.add(p);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return [...ports].sort((a, b) => a - b);
|
||||
}
|
||||
|
||||
/**
|
||||
* Manages CRUD for remote ingress edge registrations.
|
||||
* Persists edge configs via StorageManager and provides
|
||||
* the allowed edges list for the Rust hub.
|
||||
*/
|
||||
export class RemoteIngressManager {
|
||||
private storageManager: StorageManager;
|
||||
private edges: Map<string, IRemoteIngress> = new Map();
|
||||
private routes: IDcRouterRouteConfig[] = [];
|
||||
|
||||
constructor(storageManager: StorageManager) {
|
||||
this.storageManager = storageManager;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load all edge registrations from storage into memory.
|
||||
*/
|
||||
public async initialize(): Promise<void> {
|
||||
const keys = await this.storageManager.list(STORAGE_PREFIX);
|
||||
for (const key of keys) {
|
||||
const edge = await this.storageManager.getJSON<IRemoteIngress>(key);
|
||||
if (edge) {
|
||||
this.edges.set(edge.id, edge);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Store the current route configs for port derivation.
|
||||
*/
|
||||
public setRoutes(routes: IDcRouterRouteConfig[]): void {
|
||||
this.routes = routes;
|
||||
}
|
||||
|
||||
/**
|
||||
* Derive listen ports for an edge from routes tagged with remoteIngress.enabled.
|
||||
* When a route specifies edgeFilter, only edges whose id or tags match get that route's ports.
|
||||
* When edgeFilter is absent, the route applies to all edges.
|
||||
*/
|
||||
public derivePortsForEdge(edgeId: string, edgeTags?: string[]): number[] {
|
||||
const ports = new Set<number>();
|
||||
|
||||
for (const route of this.routes) {
|
||||
if (!route.remoteIngress?.enabled) continue;
|
||||
|
||||
// Apply edge filter if present
|
||||
const filter = route.remoteIngress.edgeFilter;
|
||||
if (filter && filter.length > 0) {
|
||||
const idMatch = filter.includes(edgeId);
|
||||
const tagMatch = edgeTags?.some((tag) => filter.includes(tag)) ?? false;
|
||||
if (!idMatch && !tagMatch) continue;
|
||||
}
|
||||
|
||||
// Extract ports from the route match
|
||||
if (route.match?.ports) {
|
||||
for (const p of extractPorts(route.match.ports)) {
|
||||
ports.add(p);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return [...ports].sort((a, b) => a - b);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the effective listen ports for an edge.
|
||||
* Returns manual listenPorts if non-empty, otherwise derives ports from tagged routes.
|
||||
*/
|
||||
public getEffectiveListenPorts(edge: IRemoteIngress): number[] {
|
||||
if (edge.listenPorts && edge.listenPorts.length > 0) {
|
||||
return edge.listenPorts;
|
||||
}
|
||||
return this.derivePortsForEdge(edge.id, edge.tags);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a new edge registration.
|
||||
*/
|
||||
public async createEdge(
|
||||
name: string,
|
||||
listenPorts: number[] = [],
|
||||
tags?: string[],
|
||||
): Promise<IRemoteIngress> {
|
||||
const id = plugins.uuid.v4();
|
||||
const secret = plugins.crypto.randomBytes(32).toString('hex');
|
||||
const now = Date.now();
|
||||
|
||||
const edge: IRemoteIngress = {
|
||||
id,
|
||||
name,
|
||||
secret,
|
||||
listenPorts,
|
||||
enabled: true,
|
||||
tags: tags || [],
|
||||
createdAt: now,
|
||||
updatedAt: now,
|
||||
};
|
||||
|
||||
await this.storageManager.setJSON(`${STORAGE_PREFIX}${id}`, edge);
|
||||
this.edges.set(id, edge);
|
||||
return edge;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get an edge by ID.
|
||||
*/
|
||||
public getEdge(id: string): IRemoteIngress | undefined {
|
||||
return this.edges.get(id);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all edge registrations.
|
||||
*/
|
||||
public getAllEdges(): IRemoteIngress[] {
|
||||
return Array.from(this.edges.values());
|
||||
}
|
||||
|
||||
/**
|
||||
* Update an edge registration.
|
||||
*/
|
||||
public async updateEdge(
|
||||
id: string,
|
||||
updates: {
|
||||
name?: string;
|
||||
listenPorts?: number[];
|
||||
enabled?: boolean;
|
||||
tags?: string[];
|
||||
},
|
||||
): Promise<IRemoteIngress | null> {
|
||||
const edge = this.edges.get(id);
|
||||
if (!edge) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (updates.name !== undefined) edge.name = updates.name;
|
||||
if (updates.listenPorts !== undefined) edge.listenPorts = updates.listenPorts;
|
||||
if (updates.enabled !== undefined) edge.enabled = updates.enabled;
|
||||
if (updates.tags !== undefined) edge.tags = updates.tags;
|
||||
edge.updatedAt = Date.now();
|
||||
|
||||
await this.storageManager.setJSON(`${STORAGE_PREFIX}${id}`, edge);
|
||||
this.edges.set(id, edge);
|
||||
return edge;
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete an edge registration.
|
||||
*/
|
||||
public async deleteEdge(id: string): Promise<boolean> {
|
||||
if (!this.edges.has(id)) {
|
||||
return false;
|
||||
}
|
||||
await this.storageManager.delete(`${STORAGE_PREFIX}${id}`);
|
||||
this.edges.delete(id);
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Regenerate the secret for an edge.
|
||||
*/
|
||||
public async regenerateSecret(id: string): Promise<string | null> {
|
||||
const edge = this.edges.get(id);
|
||||
if (!edge) {
|
||||
return null;
|
||||
}
|
||||
|
||||
edge.secret = plugins.crypto.randomBytes(32).toString('hex');
|
||||
edge.updatedAt = Date.now();
|
||||
|
||||
await this.storageManager.setJSON(`${STORAGE_PREFIX}${id}`, edge);
|
||||
this.edges.set(id, edge);
|
||||
return edge.secret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verify an edge's secret using constant-time comparison.
|
||||
*/
|
||||
public verifySecret(id: string, secret: string): boolean {
|
||||
const edge = this.edges.get(id);
|
||||
if (!edge) {
|
||||
return false;
|
||||
}
|
||||
const expected = Buffer.from(edge.secret);
|
||||
const provided = Buffer.from(secret);
|
||||
if (expected.length !== provided.length) {
|
||||
return false;
|
||||
}
|
||||
return plugins.crypto.timingSafeEqual(expected, provided);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the list of allowed edges (enabled only) for the Rust hub.
|
||||
*/
|
||||
public getAllowedEdges(): Array<{ id: string; secret: string }> {
|
||||
const result: Array<{ id: string; secret: string }> = [];
|
||||
for (const edge of this.edges.values()) {
|
||||
if (edge.enabled) {
|
||||
result.push({ id: edge.id, secret: edge.secret });
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
}
|
||||
126
ts/remoteingress/classes.tunnel-manager.ts
Normal file
126
ts/remoteingress/classes.tunnel-manager.ts
Normal file
@@ -0,0 +1,126 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import type { IRemoteIngressStatus } from '../../ts_interfaces/data/remoteingress.js';
|
||||
import type { RemoteIngressManager } from './classes.remoteingress-manager.js';
|
||||
|
||||
export interface ITunnelManagerConfig {
|
||||
tunnelPort?: number;
|
||||
targetHost?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Manages the RemoteIngressHub instance and tracks connected edge statuses.
|
||||
*/
|
||||
export class TunnelManager {
|
||||
private hub: InstanceType<typeof plugins.remoteingress.RemoteIngressHub>;
|
||||
private manager: RemoteIngressManager;
|
||||
private config: ITunnelManagerConfig;
|
||||
private edgeStatuses: Map<string, IRemoteIngressStatus> = new Map();
|
||||
|
||||
constructor(manager: RemoteIngressManager, config: ITunnelManagerConfig = {}) {
|
||||
this.manager = manager;
|
||||
this.config = config;
|
||||
this.hub = new plugins.remoteingress.RemoteIngressHub();
|
||||
|
||||
// Listen for edge connect/disconnect events
|
||||
this.hub.on('edgeConnected', (data: { edgeId: string }) => {
|
||||
const existing = this.edgeStatuses.get(data.edgeId);
|
||||
this.edgeStatuses.set(data.edgeId, {
|
||||
edgeId: data.edgeId,
|
||||
connected: true,
|
||||
publicIp: existing?.publicIp ?? null,
|
||||
activeTunnels: 0,
|
||||
lastHeartbeat: Date.now(),
|
||||
connectedAt: Date.now(),
|
||||
});
|
||||
});
|
||||
|
||||
this.hub.on('edgeDisconnected', (data: { edgeId: string }) => {
|
||||
const existing = this.edgeStatuses.get(data.edgeId);
|
||||
if (existing) {
|
||||
existing.connected = false;
|
||||
existing.activeTunnels = 0;
|
||||
}
|
||||
});
|
||||
|
||||
this.hub.on('streamOpened', (data: { edgeId: string; streamId: number }) => {
|
||||
const existing = this.edgeStatuses.get(data.edgeId);
|
||||
if (existing) {
|
||||
existing.activeTunnels++;
|
||||
existing.lastHeartbeat = Date.now();
|
||||
}
|
||||
});
|
||||
|
||||
this.hub.on('streamClosed', (data: { edgeId: string; streamId: number }) => {
|
||||
const existing = this.edgeStatuses.get(data.edgeId);
|
||||
if (existing && existing.activeTunnels > 0) {
|
||||
existing.activeTunnels--;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the tunnel hub and load allowed edges.
|
||||
*/
|
||||
public async start(): Promise<void> {
|
||||
await this.hub.start({
|
||||
tunnelPort: this.config.tunnelPort ?? 8443,
|
||||
targetHost: this.config.targetHost ?? '127.0.0.1',
|
||||
});
|
||||
|
||||
// Send allowed edges to the hub
|
||||
await this.syncAllowedEdges();
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop the tunnel hub.
|
||||
*/
|
||||
public async stop(): Promise<void> {
|
||||
await this.hub.stop();
|
||||
this.edgeStatuses.clear();
|
||||
}
|
||||
|
||||
/**
|
||||
* Sync allowed edges from the manager to the hub.
|
||||
* Call this after creating/deleting/updating edges.
|
||||
*/
|
||||
public async syncAllowedEdges(): Promise<void> {
|
||||
const edges = this.manager.getAllowedEdges();
|
||||
await this.hub.updateAllowedEdges(edges);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get runtime statuses for all known edges.
|
||||
*/
|
||||
public getEdgeStatuses(): IRemoteIngressStatus[] {
|
||||
return Array.from(this.edgeStatuses.values());
|
||||
}
|
||||
|
||||
/**
|
||||
* Get status for a specific edge.
|
||||
*/
|
||||
public getEdgeStatus(edgeId: string): IRemoteIngressStatus | undefined {
|
||||
return this.edgeStatuses.get(edgeId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the count of connected edges.
|
||||
*/
|
||||
public getConnectedCount(): number {
|
||||
let count = 0;
|
||||
for (const status of this.edgeStatuses.values()) {
|
||||
if (status.connected) count++;
|
||||
}
|
||||
return count;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the total number of active tunnels across all edges.
|
||||
*/
|
||||
public getTotalActiveTunnels(): number {
|
||||
let total = 0;
|
||||
for (const status of this.edgeStatuses.values()) {
|
||||
total += status.activeTunnels;
|
||||
}
|
||||
return total;
|
||||
}
|
||||
}
|
||||
2
ts/remoteingress/index.ts
Normal file
2
ts/remoteingress/index.ts
Normal file
@@ -0,0 +1,2 @@
|
||||
export * from './classes.remoteingress-manager.js';
|
||||
export * from './classes.tunnel-manager.js';
|
||||
@@ -1,5 +1,4 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import * as paths from '../paths.js';
|
||||
import { logger } from '../logger.js';
|
||||
import { Email, type Core } from '@push.rocks/smartmta';
|
||||
type IAttachment = Core.IAttachment;
|
||||
|
||||
@@ -378,7 +378,7 @@ export class StorageManager {
|
||||
*/
|
||||
async getJSON<T = any>(key: string): Promise<T | null> {
|
||||
const value = await this.get(key);
|
||||
if (value === null) {
|
||||
if (value === null || value.trim() === '') {
|
||||
return null;
|
||||
}
|
||||
|
||||
|
||||
@@ -1,2 +1,3 @@
|
||||
export * from './auth.js';
|
||||
export * from './stats.js';
|
||||
export * from './remoteingress.js';
|
||||
49
ts_interfaces/data/remoteingress.ts
Normal file
49
ts_interfaces/data/remoteingress.ts
Normal file
@@ -0,0 +1,49 @@
|
||||
import type { IRouteConfig } from '@push.rocks/smartproxy';
|
||||
|
||||
/**
|
||||
* A stored remote ingress edge registration.
|
||||
*/
|
||||
export interface IRemoteIngress {
|
||||
id: string;
|
||||
name: string;
|
||||
secret: string;
|
||||
listenPorts: number[];
|
||||
enabled: boolean;
|
||||
tags?: string[];
|
||||
createdAt: number;
|
||||
updatedAt: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* Runtime status of a remote ingress edge.
|
||||
*/
|
||||
export interface IRemoteIngressStatus {
|
||||
edgeId: string;
|
||||
connected: boolean;
|
||||
publicIp: string | null;
|
||||
activeTunnels: number;
|
||||
lastHeartbeat: number | null;
|
||||
connectedAt: number | null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Route-level remote ingress configuration.
|
||||
* When attached to a route, signals that traffic for this route
|
||||
* should be accepted from remote edge nodes.
|
||||
*/
|
||||
export interface IRouteRemoteIngress {
|
||||
/** Whether this route receives traffic from edge nodes */
|
||||
enabled: boolean;
|
||||
/** Optional filter: only edges whose id or tags match get this route's ports.
|
||||
* When absent, the route applies to all edges. */
|
||||
edgeFilter?: string[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Extended route config used within dcrouter.
|
||||
* Adds the optional `remoteIngress` property to SmartProxy's IRouteConfig.
|
||||
* SmartProxy ignores unknown properties at runtime.
|
||||
*/
|
||||
export type IDcRouterRouteConfig = IRouteConfig & {
|
||||
remoteIngress?: IRouteRemoteIngress;
|
||||
};
|
||||
@@ -128,6 +128,37 @@ TypedRequest interfaces for the OpsServer API, organized by domain:
|
||||
| `IReq_GetBounceRecords` | `getBounceRecords` | Bounce records |
|
||||
| `IReq_RemoveFromSuppressionList` | `removeFromSuppressionList` | Unsuppress an address |
|
||||
|
||||
#### 🔐 Certificates
|
||||
| Interface | Method | Description |
|
||||
|-----------|--------|-------------|
|
||||
| `IReq_GetCertificateOverview` | `getCertificateOverview` | Domain-centric certificate status |
|
||||
| `IReq_ReprovisionCertificate` | `reprovisionCertificate` | Reprovision by route name (legacy) |
|
||||
| `IReq_ReprovisionCertificateDomain` | `reprovisionCertificateDomain` | Reprovision by domain (preferred) |
|
||||
|
||||
#### Certificate Types
|
||||
```typescript
|
||||
type TCertificateStatus = 'valid' | 'expiring' | 'expired' | 'provisioning' | 'failed' | 'unknown';
|
||||
type TCertificateSource = 'acme' | 'provision-function' | 'static' | 'none';
|
||||
|
||||
interface ICertificateInfo {
|
||||
domain: string;
|
||||
routeNames: string[];
|
||||
status: TCertificateStatus;
|
||||
source: TCertificateSource;
|
||||
tlsMode: 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
|
||||
expiryDate?: string;
|
||||
issuer?: string;
|
||||
issuedAt?: string;
|
||||
error?: string;
|
||||
canReprovision: boolean;
|
||||
backoffInfo?: {
|
||||
failures: number;
|
||||
retryAfter?: string;
|
||||
lastError?: string;
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
#### 📡 RADIUS
|
||||
| Interface | Method | Description |
|
||||
|-----------|--------|-------------|
|
||||
@@ -173,7 +204,16 @@ console.log('Email:', metrics.emailStats);
|
||||
console.log('DNS:', metrics.dnsStats);
|
||||
console.log('Security:', metrics.securityMetrics);
|
||||
|
||||
// 3. Check email queues
|
||||
// 3. Check certificate status
|
||||
const certClient = new typedrequest.TypedRequest<requests.IReq_GetCertificateOverview>(
|
||||
'https://your-dcrouter:3000/typedrequest',
|
||||
'getCertificateOverview'
|
||||
);
|
||||
|
||||
const certs = await certClient.fire({ identity });
|
||||
console.log(`Certificates: ${certs.summary.valid} valid, ${certs.summary.failed} failed`);
|
||||
|
||||
// 4. Check email queues
|
||||
const queueClient = new typedrequest.TypedRequest<requests.IReq_GetQueuedEmails>(
|
||||
'https://your-dcrouter:3000/typedrequest',
|
||||
'getQueuedEmails'
|
||||
|
||||
@@ -5,8 +5,8 @@ export type TCertificateStatus = 'valid' | 'expiring' | 'expired' | 'provisionin
|
||||
export type TCertificateSource = 'acme' | 'provision-function' | 'static' | 'none';
|
||||
|
||||
export interface ICertificateInfo {
|
||||
routeName: string;
|
||||
domains: string[];
|
||||
domain: string;
|
||||
routeNames: string[];
|
||||
status: TCertificateStatus;
|
||||
source: TCertificateSource;
|
||||
tlsMode: 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
|
||||
@@ -15,6 +15,11 @@ export interface ICertificateInfo {
|
||||
issuedAt?: string; // ISO string
|
||||
error?: string; // if status === 'failed'
|
||||
canReprovision: boolean; // true for acme/provision-function routes
|
||||
backoffInfo?: {
|
||||
failures: number;
|
||||
retryAfter?: string; // ISO string
|
||||
lastError?: string;
|
||||
};
|
||||
}
|
||||
|
||||
export interface IReq_GetCertificateOverview extends plugins.typedrequestInterfaces.implementsTR<
|
||||
@@ -38,6 +43,7 @@ export interface IReq_GetCertificateOverview extends plugins.typedrequestInterfa
|
||||
};
|
||||
}
|
||||
|
||||
// Legacy route-based reprovision (kept for backward compat)
|
||||
export interface IReq_ReprovisionCertificate extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_ReprovisionCertificate
|
||||
@@ -52,3 +58,19 @@ export interface IReq_ReprovisionCertificate extends plugins.typedrequestInterfa
|
||||
message?: string;
|
||||
};
|
||||
}
|
||||
|
||||
// Domain-based reprovision (preferred)
|
||||
export interface IReq_ReprovisionCertificateDomain extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_ReprovisionCertificateDomain
|
||||
> {
|
||||
method: 'reprovisionCertificateDomain';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
domain: string;
|
||||
};
|
||||
response: {
|
||||
success: boolean;
|
||||
message?: string;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -6,3 +6,4 @@ export * from './combined.stats.js';
|
||||
export * from './radius.js';
|
||||
export * from './email-ops.js';
|
||||
export * from './certificate.js';
|
||||
export * from './remoteingress.js';
|
||||
117
ts_interfaces/requests/remoteingress.ts
Normal file
117
ts_interfaces/requests/remoteingress.ts
Normal file
@@ -0,0 +1,117 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import * as authInterfaces from '../data/auth.js';
|
||||
import type { IRemoteIngress, IRemoteIngressStatus } from '../data/remoteingress.js';
|
||||
|
||||
// ============================================================================
|
||||
// Remote Ingress Edge Management
|
||||
// ============================================================================
|
||||
|
||||
/**
|
||||
* Create a new remote ingress edge registration.
|
||||
*/
|
||||
export interface IReq_CreateRemoteIngress extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_CreateRemoteIngress
|
||||
> {
|
||||
method: 'createRemoteIngress';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
name: string;
|
||||
listenPorts?: number[];
|
||||
tags?: string[];
|
||||
};
|
||||
response: {
|
||||
success: boolean;
|
||||
edge: IRemoteIngress;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a remote ingress edge registration.
|
||||
*/
|
||||
export interface IReq_DeleteRemoteIngress extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_DeleteRemoteIngress
|
||||
> {
|
||||
method: 'deleteRemoteIngress';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
id: string;
|
||||
};
|
||||
response: {
|
||||
success: boolean;
|
||||
message?: string;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Update a remote ingress edge registration.
|
||||
*/
|
||||
export interface IReq_UpdateRemoteIngress extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_UpdateRemoteIngress
|
||||
> {
|
||||
method: 'updateRemoteIngress';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
id: string;
|
||||
name?: string;
|
||||
listenPorts?: number[];
|
||||
enabled?: boolean;
|
||||
tags?: string[];
|
||||
};
|
||||
response: {
|
||||
success: boolean;
|
||||
edge: IRemoteIngress;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Regenerate the secret for a remote ingress edge.
|
||||
*/
|
||||
export interface IReq_RegenerateRemoteIngressSecret extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_RegenerateRemoteIngressSecret
|
||||
> {
|
||||
method: 'regenerateRemoteIngressSecret';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
id: string;
|
||||
};
|
||||
response: {
|
||||
success: boolean;
|
||||
secret: string;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all remote ingress edge registrations.
|
||||
*/
|
||||
export interface IReq_GetRemoteIngresses extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_GetRemoteIngresses
|
||||
> {
|
||||
method: 'getRemoteIngresses';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
};
|
||||
response: {
|
||||
edges: IRemoteIngress[];
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get runtime status of all remote ingress edges.
|
||||
*/
|
||||
export interface IReq_GetRemoteIngressStatus extends plugins.typedrequestInterfaces.implementsTR<
|
||||
plugins.typedrequestInterfaces.ITypedRequest,
|
||||
IReq_GetRemoteIngressStatus
|
||||
> {
|
||||
method: 'getRemoteIngressStatus';
|
||||
request: {
|
||||
identity?: authInterfaces.IIdentity;
|
||||
};
|
||||
response: {
|
||||
statuses: IRemoteIngressStatus[];
|
||||
};
|
||||
}
|
||||
@@ -3,6 +3,6 @@
|
||||
*/
|
||||
export const commitinfo = {
|
||||
name: '@serve.zone/dcrouter',
|
||||
version: '5.4.5',
|
||||
version: '6.6.0',
|
||||
description: 'A multifaceted routing service handling mail and SMS delivery functions.'
|
||||
}
|
||||
|
||||
@@ -116,7 +116,7 @@ export const configStatePart = await appState.getStatePart<IConfigState>(
|
||||
// Determine initial view from URL path
|
||||
const getInitialView = (): string => {
|
||||
const path = typeof window !== 'undefined' ? window.location.pathname : '/';
|
||||
const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates'];
|
||||
const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates', 'remoteingress'];
|
||||
const segments = path.split('/').filter(Boolean);
|
||||
const view = segments[0];
|
||||
return validViews.includes(view) ? view : 'overview';
|
||||
@@ -192,6 +192,34 @@ export const certificateStatePart = await appState.getStatePart<ICertificateStat
|
||||
'soft'
|
||||
);
|
||||
|
||||
// ============================================================================
|
||||
// Remote Ingress State
|
||||
// ============================================================================
|
||||
|
||||
export interface IRemoteIngressState {
|
||||
edges: interfaces.data.IRemoteIngress[];
|
||||
statuses: interfaces.data.IRemoteIngressStatus[];
|
||||
selectedEdgeId: string | null;
|
||||
newEdgeSecret: string | null;
|
||||
isLoading: boolean;
|
||||
error: string | null;
|
||||
lastUpdated: number;
|
||||
}
|
||||
|
||||
export const remoteIngressStatePart = await appState.getStatePart<IRemoteIngressState>(
|
||||
'remoteIngress',
|
||||
{
|
||||
edges: [],
|
||||
statuses: [],
|
||||
selectedEdgeId: null,
|
||||
newEdgeSecret: null,
|
||||
isLoading: false,
|
||||
error: null,
|
||||
lastUpdated: 0,
|
||||
},
|
||||
'soft'
|
||||
);
|
||||
|
||||
// Actions for state management
|
||||
interface IActionContext {
|
||||
identity: interfaces.data.IIdentity | null;
|
||||
@@ -378,6 +406,13 @@ export const setActiveViewAction = uiStatePart.createAction<string>(async (state
|
||||
}, 100);
|
||||
}
|
||||
|
||||
// If switching to remoteingress view, ensure we fetch edge data
|
||||
if (viewName === 'remoteingress' && currentState.activeView !== 'remoteingress') {
|
||||
setTimeout(() => {
|
||||
remoteIngressStatePart.dispatchAction(fetchRemoteIngressAction, null);
|
||||
}, 100);
|
||||
}
|
||||
|
||||
return {
|
||||
...currentState,
|
||||
activeView: viewName,
|
||||
@@ -719,18 +754,18 @@ export const fetchCertificateOverviewAction = certificateStatePart.createAction(
|
||||
});
|
||||
|
||||
export const reprovisionCertificateAction = certificateStatePart.createAction<string>(
|
||||
async (statePartArg, routeName) => {
|
||||
async (statePartArg, domain) => {
|
||||
const context = getActionContext();
|
||||
const currentState = statePartArg.getState();
|
||||
|
||||
try {
|
||||
const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_ReprovisionCertificate
|
||||
>('/typedrequest', 'reprovisionCertificate');
|
||||
interfaces.requests.IReq_ReprovisionCertificateDomain
|
||||
>('/typedrequest', 'reprovisionCertificateDomain');
|
||||
|
||||
await request.fire({
|
||||
identity: context.identity,
|
||||
routeName,
|
||||
domain,
|
||||
});
|
||||
|
||||
// Re-fetch overview after reprovisioning
|
||||
@@ -745,6 +780,150 @@ export const reprovisionCertificateAction = certificateStatePart.createAction<st
|
||||
}
|
||||
);
|
||||
|
||||
// ============================================================================
|
||||
// Remote Ingress Actions
|
||||
// ============================================================================
|
||||
|
||||
export const fetchRemoteIngressAction = remoteIngressStatePart.createAction(async (statePartArg) => {
|
||||
const context = getActionContext();
|
||||
const currentState = statePartArg.getState();
|
||||
|
||||
try {
|
||||
const edgesRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_GetRemoteIngresses
|
||||
>('/typedrequest', 'getRemoteIngresses');
|
||||
|
||||
const statusRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_GetRemoteIngressStatus
|
||||
>('/typedrequest', 'getRemoteIngressStatus');
|
||||
|
||||
const [edgesResponse, statusResponse] = await Promise.all([
|
||||
edgesRequest.fire({ identity: context.identity }),
|
||||
statusRequest.fire({ identity: context.identity }),
|
||||
]);
|
||||
|
||||
return {
|
||||
...currentState,
|
||||
edges: edgesResponse.edges,
|
||||
statuses: statusResponse.statuses,
|
||||
isLoading: false,
|
||||
error: null,
|
||||
lastUpdated: Date.now(),
|
||||
};
|
||||
} catch (error) {
|
||||
return {
|
||||
...currentState,
|
||||
isLoading: false,
|
||||
error: error instanceof Error ? error.message : 'Failed to fetch remote ingress data',
|
||||
};
|
||||
}
|
||||
});
|
||||
|
||||
export const createRemoteIngressAction = remoteIngressStatePart.createAction<{
|
||||
name: string;
|
||||
listenPorts: number[];
|
||||
tags?: string[];
|
||||
}>(async (statePartArg, dataArg) => {
|
||||
const context = getActionContext();
|
||||
const currentState = statePartArg.getState();
|
||||
|
||||
try {
|
||||
const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_CreateRemoteIngress
|
||||
>('/typedrequest', 'createRemoteIngress');
|
||||
|
||||
const response = await request.fire({
|
||||
identity: context.identity,
|
||||
name: dataArg.name,
|
||||
listenPorts: dataArg.listenPorts,
|
||||
tags: dataArg.tags,
|
||||
});
|
||||
|
||||
if (response.success) {
|
||||
// Refresh the list and store the new secret for display
|
||||
await remoteIngressStatePart.dispatchAction(fetchRemoteIngressAction, null);
|
||||
return {
|
||||
...statePartArg.getState(),
|
||||
newEdgeSecret: response.edge.secret,
|
||||
};
|
||||
}
|
||||
|
||||
return currentState;
|
||||
} catch (error) {
|
||||
return {
|
||||
...currentState,
|
||||
error: error instanceof Error ? error.message : 'Failed to create edge',
|
||||
};
|
||||
}
|
||||
});
|
||||
|
||||
export const deleteRemoteIngressAction = remoteIngressStatePart.createAction<string>(
|
||||
async (statePartArg, edgeId) => {
|
||||
const context = getActionContext();
|
||||
const currentState = statePartArg.getState();
|
||||
|
||||
try {
|
||||
const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_DeleteRemoteIngress
|
||||
>('/typedrequest', 'deleteRemoteIngress');
|
||||
|
||||
await request.fire({
|
||||
identity: context.identity,
|
||||
id: edgeId,
|
||||
});
|
||||
|
||||
await remoteIngressStatePart.dispatchAction(fetchRemoteIngressAction, null);
|
||||
return statePartArg.getState();
|
||||
} catch (error) {
|
||||
return {
|
||||
...currentState,
|
||||
error: error instanceof Error ? error.message : 'Failed to delete edge',
|
||||
};
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
export const regenerateRemoteIngressSecretAction = remoteIngressStatePart.createAction<string>(
|
||||
async (statePartArg, edgeId) => {
|
||||
const context = getActionContext();
|
||||
const currentState = statePartArg.getState();
|
||||
|
||||
try {
|
||||
const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
|
||||
interfaces.requests.IReq_RegenerateRemoteIngressSecret
|
||||
>('/typedrequest', 'regenerateRemoteIngressSecret');
|
||||
|
||||
const response = await request.fire({
|
||||
identity: context.identity,
|
||||
id: edgeId,
|
||||
});
|
||||
|
||||
if (response.success) {
|
||||
return {
|
||||
...currentState,
|
||||
newEdgeSecret: response.secret,
|
||||
};
|
||||
}
|
||||
|
||||
return currentState;
|
||||
} catch (error) {
|
||||
return {
|
||||
...currentState,
|
||||
error: error instanceof Error ? error.message : 'Failed to regenerate secret',
|
||||
};
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
export const clearNewEdgeSecretAction = remoteIngressStatePart.createAction(
|
||||
async (statePartArg) => {
|
||||
return {
|
||||
...statePartArg.getState(),
|
||||
newEdgeSecret: null,
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
// Combined refresh action for efficient polling
|
||||
async function dispatchCombinedRefreshAction() {
|
||||
const context = getActionContext();
|
||||
|
||||
@@ -6,4 +6,5 @@ export * from './ops-view-logs.js';
|
||||
export * from './ops-view-config.js';
|
||||
export * from './ops-view-security.js';
|
||||
export * from './ops-view-certificates.js';
|
||||
export * from './ops-view-remoteingress.js';
|
||||
export * from './shared/index.js';
|
||||
@@ -20,6 +20,7 @@ import { OpsViewLogs } from './ops-view-logs.js';
|
||||
import { OpsViewConfig } from './ops-view-config.js';
|
||||
import { OpsViewSecurity } from './ops-view-security.js';
|
||||
import { OpsViewCertificates } from './ops-view-certificates.js';
|
||||
import { OpsViewRemoteIngress } from './ops-view-remoteingress.js';
|
||||
|
||||
@customElement('ops-dashboard')
|
||||
export class OpsDashboard extends DeesElement {
|
||||
@@ -66,6 +67,10 @@ export class OpsDashboard extends DeesElement {
|
||||
name: 'Certificates',
|
||||
element: OpsViewCertificates,
|
||||
},
|
||||
{
|
||||
name: 'RemoteIngress',
|
||||
element: OpsViewRemoteIngress,
|
||||
},
|
||||
];
|
||||
|
||||
/**
|
||||
|
||||
@@ -94,13 +94,13 @@ export class OpsViewCertificates extends DeesElement {
|
||||
color: ${cssManager.bdTheme('#374151', '#d1d5db')};
|
||||
}
|
||||
|
||||
.domainPills {
|
||||
.routePills {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 4px;
|
||||
}
|
||||
|
||||
.domainPill {
|
||||
.routePill {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
padding: 2px 8px;
|
||||
@@ -125,6 +125,17 @@ export class OpsViewCertificates extends DeesElement {
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
.backoffIndicator {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 4px;
|
||||
font-size: 11px;
|
||||
color: ${cssManager.bdTheme('#9a3412', '#fb923c')};
|
||||
padding: 2px 6px;
|
||||
border-radius: 4px;
|
||||
background: ${cssManager.bdTheme('#fff7ed', '#431407')};
|
||||
}
|
||||
|
||||
.expiryInfo {
|
||||
font-size: 12px;
|
||||
}
|
||||
@@ -218,12 +229,14 @@ export class OpsViewCertificates extends DeesElement {
|
||||
<dees-table
|
||||
.data=${this.certState.certificates}
|
||||
.displayFunction=${(cert: interfaces.requests.ICertificateInfo) => ({
|
||||
Route: cert.routeName,
|
||||
Domains: this.renderDomainPills(cert.domains),
|
||||
Domain: cert.domain,
|
||||
Routes: this.renderRoutePills(cert.routeNames),
|
||||
Status: this.renderStatusBadge(cert.status),
|
||||
Source: this.renderSourceBadge(cert.source),
|
||||
Expires: this.renderExpiry(cert.expiryDate),
|
||||
Error: cert.error
|
||||
Error: cert.backoffInfo
|
||||
? html`<span class="backoffIndicator">${cert.backoffInfo.failures} failures, retry ${this.formatRetryTime(cert.backoffInfo.retryAfter)}</span>`
|
||||
: cert.error
|
||||
? html`<span class="errorText" title="${cert.error}">${cert.error}</span>`
|
||||
: '',
|
||||
})}
|
||||
@@ -245,11 +258,11 @@ export class OpsViewCertificates extends DeesElement {
|
||||
}
|
||||
await appstate.certificateStatePart.dispatchAction(
|
||||
appstate.reprovisionCertificateAction,
|
||||
cert.routeName,
|
||||
cert.domain,
|
||||
);
|
||||
const { DeesToast } = await import('@design.estate/dees-catalog');
|
||||
DeesToast.show({
|
||||
message: `Reprovisioning triggered for ${cert.routeName}`,
|
||||
message: `Reprovisioning triggered for ${cert.domain}`,
|
||||
type: 'success',
|
||||
duration: 3000,
|
||||
});
|
||||
@@ -263,7 +276,7 @@ export class OpsViewCertificates extends DeesElement {
|
||||
const cert = actionData.item;
|
||||
const { DeesModal } = await import('@design.estate/dees-catalog');
|
||||
await DeesModal.createAndShow({
|
||||
heading: `Certificate: ${cert.routeName}`,
|
||||
heading: `Certificate: ${cert.domain}`,
|
||||
content: html`
|
||||
<div style="padding: 20px;">
|
||||
<dees-dataview-codebox
|
||||
@@ -275,10 +288,10 @@ export class OpsViewCertificates extends DeesElement {
|
||||
`,
|
||||
menuOptions: [
|
||||
{
|
||||
name: 'Copy Route Name',
|
||||
name: 'Copy Domain',
|
||||
iconName: 'copy',
|
||||
action: async () => {
|
||||
await navigator.clipboard.writeText(cert.routeName);
|
||||
await navigator.clipboard.writeText(cert.domain);
|
||||
},
|
||||
},
|
||||
],
|
||||
@@ -287,7 +300,7 @@ export class OpsViewCertificates extends DeesElement {
|
||||
},
|
||||
]}
|
||||
heading1="Certificate Status"
|
||||
heading2="TLS certificates across all routes"
|
||||
heading2="TLS certificates by domain"
|
||||
searchable
|
||||
.pagination=${true}
|
||||
.paginationSize=${50}
|
||||
@@ -296,14 +309,14 @@ export class OpsViewCertificates extends DeesElement {
|
||||
`;
|
||||
}
|
||||
|
||||
private renderDomainPills(domains: string[]): TemplateResult {
|
||||
private renderRoutePills(routeNames: string[]): TemplateResult {
|
||||
const maxShow = 3;
|
||||
const visible = domains.slice(0, maxShow);
|
||||
const remaining = domains.length - maxShow;
|
||||
const visible = routeNames.slice(0, maxShow);
|
||||
const remaining = routeNames.length - maxShow;
|
||||
|
||||
return html`
|
||||
<span class="domainPills">
|
||||
${visible.map((d) => html`<span class="domainPill">${d}</span>`)}
|
||||
<span class="routePills">
|
||||
${visible.map((r) => html`<span class="routePill">${r}</span>`)}
|
||||
${remaining > 0 ? html`<span class="moreCount">+${remaining} more</span>` : ''}
|
||||
</span>
|
||||
`;
|
||||
@@ -352,4 +365,16 @@ export class OpsViewCertificates extends DeesElement {
|
||||
</span>
|
||||
`;
|
||||
}
|
||||
|
||||
private formatRetryTime(retryAfter?: string): string {
|
||||
if (!retryAfter) return 'soon';
|
||||
const retryDate = new Date(retryAfter);
|
||||
const now = new Date();
|
||||
const diffMs = retryDate.getTime() - now.getTime();
|
||||
if (diffMs <= 0) return 'now';
|
||||
const diffMin = Math.ceil(diffMs / 60000);
|
||||
if (diffMin < 60) return `in ${diffMin}m`;
|
||||
const diffHours = Math.ceil(diffMin / 60);
|
||||
return `in ${diffHours}h`;
|
||||
}
|
||||
}
|
||||
|
||||
297
ts_web/elements/ops-view-remoteingress.ts
Normal file
297
ts_web/elements/ops-view-remoteingress.ts
Normal file
@@ -0,0 +1,297 @@
|
||||
import {
|
||||
DeesElement,
|
||||
html,
|
||||
customElement,
|
||||
type TemplateResult,
|
||||
css,
|
||||
state,
|
||||
cssManager,
|
||||
} from '@design.estate/dees-element';
|
||||
import * as appstate from '../appstate.js';
|
||||
import * as interfaces from '../../dist_ts_interfaces/index.js';
|
||||
import { viewHostCss } from './shared/css.js';
|
||||
import { type IStatsTile } from '@design.estate/dees-catalog';
|
||||
|
||||
declare global {
|
||||
interface HTMLElementTagNameMap {
|
||||
'ops-view-remoteingress': OpsViewRemoteIngress;
|
||||
}
|
||||
}
|
||||
|
||||
@customElement('ops-view-remoteingress')
|
||||
export class OpsViewRemoteIngress extends DeesElement {
|
||||
@state()
|
||||
accessor riState: appstate.IRemoteIngressState = appstate.remoteIngressStatePart.getState();
|
||||
|
||||
constructor() {
|
||||
super();
|
||||
const sub = appstate.remoteIngressStatePart.state.subscribe((newState) => {
|
||||
this.riState = newState;
|
||||
});
|
||||
this.rxSubscriptions.push(sub);
|
||||
}
|
||||
|
||||
async connectedCallback() {
|
||||
await super.connectedCallback();
|
||||
await appstate.remoteIngressStatePart.dispatchAction(appstate.fetchRemoteIngressAction, null);
|
||||
}
|
||||
|
||||
public static styles = [
|
||||
cssManager.defaultStyles,
|
||||
viewHostCss,
|
||||
css`
|
||||
.remoteIngressContainer {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 24px;
|
||||
}
|
||||
|
||||
.statusBadge {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
padding: 3px 10px;
|
||||
border-radius: 12px;
|
||||
font-size: 12px;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0.02em;
|
||||
text-transform: uppercase;
|
||||
}
|
||||
|
||||
.statusBadge.connected {
|
||||
background: ${cssManager.bdTheme('#dcfce7', '#14532d')};
|
||||
color: ${cssManager.bdTheme('#166534', '#4ade80')};
|
||||
}
|
||||
|
||||
.statusBadge.disconnected {
|
||||
background: ${cssManager.bdTheme('#fef2f2', '#450a0a')};
|
||||
color: ${cssManager.bdTheme('#991b1b', '#f87171')};
|
||||
}
|
||||
|
||||
.statusBadge.disabled {
|
||||
background: ${cssManager.bdTheme('#f3f4f6', '#374151')};
|
||||
color: ${cssManager.bdTheme('#6b7280', '#9ca3af')};
|
||||
}
|
||||
|
||||
.secretDialog {
|
||||
padding: 16px;
|
||||
background: ${cssManager.bdTheme('#fffbeb', '#1c1917')};
|
||||
border: 1px solid ${cssManager.bdTheme('#fbbf24', '#92400e')};
|
||||
border-radius: 8px;
|
||||
margin-bottom: 16px;
|
||||
}
|
||||
|
||||
.secretDialog code {
|
||||
display: block;
|
||||
padding: 8px 12px;
|
||||
background: ${cssManager.bdTheme('#1f2937', '#111827')};
|
||||
color: #10b981;
|
||||
border-radius: 4px;
|
||||
font-family: monospace;
|
||||
font-size: 13px;
|
||||
word-break: break-all;
|
||||
margin: 8px 0;
|
||||
user-select: all;
|
||||
}
|
||||
|
||||
.secretDialog .warning {
|
||||
font-size: 12px;
|
||||
color: ${cssManager.bdTheme('#92400e', '#fbbf24')};
|
||||
margin-top: 8px;
|
||||
}
|
||||
|
||||
.portsDisplay {
|
||||
display: flex;
|
||||
gap: 4px;
|
||||
flex-wrap: wrap;
|
||||
}
|
||||
|
||||
.portBadge {
|
||||
display: inline-flex;
|
||||
padding: 2px 8px;
|
||||
border-radius: 4px;
|
||||
font-size: 12px;
|
||||
font-weight: 500;
|
||||
background: ${cssManager.bdTheme('#eff6ff', '#172554')};
|
||||
color: ${cssManager.bdTheme('#1e40af', '#60a5fa')};
|
||||
}
|
||||
`,
|
||||
];
|
||||
|
||||
render(): TemplateResult {
|
||||
const totalEdges = this.riState.edges.length;
|
||||
const connectedEdges = this.riState.statuses.filter(s => s.connected).length;
|
||||
const disconnectedEdges = totalEdges - connectedEdges;
|
||||
const activeTunnels = this.riState.statuses.reduce((sum, s) => sum + s.activeTunnels, 0);
|
||||
|
||||
const statsTiles: IStatsTile[] = [
|
||||
{
|
||||
id: 'totalEdges',
|
||||
title: 'Total Edges',
|
||||
type: 'number',
|
||||
value: totalEdges,
|
||||
icon: 'lucide:server',
|
||||
description: 'Registered edge nodes',
|
||||
color: '#3b82f6',
|
||||
},
|
||||
{
|
||||
id: 'connectedEdges',
|
||||
title: 'Connected',
|
||||
type: 'number',
|
||||
value: connectedEdges,
|
||||
icon: 'lucide:link',
|
||||
description: 'Currently connected edges',
|
||||
color: '#10b981',
|
||||
},
|
||||
{
|
||||
id: 'disconnectedEdges',
|
||||
title: 'Disconnected',
|
||||
type: 'number',
|
||||
value: disconnectedEdges,
|
||||
icon: 'lucide:unlink',
|
||||
description: 'Offline edge nodes',
|
||||
color: disconnectedEdges > 0 ? '#ef4444' : '#6b7280',
|
||||
},
|
||||
{
|
||||
id: 'activeTunnels',
|
||||
title: 'Active Tunnels',
|
||||
type: 'number',
|
||||
value: activeTunnels,
|
||||
icon: 'lucide:cable',
|
||||
description: 'Active client connections',
|
||||
color: '#8b5cf6',
|
||||
},
|
||||
];
|
||||
|
||||
return html`
|
||||
<ops-sectionheading>Remote Ingress</ops-sectionheading>
|
||||
|
||||
${this.riState.newEdgeSecret ? html`
|
||||
<div class="secretDialog">
|
||||
<strong>Edge Secret (copy now - shown only once):</strong>
|
||||
<code>${this.riState.newEdgeSecret}</code>
|
||||
<div class="warning">This secret will not be shown again. Save it securely.</div>
|
||||
<dees-button
|
||||
@click=${() => appstate.remoteIngressStatePart.dispatchAction(appstate.clearNewEdgeSecretAction, null)}
|
||||
>Dismiss</dees-button>
|
||||
</div>
|
||||
` : ''}
|
||||
|
||||
<div class="remoteIngressContainer">
|
||||
<dees-statsgrid .tiles=${statsTiles}></dees-statsgrid>
|
||||
|
||||
<dees-table
|
||||
.heading1=${'Edge Nodes'}
|
||||
.heading2=${'Manage remote ingress edge registrations'}
|
||||
.data=${this.riState.edges}
|
||||
.displayFunction=${(edge: interfaces.data.IRemoteIngress) => ({
|
||||
name: edge.name,
|
||||
status: this.getEdgeStatusHtml(edge),
|
||||
publicIp: this.getEdgePublicIp(edge.id),
|
||||
ports: this.getPortsHtml(edge.listenPorts),
|
||||
tunnels: this.getEdgeTunnelCount(edge.id),
|
||||
lastHeartbeat: this.getLastHeartbeat(edge.id),
|
||||
})}
|
||||
.dataActions=${[
|
||||
{
|
||||
name: 'Create Edge Node',
|
||||
iconName: 'lucide:plus',
|
||||
type: ['header'],
|
||||
actionFunc: async () => {
|
||||
const { DeesModal } = await import('@design.estate/dees-catalog');
|
||||
const result = await DeesModal.createAndShow({
|
||||
heading: 'Create Edge Node',
|
||||
content: html`
|
||||
<dees-form>
|
||||
<dees-input-text .key=${'name'} .label=${'Name'} .required=${true}></dees-input-text>
|
||||
<dees-input-text .key=${'listenPorts'} .label=${'Listen Ports (comma-separated)'} .required=${true} .value=${'443,25'}></dees-input-text>
|
||||
<dees-input-text .key=${'tags'} .label=${'Tags (comma-separated, optional)'}></dees-input-text>
|
||||
</dees-form>
|
||||
`,
|
||||
menuOptions: [],
|
||||
});
|
||||
if (result) {
|
||||
const formData = result as any;
|
||||
const ports = (formData.name ? formData.listenPorts : '443')
|
||||
.split(',')
|
||||
.map((p: string) => parseInt(p.trim(), 10))
|
||||
.filter((p: number) => !isNaN(p));
|
||||
const tags = formData.tags
|
||||
? formData.tags.split(',').map((t: string) => t.trim()).filter(Boolean)
|
||||
: undefined;
|
||||
await appstate.remoteIngressStatePart.dispatchAction(
|
||||
appstate.createRemoteIngressAction,
|
||||
{
|
||||
name: formData.name,
|
||||
listenPorts: ports,
|
||||
tags,
|
||||
},
|
||||
);
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'Regenerate Secret',
|
||||
iconName: 'lucide:key',
|
||||
type: ['row'],
|
||||
action: async (edge: interfaces.data.IRemoteIngress) => {
|
||||
await appstate.remoteIngressStatePart.dispatchAction(
|
||||
appstate.regenerateRemoteIngressSecretAction,
|
||||
edge.id,
|
||||
);
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'Delete',
|
||||
iconName: 'lucide:trash2',
|
||||
type: ['row'],
|
||||
action: async (edge: interfaces.data.IRemoteIngress) => {
|
||||
await appstate.remoteIngressStatePart.dispatchAction(
|
||||
appstate.deleteRemoteIngressAction,
|
||||
edge.id,
|
||||
);
|
||||
},
|
||||
},
|
||||
]}
|
||||
></dees-table>
|
||||
</div>
|
||||
`;
|
||||
}
|
||||
|
||||
private getEdgeStatus(edgeId: string): interfaces.data.IRemoteIngressStatus | undefined {
|
||||
return this.riState.statuses.find(s => s.edgeId === edgeId);
|
||||
}
|
||||
|
||||
private getEdgeStatusHtml(edge: interfaces.data.IRemoteIngress): TemplateResult {
|
||||
if (!edge.enabled) {
|
||||
return html`<span class="statusBadge disabled">Disabled</span>`;
|
||||
}
|
||||
const status = this.getEdgeStatus(edge.id);
|
||||
if (status?.connected) {
|
||||
return html`<span class="statusBadge connected">Connected</span>`;
|
||||
}
|
||||
return html`<span class="statusBadge disconnected">Disconnected</span>`;
|
||||
}
|
||||
|
||||
private getEdgePublicIp(edgeId: string): string {
|
||||
const status = this.getEdgeStatus(edgeId);
|
||||
return status?.publicIp || '-';
|
||||
}
|
||||
|
||||
private getPortsHtml(ports: number[]): TemplateResult {
|
||||
return html`<div class="portsDisplay">${ports.map(p => html`<span class="portBadge">${p}</span>`)}</div>`;
|
||||
}
|
||||
|
||||
private getEdgeTunnelCount(edgeId: string): number {
|
||||
const status = this.getEdgeStatus(edgeId);
|
||||
return status?.activeTunnels || 0;
|
||||
}
|
||||
|
||||
private getLastHeartbeat(edgeId: string): string {
|
||||
const status = this.getEdgeStatus(edgeId);
|
||||
if (!status?.lastHeartbeat) return '-';
|
||||
const ago = Date.now() - status.lastHeartbeat;
|
||||
if (ago < 60000) return `${Math.floor(ago / 1000)}s ago`;
|
||||
if (ago < 3600000) return `${Math.floor(ago / 60000)}m ago`;
|
||||
return `${Math.floor(ago / 3600000)}h ago`;
|
||||
}
|
||||
}
|
||||
@@ -34,6 +34,13 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
|
||||
- **Security** — Security incidents from email processing
|
||||
- Bounce record management and suppression list controls
|
||||
|
||||
### 🔐 Certificate Management
|
||||
- Domain-centric certificate overview with status indicators
|
||||
- Certificate source tracking (ACME, provision function, static)
|
||||
- Expiry date monitoring and alerts
|
||||
- Per-domain backoff status for failed provisions
|
||||
- One-click reprovisioning per domain
|
||||
|
||||
### 📜 Log Viewer
|
||||
- Real-time log streaming
|
||||
- Filter by log level (error, warning, info, debug)
|
||||
@@ -77,6 +84,7 @@ ts_web/
|
||||
├── ops-view-overview.ts # Overview statistics
|
||||
├── ops-view-network.ts # Network monitoring
|
||||
├── ops-view-emails.ts # Email queue management
|
||||
├── ops-view-certificates.ts # Certificate overview & reprovisioning
|
||||
├── ops-view-logs.ts # Log viewer
|
||||
├── ops-view-config.ts # Configuration display
|
||||
├── ops-view-security.ts # Security dashboard
|
||||
@@ -132,6 +140,7 @@ removeFromSuppressionAction(email) // Remove from suppression list
|
||||
/emails/sent → Sent emails
|
||||
/emails/failed → Failed emails
|
||||
/emails/security → Security incidents
|
||||
/certificates → Certificate management
|
||||
/logs → Log viewer
|
||||
/configuration → System configuration
|
||||
/security → Security dashboard
|
||||
|
||||
@@ -3,7 +3,7 @@ import * as appstate from './appstate.js';
|
||||
|
||||
const SmartRouter = plugins.domtools.plugins.smartrouter.SmartRouter;
|
||||
|
||||
export const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates'] as const;
|
||||
export const validViews = ['overview', 'network', 'emails', 'logs', 'configuration', 'security', 'certificates', 'remoteingress'] as const;
|
||||
export const validEmailFolders = ['queued', 'sent', 'failed', 'security'] as const;
|
||||
|
||||
export type TValidView = typeof validViews[number];
|
||||
|
||||
Reference in New Issue
Block a user