onebox/readme.hints.md

Onebox Project Hints

SSL Certificate Storage (November 2025)

SSL certificates are now stored directly in the SQLite database as PEM content instead of file paths:

• ISslCertificate and ICertificate interfaces use certPem, keyPem, fullchainPem properties
• Database migration 8 converted the certificates table schema
• No filesystem storage for certificates - everything in DB
• reverseproxy.ts reads certificate PEM content from database
• certmanager.ts stores SmartACME certificates directly to database

Architecture Notes

Database Layer (November 2025 Refactoring)

The database layer has been refactored into a repository pattern:

Directory Structure:

ts/database/
├── index.ts              # Main OneboxDatabase class (composes repositories, handles migrations)
├── types.ts              # Shared types (TBindValue, TQueryFunction)
├── base.repository.ts    # Base repository class
└── repositories/
    ├── index.ts          # Repository exports
    ├── service.repository.ts      # Services CRUD
    ├── registry.repository.ts     # Registries + Registry Tokens
    ├── certificate.repository.ts  # Domains, Certificates, Cert Requirements, SSL Certificates (legacy)
    ├── auth.repository.ts         # Users, Settings
    ├── metrics.repository.ts      # Metrics, Logs
    └── platform.repository.ts     # Platform Services, Platform Resources

Import paths:

• Main: import { OneboxDatabase } from './database/index.ts'
• Legacy (deprecated): import { OneboxDatabase } from './classes/database.ts' (re-exports from new location)

API Compatibility:

• The OneboxDatabase class maintains the same public API
• All methods delegate to the appropriate repository
• No breaking changes for existing code

Current Migration Version: 8

Migration 8 converted certificate storage from file paths to PEM content.

Reverse Proxy SNI Support (November 2025)

The HTTPS reverse proxy now uses Node.js https.createServer() with SNI support:

• Uses Deno's Node.js compatibility layer for node:https module
• Implements server.addContext(hostname, {cert, key}) for per-domain certificates
• Dynamic certificate addition via addCertificate() without server restart
• HTTP-to-HTTPS redirect when certificate exists for domain
• Wildcard pattern support (e.g., *.bleu.de covers sub.bleu.de)

Key files:

• ts/classes/reverseproxy.ts - SNI-enabled HTTPS server
• ts/classes/services.ts - Dynamic route updates on service start/stop

Certificate workflow:

1. CertRequirementManager creates requirements for domains
2. Daemon processes requirements via certmanager.ts
3. Certificates stored in database (PEM content)
4. reverseProxy.addCertificate() dynamically adds SNI context
5. HTTP requests redirect to HTTPS when cert exists