itsi-server 0.1.1 → 0.1.13

data/ext/itsi_server/src/server/tls.rs

@@ -1,20 +1,115 @@
 use base64::{engine::general_purpose, Engine as _};
 use itsi_error::Result;
-use itsi_tracing::{info, warn};
-use rcgen::{CertificateParams, DnType, KeyPair, SanType};
+use itsi_tracing::info;
+use locked_dir_cache::LockedDirCache;
+use rcgen::{
+    generate_simple_self_signed, CertificateParams, CertifiedKey, DnType, KeyPair, SanType,
+};
+use rustls::{
+    pki_types::{CertificateDer, PrivateKeyDer},
+    ClientConfig, RootCertStore,
+};
 use rustls_pemfile::{certs, pkcs8_private_keys};
-use std::{collections::HashMap, fs, io::BufReader};
-use tokio_rustls::rustls::{Certificate, PrivateKey, ServerConfig};
-
-const ITS_CA_CERT: &str = include_str!("./itsi_ca/itsi_ca.crt");
-const ITS_CA_KEY: &str = include_str!("./itsi_ca/itsi_ca.key");
-
-// Generates a TLS configuration based on either :
-// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
-// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
-// If a non-local host or optional domain parameter is provided,
-// an automated certificate will attempt to be fetched using let's encrypt.
-pub fn configure_tls(host: &str, query_params: &HashMap<String, String>) -> Result<ServerConfig> {
+use std::{
+    collections::HashMap,
+    fs,
+    io::{BufReader, Error},
+    sync::Arc,
+};
+use tokio::sync::Mutex;
+use tokio_rustls::{rustls::ServerConfig, TlsAcceptor};
+use tokio_rustls_acme::{AcmeAcceptor, AcmeConfig, AcmeState};
+
+use crate::env::{
+    ITSI_ACME_CACHE_DIR, ITSI_ACME_CA_PEM_PATH, ITSI_ACME_CONTACT_EMAIL, ITSI_ACME_DIRECTORY_URL,
+    ITSI_LOCAL_CA_DIR,
+};
+mod locked_dir_cache;
+
+#[derive(Clone)]
+pub enum ItsiTlsAcceptor {
+    Manual(TlsAcceptor),
+    Automatic(
+        AcmeAcceptor,
+        Arc<Mutex<AcmeState<Error>>>,
+        Arc<ServerConfig>,
+    ),
+}
+
+/// Generates a TLS configuration based on either :
+/// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
+/// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
+///
+/// If a non-local host or optional domain parameter is provided,
+/// an automated certificate will attempt to be fetched using let's encrypt.
+pub fn configure_tls(
+    host: &str,
+    query_params: &HashMap<String, String>,
+) -> Result<ItsiTlsAcceptor> {
+    let domains = query_params
+        .get("domains")
+        .map(|v| v.split(',').map(String::from).collect::<Vec<_>>())
+        .or_else(|| query_params.get("domain").map(|v| vec![v.to_string()]));
+
+    if query_params.get("cert").is_some_and(|c| c == "acme") {
+        if let Some(domains) = domains {
+            let directory_url = &*ITSI_ACME_DIRECTORY_URL;
+            info!(
+                domains = format!("{:?}", domains),
+                directory_url, "Requesting acme cert"
+            );
+            let acme_contact_email = query_params
+                .get("acme_email")
+                .map(|s| s.to_string())
+                .or_else(|| (*ITSI_ACME_CONTACT_EMAIL).as_ref().ok().map(|s| s.to_string()))
+                .ok_or_else(|| itsi_error::ItsiError::ArgumentError(
+                    "acme_email query param or ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate let's encrypt certificates".to_string(),
+                ))?;
+
+            let acme_config = AcmeConfig::new(domains)
+                .contact([format!("mailto:{}", acme_contact_email)])
+                .cache(LockedDirCache::new(&*ITSI_ACME_CACHE_DIR))
+                .directory(directory_url);
+
+            let acme_state = if let Ok(ca_pem_path) = &*ITSI_ACME_CA_PEM_PATH {
+                let mut root_cert_store = RootCertStore::empty();
+
+                let ca_pem = fs::read(ca_pem_path).expect("failed to read CA pem file");
+                let mut ca_reader = BufReader::new(&ca_pem[..]);
+                let der_certs: Vec<CertificateDer> = certs(&mut ca_reader)
+                    .collect::<std::result::Result<Vec<CertificateDer>, _>>()
+                    .map_err(|e| {
+                        itsi_error::ItsiError::ArgumentError(format!(
+                            "Invalid ACME CA Pem path {:?}",
+                            e
+                        ))
+                    })?;
+                root_cert_store.add_parsable_certificates(der_certs);
+
+                let client_config = ClientConfig::builder()
+                    .with_root_certificates(root_cert_store)
+                    .with_no_client_auth();
+                acme_config
+                    .client_tls_config(Arc::new(client_config))
+                    .state()
+            } else {
+                acme_config.state()
+            };
+
+            let mut rustls_config = ServerConfig::builder()
+                .with_no_client_auth()
+                .with_cert_resolver(acme_state.resolver());
+
+            rustls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+
+            let acceptor = acme_state.acceptor();
+            return Ok(ItsiTlsAcceptor::Automatic(
+                acceptor,
+                Arc::new(Mutex::new(acme_state)),
+                Arc::new(rustls_config),
+            ));
+        }
+    }
     let (certs, key) = if let (Some(cert_path), Some(key_path)) =
         (query_params.get("cert"), query_params.get("key"))
     {
@@ -22,41 +117,20 @@ pub fn configure_tls(host: &str, query_params: &HashMap<String, String>) -> Resu
         let certs = load_certs(cert_path);
         let key = load_private_key(key_path);
         (certs, key)
-    } else if query_params
-        .get("cert")
-        .map(|v| v == "auto")
-        .unwrap_or(false)
-    {
-        let domain_param = query_params.get("domain");
-        let host_string = host.to_string();
-        let domain = domain_param.or_else(|| {
-            if host_string != "localhost" {
-                Some(&host_string)
-            } else {
-                None
-            }
-        });
-
-        if let Some(domain) = domain {
-            retrieve_acme_cert(domain)?
-        } else {
-            generate_ca_signed_cert(host)?
-        }
     } else {
-        generate_ca_signed_cert(host)?
+        generate_ca_signed_cert(domains.unwrap_or(vec![host.to_owned()]))?
     };
 
     let mut config = ServerConfig::builder()
-        .with_safe_defaults()
         .with_no_client_auth()
         .with_single_cert(certs, key)
         .expect("Failed to build TLS config");
 
     config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-    Ok(config)
+    Ok(ItsiTlsAcceptor::Manual(TlsAcceptor::from(Arc::new(config))))
 }
 
-pub fn load_certs(path: &str) -> Vec<Certificate> {
+pub fn load_certs(path: &str) -> Vec<CertificateDer<'static>> {
     let data = if let Some(stripped) = path.strip_prefix("base64:") {
         general_purpose::STANDARD
             .decode(stripped)
@@ -74,14 +148,20 @@ pub fn load_certs(path: &str) -> Vec<Certificate> {
             })
             .collect::<Result<_>>()
             .expect("Failed to parse certificate file");
-        certs_der.into_iter().map(Certificate).collect()
+        certs_der
+            .into_iter()
+            .map(|vec| {
+                // Convert the owned Vec<u8> into a CertificateDer and force 'static.
+                unsafe { std::mem::transmute(CertificateDer::from(vec)) }
+            })
+            .collect()
     } else {
-        vec![Certificate(data)]
+        vec![CertificateDer::from(data)]
     }
 }
 
 /// Loads a private key from a file or Base64.
-pub fn load_private_key(path: &str) -> PrivateKey {
+pub fn load_private_key(path: &str) -> PrivateKeyDer<'static> {
     let key_data = if let Some(stripped) = path.strip_prefix("base64:") {
         general_purpose::STANDARD
             .decode(stripped)
@@ -100,39 +180,86 @@ pub fn load_private_key(path: &str) -> PrivateKey {
             .collect::<Result<_>>()
             .expect("Failed to parse private key");
         if !keys.is_empty() {
-            return PrivateKey(keys[0].clone());
+            return PrivateKeyDer::try_from(keys[0].clone()).unwrap();
         }
     }
-    PrivateKey(key_data)
+    PrivateKeyDer::try_from(key_data).unwrap()
 }
 
-pub fn generate_ca_signed_cert(domain: &str) -> Result<(Vec<Certificate>, PrivateKey)> {
-    info!("Generating New Itsi CA - Self signed Certificate. Use `itsi ca export` to export the CA certificate for import into your local trust store.");
+pub fn generate_ca_signed_cert(
+    domains: Vec<String>,
+) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
+    info!(
+        domains = format!("{}", domains.join(", ")),
+        "Self signed cert",
+    );
+    info!(
+        "Add {} to your system's trusted cert store to resolve certificate errors.",
+        format!("{}/itsi_dev_ca.crt", ITSI_LOCAL_CA_DIR.to_str().unwrap())
+    );
+    info!("Dev CA path can be overridden by setting env var: `ITSI_LOCAL_CA_DIR`.");
+    let (ca_key_pem, ca_cert_pem) = get_or_create_local_dev_ca()?;
 
-    let ca_kp = KeyPair::from_pem(ITS_CA_KEY).unwrap();
-    let params = CertificateParams::from_ca_cert_pem(ITS_CA_CERT).unwrap();
+    let ca_kp = KeyPair::from_pem(&ca_key_pem).expect("Failed to load CA key");
+    let ca_cert = CertificateParams::from_ca_cert_pem(&ca_cert_pem)
+        .expect("Failed to parse embedded CA certificate")
+        .self_signed(&ca_kp)
+        .expect("Failed to self-sign embedded CA cert");
 
-    let ca_cert = params.self_signed(&ca_kp).unwrap();
-    let ee_key = KeyPair::generate().unwrap();
+    let ee_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
     let mut ee_params = CertificateParams::default();
 
-    // Set the domain in the subject alternative names (SAN)
-    ee_params.subject_alt_names = vec![SanType::DnsName(domain.try_into()?)];
-    // Optionally, set the Common Name (CN) in the distinguished name:
+    use std::net::IpAddr;
+
+    ee_params.subject_alt_names = domains
+        .iter()
+        .map(|domain| {
+            if let Ok(ip) = domain.parse::<IpAddr>() {
+                SanType::IpAddress(ip)
+            } else {
+                SanType::DnsName(domain.clone().try_into().unwrap())
+            }
+        })
+        .collect();
+
     ee_params
         .distinguished_name
-        .push(DnType::CommonName, domain);
+        .push(DnType::CommonName, domains[0].clone());
 
     ee_params.use_authority_key_identifier_extension = true;
 
-    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ee_key).unwrap();
+    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ca_kp).unwrap();
     let ee_cert_der = ee_cert.der().to_vec();
-    let ee_cert = Certificate(ee_cert_der);
-    Ok((vec![ee_cert], PrivateKey(ee_key.serialize_der())))
+    let ee_cert = CertificateDer::from(ee_cert_der);
+    let ca_cert = CertificateDer::from(ca_cert.der().to_vec());
+    Ok((
+        vec![ee_cert, ca_cert],
+        PrivateKeyDer::try_from(ee_key.serialize_der()).unwrap(),
+    ))
 }
 
-/// Retrieves an ACME certificate for a given domain.
-pub fn retrieve_acme_cert(domain: &str) -> Result<(Vec<Certificate>, PrivateKey)> {
-    warn!("Retrieving ACME cert for {}", domain);
-    generate_ca_signed_cert(domain)
+fn get_or_create_local_dev_ca() -> Result<(String, String)> {
+    let ca_dir = &*ITSI_LOCAL_CA_DIR;
+    fs::create_dir_all(ca_dir)?;
+
+    let key_path = ca_dir.join("itsi_dev_ca.key");
+    let cert_path = ca_dir.join("itsi_dev_ca.crt");
+
+    if key_path.exists() && cert_path.exists() {
+        // Already have a local CA
+        let key_pem = fs::read_to_string(&key_path)?;
+        let cert_pem = fs::read_to_string(&cert_path)?;
+
+        Ok((key_pem, cert_pem))
+    } else {
+        let subject_alt_names = vec!["dev.itsi.fyi".to_string(), "localhost".to_string()];
+
+        let CertifiedKey { cert, key_pair } =
+            generate_simple_self_signed(subject_alt_names).unwrap();
+
+        fs::write(&key_path, key_pair.serialize_pem())?;
+        fs::write(&cert_path, cert.pem())?;
+
+        Ok((key_pair.serialize_pem(), cert.pem()))
+    }
 }

data/ext/itsi_server/src/server/types.rs

@@ -0,0 +1,43 @@
+use std::convert::Infallible;
+
+use bytes::Bytes;
+use http::{Request, Response};
+use http_body_util::combinators::BoxBody;
+use hyper::body::Incoming;
+
+pub type HttpResponse = Response<BoxBody<Bytes, Infallible>>;
+pub type HttpRequest = Request<Incoming>;
+
+pub trait RequestExt {
+    fn content_type(&self) -> Option<&str>;
+    fn accept(&self) -> Option<&str>;
+    fn header(&self, header_name: &str) -> Option<&str>;
+    fn query_param(&self, query_name: &str) -> Option<&str>;
+}
+
+impl RequestExt for HttpRequest {
+    fn content_type(&self) -> Option<&str> {
+        self.headers()
+            .get("content-type")
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn accept(&self) -> Option<&str> {
+        self.headers()
+            .get("accept")
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn header(&self, header_name: &str) -> Option<&str> {
+        self.headers()
+            .get(header_name)
+            .map(|hv| hv.to_str().unwrap_or(""))
+    }
+
+    fn query_param(&self, query_name: &str) -> Option<&str> {
+        self.uri()
+            .query()
+            .and_then(|query| query.split('&').find(|param| param.starts_with(query_name)))
+            .map(|param| param.split('=').nth(1).unwrap_or(""))
+    }
+}

data/ext/itsi_tracing/Cargo.toml

@@ -9,4 +9,9 @@ tracing-subscriber = { version = "0.3.19", features = [
   "env-filter",
   "std",
   "fmt",
+  "json",
+  "ansi",
 ] }
+tracing-attributes = "0.1"
+atty = "0.2.14"
+tracing-appender = "0.2.3"

data/ext/itsi_tracing/src/lib.rs

@@ -1,11 +1,229 @@
+use atty::{Stream, is};
+use std::{
+    env,
+    sync::{Mutex, OnceLock},
+};
 pub use tracing::{debug, error, info, trace, warn};
-use tracing_subscriber::{EnvFilter, fmt};
+use tracing_appender::rolling;
+use tracing_subscriber::Layer;
+use tracing_subscriber::fmt::writer::BoxMakeWriter;
+use tracing_subscriber::{EnvFilter, fmt, prelude::*, reload};
 
+// Global reload handle for changing the level at runtime.
+static RELOAD_HANDLE: OnceLock<
+    Mutex<Option<reload::Handle<EnvFilter, tracing_subscriber::Registry>>>,
+> = OnceLock::new();
+
+/// Log format: Plain or JSON.
+#[derive(Debug, Clone)]
+pub enum LogFormat {
+    Plain,
+    Json,
+}
+
+/// Log target: STDOUT, File, or Both.
+#[derive(Debug, Clone)]
+pub enum LogTarget {
+    Stdout,
+    File(String), // file name (rotated daily)
+    Both(String), // file name (rotated daily) plus STDOUT
+}
+
+/// Logger configuration.
+#[derive(Debug, Clone)]
+pub struct LogConfig {
+    /// Log level as a string (e.g. "info", "debug").
+    pub level: String,
+    /// Format: Plain (with optional ANSI) or JSON.
+    pub format: LogFormat,
+    /// Target: STDOUT, File, or Both.
+    pub target: LogTarget,
+    /// Whether to enable ANSI coloring (for plain text).
+    pub use_ansi: bool,
+}
+
+impl Default for LogConfig {
+    fn default() -> Self {
+        let level = env::var("ITSI_LOG").unwrap_or_else(|_| "info".into());
+        let format = match env::var("ITSI_LOG_FORMAT").as_deref() {
+            Ok("json") => LogFormat::Json,
+            _ => LogFormat::Plain,
+        };
+        let target = match env::var("ITSI_LOG_TARGET").as_deref() {
+            Ok("file") => {
+                let file = env::var("ITSI_LOG_FILE").unwrap_or_else(|_| "app.log".into());
+                LogTarget::File(file)
+            }
+            Ok("both") => {
+                let file = env::var("ITSI_LOG_FILE").unwrap_or_else(|_| "app.log".into());
+                LogTarget::Both(file)
+            }
+            _ => LogTarget::Stdout,
+        };
+        // If ITSI_LOG_ANSI is set, use that; otherwise, use ANSI if stdout is a TTY.
+        let use_ansi = env::var("ITSI_LOG_ANSI")
+            .map(|s| s == "true")
+            .unwrap_or_else(|_| is(Stream::Stdout));
+        Self {
+            level,
+            format,
+            target,
+            use_ansi,
+        }
+    }
+}
+
+/// Initialize the global tracing subscriber with the default configuration.
 pub fn init() {
-    let env_filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("info"));
-    let format = fmt::format().with_level(true).with_target(false).compact();
-    tracing_subscriber::fmt()
-        .with_env_filter(env_filter)
-        .event_format(format)
-        .init();
+    init_with_config(LogConfig::default());
+}
+
+/// Initialize the global tracing subscriber with a given configuration.
+pub fn init_with_config(config: LogConfig) {
+    // Build an EnvFilter from the configured level.
+    let env_filter = EnvFilter::new(config.level);
+
+    // Build the formatting layer based on target and format.
+    let fmt_layer = match config.target {
+        LogTarget::Stdout => match config.format {
+            LogFormat::Plain => fmt::layer()
+                .compact()
+                .with_file(false)
+                .with_line_number(false)
+                .with_target(false)
+                .with_thread_ids(false)
+                .with_writer(BoxMakeWriter::new(std::io::stdout))
+                .with_ansi(config.use_ansi)
+                .boxed(),
+            LogFormat::Json => fmt::layer()
+                .compact()
+                .with_file(false)
+                .with_line_number(false)
+                .with_target(false)
+                .with_thread_ids(false)
+                .with_writer(BoxMakeWriter::new(std::io::stdout))
+                .with_ansi(config.use_ansi)
+                .json()
+                .boxed(),
+        },
+        LogTarget::File(file) => match config.format {
+            LogFormat::Plain => fmt::layer()
+                .compact()
+                .with_file(false)
+                .with_line_number(false)
+                .with_target(false)
+                .with_thread_ids(false)
+                .with_writer(BoxMakeWriter::new({
+                    let file = file.clone();
+                    move || rolling::daily(".", file.clone())
+                }))
+                .with_ansi(false)
+                .boxed(),
+            LogFormat::Json => fmt::layer()
+                .compact()
+                .with_file(false)
+                .with_line_number(false)
+                .with_target(false)
+                .with_thread_ids(false)
+                .with_writer(BoxMakeWriter::new({
+                    let file = file.clone();
+                    move || rolling::daily(".", file.clone())
+                }))
+                .with_ansi(false)
+                .json()
+                .boxed(),
+        },
+        LogTarget::Both(file) => {
+            // For "Both" target, handle each format separately to avoid type mismatches
+            match config.format {
+                LogFormat::Plain => {
+                    let stdout_layer = fmt::layer()
+                        .compact()
+                        .with_file(false)
+                        .with_line_number(false)
+                        .with_target(false)
+                        .with_thread_ids(false)
+                        .with_writer(BoxMakeWriter::new(std::io::stdout))
+                        .with_ansi(config.use_ansi);
+
+                    let file_layer = fmt::layer()
+                        .compact()
+                        .with_file(false)
+                        .with_line_number(false)
+                        .with_target(false)
+                        .with_thread_ids(false)
+                        .with_writer(BoxMakeWriter::new({
+                            let file = file.clone();
+                            move || rolling::daily(".", file.clone())
+                        }))
+                        .with_ansi(false);
+
+                    stdout_layer.and_then(file_layer).boxed()
+                }
+                LogFormat::Json => {
+                    let stdout_layer = fmt::layer()
+                        .compact()
+                        .with_file(false)
+                        .with_line_number(false)
+                        .with_target(false)
+                        .with_thread_ids(false)
+                        .with_writer(BoxMakeWriter::new(std::io::stdout))
+                        .with_ansi(config.use_ansi)
+                        .json();
+
+                    let file_layer = fmt::layer()
+                        .compact()
+                        .with_file(false)
+                        .with_line_number(false)
+                        .with_target(false)
+                        .with_thread_ids(false)
+                        .with_writer(BoxMakeWriter::new({
+                            let file = file.clone();
+                            move || rolling::daily(".", file.clone())
+                        }))
+                        .with_ansi(false)
+                        .json();
+
+                    stdout_layer.and_then(file_layer).boxed()
+                }
+            }
+        }
+    };
+
+    // Create a reloadable filter layer so we can update the level at runtime.
+    let (filter_layer, handle) = reload::Layer::new(env_filter);
+
+    // Build the subscriber registry
+    let subscriber = tracing_subscriber::registry()
+        .with(filter_layer)
+        .with(fmt_layer);
+
+    tracing::subscriber::set_global_default(subscriber)
+        .expect("Unable to set global tracing subscriber");
+
+    RELOAD_HANDLE.set(Mutex::new(Some(handle))).unwrap();
+}
+
+/// Change the log level at runtime.
+pub fn set_level(new_level: &str) {
+    if let Some(handle) = RELOAD_HANDLE.get().unwrap().lock().unwrap().as_ref() {
+        handle
+            .modify(|filter| *filter = EnvFilter::new(new_level))
+            .expect("Failed to update log level");
+    } else {
+        eprintln!("Reload handle not initialized; call init() first.");
+    }
+}
+
+/// Run a function silently by temporarily setting a no-op subscriber.
+pub fn run_silently<F, R>(f: F) -> R
+where
+    F: FnOnce() -> R,
+{
+    let no_op_subscriber = tracing_subscriber::fmt()
+        .with_writer(std::io::sink)
+        .with_max_level(tracing_subscriber::filter::LevelFilter::OFF)
+        .finish();
+    let dispatch = tracing::Dispatch::new(no_op_subscriber);
+    tracing::dispatcher::with_default(&dispatch, f)
 }