itsi-server 0.2.26-aarch64-linux → 0.2.27-aarch64-linux

data/ext/itsi_server/src/services/itsi_http_service.rs

@@ -1,16 +1,17 @@
 use crate::default_responses::{NOT_FOUND_RESPONSE, TIMEOUT_RESPONSE};
 use crate::ruby_types::itsi_server::itsi_server_config::ItsiServerTokenPreference;
 use crate::server::http_message_types::{
-    ConversionExt, HttpRequest, HttpResponse, RequestExt, ResponseFormat,
+    ConversionExt, HttpBody, HttpRequest, HttpResponse, RequestExt, ResponseFormat,
 };
 use crate::server::lifecycle_event::LifecycleEvent;
 use crate::server::middleware_stack::MiddlewareLayer;
 use crate::server::serve_strategy::acceptor::AcceptorArgs;
 use crate::server::signal::{send_lifecycle_event, SHUTDOWN_REQUESTED};
+use bytes::Bytes;
 use chrono::{self, DateTime, Local};
 use either::Either;
 use http::header::ACCEPT_ENCODING;
-use http::{HeaderValue, Request};
+use http::{HeaderValue, Request, StatusCode};
 use hyper::body::Incoming;
 use regex::Regex;
 use smallvec::SmallVec;
@@ -174,6 +175,7 @@ impl HttpRequestContext {
 const SERVER_TOKEN_VERSION: HeaderValue =
     HeaderValue::from_static(concat!("Itsi/", env!("CARGO_PKG_VERSION")));
 const SERVER_TOKEN_NAME: HeaderValue = HeaderValue::from_static("Itsi");
+const TEXT_PLAIN_UTF8: HeaderValue = HeaderValue::from_static("text/plain; charset=utf-8");
 
 impl ItsiHttpService {
     pub async fn handle_request(&self, req: Request<Incoming>) -> itsi_error::Result<HttpResponse> {
@@ -188,14 +190,15 @@ impl ItsiHttpService {
         let token_preference = self.server_params.itsi_server_token_preference;
 
         let service_future = async move {
-            let middleware_stack = self
-                .server_params
-                .middleware
-                .get()
-                .unwrap()
-                .stack_for(&req)
-                .unwrap();
-            let (stack, matching_pattern) = middleware_stack;
+            if let Some(acme_response) = self.acme_http01_response(&req) {
+                return Ok(acme_response);
+            }
+
+            let Some((stack, matching_pattern)) =
+                self.server_params.middleware.get().unwrap().stack_for(&req)
+            else {
+                return Ok(NOT_FOUND_RESPONSE.to_http_response(accept).await);
+            };
             let mut resp: Option<HttpResponse> = None;
 
             let mut context =
@@ -267,4 +270,42 @@ impl ItsiHttpService {
             service_future.await
         }
     }
+
+    fn acme_http01_response(&self, req: &HttpRequest) -> Option<HttpResponse> {
+        let host = normalize_host_header(req.header("host")?)?;
+        let managers = self.server_params.acme_managers.read();
+        let key_authorization = managers
+            .iter()
+            .find_map(|(_, manager)| manager.http01_response(host, req.uri().path()))?;
+
+        let mut builder = http::Response::builder()
+            .status(StatusCode::OK)
+            .header(http::header::CONTENT_TYPE, TEXT_PLAIN_UTF8);
+
+        if req.method() == http::Method::HEAD {
+            builder = builder.header(http::header::CONTENT_LENGTH, "0");
+            return builder.body(HttpBody::empty()).ok();
+        }
+
+        builder
+            .header(
+                http::header::CONTENT_LENGTH,
+                key_authorization.len().to_string(),
+            )
+            .body(HttpBody::full(Bytes::from(key_authorization)))
+            .ok()
+    }
+}
+
+fn normalize_host_header(host: &str) -> Option<&str> {
+    let host = host.trim();
+    if host.is_empty() {
+        return None;
+    }
+
+    if let Some(stripped) = host.strip_prefix('[') {
+        return stripped.split(']').next();
+    }
+
+    Some(host.split(':').next().unwrap_or(host))
 }

data/lib/itsi/http_request.rb

@@ -145,6 +145,16 @@ module Itsi
       end
     end
 
+    def partial_hijack
+      UNIXSocket.pair.yield_self do |(server_sock, app_sock)|
+        server_sock.autoclose = false
+        response.partial_hijack(server_sock.fileno)
+        server_sock.sync = true
+        app_sock.sync = true
+        app_sock
+      end
+    end
+
     # Rack expects env["rack.hijack"] to respond to #call.
     def call
       hijack

data/lib/itsi/server/config/options/certificates.md

@@ -54,12 +54,40 @@ Let's Encrypt enforces strict rate limits on production certificate generation.
 {{< /callout >}}
 
 
-{{< callout type="warn" >}}
-Currently only the TLS-ALPN-01 challenge type is supported for automated certificates.
-The HTTP-01 challenge is not *yet* supported. This means that, for e.g. if your server is sitting behind a CDN or reverse proxy that performs HTTPS termination, you will not be able to rely on the *automated* certificate generation for fully automated, verified e2e encryption.
-
-Instead you may wish to use:
-* [Self-signed](#development--self-signed) certificates
-* [Manually](#existing-certificates) install certificates
-* Use HTTP between the CDN and the server
-{{< /callout >}}
+Itsi supports both ACME challenge types that matter for common deployments:
+
+* `TLS-ALPN-01` is used when the certificate authority can reach Itsi directly on the HTTPS listener.
+* `HTTP-01` can be used when you also expose a reachable HTTP listener for the same hostname. In real Let's Encrypt deployments this typically means port `80` must reach Itsi for `/.well-known/acme-challenge/*`.
+
+This means setups behind a CDN, WAF, or TLS-terminating proxy can still use automated certificates, provided plain HTTP validation traffic is forwarded to Itsi.
+
+E.g. a production configuration that allows HTTP-01 fallback might look like this:
+
+```ruby {filename=Itsi.rb}
+bind "http://0.0.0.0:80"
+bind "https://0.0.0.0:443?cert=acme&domains=example.com&acme_email=you@example.com"
+```
+
+## Dynamic Domain Registration
+You can add or remove ACME-managed domains while Itsi is already running.
+
+This is useful when hostnames are discovered dynamically by your Ruby application, or when you want to defer certificate issuance until a tenant, customer, or site is activated.
+
+Runtime APIs:
+
+* `Itsi::Server.tls_bindings`
+* `Itsi::Server.tls_domains(listener_id = nil)`
+* `Itsi::Server.tls_domain_statuses(listener_id = nil)`
+* `Itsi::Server.register_tls_domain(domain, listener_id = nil)`
+* `Itsi::Server.unregister_tls_domain(domain, listener_id = nil)`
+
+Example:
+
+```ruby
+Itsi::Server.register_tls_domain("customer-a.example.com")
+
+status = Itsi::Server.tls_domain_statuses.find { |entry| entry["domain"] == "customer-a.example.com" }
+puts status
+```
+
+When using dynamic issuance with HTTP-01, the same requirement still applies: the domain being issued must be able to reach an Itsi-managed HTTP listener for the ACME challenge path.

data/lib/itsi/server/config/options/fiber_scheduler.md

@@ -7,6 +7,8 @@ This allows Itsi to process a very large number of IO heavy requests concurrentl
 
 Enabling Fiber Scheduler mode can drastically improve application performance if you perform large amounts of blocking IO operations.
 
+Itsi's bundled scheduler is intended to be practical for real Ruby applications, not just toy socket examples. It integrates with the scheduler hooks used by modern Rubies for socket I/O, DNS lookups, sleeps and timeouts, and process waiting.
+
 
 ## Configuration File
 ```ruby {filename="Itsi.rb"}

data/lib/itsi/server/default_config/Itsi.rb

@@ -37,6 +37,10 @@ fiber_scheduler nil
 # bind "https://itsi.fyi?cert=acme&acme_email=admin@itsi.fyi"
 # You can generate certificates for multiple domains at once, by passing a comma-separated list of domains
 # bind "https://0.0.0.0?domains=foo.itsi.fyi,bar.itsi.fyi&cert=acme&acme_email=admin@itsi.fyi"
+# If HTTPS on 443 is not directly reachable, you can also expose an HTTP listener and
+# Let's Encrypt will be able to validate using HTTP-01 instead.
+# bind "http://0.0.0.0:80"
+# bind "https://0.0.0.0:443?domains=foo.itsi.fyi&cert=acme&acme_email=admin@itsi.fyi"
 #
 # If you already have a certificate you can specify it using the cert and key parameters
 # bind "https://itsi.fyi?cert=/path/to/cert.pem&key=/path/to/key.pem"

data/lib/itsi/server/rack_interface.rb

@@ -1,6 +1,45 @@
 module Itsi
   class Server
     module RackInterface
+      class PartialHijackStream
+        def initialize(response)
+          @response = response
+        end
+
+        def write(chunk)
+          @response.write(chunk.to_s)
+        end
+
+        def read(*)
+          nil
+        end
+
+        def <<(chunk)
+          write(chunk)
+          self
+        end
+
+        def flush
+          self
+        end
+
+        def close_write
+          @response.close_write
+        end
+
+        def close_read
+          true
+        end
+
+        def close
+          @response.close_write
+        end
+
+        def closed?
+          @response.closed?
+        end
+      end
+
       # Builds a handler proc that is compatible with Rack applications.
       def self.for(app)
         require "rack"
@@ -38,7 +77,8 @@ module Itsi
         response.status = status
 
         # 2. Set Headers
-        body_streamer = streaming_body?(body) ? body : headers.delete("rack.hijack")
+        hijack_callback = headers.delete("rack.hijack")
+        body_streamer = streaming_body?(body) ? body : hijack_callback
 
         response.reserve_headers(headers.size)
 
@@ -57,10 +97,14 @@ module Itsi
         # the server will begin to stream it to the client.
 
 
-        if body_streamer
+        if hijack_callback
+          stream = status == 101 ? request.partial_hijack : PartialHijackStream.new(response)
+          body_streamer.call(stream)
+        elsif body_streamer
           # If we're partially hijacked or returned a streaming body,
           # stream this response.
-          body_streamer.call(response)
+          stream = status == 101 ? request.partial_hijack : response
+          body_streamer.call(stream)
 
         elsif body.is_a?(Array)
           if body.length == 1

data/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.2.26"
+    VERSION = "0.2.27"
   end
 end

data/lib/itsi/server.rb

@@ -32,6 +32,30 @@ module Itsi
         @running && !@running.empty?
       end
 
+      def current_server
+        @running&.last || raise("No running Itsi::Server instance")
+      end
+
+      def tls_bindings
+        current_server.tls_bindings
+      end
+
+      def tls_domains(listener_id = nil)
+        current_server.tls_domains(listener_id)
+      end
+
+      def tls_domain_statuses(listener_id = nil)
+        current_server.tls_domain_statuses(listener_id)
+      end
+
+      def register_tls_domain(domain, listener_id = nil)
+        current_server.register_tls_domain(domain, listener_id)
+      end
+
+      def unregister_tls_domain(domain, listener_id = nil)
+        current_server.unregister_tls_domain(domain, listener_id)
+      end
+
       def start_in_background_thread(cli_params = {}, &blk)
         @background_threads ||= []
         server, background_thread = start(cli_params, background: true, &blk)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: itsi-server
 version: !ruby/object:Gem::Version
-  version: 0.2.26
+  version: 0.2.27
 platform: aarch64-linux
 authors:
 - Wouter Coppieters
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-05-13 00:00:00.000000000 Z
+date: 2026-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -109,6 +109,7 @@ files:
 - ext/itsi_acme/src/caches/no.rs
 - ext/itsi_acme/src/caches/test.rs
 - ext/itsi_acme/src/config.rs
+- ext/itsi_acme/src/http_challenge.rs
 - ext/itsi_acme/src/https_helper.rs
 - ext/itsi_acme/src/incoming.rs
 - ext/itsi_acme/src/jose.rs