itsi 0.1.6 → 0.1.8

data/gems/server/ext/itsi_server/src/server/tls.rs

@@ -2,7 +2,9 @@ use base64::{engine::general_purpose, Engine as _};
 use itsi_error::Result;
 use itsi_tracing::info;
 use locked_dir_cache::LockedDirCache;
-use rcgen::{CertificateParams, DnType, KeyPair, SanType};
+use rcgen::{
+    generate_simple_self_signed, CertificateParams, CertifiedKey, DnType, KeyPair, SanType,
+};
 use rustls::{
     pki_types::{CertificateDer, PrivateKeyDer},
     ClientConfig, RootCertStore,
@@ -10,16 +12,19 @@ use rustls::{
 use rustls_pemfile::{certs, pkcs8_private_keys};
 use std::{
     collections::HashMap,
-    env, fs,
+    fs,
     io::{BufReader, Error},
     sync::Arc,
 };
 use tokio::sync::Mutex;
 use tokio_rustls::{rustls::ServerConfig, TlsAcceptor};
 use tokio_rustls_acme::{AcmeAcceptor, AcmeConfig, AcmeState};
+
+use crate::env::{
+    ITSI_ACME_CACHE_DIR, ITSI_ACME_CA_PEM_PATH, ITSI_ACME_CONTACT_EMAIL, ITSI_ACME_DIRECTORY_URL,
+    ITSI_LOCAL_CA_DIR,
+};
 mod locked_dir_cache;
-const ITS_CA_CERT: &str = include_str!("./itsi_ca/itsi_ca.crt");
-const ITS_CA_KEY: &str = include_str!("./itsi_ca/itsi_ca.key");
 
 #[derive(Clone)]
 pub enum ItsiTlsAcceptor {
@@ -31,11 +36,12 @@ pub enum ItsiTlsAcceptor {
     ),
 }
 
-// Generates a TLS configuration based on either :
-// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
-// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
-// If a non-local host or optional domain parameter is provided,
-// an automated certificate will attempt to be fetched using let's encrypt.
+/// Generates a TLS configuration based on either :
+/// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
+/// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
+///
+/// If a non-local host or optional domain parameter is provided,
+/// an automated certificate will attempt to be fetched using let's encrypt.
 pub fn configure_tls(
     host: &str,
     query_params: &HashMap<String, String>,
@@ -44,17 +50,27 @@ pub fn configure_tls(
         .get("domains")
         .map(|v| v.split(',').map(String::from).collect::<Vec<_>>());
 
-    if query_params.get("cert").is_none() || query_params.get("key").is_none() {
+    if query_params.get("cert").is_some_and(|c| c == "auto") {
         if let Some(domains) = domains {
-            let directory_url = env::var("ACME_DIRECTORY_URL")
-                .unwrap_or_else(|_| "https://acme-v02.api.letsencrypt.org/directory".to_string());
+            let directory_url = &*ITSI_ACME_DIRECTORY_URL;
             info!(
                 domains = format!("{:?}", domains),
                 directory_url, "Requesting acme cert"
             );
 
-            let mut root_cert_store = RootCertStore::empty();
-            if let Ok(ca_pem_path) = env::var("ITSI_ACME_CA_PEM_PATH") {
+            let acme_config = AcmeConfig::new(domains)
+                .contact([format!("mailto:{}", (*ITSI_ACME_CONTACT_EMAIL).as_ref().map_err(|_| {
+                    itsi_error::ItsiError::ArgumentError(
+                      "ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate production certificates"
+                          .to_string(),
+                  )
+                })?)])
+                .cache(LockedDirCache::new(&*ITSI_ACME_CACHE_DIR))
+                .directory(directory_url);
+
+            let acme_state = if let Ok(ca_pem_path) = &*ITSI_ACME_CA_PEM_PATH {
+                let mut root_cert_store = RootCertStore::empty();
+
                 let ca_pem = fs::read(ca_pem_path).expect("failed to read CA pem file");
                 let mut ca_reader = BufReader::new(&ca_pem[..]);
                 let der_certs: Vec<CertificateDer> = certs(&mut ca_reader)
@@ -66,31 +82,23 @@ pub fn configure_tls(
                         ))
                     })?;
                 root_cert_store.add_parsable_certificates(der_certs);
-            }
 
-            let client_config = ClientConfig::builder()
-                .with_root_certificates(root_cert_store)
-                .with_no_client_auth();
-
-            let contact_email = env::var("ITSI_ACME_CONTACT_EMAIL").map_err(|_| {
-                itsi_error::ItsiError::ArgumentError(
-                    "ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate production certificates"
-                        .to_string(),
-                )
-            })?;
-
-            let cache_dir = env::var("ITSI_ACME_CACHE_DIR")
-                .unwrap_or_else(|_| "./.rustls_acme_cache".to_string());
-
-            let acme_state = AcmeConfig::new(domains)
-                .contact([format!("mailto:{}", contact_email)])
-                .cache(LockedDirCache::new(cache_dir))
-                .directory(directory_url)
-                .client_tls_config(Arc::new(client_config))
-                .state();
-            let rustls_config = ServerConfig::builder()
+                let client_config = ClientConfig::builder()
+                    .with_root_certificates(root_cert_store)
+                    .with_no_client_auth();
+                acme_config
+                    .client_tls_config(Arc::new(client_config))
+                    .state()
+            } else {
+                acme_config.state()
+            };
+
+            let mut rustls_config = ServerConfig::builder()
                 .with_no_client_auth()
                 .with_cert_resolver(acme_state.resolver());
+
+            rustls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+
             let acceptor = acme_state.acceptor();
             return Ok(ItsiTlsAcceptor::Automatic(
                 acceptor,
@@ -107,7 +115,7 @@ pub fn configure_tls(
         let key = load_private_key(key_path);
         (certs, key)
     } else {
-        generate_ca_signed_cert(vec![host.to_owned()])?
+        generate_ca_signed_cert(domains.unwrap_or(vec![host.to_owned()]))?
     };
 
     let mut config = ServerConfig::builder()
@@ -178,10 +186,19 @@ pub fn load_private_key(path: &str) -> PrivateKeyDer<'static> {
 pub fn generate_ca_signed_cert(
     domains: Vec<String>,
 ) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
-    info!("Generating New Itsi CA - Self signed Certificate. Use `itsi ca export` to export the CA certificate for import into your local trust store.");
+    info!(
+        domains = format!("{}", domains.join(", ")),
+        "Self signed cert",
+    );
+    info!(
+        "Add {} to your system's trusted cert store to resolve certificate errors.",
+        format!("{}/itsi_dev_ca.crt", ITSI_LOCAL_CA_DIR.to_str().unwrap())
+    );
+    info!("Dev CA path can be overridden by setting env var: `ITSI_LOCAL_CA_DIR`.");
+    let (ca_key_pem, ca_cert_pem) = get_or_create_local_dev_ca()?;
 
-    let ca_kp = KeyPair::from_pem(ITS_CA_KEY).expect("Failed to load embedded CA key");
-    let ca_cert = CertificateParams::from_ca_cert_pem(ITS_CA_CERT)
+    let ca_kp = KeyPair::from_pem(&ca_key_pem).expect("Failed to load CA key");
+    let ca_cert = CertificateParams::from_ca_cert_pem(&ca_cert_pem)
         .expect("Failed to parse embedded CA certificate")
         .self_signed(&ca_kp)
         .expect("Failed to self-sign embedded CA cert");
@@ -189,10 +206,6 @@ pub fn generate_ca_signed_cert(
     let ee_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
     let mut ee_params = CertificateParams::default();
 
-    info!(
-        "Generated certificate will be valid for domains {:?}",
-        domains
-    );
     use std::net::IpAddr;
 
     ee_params.subject_alt_names = domains
@@ -221,3 +234,29 @@ pub fn generate_ca_signed_cert(
         PrivateKeyDer::try_from(ee_key.serialize_der()).unwrap(),
     ))
 }
+
+fn get_or_create_local_dev_ca() -> Result<(String, String)> {
+    let ca_dir = &*ITSI_LOCAL_CA_DIR;
+    fs::create_dir_all(ca_dir)?;
+
+    let key_path = ca_dir.join("itsi_dev_ca.key");
+    let cert_path = ca_dir.join("itsi_dev_ca.crt");
+
+    if key_path.exists() && cert_path.exists() {
+        // Already have a local CA
+        let key_pem = fs::read_to_string(&key_path)?;
+        let cert_pem = fs::read_to_string(&cert_path)?;
+
+        Ok((key_pem, cert_pem))
+    } else {
+        let subject_alt_names = vec!["dev.itsi.fyi".to_string(), "localhost".to_string()];
+
+        let CertifiedKey { cert, key_pair } =
+            generate_simple_self_signed(subject_alt_names).unwrap();
+
+        fs::write(&key_path, key_pair.serialize_pem())?;
+        fs::write(&cert_path, cert.pem())?;
+
+        Ok((key_pair.serialize_pem(), cert.pem()))
+    }
+}

data/gems/server/lib/itsi/index.html.erb

@@ -0,0 +1,91 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <title>Itsi - Default</title>
+  <style>
+    * {
+      box-sizing: border-box;
+      margin: 0;
+      padding: 0;
+    }
+    body {
+      font-family: "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      background-color: #f4f4f4;
+      color: #333;
+      line-height: 1.6;
+    }
+    .container {
+      max-width: 700px;
+      margin: 3rem auto;
+      background: #fff;
+      border-radius: 8px;
+      box-shadow: 0 2px 6px rgba(0, 0, 0, 0.1);
+      padding: 2rem;
+    }
+    h1 {
+      font-size: 1.8rem;
+      margin-bottom: 1rem;
+      text-align: center;
+      color: #444;
+    }
+    p {
+      margin-bottom: 1rem;
+      text-align: center;
+      color: #666;
+    }
+    ul.fields {
+      list-style: none;
+      margin-top: 1.5rem;
+      padding: 0;
+    }
+    ul.fields li {
+      background: #fafafa;
+      border: 1px solid #eee;
+      border-radius: 5px;
+      padding: 0.75rem;
+      margin-bottom: 0.75rem;
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+    }
+    .label {
+      font-weight: bold;
+      margin-right: 1rem;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>You're running on Itsi!</h1>
+    <p>RACK environment:</p>
+
+    <ul class="fields">
+      <li>
+        <span class="label">REQUEST_METHOD:</span>
+        <span>%{REQUEST_METHOD}</span>
+      </li>
+      <li>
+        <span class="label">PATH_INFO:</span>
+        <span>%{PATH_INFO}</span>
+      </li>
+      <li>
+        <span class="label">SERVER_NAME:</span>
+        <span>%{SERVER_NAME}</span>
+      </li>
+      <li>
+        <span class="label">SERVER_PORT:</span>
+        <span>%{SERVER_PORT}</span>
+      </li>
+      <li>
+        <span class="label">REMOTE_ADDR:</span>
+        <span>%{REMOTE_ADDR}</span>
+      </li>
+      <li>
+        <span class="label">HTTP_USER_AGENT:</span>
+        <span>%{HTTP_USER_AGENT}</span>
+      </li>
+    </ul>
+  </div>
+</body>
+</html>

data/gems/server/lib/itsi/server/scheduler_mode.rb

@@ -1,6 +1,6 @@
 if defined?(ActiveSupport::IsolatedExecutionState) && !ENV["ITSI_DISABLE_AS_AUTO_FIBER_ISOLATION_LEVEL"]
   Itsi.log_info \
     "ActiveSupport Isolated Execution state detected. Automatically switching to :fiber mode. "\
-    "Use ENV['ITSI_DISABLE_AS_AUTO_FIBER_ISOLATION_LEVEL'] to disable this behavior"
+    "Set ITSI_DISABLE_AS_AUTO_FIBER_ISOLATION_LEVEL to disable this behavior"
   ActiveSupport::IsolatedExecutionState.isolation_level = :fiber
 end

data/gems/server/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.1.6"
+    VERSION = "0.1.8"
   end
 end

data/gems/server/lib/itsi/server.rb

@@ -6,6 +6,9 @@ require_relative "signals"
 require_relative "request"
 require_relative "stream_io"
 require_relative "server/rack/handler/itsi"
+require 'erb'
+
+DEFAULT_INDEX = IO.read(__dir__ + '/index.html.erb')
 
 module Itsi
   class Server
@@ -14,8 +17,25 @@ module Itsi
       @running ||= false
     end
 
-    def self.start(app:, **opts)
-      server = new(app: ->{app}, **opts)
+    def self.start(
+      app: ->(env){
+        [env['CONTENT_TYPE'], env['HTTP_ACCEPT']].include?('application/json') ?
+          [200, {"Content-Type" => "application/json"}, ["{\"message\": \"You're running on Itsi!\"}"]] :
+          [200, {"Content-Type" => "text/html"}, [
+            DEFAULT_INDEX % {
+              REQUEST_METHOD: env['REQUEST_METHOD'],
+              PATH_INFO: env['PATH_INFO'],
+              SERVER_NAME: env['SERVER_NAME'],
+              SERVER_PORT: env['SERVER_PORT'],
+              REMOTE_ADDR: env['REMOTE_ADDR'],
+              HTTP_USER_AGENT: env['HTTP_USER_AGENT']
+            }
+          ]]
+      },
+      binds: ['http://0.0.0.0:3000'],
+      **opts
+    )
+      server = new(app: ->{app}, binds: binds, **opts)
       @running = true
       Signal.trap('INT', 'DEFAULT')
       server.start

data/lib/itsi/version.rb

@@ -1,3 +1,3 @@
 module Itsi
-  VERSION = "0.1.6"
+  VERSION = "0.1.8"
 end

data/sandbox/deploy/main.tf

@@ -0,0 +1,237 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 5.0.0"
+    }
+  }
+
+  required_version = ">= 0.14.9"
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+
+data "aws_region" "current" {
+  name = var.aws_region
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd-gp3/*ubuntu-noble-24.04-arm64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+# Create VPC
+# terraform aws create vpc
+resource "aws_vpc" "vpc" {
+  cidr_block           = "10.0.0.0/16"
+  instance_tenancy     = "default"
+  enable_dns_hostnames = true
+  tags = {
+    Name = "${var.environment}-vpc"
+  }
+}
+resource "aws_subnet" "public_subnet_a" {
+  vpc_id                  = aws_vpc.vpc.id
+  cidr_block              = "10.0.1.0/24"
+  availability_zone       = var.subnet_az
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name = "${var.environment} Public Subnet A"
+  }
+}
+
+resource "aws_subnet" "private_subnet_a" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.2.0/24"
+  availability_zone = var.subnet_az
+
+  tags = {
+    Name = "${var.environment} Private Subnet A"
+  }
+}
+
+resource "aws_internet_gateway" "ig_a" {
+  vpc_id = aws_vpc.vpc.id
+
+  tags = {
+    Name = "${var.environment} Internet Gateway A"
+  }
+}
+
+resource "aws_route_table" "public_rt" {
+  vpc_id = aws_vpc.vpc.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.ig_a.id
+  }
+
+  route {
+    ipv6_cidr_block = "::/0"
+    gateway_id      = aws_internet_gateway.ig_a.id
+  }
+
+  tags = {
+    Name = "${var.environment} Public Route Table"
+  }
+}
+
+resource "aws_route_table_association" "public_1_rt_a" {
+  subnet_id      = aws_subnet.public_subnet_a.id
+  route_table_id = aws_route_table.public_rt.id
+}
+
+resource "aws_security_group" "web_sg" {
+  name   = "HTTP and SSH"
+  vpc_id = aws_vpc.vpc.id
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = "${var.environment} Web Security Group"
+  }
+}
+
+
+resource "aws_instance" "web" {
+  ami                  = data.aws_ami.ubuntu.id
+  instance_type        = "t4g.micro"
+  key_name             = "key-pair-aws-admin"
+  iam_instance_profile = aws_iam_instance_profile.web.name
+
+  tags = {
+    Name = "web-${var.environment}"
+  }
+
+  subnet_id                   = aws_subnet.public_subnet_a.id
+  security_groups             = [aws_security_group.web_sg.id]
+  associate_public_ip_address = true
+
+  user_data = <<EOF
+#!/bin/bash
+apt-get update
+apt-get install zlib1g-dev libyaml-dev libssl-dev libffi-dev libgmp3-dev libclang-dev build-essential -y  && \
+apt-get clean && rm -rf /var/lib/apt/lists/* && apt-get autoremove -y
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+curl https://mise.run | sh
+echo "eval \"\$(/root/.local/bin/mise activate bash)\"" >> ~/.bashrc
+eval "$(/root/.local/bin/mise activate bash)"
+mise use ruby@3.4.2
+gem install itsi
+EOF
+
+  root_block_device {
+    encrypted   = true
+    volume_type = "gp3"
+    volume_size = 12
+    tags = {
+      Name = "web-root-block-device-${var.environment}"
+    }
+  }
+
+  depends_on = [aws_route_table_association.public_1_rt_a]
+}
+
+locals {
+  role_policy_arns = [
+    "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
+    "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
+  ]
+}
+
+resource "aws_iam_instance_profile" "web" {
+  name = "EC2-Profile-${var.environment}"
+  role = aws_iam_role.web.name
+}
+
+resource "aws_iam_role_policy_attachment" "web" {
+  count = length(local.role_policy_arns)
+
+  role       = aws_iam_role.web.name
+  policy_arn = element(local.role_policy_arns, count.index)
+}
+
+resource "aws_iam_role_policy" "web" {
+  name = "EC2-Inline-Policy-${var.environment}"
+  role = aws_iam_role.web.id
+  policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Effect" : "Allow",
+          "Action" : [
+            "ssm:GetParameter"
+          ],
+          "Resource" : "*"
+        }
+      ]
+    }
+  )
+}
+
+resource "aws_iam_role" "web" {
+  name = "EC2-Role-${var.environment}"
+  path = "/"
+
+  assume_role_policy = jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Action" : "sts:AssumeRole",
+          "Principal" : {
+            "Service" : "ec2.amazonaws.com"
+          },
+          "Effect" : "Allow"
+        }
+      ]
+    }
+  )
+}

data/sandbox/deploy/outputs.tf

@@ -0,0 +1,4 @@
+output "ec2_public_ip" {
+  description = "Public IP of the EC2 instance"
+  value       = aws_instance.web.public_ip
+}

data/sandbox/deploy/vars.tf

@@ -0,0 +1,11 @@
+variable "aws_region" {
+  default = "ap-southeast-2"
+}
+
+variable "environment" {
+  default = "itsi-production"
+}
+
+variable "subnet_az" {
+  default = "ap-southeast-2a"
+}

data/sandbox/falcon_benchmark/Gemfile

@@ -0,0 +1,10 @@
+source 'https://rubygems.org'
+
+gem 'iodine'
+gem 'unicorn'
+gem 'puma'
+gem 'passenger'
+gem 'agoo'
+gem 'falcon'
+gem "itsi-server", path: "../../gems/server"
+gem "itsi-scheduler", path: "../../gems/scheduler"