1cattunnel 0.1.2-b.3 → 0.3.0

package/README.md

@@ -2,6 +2,8 @@
 
 Global npm wrapper for the 1Cat Tunnel client.
 
+Version 0.3.0 uses TLS 1.3 by default and persists the dedicated per-node credential after first enrollment.
+
 ## Install
 
 ```bash
@@ -21,15 +23,26 @@ On first run it creates a writable user config and the Go client wizard asks for
 - a WebUI bootstrap token; or
 - the enrollment password from the administrator.
 
-The entered enrollment password is saved locally so later runs can reconnect automatically.
+The enrollment password is saved only until the first successful connection. It is then replaced by the dedicated node token. On Windows, choose `Manual custom ports` in the wizard to expose one or more custom TCP/UDP local ports.
 
 Config path:
 
 - Windows: `%APPDATA%\\1cat-tunnel\\client-windows.json`
 - Linux: `~/.config/1cat-tunnel/client-linux.json`
 
+Linux clients also expose a loopback-only API for submitting blocked IPs to the server:
+
+```bash
+curl -u admin:YOUR_ADMIN_PASSWORD \
+  -H "Content-Type: application/json" \
+  -d '{"ip":"203.0.113.10","reason":"scan"}' \
+  http://127.0.0.1:51888/api/block-ip
+```
+
+The server validates the same WebUI administrator username/password before adding the IP to the persistent blocklist.
+
 Use a custom config if needed:
 
 ```bash
 1cattunnel -config ./client-linux.json
-```
+```

package/bin/1cattunnel.js

@@ -82,13 +82,16 @@ function ensureUserConfig() {
   const dir = configRoot();
   const target = path.join(dir, configName);
   if (fs.existsSync(target)) {
+    if (!isWindows) {
+      fs.chmodSync(target, 0o600);
+    }
     return target;
   }
 
   fs.mkdirSync(dir, { recursive: true });
   const config = JSON.parse(fs.readFileSync(templatePath, 'utf8'));
   config.node_name = safeNodeName();
-  fs.writeFileSync(target, `${JSON.stringify(config, null, 2)}\n`);
+  fs.writeFileSync(target, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
   console.log(`1cattunnel: created default config at ${target}`);
   return target;
 }
@@ -109,4 +112,4 @@ if (result.error) {
   fail(result.error.message);
 }
 
-process.exit(typeof result.status === 'number' ? result.status : 1);
+process.exit(typeof result.status === 'number' ? result.status : 1);

package/dist/client-linux.json

@@ -1,8 +1,11 @@
 {
-    "server_addr":  "dx.1catai.com:50001",
-    "node_name":  "cust-linux-01",
-    "reconnect_interval_sec":  5,
-    "presets":  [
+    "server_addr":  "dx.1catai.com:32001",
+    "tls_enabled":  true,
+    "tls_server_name":  "dx.1catai.com",
+    "node_name":  "cust-linux-01",
+    "reconnect_interval_sec":  5,
+    "block_ip_api_listen_addr":  "127.0.0.1:51888",
+    "presets":  [
                     {
                         "name":  "ssh",
                         "local_addr":  "0.0.0.0:22",

package/dist/client-windows.json

@@ -1,5 +1,7 @@
 {
-    "server_addr":  "dx.1catai.com:50001",
+    "server_addr":  "dx.1catai.com:32001",
+    "tls_enabled":  true,
+    "tls_server_name":  "dx.1catai.com",
     "node_name":  "cust-win-01",
     "reconnect_interval_sec":  5,
     "presets":  [

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "1cattunnel",
-    "version":  "0.1.2-b.3",
+    "version":  "0.3.0",
     "description":  "1Cat Tunnel client with bundled Windows/Linux amd64 binaries",
     "license":  "UNLICENSED",
     "private":  false,
@@ -27,4 +27,4 @@
     "scripts":  {
                     "postinstall":  "node scripts/postinstall.js"
                 }
-}
+}