@amenophis1er/foreman 0.1.4 → 0.1.6

package/src/tailscale.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { isTailscaleIp, parseTailscaleStatus, tailnetFromInterfaces, tailnetUrl } from './tailscale.js';
+import { isTailscaleIp, parseTailscaleStatus, tailnetFromInterfaces, tailnetUrl, parseServeStatus, serveHint } from './tailscale.js';
 
 test('isTailscaleIp: only 100.64.0.0/10', () => {
   assert.equal(isTailscaleIp('100.94.221.98'), true);
@@ -30,3 +30,29 @@ test('tailnetFromInterfaces: finds the CGNAT address, ignores loopback and LAN',
   assert.deepEqual(t, { ip: '100.94.221.98' });
   assert.equal(tailnetFromInterfaces({ en0: [{ address: '192.168.1.5', family: 'IPv4', internal: false } as never] }), null);
 });
+
+test('parseServeStatus finds the HTTPS port that proxies to Foreman, and the ports already taken', () => {
+  const json = {
+    TCP: { 443: { HTTPS: true }, 8443: { HTTPS: true } },
+    Web: {
+      'laptop.tail1234.ts.net:443': { Handlers: { '/': { Proxy: 'http://127.0.0.1:7717' } } },
+      'laptop.tail1234.ts.net:8443': { Handlers: { '/': { Proxy: 'http://127.0.0.1:4177' } } },
+    },
+  };
+  assert.deepEqual(parseServeStatus(json, 4177), { httpsPort: 8443, httpsInUse: [443, 8443] });
+  assert.deepEqual(parseServeStatus(json, 4178), { httpsPort: undefined, httpsInUse: [443, 8443] });
+  assert.deepEqual(parseServeStatus({}, 4177), { httpsPort: undefined, httpsInUse: [] });
+});
+
+test('tailnetUrl prefers the served HTTPS origin, port only when not 443', () => {
+  const t = { ip: '100.64.0.1', dnsName: 'laptop.tail1234.ts.net' };
+  assert.equal(tailnetUrl({ ...t, httpsPort: 443 }, 4177), 'https://laptop.tail1234.ts.net');
+  assert.equal(tailnetUrl({ ...t, httpsPort: 8443 }, 4177), 'https://laptop.tail1234.ts.net:8443');
+  assert.equal(tailnetUrl(t, 4177), 'http://laptop.tail1234.ts.net:4177');
+});
+
+test('serveHint picks 443 when free, else the next conventional port', () => {
+  assert.equal(serveHint(4177), 'tailscale serve --bg 4177');
+  assert.equal(serveHint(4177, [443]), 'tailscale serve --bg --https=8443 4177');
+  assert.equal(serveHint(4177, [443, 8443]), 'tailscale serve --bg --https=10000 4177');
+});

package/src/tailscale.ts

@@ -21,6 +21,14 @@ export interface Tailnet {
   ip: string;
   /** MagicDNS name without the trailing dot, e.g. `laptop.tail1234.ts.net`. */
   dnsName?: string;
+  /**
+   * An HTTPS port `tailscale serve` maps onto Foreman's own port, when one
+   * is configured. Tailscale terminates TLS with a certificate for the node
+   * name; Foreman never holds a key. Links prefer this origin when present.
+   */
+  httpsPort?: number;
+  /** HTTPS ports `serve` already uses for something else — so a hint can pick a free one. */
+  httpsInUse?: number[];
 }
 
 /** True for addresses in 100.64.0.0/10, the CGNAT range Tailscale hands out. */
@@ -51,6 +59,32 @@ export function tailnetFromInterfaces(ifaces: NodeJS.Dict<os.NetworkInterfaceInf
   return null;
 }
 
+/**
+ * The parts of `tailscale serve status --json` Foreman reads: which HTTPS
+ * port, if any, proxies "/" to this port on loopback. `--bg` config only;
+ * a foreground `serve` is the same on the wire and shows up the same way.
+ */
+export function parseServeStatus(json: unknown, port: number): { httpsPort?: number; httpsInUse: number[] } {
+  const d = json as { Web?: Record<string, { Handlers?: Record<string, { Proxy?: string }> }> } | null;
+  const inUse: number[] = [];
+  let httpsPort: number | undefined;
+  for (const [hostPort, site] of Object.entries(d?.Web ?? {})) {
+    const p = Number(hostPort.split(':').pop());
+    if (!Number.isFinite(p)) continue;
+    inUse.push(p);
+    const proxy = site.Handlers?.['/']?.Proxy ?? '';
+    const m = /^https?:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):(\d+)\/?$/.exec(proxy);
+    if (m && Number(m[1]) === port && httpsPort === undefined) httpsPort = p;
+  }
+  return { httpsPort, httpsInUse: inUse };
+}
+
+/** The one command that gives Foreman a certificate: 443 when free, else the next conventional port. */
+export function serveHint(port: number, inUse: number[] = []): string {
+  const https = [443, 8443, 10000].find((p) => !inUse.includes(p)) ?? 8443;
+  return `tailscale serve --bg${https === 443 ? '' : ` --https=${https}`} ${port}`;
+}
+
 const CLI_CANDIDATES = [
   'tailscale',
   '/Applications/Tailscale.app/Contents/MacOS/Tailscale',
@@ -63,17 +97,37 @@ function run(cmd: string, args: string[], timeoutMs: number): Promise<string | n
   });
 }
 
-/** The tailnet this machine is on, or null. Read-only; a few seconds at most. */
-export async function detectTailscale(): Promise<Tailnet | null> {
+/**
+ * The tailnet this machine is on, or null. Read-only; a few seconds at most.
+ * With a port, also asks whether `tailscale serve` fronts it with HTTPS.
+ */
+export async function detectTailscale(port?: number): Promise<Tailnet | null> {
   for (const cmd of CLI_CANDIDATES) {
     const out = await run(cmd, ['status', '--json'], 3_000);
     if (!out) continue;
-    try { const t = parseTailscaleStatus(JSON.parse(out)); if (t) return t; } catch { /* not JSON — try the next */ }
+    let t: Tailnet | null = null;
+    try { t = parseTailscaleStatus(JSON.parse(out)); } catch { /* not JSON — try the next */ }
+    if (!t) continue;
+    if (port && t.dnsName) {
+      const serve = await run(cmd, ['serve', 'status', '--json'], 3_000);
+      if (serve) {
+        try {
+          const { httpsPort, httpsInUse } = parseServeStatus(JSON.parse(serve), port);
+          t = { ...t, ...(httpsPort ? { httpsPort } : {}), httpsInUse };
+        } catch { /* no serve config, or an older CLI */ }
+      }
+    }
+    return t;
   }
   return tailnetFromInterfaces();
 }
 
-/** `http://laptop.tail1234.ts.net:4177` — the name when there is one, the address otherwise. */
+/**
+ * Where the tailnet reaches Foreman: `https://laptop.tail1234.ts.net` when
+ * `tailscale serve` fronts it (the port only when it is not 443), else
+ * `http://name:port`, else the address.
+ */
 export function tailnetUrl(t: Tailnet, port: number): string {
+  if (t.httpsPort && t.dnsName) return `https://${t.dnsName}${t.httpsPort === 443 ? '' : `:${t.httpsPort}`}`;
   return `http://${t.dnsName ?? t.ip}:${port}`;
 }