@dshn/agent 0.1.2 → 0.1.4

package/README.md

@@ -111,7 +111,20 @@ Agent environment (all optional; sensible defaults):
 | `DSHN_STATE` | `~/.dsh/dshn-agent.json` | legacy state file (creds now live in `settings.yaml`) |
 | `DSH_HOME` | `~/.dsh` | dsh home directory |
 
-## Run the relay (your server)
+## Self-host your own network
+
+You don't have to use `ds.hn` — run the whole thing on your own domain. The relay
+ships as **`@dshn/relay`** (npm) and a Docker image; your agents point at it with
+`DSHN_RELAY_HOST`. Full guide, including DNS + TLS options: **[SELF-HOSTING.md](./SELF-HOSTING.md)**.
+
+```sh
+# your server
+DSHN_APEX=tunnel.example.com DSHN_COOKIE_SECRET=$(openssl rand -hex 32) npx @dshn/relay
+# your dsh
+DSHN_RELAY_HOST=wss://tunnel.example.com dsh --profile web
+```
+
+Or from source:
 
 ```sh
 pnpm install && pnpm build

package/client.js

@@ -331,6 +331,13 @@ window.__ModuleLoader__.load({
 .dshn-err { color: var(--dsw-alias-state-error-primary, #e5484d); font-size: 11.5px; margin-bottom: 9px; }
 .dshn-hint { color: var(--dsw-alias-label-tertiary, #8b9099); font-size: 10.5px; margin-top: 3px; }
 .dshn-note { color: var(--dsw-alias-state-warn-primary, #d98324); font-size: 10.5px; margin: 2px 0 10px; }
+.dshn-adv { margin: 2px 0 12px; }
+.dshn-adv-toggle { border: 0; background: transparent; cursor: pointer; padding: 4px 0; font-size: 11.5px;
+  color: var(--dsw-alias-label-tertiary, #8b9099); font-family: inherit; }
+.dshn-adv-toggle:hover { color: var(--dsw-alias-label-primary, #1c1e21); }
+.dshn-adv-body { display: flex; flex-direction: column; gap: 10px; margin-top: 6px; padding: 11px 12px; border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(128,134,142,.25)); background: var(--dsw-alias-bg-layer-2, #f4f5f7); }
+.dshn-ca { min-height: 54px; resize: vertical; font-family: ui-monospace, Menlo, monospace; font-size: 11px; line-height: 1.4; }
 .dshn-e2e-box { margin: 4px 0 12px; padding: 11px 12px; border-radius: 10px;
   border: 1px solid var(--dsw-alias-border-l2, rgba(128,134,142,.25)); background: var(--dsw-alias-bg-layer-2, #f4f5f7); }
 .dshn-e2e-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin-bottom: 8px;
@@ -384,7 +391,11 @@ window.__ModuleLoader__.load({
           localOnly: '公网转发的配置只能在本机（打开 dsh 的这台机器）进行。', loading: '加载中…',
           openSettings: '打开设置', open: '打开', addrLabel: '公网地址',
           dcTitle: '确认断开公网转发？', dcWarn: '断开会立即切断公网访问。云端不保存你的密码、无法找回；若你没有另存密码，之后可能无法用同一前缀重新连接。',
-          dcConfirm: '确认断开', dcCancel: '取消', dcCopyFirst: '先复制密码' }
+          dcConfirm: '确认断开', dcCancel: '取消', dcCopyFirst: '先复制密码',
+          advanced: '高级 · 自托管中继', relayHost: '中继地址',
+          relayHostHint: '自托管时填你自己的中继,如 wss://tunnel.example.com;留空即用默认。改动后点“连接/重新连接”生效。',
+          relayCa: '中继证书(自签名,可选)',
+          relayCaHint: '仅当你的中继用自签名证书时:粘贴其 PEM 证书以固定信任(公有证书/套 Cloudflare 时留空)。' }
       : { brand: 'Public forwarding · ds.hn', connecting: 'connecting…', live: 'live', off: 'off', notset: 'not set up',
           setupTitle: 'Set up public forwarding', setupSub: 'Pick a subdomain prefix and an access password — the two are your credential.',
           connTitle: 'Public forwarding', prefix: 'Subdomain prefix', password: 'Access password', confirm: 'Confirm password',
@@ -404,7 +415,11 @@ window.__ModuleLoader__.load({
           localOnly: 'Public-forwarding settings can only be changed on this machine (where dsh is running).', loading: 'Loading…',
           openSettings: 'open settings', open: 'open', addrLabel: 'Public address',
           dcTitle: 'Disconnect public forwarding?', dcWarn: 'This immediately cuts off public access. The cloud does not store your password and cannot recover it — if you have not saved it elsewhere, you may not be able to reconnect with the same prefix.',
-          dcConfirm: 'Disconnect', dcCancel: 'Cancel', dcCopyFirst: 'Copy password first' }
+          dcConfirm: 'Disconnect', dcCancel: 'Cancel', dcCopyFirst: 'Copy password first',
+          advanced: 'Advanced · self-hosted relay', relayHost: 'Relay host',
+          relayHostHint: 'For self-hosting, your own relay, e.g. wss://tunnel.example.com; blank uses the default. Connect / Reconnect to apply.',
+          relayCa: 'Relay CA (self-signed, optional)',
+          relayCaHint: 'Only when your relay uses a self-signed cert: paste its PEM to pin trust (leave blank for a public cert / behind Cloudflare).' }
 
     function strength(pw) {
       if (pw.length < MIN_PW) return { score: 0, ok: false }
@@ -467,7 +482,6 @@ window.__ModuleLoader__.load({
     function Panel(props) {
       const s = props.status
       const configured = s.configured
-      const apex = s.apex || 'ds.hn'
       const [prefix, setPrefix] = react.useState(configured ? (s.subdomain || '') : '')
       const [pw, setPw] = react.useState(configured ? (s.password || '') : '')
       const [confirm, setConfirm] = react.useState('')
@@ -480,6 +494,11 @@ window.__ModuleLoader__.load({
       const [e2eBusy, setE2eBusy] = react.useState(false)
       const [e2eErr, setE2eErr] = react.useState('')
       const [e2eMsg, setE2eMsg] = react.useState('')
+      // Self-hosted relay overrides (advanced). Pre-filled from the saved settings.
+      const rs0 = s.relaySettings || {}
+      const [relayHost, setRelayHost] = react.useState(rs0.relayHost || '')
+      const [originCa, setOriginCa] = react.useState(rs0.originCa || '')
+      const [showAdvanced, setShowAdvanced] = react.useState(!!rs0.relayHost)
 
       // When the saved passwords arrive from a later status poll, fill them once.
       react.useEffect(() => {
@@ -488,6 +507,27 @@ window.__ModuleLoader__.load({
       react.useEffect(() => {
         if (configured && s.e2ePassword && e2e === '') setE2e(s.e2ePassword)
       }, [s.e2ePassword])
+      // Fill the self-hosted relay fields once the saved settings arrive; auto-open
+      // the advanced section when a custom relay is already configured.
+      react.useEffect(() => {
+        const rs = s.relaySettings
+        if (!rs) return
+        if (rs.relayHost && relayHost === '') { setRelayHost(rs.relayHost); setShowAdvanced(true) }
+        if (rs.originCa && originCa === '') setOriginCa(rs.originCa)
+      }, [s.relaySettings && s.relaySettings.relayHost])
+
+      // The domain suffix reflects the self-hosted relay AS YOU TYPE it (a
+      // client-side mirror of the server's apex derivation), so the preview shows
+      // YOUR domain — not the default ds.hn — before you've connected. Empty →
+      // the server's current apex.
+      const apex = (() => {
+        const rh = relayHost.trim()
+        if (rh === '') return s.apex || 'ds.hn'
+        const bare = rh.replace(/^wss?:\/\//, '').replace(/:\d+$/, '').replace(/\/.*$/, '')
+        const parts = bare.split('.')
+        if (parts.length > 2 && (parts[0] === 'relay' || parts[0] === 'origin')) return parts.slice(1).join('.')
+        return bare || (s.apex || 'ds.hn')
+      })()
 
       const copyText = (text, tag) => {
         if (!text || !navigator.clipboard) return
@@ -519,7 +559,7 @@ window.__ModuleLoader__.load({
         setBusy(true); setErr('')
         const e2eVal = e2e.trim()
         fetch('/dshn/configure', { method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ subdomain: prefix.trim().toLowerCase(), password: pw }) })
+          body: JSON.stringify({ subdomain: prefix.trim().toLowerCase(), password: pw, relayHost: relayHost.trim(), originCa: originCa.trim() }) })
           .then((r) => r.json().then((j) => ({ ok: r.ok, j })))
           .then(async ({ ok, j }) => {
             if (!ok) { setBusy(false); setErr((j && j.error) || 'failed'); return }
@@ -657,6 +697,24 @@ window.__ModuleLoader__.load({
             h('div', { className: 'dshn-hint', style: { marginTop: '7px' } }, T.e2eHint + ' ' + T.e2eIndep))
         })() : null,
 
+        // Advanced — self-hosted relay. Point the agent at your own @dshn/relay
+        // instead of the default ds.hn. Collapsed unless a custom relay is already
+        // set; applied on Connect/Reconnect (changing it reconnects the tunnel).
+        h('div', { className: 'dshn-adv' },
+          h('button', { type: 'button', className: 'dshn-adv-toggle', onClick: () => setShowAdvanced(!showAdvanced) },
+            (showAdvanced ? '▾ ' : '▸ ') + T.advanced),
+          showAdvanced ? h('div', { className: 'dshn-adv-body' },
+            h('label', { className: 'dshn-field' },
+              h('span', null, T.relayHost),
+              h('input', { className: 'dshn-input', value: relayHost, placeholder: s.defaultRelayHost || 'relay.ds.hn',
+                autoComplete: 'off', spellCheck: false, onChange: (ev) => setRelayHost(ev.target.value) }),
+              h('div', { className: 'dshn-hint' }, T.relayHostHint)),
+            h('label', { className: 'dshn-field' },
+              h('span', null, T.relayCa),
+              h('textarea', { className: 'dshn-input dshn-ca', value: originCa, rows: 3, spellCheck: false,
+                placeholder: '-----BEGIN CERTIFICATE-----', onChange: (ev) => setOriginCa(ev.target.value) }),
+              h('div', { className: 'dshn-hint' }, T.relayCaHint))) : null),
+
         // Disconnecting severs public access and the password is unrecoverable
         // from the cloud — so it takes an explicit, spelled-out confirmation.
         confirmDc ? h('div', { className: 'dshn-dcwarn' },

package/lib/index.js

@@ -4625,7 +4625,9 @@ var CREDS_SCHEMA = Schema.object({
   subdomain: Schema.string().default(""),
   password: Schema.string().role("secret").default(""),
   e2ePassword: Schema.string().role("secret").default(""),
-  e2eSalt: Schema.string().default("")
+  e2eSalt: Schema.string().default(""),
+  relayHost: Schema.string().default(""),
+  originCa: Schema.string().default("")
 });
 function readCredsFile(path) {
   try {
@@ -4635,7 +4637,9 @@ function readCredsFile(path) {
         subdomain: raw.subdomain,
         password: raw.password,
         e2ePassword: typeof raw.e2ePassword === "string" && raw.e2ePassword !== "" ? raw.e2ePassword : void 0,
-        e2eSalt: typeof raw.e2eSalt === "string" ? raw.e2eSalt : void 0
+        e2eSalt: typeof raw.e2eSalt === "string" ? raw.e2eSalt : void 0,
+        relayHost: typeof raw.relayHost === "string" && raw.relayHost !== "" ? raw.relayHost : void 0,
+        originCa: typeof raw.originCa === "string" && raw.originCa !== "" ? raw.originCa : void 0
       };
     }
   } catch {
@@ -4655,14 +4659,16 @@ function settingsStore(scope, migrateFrom) {
   const store = {
     load: () => {
       const v = scope.get() ?? {};
-      return typeof v.subdomain === "string" && v.subdomain !== "" ? { subdomain: v.subdomain, password: v.password ?? "", e2ePassword: v.e2ePassword || void 0, e2eSalt: v.e2eSalt || void 0 } : null;
+      return typeof v.subdomain === "string" && v.subdomain !== "" ? { subdomain: v.subdomain, password: v.password ?? "", e2ePassword: v.e2ePassword || void 0, e2eSalt: v.e2eSalt || void 0, relayHost: v.relayHost || void 0, originCa: v.originCa || void 0 } : null;
     },
     save: (creds) => {
       Promise.resolve(scope.update({
         subdomain: creds?.subdomain ?? "",
         password: creds?.password ?? "",
         e2ePassword: creds?.e2ePassword ?? "",
-        e2eSalt: creds?.e2eSalt ?? ""
+        e2eSalt: creds?.e2eSalt ?? "",
+        relayHost: creds?.relayHost ?? "",
+        originCa: creds?.originCa ?? ""
       })).catch(() => {
       });
     }
@@ -4796,13 +4802,15 @@ var AgentTunnel = class {
    * mirrors the relay's so the user sees the error locally before a round trip.
    * @returns null on success, or a human-readable error.
    */
-  configure(subdomain, password) {
+  configure(subdomain, password, relayHost, originCa) {
     const label = String(subdomain).trim().toLowerCase();
     if (!isValidSubdomainLabel(label))
       return "Invalid subdomain: 4\u201332 lowercase letters, digits or hyphens (not reserved).";
     if (String(password).length < 8)
       return "Password must be at least 8 characters.";
-    this.creds = { subdomain: label, password: String(password), e2ePassword: this.creds?.e2ePassword, e2eSalt: this.creds?.e2eSalt };
+    const rh = typeof relayHost === "string" ? relayHost.trim() : this.creds?.relayHost ?? "";
+    const ca = typeof originCa === "string" ? originCa.trim() : this.creds?.originCa ?? "";
+    this.creds = { subdomain: label, password: String(password), e2ePassword: this.creds?.e2ePassword, e2eSalt: this.creds?.e2eSalt, relayHost: rh || void 0, originCa: ca || void 0 };
     this.refreshE2E();
     this.saveCreds(this.creds);
     this.status.configured = true;
@@ -4850,11 +4858,34 @@ var AgentTunnel = class {
   e2eInfo() {
     return { enabled: this.e2eKey !== null, salt: this.e2eSalt };
   }
+  /** The relay authority actually dialled: the user's self-hosted override if set, else the env/default. */
+  effectiveRelayHost() {
+    const c = this.creds?.relayHost;
+    return typeof c === "string" && c !== "" ? c : this.config.relayHost;
+  }
+  /** The origin CA to pin, as PEM bytes: inline PEM from the UI, or an env-configured file path. */
+  effectiveOriginCa() {
+    const raw = this.creds?.originCa && this.creds.originCa !== "" ? this.creds.originCa : this.config.originCa;
+    if (raw === "" || raw === void 0)
+      return null;
+    if (raw.includes("BEGIN CERTIFICATE"))
+      return Buffer.from(raw);
+    try {
+      return readFileSync(raw);
+    } catch {
+      return null;
+    }
+  }
+  /** The raw self-hosted overrides, for the settings UI to pre-fill (loopback callers only). */
+  relaySettings() {
+    return { relayHost: this.creds?.relayHost ?? "", originCa: this.creds?.originCa ?? "" };
+  }
   /** Connection details for the local panel (relay, mode, uptime, latency, throughput). */
   info() {
-    const direct = /^wss?:\/\//.test(this.config.relayHost) || this.config.originCa !== "";
+    const host = this.effectiveRelayHost();
+    const direct = /^wss?:\/\//.test(host) || this.effectiveOriginCa() !== null;
     return {
-      relayHost: this.config.relayHost.replace(/^wss?:\/\//, "").replace(/\/.*$/, ""),
+      relayHost: host.replace(/^wss?:\/\//, "").replace(/\/.*$/, ""),
       direct,
       connectedSince: this.connectedSince,
       served: this.served,
@@ -4908,15 +4939,12 @@ var AgentTunnel = class {
       clearTimeout(this.reconnectTimer);
       this.reconnectTimer = null;
     }
-    const base = this.config.relayHost.includes("://") ? this.config.relayHost : `wss://${this.config.relayHost}`;
+    const relayHost = this.effectiveRelayHost();
+    const base = relayHost.includes("://") ? relayHost : `wss://${relayHost}`;
     const wsOpts = { maxPayload: 512 * 1024 * 1024 };
-    if (this.config.originCa !== "") {
-      try {
-        wsOpts.ca = readFileSync(this.config.originCa);
-      } catch (err) {
-        this.status.lastError = `cannot read origin CA: ${err.message}`;
-      }
-    }
+    const ca = this.effectiveOriginCa();
+    if (ca !== null)
+      wsOpts.ca = ca;
     const ws = new import_websocket.default(`${base}${AGENT_WS_PATH}`, wsOpts);
     this.control = ws;
     if (process.env.DSHN_DEBUG)
@@ -5313,12 +5341,17 @@ function apply(ctx, rawConfig) {
         subdomain: tunnel.status.subdomain,
         lastError: tunnel.status.lastError,
         configurable: loopback,
-        apex: publicApex(config.relayHost),
+        apex: publicApex(info.relayHost),
         // The saved password is the only recoverable copy (cloud stores a hash).
         // Only ever handed to a loopback caller — the local machine's owner.
         password: loopback ? tunnel.revealPassword() : null,
         e2ePassword: loopback ? tunnel.revealE2EPassword() : null,
         e2eEnabled: tunnel.e2eInfo().enabled,
+        // Self-hosted relay overrides, so the settings UI can pre-fill them
+        // (loopback only). `defaultRelayHost` is what an empty override falls back
+        // to, shown as the field's placeholder.
+        relaySettings: loopback ? tunnel.relaySettings() : null,
+        defaultRelayHost: config.relayHost,
         // Connection details for the panel.
         relayHost: info.relayHost,
         mode: info.direct ? "direct" : "cloudflare",
@@ -5349,7 +5382,9 @@ function apply(ctx, rawConfig) {
       if (body === null || typeof body.subdomain !== "string" || typeof body.password !== "string") {
         return json(res, 400, { error: "expected { subdomain, password }" });
       }
-      const err = tunnel.configure(body.subdomain, body.password);
+      const relayHost = typeof body.relayHost === "string" ? body.relayHost : void 0;
+      const originCa = typeof body.originCa === "string" ? body.originCa : void 0;
+      const err = tunnel.configure(body.subdomain, body.password, relayHost, originCa);
       if (err !== null)
         return json(res, 400, { error: err });
       json(res, 200, { ok: true, subdomain: tunnel.status.subdomain });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dshn/agent",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Forward a local dsh web service to the public internet over ds.hn (bundled).",
   "keywords": [
     "dsh",