@metric-im/administrate 2.0.1 → 2.1.0

package/certify.mjs

@@ -6,18 +6,24 @@ import moment from 'moment';
 
 const MAX_AGE = 75; // days
 const MAX_WAIT_TIME = 60; // seconds
+const LOCK_TTL = 180; // seconds — renew lease held in the shared store
+const CHALLENGE_PATH = '/.acme-challenges'; // shared subtree (under the role's root) of token→keyAuthorization
+const LOCK_PATH = '/.acme-lock';            // shared subtree of sitename→{holder,ts}
 
 export class Certify {
     constructor(app,options) {
         this.app = app;
         this.options = options || {};
         this.pending = {};
-        this.challenges = {};
+        this.challenges = {};      // local fast-path mirror of the shared challenge store
         this.contactEmail = undefined;
+        this.shared = null;        // Config handle for the pool-shared subtree (challenges + renew lease)
+        this.nodeId = Math.random().toString(36).slice(2) + Date.now().toString(36);
     }
     static async attach(app,options) {
         const instance = new Certify(app,options);
         instance.config = new Config();
+        instance.shared = new Config();   // same backend/root; pool-shared challenge tokens + renew lease
 
         // Load root config to get contact email
         await instance.config.setPath('/');
@@ -52,18 +58,18 @@ export class Certify {
     routes() {
         const router = express.Router();
 
-        router.get(/^\/\.well-known\/acme-challenge\/([^\/]+)$/,(req,res)=>{
+        router.get(/^\/\.well-known\/acme-challenge\/([^\/]+)$/, async (req,res)=>{
             const token = req.params[0];
-            console.log(`ACME challenge request for token: ${token}`);
-            console.log(`Available challenges:`, Object.keys(this.challenges));
-            if (token in this.challenges) {
-                console.log(`✓ Challenge found, responding with authorization`);
+            // Pool-safe: the renewing member may not be the one Let's Encrypt's
+            // validator reaches (the L4 LB round-robins :80), so fall back to the
+            // shared store any member can read.
+            const keyAuthorization = await this._lookupChallenge(token);
+            if (keyAuthorization) {
                 res.writeHead(200);
-                res.end(this.challenges[token]);
+                res.end(keyAuthorization);
                 return;
             }
-            console.log(`✗ Challenge not found, returning 404`);
-            // Don't redirect ACME challenges - return 404 instead (says Claude, used to be 302)
+            console.log(`✗ ACME challenge token not found (local or shared): ${token}`);
             res.writeHead(404);
             res.end('Challenge not found');
         });
@@ -75,6 +81,48 @@ export class Certify {
         // });
         return router;
     }
+    // ── pool coordination, via the shared authority store ────────────────────
+    // http-01 tokens are written to a shared subtree so ANY member can answer
+    // LE's validation; a TTL lease ensures only one member renews at a time.
+    // With no shared store (single node) these degrade to local-only behavior.
+    async _putChallenge(token, keyAuthorization) {
+      this.challenges[token] = keyAuthorization;        // local fast path
+      try {
+        await this.shared.setPath(CHALLENGE_PATH);
+        this.shared.data[token] = keyAuthorization;
+        await this.shared.save();
+      } catch (e) { console.warn(`certify: shared challenge put failed (local still serves): ${e.message}`); }
+    }
+    async _delChallenge(token) {
+      delete this.challenges[token];
+      try {
+        await this.shared.setPath(CHALLENGE_PATH);
+        delete this.shared.data[token];
+        await this.shared.save();
+      } catch (e) { /* best effort — a stale token is harmless */ }
+    }
+    async _lookupChallenge(token) {
+      if (token in this.challenges) return this.challenges[token];
+      try { const d = await this.shared.read(CHALLENGE_PATH); return (d && d[token]) || null; }
+      catch { return null; }
+    }
+    async _acquireRenewLock(sitename) {
+      try {
+        await this.shared.setPath(LOCK_PATH);
+        const cur = this.shared.data[sitename];
+        if (cur && cur.ts && cur.holder !== this.nodeId &&
+            moment().isBefore(moment(cur.ts).add(LOCK_TTL, 'seconds'))) {
+          return false;                                 // another member holds a fresh lease
+        }
+        this.shared.data[sitename] = { holder: this.nodeId, ts: moment().toISOString() };
+        await this.shared.save();
+        const check = await this.shared.read(LOCK_PATH); // confirm we won the write race
+        return !check || !check[sitename] || check[sitename].holder === this.nodeId;
+      } catch (e) {
+        console.warn(`certify: renew lease unavailable, proceeding solo: ${e.message}`);
+        return true;                                    // no shared store → single-node behavior
+      }
+    }
     async getSiteKeys(sitename) {
       // For localhost and local domains, don't try to get Let's Encrypt certificates
       if (sitename === 'localhost' || sitename.includes('.local') || sitename.match(/^\d+\.\d+\.\d+\.\d+$/)) {
@@ -120,6 +168,14 @@ export class Certify {
         return;
       } else {
         if (!this.contactEmail) throw new Error(`cannot request certificate without CONTACT_EMAIL set`);
+        // Pool coordination: only one member renews a given cert at a time. If
+        // another holds a fresh lease, skip — the existing cert is still valid
+        // and the renewed one lands in the shared store for everyone to read.
+        if (!(await this._acquireRenewLock(sitename))) {
+          console.log(`certify: another pool member is renewing ${sitename}; skipping`);
+          delete this.pending[sitename];
+          return;
+        }
         this.pending[sitename] = moment();
 
         try {
@@ -168,14 +224,13 @@ export class Certify {
         email: this.contactEmail,
         termsOfServiceAgreed: true,
         challengePriority: ['http-01'],
-        challengeCreateFn: (authz, challenge, keyAuthorization) => {
+        challengeCreateFn: async (authz, challenge, keyAuthorization) => {
           console.log(`✓ Challenge created - token: ${challenge.token}`);
-          console.log(`  Challenge URL: http://${sitename}/.well-known/acme-challenge/${challenge.token}`);
-          this.challenges[challenge.token] = keyAuthorization;
+          await this._putChallenge(challenge.token, keyAuthorization);   // local + shared store
         },
-        challengeRemoveFn: (authz, challenge) => {
+        challengeRemoveFn: async (authz, challenge) => {
           console.log(`✓ Challenge removed - token: ${challenge.token}`);
-          delete this.challenges[challenge.token];
+          await this._delChallenge(challenge.token);
         },
       });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metric-im/administrate",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Tools for site administration",
   "homepage": "https://github.com/metric-im/administrate#readme",
   "bugs": {