@push.rocks/smartproxy 27.20.0 → 27.22.0

package/ts/proxies/smart-proxy/smart-proxy.ts

@@ -25,6 +25,10 @@ import type { IRustCertificateStatus, IRustChallengeOptions, IRustProxyOptions,
 
 type TChallengeProvider = plugins.smartchallenge.IChallengeProvider;
 
+/** What one certProvisionFunction call amounted to, in the order each sweep logs the tally. */
+const certProvisionOutcomes = ['loaded', 'http01', 'deferred', 'failed', 'stopped', 'unrecognized'] as const;
+type TCertProvisionOutcome = (typeof certProvisionOutcomes)[number];
+
 /**
  * SmartProxy - Rust-backed proxy engine with TypeScript configuration API.
  *
@@ -319,7 +323,7 @@ export class SmartProxy extends plugins.EventEmitter {
     }
 
     // Stop metrics polling
-    this.metricsAdapter.stopPolling();
+    await this.metricsAdapter.stopPolling();
 
     // Remove exit listener before killing to avoid spurious error events
     this.bridge.removeAllListeners('exit');
@@ -330,7 +334,7 @@ export class SmartProxy extends plugins.EventEmitter {
     } catch {
       // Ignore if already stopped
     }
-    this.bridge.kill();
+    await this.bridge.terminate();
 
     // Stop socket handler relay
     if (this.socketHandlerServer) {
@@ -489,6 +493,24 @@ export class SmartProxy extends plugins.EventEmitter {
     return this.bridge.getCertificateStatus(routeName);
   }
 
+  /**
+   * Lift the provisioning failure cooldown of one domain, so the next sweep
+   * (`updateRoutes()` or the renewal check) calls `certProvisionFunction` for it
+   * again instead of waiting out `certProvisionFailureCooldownMs`. Use it when the
+   * cause of a failure was resolved outside SmartProxy, for example after a
+   * certificate for the domain was issued out of band.
+   *
+   * @param domain The provisioning domain exactly as `certProvisionFunction`
+   *   receives it and `certificate-failed` reports it.
+   * @returns true if the domain was cooling down, false if it was not (never
+   *   failed, or its cooldown had already elapsed).
+   */
+  public invalidateCertProvisionCooldown(domain: string): boolean {
+    const wasCoolingDown = this.isInFailureCooldown(domain, Date.now());
+    this.certFailureAt.delete(domain);
+    return wasCoolingDown;
+  }
+
   /**
    * Get the metrics interface.
    */
@@ -582,7 +604,7 @@ export class SmartProxy extends plugins.EventEmitter {
   // --- Private helpers ---
 
   private async cleanupRuntimeResourcesAfterStartFailure(didSpawn: boolean): Promise<void> {
-    this.metricsAdapter.stopPolling();
+    await this.metricsAdapter.stopPolling();
 
     if (this.nftablesManager) {
       await this.nftablesManager.cleanup().catch((err) => {
@@ -616,7 +638,7 @@ export class SmartProxy extends plugins.EventEmitter {
     if (didSpawn) {
       this.bridge.removeAllListeners('exit');
       await this.bridge.stopProxy().catch(() => undefined);
-      this.bridge.kill();
+      await this.bridge.terminate();
     }
   }
 
@@ -985,6 +1007,7 @@ export class SmartProxy extends plugins.EventEmitter {
    * For routes with certificate: 'auto', call certProvisionFunction if set.
    * If the callback returns a cert object, load it into Rust.
    * If it returns 'http01', let Rust handle ACME.
+   * If it returns 'defer', leave the domain for the next sweep.
    */
   private async provisionCertificatesViaCallback(skipDomains: Set<string> = new Set()): Promise<void> {
     const provisionFn = this.settings.certProvisionFunction;
@@ -1045,16 +1068,28 @@ export class SmartProxy extends plugins.EventEmitter {
     const concurrency = this.settings.certProvisionConcurrency ?? 4;
     const semaphore = new ConcurrencySemaphore(concurrency);
 
-    const promises = tasks.map(async ({ domain, route }) => {
+    const promises = tasks.map(async ({ domain, route }): Promise<TCertProvisionOutcome> => {
       await semaphore.acquire();
       try {
-        await this.provisionSingleDomain(domain, route, provisionFn);
+        return await this.provisionSingleDomain(domain, route, provisionFn);
       } finally {
         semaphore.release();
       }
     });
 
-    await Promise.allSettled(promises);
+    // provisionSingleDomain settles provisioning errors itself; it rejects only
+    // when a certificate-failed listener throws, after the failure was recorded.
+    const settled = await Promise.allSettled(promises);
+    const tally = new Map<TCertProvisionOutcome, number>();
+    for (const result of settled) {
+      const outcome = result.status === 'fulfilled' ? result.value : 'failed';
+      tally.set(outcome, (tally.get(outcome) ?? 0) + 1);
+    }
+    const summary = certProvisionOutcomes
+      .filter((outcome) => tally.has(outcome))
+      .map((outcome) => `${tally.get(outcome)} ${outcome}`)
+      .join(', ');
+    logger.log('info', `Cert provisioning sweep finished: ${summary}`, { component: 'smart-proxy' });
   }
 
   /**
@@ -1065,8 +1100,8 @@ export class SmartProxy extends plugins.EventEmitter {
     domain: string,
     route: IRouteConfig,
     provisionFn: (domain: string, eventComms: ICertProvisionEventComms) => Promise<TSmartProxyCertProvisionObject>,
-  ): Promise<void> {
-    if (this.stopping) return;
+  ): Promise<TCertProvisionOutcome> {
+    if (this.stopping) return 'stopped';
 
     let expiryDate: string | undefined;
     let source = 'certProvisionFunction';
@@ -1088,7 +1123,13 @@ export class SmartProxy extends plugins.EventEmitter {
         `Certificate provisioning timed out for ${domain} after ${timeoutMs}ms`,
       );
 
-      if (this.stopping) return;
+      if (this.stopping) return 'stopped';
+
+      // A deferral is not a failure: no cooldown, no event, no ACME fallback.
+      if (result === 'defer') {
+        logger.log('info', `Certificate provisioning deferred for ${domain}; the next sweep retries it`, { component: 'smart-proxy' });
+        return 'deferred';
+      }
 
       if (result === 'http01') {
         if (route.name) {
@@ -1100,11 +1141,11 @@ export class SmartProxy extends plugins.EventEmitter {
               'Note: Rust ACME is disabled when certProvisionFunction is set.', { component: 'smart-proxy' });
           }
         }
-        return;
+        return 'http01';
       }
 
       if (result && typeof result === 'object') {
-        if (this.stopping) return;
+        if (this.stopping) return 'stopped';
 
         const certObj = result as ISmartProxyCertProvisionCertificate;
         await this.bridge.loadCertificate(
@@ -1135,7 +1176,9 @@ export class SmartProxy extends plugins.EventEmitter {
           expiryDate: expiryDate || (certObj.validUntil ? new Date(certObj.validUntil).toISOString() : undefined),
           source,
         } satisfies ICertificateIssuedEvent);
+        return 'loaded';
       }
+      return 'unrecognized';
     } catch (err: any) {
       logger.log('warn', `certProvisionFunction failed for ${domain}: ${err.message}`, { component: 'smart-proxy' });
 
@@ -1161,6 +1204,7 @@ export class SmartProxy extends plugins.EventEmitter {
               : ' — default self-signed fallback cert will be used'), { component: 'smart-proxy' });
         }
       }
+      return 'failed';
     }
   }