@stacksjs/rpx 0.11.17 → 0.11.19

package/src/start.ts

@@ -1,7 +1,7 @@
 /* eslint-disable no-console */
 import type { IncomingHttpHeaders, SecureServerOptions } from 'node:http2'
 import type { ServerOptions } from 'node:https'
-import type { BaseProxyConfig, CleanupOptions, ProxyConfig, ProxyOption, ProxyOptions, ProxySetupOptions, SingleProxyConfig, SSLConfig, StartOptions } from './types'
+import type { BaseProxyConfig, CleanupOptions, ProxyConfig, ProxyOption, ProxyOptions, ProxySetupOptions, ResolvedProxyOptions, SingleProxyConfig, SSLConfig, StartOptions } from './types'
 import { exec, execSync } from 'node:child_process'
 import * as fs from 'node:fs'
 import * as http from 'node:http'
@@ -20,12 +20,13 @@ import { addHosts, checkHosts, removeHosts } from './hosts'
 import { checkExistingCertificates, cleanupCertificates, generateCertificate, httpsConfig, loadSSLConfig } from './https'
 import { DefaultPortManager, findAvailablePort, isPortInUse } from './port-manager'
 import { ProcessManager } from './process-manager'
+import { createOriginGuard } from './origin-guard'
 import { createProxyFetchHandler, createProxyWebSocketHandler } from './proxy-handler'
 import type { ProxyRoute, ProxyServer as ProxyServerLike } from './proxy-handler'
 import { isWildcardPattern } from './host-match'
 import { buildHostRoutes, matchHostRoute, normalizePathPrefix } from './host-routes'
 import { resolveStaticRoute } from './static-files'
-import { debugLog, getSudoPassword, safeStringify } from './utils'
+import { debugLog, getSudoPassword, safeStringify, shouldReusePort } from './utils'
 
 const processManager = new ProcessManager()
 const version = '0.12.0'
@@ -236,7 +237,8 @@ async function testConnection(hostname: string, port: number, verbose?: boolean,
   try {
     await tryConnect()
   }
-  catch (err: any) {
+  catch (err: unknown) {
+    const e = err as NodeJS.ErrnoException
     // Check if we've exceeded the maximum test duration
     if (Date.now() - startTime > maxTestDuration) {
       debugLog('connection', `Connection test timed out after ${maxTestDuration}ms, but continuing anyway`, verbose)
@@ -245,7 +247,7 @@ async function testConnection(hostname: string, port: number, verbose?: boolean,
     }
 
     // If we're dealing with a server that takes time to start up
-    if (err.code === 'ECONNREFUSED' && retries > 0) {
+    if (e.code === 'ECONNREFUSED' && retries > 0) {
       debugLog('connection', `Connection refused, server might be starting up. Retrying in 2 seconds... (${retries} retries left)`, verbose)
       await new Promise(resolve => setTimeout(resolve, 2000))
       return testConnection(hostname, port, verbose, retries - 1)
@@ -293,7 +295,7 @@ async function testConnection(hostname: string, port: number, verbose?: boolean,
 
     // For production environments, we might want to be more strict
     // But for typical usage, let's be permissive and just warn
-    const errorMessage = `Failed to connect to ${hostname}:${port} after ${5 - retries} attempts: ${err.message}`
+    const errorMessage = `Failed to connect to ${hostname}:${port} after ${5 - retries} attempts: ${e.message}`
     debugLog('connection', `${errorMessage}. To bypass this check set RPX_BYPASS_CONNECTION_TEST=true`, verbose)
     log.warn(errorMessage)
     log.warn(`RPX will try to continue anyway. If you're sure this is correct, you can set RPX_BYPASS_CONNECTION_TEST=true to skip this check.`)
@@ -584,6 +586,7 @@ async function createProxyServer(
         const bunServer = Bun.serve({
           port: listenPort,
           hostname,
+          reusePort: shouldReusePort(),
           tls: {
             key: ssl.key,
             cert: ssl.cert,
@@ -596,9 +599,19 @@ async function createProxyServer(
             const url = new URL(req.url)
             debugLog('request', `Bun.serve received: ${req.method} ${url.pathname}`, verbose)
 
-            // Build target URL from sourceUrl object
+            // Handle clean URLs redirect before any upstream work — the
+            // redirect doesn't depend on the origin response.
+            if (cleanUrls && url.pathname.endsWith('.html')) {
+              const cleanPath = url.pathname.replace(/\.html$/, '')
+              return new Response(null, {
+                status: 301,
+                headers: { Location: cleanPath },
+              })
+            }
+
+            // Build target URL by string concat (avoids an extra URL parse).
             const baseUrl = `http://${sourceUrl.host}`
-            const targetUrl = new URL(url.pathname + url.search, baseUrl)
+            const targetUrl = `${baseUrl}${url.pathname}${url.search}`
 
             // Forward the request
             try {
@@ -611,30 +624,15 @@ async function createProxyServer(
               headers.set('x-forwarded-proto', 'https')
               headers.set('x-forwarded-host', to)
 
-              const response = await fetch(targetUrl.toString(), {
+              // Return the upstream response directly — Bun streams the body and
+              // forwards status/headers verbatim, so re-wrapping it in a fresh
+              // Response would just copy every header and allocate twice.
+              return await fetch(targetUrl, {
                 method: req.method,
                 headers,
                 body: req.body,
                 redirect: 'manual',
               })
-
-              // Clone response with modified headers if needed
-              const responseHeaders = new Headers(response.headers)
-
-              // Handle clean URLs redirect
-              if (cleanUrls && url.pathname.endsWith('.html')) {
-                const cleanPath = url.pathname.replace(/\.html$/, '')
-                return new Response(null, {
-                  status: 301,
-                  headers: { Location: cleanPath },
-                })
-              }
-
-              return new Response(response.body, {
-                status: response.status,
-                statusText: response.statusText,
-                headers: responseHeaders,
-              })
             }
             catch (err) {
               debugLog('request', `Proxy error: ${err}`, verbose)
@@ -933,7 +931,7 @@ export function startProxy(options: ProxyOption): void {
 }
 
 // Helper function to safely get verbose flag from different config types
-function getVerbose(options: any): boolean {
+function getVerbose(options: ProxyOptions): boolean {
   return options?.verbose || false
 }
 
@@ -943,7 +941,7 @@ function getVerbose(options: any): boolean {
  * `false`). Real-server deployments with real DNS should set
  * `hostsManagement: false` so rpx never touches `/etc/hosts`.
  */
-function isHostsManagementEnabled(options: any): boolean {
+function isHostsManagementEnabled(options: ProxyOptions): boolean {
   if (options?.hostsManagement === false)
     return false
   const cleanup = options?.cleanup
@@ -970,7 +968,7 @@ export async function startProxies(options?: ProxyOptions): Promise<void> {
     cleanUrls: false,
     changeOrigin: false,
     regenerateUntrustedCerts: true,
-  } as any
+  } as ResolvedProxyOptions
 
   if (options) {
     mergedOptions = {
@@ -1006,7 +1004,7 @@ export async function startProxies(options?: ProxyOptions): Promise<void> {
       : [{
           id: mergedOptions.id,
           from: mergedOptions.from,
-          to: mergedOptions.to,
+          to: mergedOptions.to ?? 'rpx.localhost',
           path: mergedOptions.path,
           cleanUrls: mergedOptions.cleanUrls,
           changeOrigin: mergedOptions.changeOrigin,
@@ -1029,7 +1027,7 @@ export async function startProxies(options?: ProxyOptions): Promise<void> {
           await processManager.startProcess(proxyId, proxy.start, verbose)
 
           // Parse the URL to get hostname and port
-          const fromUrl = new URL(proxy.from.startsWith('http') ? proxy.from : `http://${proxy.from}`)
+          const fromUrl = new URL(proxy.from?.startsWith('http') ? proxy.from : `http://${proxy.from}`)
           const hostname = fromUrl.hostname || 'localhost'
           const port = Number(fromUrl.port) || 80
 
@@ -1135,7 +1133,7 @@ export async function startProxies(options?: ProxyOptions): Promise<void> {
 
   // Prepare proxy configurations
   const proxyOptions = 'proxies' in mergedOptions && Array.isArray(mergedOptions.proxies)
-    ? mergedOptions.proxies.map((proxy: any) => ({
+    ? mergedOptions.proxies.map(proxy => ({
         ...proxy,
         https: mergedOptions.https,
         cleanup: mergedOptions.cleanup,
@@ -1323,16 +1321,25 @@ export async function startProxies(options?: ProxyOptions): Promise<void> {
     }
 
     const routingTable = buildHostRoutes(routeEntries)
-    const sharedFetchHandler = createProxyFetchHandler(
+    const baseFetchHandler = createProxyFetchHandler(
       (host, pathname) => matchHostRoute(routingTable, host, pathname),
       verbose,
     )
+    // Origin lockdown: when a CDN fronts this gateway, reject direct hits to the
+    // fronted hosts that lack the CDN's shared-secret header (the CDN injects it).
+    const originGuard = mergedOptions.originGuard ? createOriginGuard(mergedOptions.originGuard) : null
+    const sharedFetchHandler = originGuard
+      ? (req: Request, server: ProxyServerLike) => originGuard(req) ?? baseFetchHandler(req, server)
+      : baseFetchHandler
     const sharedWsHandler = createProxyWebSocketHandler(verbose)
 
     try {
       const bunServer = Bun.serve({
         port: listenPort,
         hostname: '0.0.0.0',
+        // Opt-in (RPX_REUSE_PORT): lets multiple rpx instances share :443 for
+        // multi-core scaling on Linux. Off by default — see shouldReusePort().
+        reusePort: shouldReusePort(),
         tls: {
           key: sslConfig.key,
           cert: sslConfig.cert,

package/src/types.ts

@@ -1,4 +1,5 @@
 import type { TlsConfig, TlsOption } from '@stacksjs/tlsx'
+import type { OriginGuardOptions } from './origin-guard'
 
 export interface StartOptions {
   command: string
@@ -208,6 +209,13 @@ export interface SharedProxyConfig {
    * the first time it's needed. Opt-in — see {@link OnDemandTlsConfig}.
    */
   onDemandTls?: OnDemandTlsConfig
+  /**
+   * Origin lockdown for "CDN in front of rpx" setups. When set, the shared
+   * HTTPS handler rejects requests to the listed hosts that lack the CDN's
+   * shared-secret header — so the publicly-resolvable origin can't be used to
+   * bypass the CDN. See {@link createOriginGuard}.
+   */
+  originGuard?: OriginGuardOptions
 }
 
 export type SharedProxyOptions = Partial<SharedProxyConfig>
@@ -225,6 +233,17 @@ export type BaseProxyOption = Partial<BaseProxyConfig>
 export type ProxyOption = Partial<SingleProxyConfig>
 export type ProxyOptions = Partial<SingleProxyConfig> | Partial<MultiProxyConfig>
 
+/**
+ * Internal shape used by `startProxies` after merging the built-in defaults with
+ * the caller's single- or multi-proxy options. Every field is optional, and the
+ * `proxies` array elements tolerate the per-proxy `cleanUrls`/`changeOrigin`
+ * overrides the runtime reads — so the merged object can be accessed across both
+ * single and multi shapes without falling back to `any`.
+ */
+export type ResolvedProxyOptions = Partial<SingleProxyConfig> & {
+  proxies?: Array<BaseProxyConfig & { cleanUrls?: boolean, changeOrigin?: boolean, pathRewrites?: PathRewrite[] }>
+}
+
 export interface SSLConfig {
   key: string
   cert: string

package/src/utils.ts

@@ -14,10 +14,26 @@ export function getSudoPassword(): string | undefined {
   return process.env.SUDO_PASSWORD
 }
 
+/** True when the process can write system paths without `sudo` (e.g. rpx daemon started via sudo). */
+export function isProcessElevated(): boolean {
+  if (process.platform === 'win32')
+    return false
+  try {
+    return typeof process.getuid === 'function' && process.getuid() === 0
+  }
+  catch {
+    return false
+  }
+}
+
 /**
  * Execute a command with sudo, using SUDO_PASSWORD if available
  */
 export function execSudoSync(command: string): string {
+  if (isProcessElevated()) {
+    return execSync(command, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] })
+  }
+
   const sudoPassword = getSudoPassword()
   const escaped = command.replace(/'/g, `'\\''`)
 
@@ -42,6 +58,23 @@ export function debugLog(category: string, message: string, verbose?: boolean):
     logger.debug(`[rpx:${category}] ${message}`)
 }
 
+/**
+ * Whether the proxy's listeners should set `reusePort`. Off by default: rpx is a
+ * single-instance local-dev proxy, and one instance gains nothing from
+ * `SO_REUSEPORT` while losing the helpful "port 443 already in use" guard.
+ *
+ * Opt in with `RPX_REUSE_PORT=1` when running **multiple** rpx instances behind a
+ * process manager (systemd/pm2/k8s) on **Linux**, where the kernel load-balances
+ * accepted connections across them for multi-core scaling. It is a no-op on
+ * macOS/BSD, whose `SO_REUSEPORT` does not load-balance across processes — so
+ * rpx never spawns a worker cluster itself; scaling is left to the OS + your
+ * supervisor, which is where it belongs for a dev proxy.
+ */
+export function shouldReusePort(): boolean {
+  const v = process.env.RPX_REUSE_PORT
+  return v === '1' || v === 'true'
+}
+
 const REDACTED = '[redacted]'
 const SENSITIVE_KEYS = new Set([
   'certificate',

package/dist/chunk-a0b9f9fs.js

@@ -1 +0,0 @@
-import{Ka as a,La as b,Ma as c,Na as d,Oa as e,Pa as f,Qa as g,Ra as h,Sa as i,Ta as j,Ua as k,Va as l,Wa as m,Xa as n}from"./chunk-rbgb5fyg.js";export{e as safeStringify,n as safeDeleteFile,m as resolvePathRewrite,d as redactSensitive,g as isValidRootCA,k as isSingleProxyOptions,l as isSingleProxyConfig,j as isMultiProxyOptions,i as isMultiProxyConfig,a as getSudoPassword,h as getPrimaryDomain,f as extractHostname,b as execSudoSync,c as debugLog};

package/dist/chunk-fndafyac.js

@@ -1 +0,0 @@
-import{ka as a,la as b,ma as c,na as d,oa as e,pa as f,qa as g,ra as h,sa as i,ta as j,ua as k,va as l,wa as m,xa as n}from"./chunk-zx2ghrc1.js";import"./chunk-rbgb5fyg.js";export{l as tearDownDevelopmentDns,k as syncDevelopmentDnsFromRegistry,d as stopDnsServer,c as startDnsServer,h as setupResolver,j as setupDevelopmentDns,f as resolverFilePath,m as removeResolver,i as removeLegacyTldResolvers,n as reconcileStaleDevelopmentDns,e as isDnsServerRunning,g as contentLooksLikeRpxResolver,b as RPX_RESOLVER_MARKER,a as DNS_PORT};