locadot 2.0.0 → 2.1.0-beta.0

package/dist/proxy/hub-tunnel.js

@@ -0,0 +1,241 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubTunnel = void 0;
+exports.setupNamedTunnel = setupNamedTunnel;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const constants_1 = __importDefault(require("../constants"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const tunnel_1 = require("./tunnel");
+/**
+ * Runs the sender's own cloudflared, mirroring TunnelManager in tunnel.ts but for a single
+ * public hostname instead of one tunnel per mapping.
+ */
+const QUICK_URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+const REGISTERED_PATTERN = /Registered tunnel connection/i;
+const HTTPS_URL_PATTERN = /https:\/\/\S+/;
+const LOGIN_WAIT_MS = 10 * 60000;
+const DEFAULT_TUNNEL = "locadot";
+const isHostname = (value) => {
+    if (!value || value.length > 253)
+        return false;
+    const labels = value.toLowerCase().split(".");
+    return labels.length >= 2 && labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+};
+const trimSlash = (value) => value.replace(/\/$/, "");
+const configEqual = (a, b) => {
+    if (!a || !b)
+        return a === b;
+    return a.mode === b.mode && a.domain === b.domain && a.tunnel === b.tunnel && a.url === b.url;
+};
+class HubTunnel {
+    constructor(origin) {
+        this.origin = origin;
+        this.st = { enabled: false, status: "off" };
+    }
+    state() {
+        return { ...this.st };
+    }
+    /** hostname of state().url when up (manual mode too: the configured url). */
+    publicHost() {
+        if (this.st.status !== "up" || !this.st.url)
+            return undefined;
+        try {
+            return new URL(this.st.url).hostname;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    sync(config) {
+        const origin = this.origin();
+        if (this.applied && configEqual(this.applied.config, config) && this.applied.origin === origin)
+            return;
+        this.killChild();
+        this.applied = { config, origin };
+        if (!config) {
+            this.st = { enabled: false, status: "off" };
+            return;
+        }
+        if (config.mode === "manual") {
+            const url = config.url ? trimSlash(config.url) : undefined;
+            this.st = url
+                ? { enabled: true, mode: "manual", status: "up", url }
+                : { enabled: true, mode: "manual", status: "error", error: "No url configured." };
+            return;
+        }
+        const file = (0, tunnel_1.cloudflaredPath)();
+        if (!file) {
+            this.st = { enabled: true, mode: config.mode, status: "error", error: "cloudflared is not installed. Run `locadot tunnel:install`." };
+            return;
+        }
+        this.st = { enabled: true, mode: config.mode, status: "starting" };
+        if (config.mode === "quick")
+            this.startQuick(file, origin);
+        else
+            this.startNamed(file, config, origin);
+    }
+    startQuick(file, origin) {
+        const config = path_1.default.join(constants_1.default.paths.HOME, "cloudflared-hub-quick.yml");
+        fs_1.default.writeFileSync(config, "");
+        const child = (0, child_process_1.spawn)(file, ["tunnel", "--no-autoupdate", "--config", config, "--url", origin], {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        this.attach(child, (text) => {
+            const url = text.match(QUICK_URL_PATTERN)?.[0];
+            if (url && this.st.status !== "up") {
+                this.st = { ...this.st, status: "up", url };
+                logger_1.default.info(`🌍 hub is public at ${url}`);
+            }
+        });
+    }
+    startNamed(file, config, origin) {
+        const tunnel = config.tunnel || DEFAULT_TUNNEL;
+        const child = (0, child_process_1.spawn)(file, ["tunnel", "--no-autoupdate", "run", "--url", origin, tunnel], {
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        this.attach(child, (text) => {
+            if (REGISTERED_PATTERN.test(text) && this.st.status !== "up") {
+                const url = `https://${config.domain}`;
+                this.st = { ...this.st, status: "up", url };
+                logger_1.default.info(`🌍 hub is public at ${url}`);
+            }
+        });
+    }
+    attach(child, onData) {
+        const running = { child, tail: "" };
+        this.running = running;
+        const read = (chunk) => {
+            const text = chunk.toString("utf8");
+            running.tail = (running.tail + text).slice(-2000);
+            onData(text);
+        };
+        child.stdout?.on("data", read);
+        child.stderr?.on("data", read);
+        child.on("error", (error) => {
+            if (this.running !== running)
+                return;
+            this.st = { ...this.st, status: "error", error: error.message };
+            this.running = undefined;
+        });
+        child.on("exit", (code) => {
+            if (this.running !== running)
+                return;
+            const reason = running.tail
+                .split(/\r?\n/)
+                .filter((line) => /ERR|error|failed/i.test(line))
+                .pop()
+                ?.trim();
+            this.st = { ...this.st, status: "error", error: reason || `cloudflared exited (${code})`, url: undefined };
+            this.running = undefined;
+            logger_1.default.warn(`🌍 hub tunnel stopped: ${this.st.error}`);
+        });
+    }
+    killChild() {
+        this.running?.child.kill();
+        this.running = undefined;
+    }
+    /** Background named-tunnel setup: reflects progress (incl. loginUrl) in state() rather than throwing. */
+    setupNamed(domain, tunnel) {
+        this.st = { enabled: true, mode: "named", status: "login" };
+        return setupNamedTunnel(domain, tunnel, (url) => {
+            this.st = { ...this.st, loginUrl: url };
+        })
+            .then((config) => {
+            hub_config_1.default.write(config);
+            this.applied = undefined; // force sync() to (re)apply the fresh config
+            this.sync(config);
+        })
+            .catch((error) => {
+            this.st = { enabled: true, mode: "named", status: "error", error: error?.message || String(error) };
+        });
+    }
+    stop() {
+        this.killChild();
+        this.applied = undefined;
+        this.st = { enabled: false, status: "off" };
+    }
+}
+exports.HubTunnel = HubTunnel;
+const runCapture = (file, args, opts = {}) => new Promise((resolve, reject) => {
+    const child = (0, child_process_1.spawn)(file, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    let output = "";
+    let done = false;
+    const timer = opts.timeoutMs
+        ? setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            child.kill();
+            reject(new Error(`${args.join(" ")} timed out`));
+        }, opts.timeoutMs)
+        : undefined;
+    const read = (chunk) => {
+        const text = chunk.toString("utf8");
+        output += text;
+        opts.onData?.(text);
+    };
+    child.stdout?.on("data", read);
+    child.stderr?.on("data", read);
+    child.on("error", (error) => {
+        if (done)
+            return;
+        done = true;
+        if (timer)
+            clearTimeout(timer);
+        reject(error);
+    });
+    child.on("exit", (code) => {
+        if (done)
+            return;
+        done = true;
+        if (timer)
+            clearTimeout(timer);
+        resolve({ code, output });
+    });
+});
+/**
+ * Used by the CLI (outside the proxy). Logs in if ~/.cloudflared/cert.pem is missing, creates the
+ * tunnel (reusing an existing one), routes DNS with --overwrite-dns.
+ */
+async function setupNamedTunnel(domain, tunnel = DEFAULT_TUNNEL, onLoginUrl) {
+    if (!isHostname(domain))
+        throw new Error(`Invalid domain "${domain}".`);
+    const file = (0, tunnel_1.cloudflaredPath)();
+    if (!file)
+        throw new Error("cloudflared is not installed. Run `locadot tunnel:install`.");
+    const certPath = path_1.default.join(os_1.default.homedir(), ".cloudflared", "cert.pem");
+    if (!fs_1.default.existsSync(certPath)) {
+        let announced = false;
+        const login = await runCapture(file, ["tunnel", "login"], {
+            timeoutMs: LOGIN_WAIT_MS,
+            onData: (text) => {
+                if (announced)
+                    return;
+                const url = text.match(HTTPS_URL_PATTERN)?.[0];
+                if (url) {
+                    announced = true;
+                    onLoginUrl?.(url);
+                }
+            },
+        });
+        if (login.code !== 0)
+            throw new Error(`cloudflared login failed: ${login.output.trim().slice(-500)}`);
+    }
+    const create = await runCapture(file, ["tunnel", "create", tunnel]);
+    if (create.code !== 0 && !/already exists/i.test(create.output)) {
+        throw new Error(`cloudflared tunnel create failed: ${create.output.trim().slice(-500)}`);
+    }
+    const route = await runCapture(file, ["tunnel", "route", "dns", "--overwrite-dns", tunnel, domain]);
+    if (route.code !== 0)
+        throw new Error(`cloudflared tunnel route dns failed: ${route.output.trim().slice(-500)}`);
+    return { mode: "named", domain, tunnel };
+}

package/dist/proxy/hub.js

@@ -0,0 +1,280 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetRateLimiter = void 0;
+exports.classify = classify;
+exports.handleHubApi = handleHubApi;
+const os_1 = __importDefault(require("os"));
+const constants_1 = __importDefault(require("../constants"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const links_1 = __importStar(require("../lib/links"));
+const hosts_1 = __importStar(require("../lib/hosts"));
+const localhost_1 = require("../lib/localhost");
+const registry_1 = require("../lib/registry");
+const request_1 = require("./request");
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { version } = require("../../package.json");
+const MAX_BODY = 64 * 1024;
+const RATE_LIMIT_WINDOW_MS = 10 * 60000;
+const RATE_LIMIT_MAX = 20;
+class HubApiError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/* ---------- per-IP auth-failure rate limiting, shared by classify() and the /_locadot/v1 API ---------- */
+const failures = new Map();
+const recentFailures = (ip, now) => (failures.get(ip) || []).filter((at) => now - at < RATE_LIMIT_WINDOW_MS);
+const isLimited = (ip) => {
+    const now = Date.now();
+    const recent = recentFailures(ip, now);
+    failures.set(ip, recent);
+    return recent.length >= RATE_LIMIT_MAX;
+};
+const recordFailure = (ip) => {
+    const now = Date.now();
+    failures.set(ip, [...recentFailures(ip, now), now]);
+};
+/** Test-only: forget every recorded failure. */
+const resetRateLimiter = () => failures.clear();
+exports.resetRateLimiter = resetRateLimiter;
+const clientIp = (req) => {
+    const header = req.headers["cf-connecting-ip"];
+    const value = Array.isArray(header) ? header[0] : header;
+    return value || req.socket.remoteAddress || "unknown";
+};
+const bearerToken = (req) => {
+    const header = req.headers.authorization;
+    const match = typeof header === "string" ? /^Bearer\s+(\S+)$/i.exec(header) : null;
+    return match?.[1];
+};
+/* ---------- app traffic: classify every request that arrives on the hub's public hostname ---------- */
+function classify(req, publicHost, hosts) {
+    if (!publicHost || (0, request_1.hostOf)(req) !== publicHost)
+        return { kind: "none" };
+    const pathname = (req.url || "/").split("?")[0];
+    if (pathname === "/_locadot" || pathname.startsWith("/_locadot/"))
+        return { kind: "api" };
+    const ip = clientIp(req);
+    if (isLimited(ip))
+        return { kind: "deny", status: 429, message: "Too many failed attempts. Try again later." };
+    // Not Authorization: the sender's own apps may need that header from the visitor.
+    const token = req.headers["x-locadot-peer"];
+    const peer = links_1.default.authenticate(typeof token === "string" ? token.trim() : undefined);
+    if (!peer) {
+        recordFailure(ip);
+        return { kind: "deny", status: 401, message: "Unauthorized" };
+    }
+    const hostHeader = req.headers["x-locadot-host"];
+    const host = typeof hostHeader === "string" ? hostHeader.trim().toLowerCase() : "";
+    const entry = host ? hosts[host] : undefined;
+    if (!host || constants_1.default.dashboardHosts.includes(host) || !entry || entry.remote) {
+        return { kind: "deny", status: 404, message: "Not found" };
+    }
+    const visible = links_1.default.visibleHosts(peer, Object.keys(hosts));
+    if (!visible.includes(host)) {
+        return { kind: "deny", status: 403, message: "Forbidden" };
+    }
+    for (const name of Object.keys(req.headers))
+        if (name.toLowerCase().startsWith("x-locadot-"))
+            delete req.headers[name];
+    return { kind: "app", host, peer };
+}
+/* ---------- /_locadot/v1 API ---------- */
+const send = (res, status, body) => {
+    const json = JSON.stringify(body);
+    res.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(json) });
+    res.end(json);
+};
+const readJson = (req) => new Promise((resolve, reject) => {
+    const type = String(req.headers["content-type"] || "");
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_BODY)
+            reject(new HubApiError(413, "Request body too large."));
+        else
+            chunks.push(chunk);
+    });
+    req.on("error", reject);
+    req.on("end", () => {
+        if (!/^application\/json\b/i.test(type))
+            return reject(new HubApiError(400, "Content-Type must be application/json."));
+        try {
+            const value = size ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : {};
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw new Error();
+            resolve(value);
+        }
+        catch {
+            reject(new HubApiError(400, "Body must be a JSON object."));
+        }
+    });
+});
+const requireString = (value, name) => {
+    if (typeof value !== "string" || !value.trim())
+        throw new HubApiError(400, `\`${name}\` is required.`);
+    return value;
+};
+const optionalBool = (value, name) => {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "boolean")
+        throw new HubApiError(400, `\`${name}\` must be true or false.`);
+    return value;
+};
+/** connect name: printable characters only, capped so it can't be used to stuff the peers file. */
+const sanitizeName = (value) => {
+    const raw = typeof value === "string" ? value : "";
+    const printable = raw.replace(/[^\x20-\x7E]/g, "").trim();
+    return (printable || "peer").slice(0, 40);
+};
+const requirePerm = (peer, permission) => {
+    if (!links_1.default.can(peer, permission))
+        throw new HubApiError(403, "Forbidden");
+};
+const peerView = (peer) => {
+    const { id, name, role, hosts } = peer;
+    return hosts ? { id, name, role, hosts } : { id, name, role };
+};
+const senderInfo = () => ({ hostname: os_1.default.hostname(), version: String(version) });
+const hostView = (host, entry) => ({
+    host,
+    target: entry.target,
+    cors: Boolean(entry.cors),
+    insecure: Boolean(entry.insecure),
+});
+async function handleHubApi(req, res, ctx) {
+    const url = new URL(req.url || "/", "http://hub.invalid");
+    const path = url.pathname;
+    const method = req.method || "GET";
+    const ip = clientIp(req);
+    try {
+        if (path === "/_locadot/v1/connect" && method === "POST") {
+            const body = await readJson(req);
+            const code = requireString(body.code, "code");
+            const name = sanitizeName(body.name);
+            const { peer, token } = links_1.default.redeem(code, name);
+            logger_1.default.info(`🔗 hub: ${peer.name} connected as ${peer.role}`);
+            return send(res, 200, { token, peer: peerView(peer), sender: senderInfo() });
+        }
+        if (isLimited(ip))
+            return send(res, 429, { error: "Too many failed attempts. Try again later." });
+        const peer = links_1.default.authenticate(bearerToken(req));
+        if (!peer) {
+            recordFailure(ip);
+            return send(res, 401, { error: "Unauthorized" });
+        }
+        if (path === "/_locadot/v1/whoami" && method === "GET") {
+            requirePerm(peer, "read");
+            return send(res, 200, { peer: peerView(peer), sender: senderInfo() });
+        }
+        if (path === "/_locadot/v1/hosts" && method === "GET") {
+            requirePerm(peer, "read");
+            const registry = ctx.getRegistry();
+            const visible = links_1.default.visibleHosts(peer, Object.keys(registry.hosts));
+            const hosts = visible.filter((host) => !registry.hosts[host].remote).map((host) => hostView(host, registry.hosts[host]));
+            return send(res, 200, { hosts });
+        }
+        if (path === "/_locadot/v1/hosts" && method === "POST") {
+            requirePerm(peer, "write");
+            const body = await readJson(req);
+            const { host, entry } = await hosts_1.default.add({
+                host: body.host,
+                target: body.target,
+                insecure: optionalBool(body.insecure, "insecure"),
+                cors: optionalBool(body.cors, "cors"),
+            });
+            ctx.reload();
+            logger_1.default.info(`➕ hub: ${peer.name} added ${host} → ${entry.target}`);
+            return send(res, 201, { host: hostView(host, entry) });
+        }
+        const hostMatch = /^\/_locadot\/v1\/hosts\/([^/]+)$/.exec(path);
+        if (hostMatch && method === "PUT") {
+            requirePerm(peer, "write");
+            const host = decodeURIComponent(hostMatch[1]);
+            const body = await readJson(req);
+            const tunnel = optionalBool(body.tunnel, "tunnel");
+            if (tunnel !== undefined)
+                requirePerm(peer, "settings");
+            let updated;
+            if (body.target !== undefined || tunnel === undefined) {
+                updated = await hosts_1.default.update({
+                    host,
+                    target: body.target,
+                    insecure: optionalBool(body.insecure, "insecure"),
+                    cors: optionalBool(body.cors, "cors"),
+                });
+            }
+            if (tunnel !== undefined)
+                updated = await hosts_1.default.setTunnel({ host, tunnel });
+            ctx.reload();
+            if (tunnel)
+                ctx.retryTunnels();
+            logger_1.default.info(`✏️ hub: ${peer.name} updated ${host}`);
+            return send(res, 200, { host: hostView(updated.host, updated.entry) });
+        }
+        if (hostMatch && method === "DELETE") {
+            requirePerm(peer, "delete");
+            const host = decodeURIComponent(hostMatch[1]);
+            await hosts_1.default.remove({ host });
+            ctx.reload();
+            logger_1.default.info(`🗑️ hub: ${peer.name} removed ${host}`);
+            return send(res, 200, { ok: true });
+        }
+        send(res, 404, { error: "Not found" });
+    }
+    catch (error) {
+        if (error instanceof hosts_1.NotFoundError)
+            return send(res, 404, { error: error.message.replace(/^❌\s*/u, "") });
+        if (error instanceof hosts_1.ConflictError)
+            return send(res, 409, { error: error.message.replace(/^❌\s*/u, "") });
+        if (error instanceof localhost_1.InputError)
+            return send(res, 400, { error: error.message.replace(/^❌\s*/u, "") });
+        if (error instanceof registry_1.RegistryError)
+            return send(res, 500, { error: error.message });
+        if (error instanceof HubApiError)
+            return send(res, error.status, { error: error.message });
+        if (error instanceof links_1.LinkError)
+            return send(res, error.status, { error: error.message });
+        logger_1.default.error(error);
+        return send(res, 500, { error: "Internal error." });
+    }
+}

package/dist/proxy/remote.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.remoteOptions = exports.remoteFor = void 0;
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const request_1 = require("./request");
+let cache;
+/** REMOTES_FILE, re-parsed only when its mtime changes so the proxy doesn't hit disk per request. */
+const remoteFor = (name) => {
+    let stat;
+    try {
+        stat = fs_1.default.statSync(constants_1.default.paths.REMOTES_FILE);
+    }
+    catch {
+        cache = undefined;
+        return undefined;
+    }
+    if (!cache || cache.mtimeMs !== stat.mtimeMs) {
+        let data = { remotes: {} };
+        try {
+            const parsed = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.REMOTES_FILE, "utf8"));
+            if (parsed && typeof parsed.remotes === "object")
+                data = parsed;
+        }
+        catch { }
+        cache = { mtimeMs: stat.mtimeMs, data };
+    }
+    return cache.data.remotes[name];
+};
+exports.remoteFor = remoteFor;
+const remoteOptions = (req, entry, remote) => ({
+    target: remote.url,
+    changeOrigin: true,
+    // Don't leak the receiver's LAN addresses to the sender.
+    xfwd: false,
+    ws: true,
+    secure: true,
+    autoRewrite: true,
+    hostRewrite: req.headers.host,
+    protocolRewrite: (0, request_1.isTls)(req) ? "https" : "http",
+    cookieDomainRewrite: { "*": "" },
+    headers: {
+        "X-Original-Host": req.headers.host || "",
+        "X-Locadot-Peer": remote.token,
+        "X-Locadot-Host": entry.remote.host,
+    },
+});
+exports.remoteOptions = remoteOptions;

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -19,8 +19,10 @@ const mappedHost = (req) => tags.get(req)?.host ?? (0, exports.hostOf)(req);
 exports.mappedHost = mappedHost;
 const fromTunnel = (req) => Boolean(tags.get(req)?.tunnel);
 exports.fromTunnel = fromTunnel;
+const fromRemote = (req) => Boolean(tags.get(req)?.remote);
+exports.fromRemote = fromRemote;
 const viaOf = (req) => tags.get(req)?.via;
 exports.viaOf = viaOf;
 /** Tunnel visitors are on https even though cloudflared talks plain http to us. */
-const isTls = (req) => Boolean(req.socket.encrypted) || (0, exports.fromTunnel)(req);
+const isTls = (req) => Boolean(req.socket.encrypted) || (0, exports.fromTunnel)(req) || Boolean(tags.get(req)?.secure);
 exports.isTls = isTls;