locadot 2.2.0 → 2.3.0

package/dist/index.js

@@ -44,8 +44,17 @@ program
     .description("HTTPS custom *.localhost domains for any local or remote upstream")
     .version(package_json_1.version)
     .helpOption("--help", "Display help for command");
-destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption())).action(run((options) => commands_1.default.add(options)));
+destinationOptions(program.command("add").description("Map a new domain to a port or URL").addOption(hostOption()))
+    .option("--allow <addresses>", "Internal addresses shared visitors may reach through --cors, e.g. localhost:3000,localhost:4000")
+    .action(run((options) => commands_1.default.add(options)));
 destinationOptions(program.command("update").description("Change the destination of a mapped domain").addOption(hostOption())).action(run((options) => commands_1.default.update(options)));
+program
+    .command("allow [addresses...]")
+    .description("Let tunnel visitors and connected machines reach internal addresses (localhost:3000) through a --cors domain")
+    .addOption(hostOption())
+    .option("--rm", "Remove the given addresses instead of adding them")
+    .option("--clear", "Remove every allowed address")
+    .action(run((addresses, options) => commands_1.default.allow(addresses, options)));
 program
     .command("remove")
     .alias("rm")
@@ -74,8 +83,9 @@ program
     .action(run((host) => commands_1.default.open(host)));
 program
     .command("tunnel")
-    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account); lists shared domains without --host")
+    .description("Share a domain on a public https://*.trycloudflare.com URL (Cloudflare quick tunnel, no account) or on your own hostname; lists shared domains without --host")
     .option("-h, --host <host>", "Domain to share, e.g. app.localhost")
+    .option("-d, --domain <hostname>", "Share on this hostname in your Cloudflare account (named tunnel), e.g. app.example.com")
     .option("--off", "Stop sharing it")
     .action(run((options) => commands_1.default.tunnel(options)));
 program.command("tunnel:install").description("Download cloudflared into the locadot state dir").action(run(() => commands_1.default.installTunnel()));

package/dist/lib/allow.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowMatches = exports.splitHost = exports.parseAllowList = exports.parseAllow = exports.MAX_ALLOW = void 0;
+const net_1 = __importDefault(require("net"));
+const guard_1 = require("../proxy/guard");
+const localhost_1 = require("./localhost");
+/**
+ * A mapping's `allow` list: internal addresses (`localhost:3000`, `api.internal`) that a tunnel visitor or hub peer
+ * may reach through that mapping's --cors pass-through. Everyone else stays limited to public hosts.
+ */
+exports.MAX_ALLOW = 32;
+const LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+const HOSTNAME = new RegExp(`^${LABEL}(?:\\.${LABEL})*$`);
+/** Loopback spellings (127.0.0.1, 0.0.0.0) all mean this machine, and the shim sends whichever the app wrote. */
+const canonicalHost = (host) => ((0, guard_1.isLoopbackHost)(host) && !host.endsWith(".localhost") ? "localhost" : host);
+const parseAllow = (value) => {
+    if (typeof value !== "string")
+        throw new localhost_1.InputError("❌ Each allowed address must be a string, e.g. localhost:3000.");
+    const raw = value.trim().toLowerCase();
+    const bare = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/$/, "");
+    const match = bare.match(/^([^:/\s]+)(?::(\d{1,5}))?$/);
+    const port = match?.[2] === undefined ? undefined : Number(match[2]);
+    if (!match || !(net_1.default.isIPv4(match[1]) || HOSTNAME.test(match[1])) || (port !== undefined && (port < 1 || port > 65535))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a host or host:port, e.g. localhost:3000 or api.internal.`);
+    }
+    const host = canonicalHost(match[1]);
+    return port === undefined ? host : `${host}:${port}`;
+};
+exports.parseAllow = parseAllow;
+/** Normalizes and de-duplicates; an empty list clears it. */
+const parseAllowList = (value) => {
+    const items = typeof value === "string" ? value.split(",").filter((item) => item.trim()) : value;
+    if (!Array.isArray(items))
+        throw new localhost_1.InputError("❌ `allow` must be a list of addresses, e.g. [\"localhost:3000\"].");
+    const list = [...new Set(items.map(exports.parseAllow))];
+    if (list.length > exports.MAX_ALLOW)
+        throw new localhost_1.InputError(`❌ At most ${exports.MAX_ALLOW} allowed addresses per mapping.`);
+    return list;
+};
+exports.parseAllowList = parseAllowList;
+const defaultPort = (scheme) => (scheme === "https" || scheme === "wss" ? 443 : 80);
+/** `host` from the pass-through URL (no brackets: parseVia only accepts names and IPv4). */
+const splitHost = (host, scheme) => {
+    const match = host.toLowerCase().match(/^(.*?)(?::(\d+))?$/);
+    return { host: canonicalHost(match[1].replace(/\.$/, "")), port: match[2] ? Number(match[2]) : defaultPort(scheme) };
+};
+exports.splitHost = splitHost;
+const allowMatches = (allow, host, scheme) => {
+    if (!allow?.length)
+        return false;
+    const target = (0, exports.splitHost)(host, scheme);
+    return allow.some((entry) => {
+        const [name, port] = entry.split(":");
+        return name === target.host && (port === undefined || Number(port) === target.port);
+    });
+};
+exports.allowMatches = allowMatches;

package/dist/lib/hosts.js

@@ -36,10 +36,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConflictError = exports.NotFoundError = void 0;
+exports.parseTunnelDomain = exports.ConflictError = exports.NotFoundError = void 0;
 const constants_1 = __importDefault(require("../constants"));
 const localhost_1 = __importStar(require("./localhost"));
 const registry_1 = __importDefault(require("./registry"));
+const allow_1 = require("./allow");
+const hub_config_1 = __importDefault(require("./hub-config"));
 class NotFoundError extends localhost_1.InputError {
 }
 exports.NotFoundError = NotFoundError;
@@ -53,17 +55,30 @@ const requireTarget = (value) => {
     }
     return localhost_1.default.parseTarget(String(value));
 };
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A public hostname on the user's Cloudflare zone, e.g. app.example.com (scheme and trailing slash allowed). */
+const parseTunnelDomain = (value) => {
+    const domain = typeof value === "string" ? value.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/$/, "") : "";
+    const labels = domain.split(".");
+    const tld = labels[labels.length - 1];
+    if (domain.length > 253 || labels.length < 2 || tld === "localhost" || !/[a-z]/.test(tld) || !labels.every((label) => LABEL.test(label))) {
+        throw new localhost_1.InputError(`❌ "${value}" isn't a public hostname, e.g. app.example.com.`);
+    }
+    return domain;
+};
+exports.parseTunnelDomain = parseTunnelDomain;
 class HostOps {
     static async add(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? [] : (0, allow_1.parseAllowList)(input.allow);
         const now = new Date().toISOString();
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -71,24 +86,57 @@ class HostOps {
     static async update(input) {
         const host = localhost_1.default.requireHost(input.host);
         const target = requireTarget(input.target);
+        const allow = input.allow === undefined ? undefined : (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             const insecure = input.insecure ?? existing.insecure;
             const cors = input.cors ?? existing.cors;
-            registry.hosts[host] = { ...existing, target, insecure: insecure || undefined, cors: cors || undefined, updatedAt: new Date().toISOString() };
+            const list = allow ?? existing.allow;
+            registry.hosts[host] = {
+                ...existing,
+                target,
+                insecure: insecure || undefined,
+                cors: cors || undefined,
+                allow: list?.length ? list : undefined,
+                updatedAt: new Date().toISOString(),
+            };
             return registry.hosts[host];
         });
         return { host, entry };
     }
+    /** Sharing on: `domain` shares on that hostname, none on a random trycloudflare.com URL. Sharing off keeps the hostname for next time. */
     static async setTunnel(input) {
         const host = localhost_1.default.requireHost(input.host);
+        const domain = input.tunnel && input.domain !== undefined && input.domain !== null && input.domain !== "" ? (0, exports.parseTunnelDomain)(input.domain) : undefined;
+        if (domain && hub_config_1.default.read()?.domain === domain)
+            throw new ConflictError(`❌ ${domain} is this machine's remote-access hostname.`);
+        const entry = await registry_1.default.mutate((registry) => {
+            const existing = registry.hosts[host];
+            if (!existing)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            if (domain && existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; share it on a custom hostname from that machine.`);
+            const taken = domain && Object.entries(registry.hosts).find(([other, e]) => other !== host && e.tunnelDomain === domain)?.[0];
+            if (taken)
+                throw new ConflictError(`❌ ${domain} is already the shared hostname of ${taken}.`);
+            const tunnelDomain = input.tunnel ? domain : existing.tunnelDomain;
+            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, tunnelDomain, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
+    static async setAllow(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const allow = (0, allow_1.parseAllowList)(input.allow);
         const entry = await registry_1.default.mutate((registry) => {
             const existing = registry.hosts[host];
             if (!existing)
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
-            registry.hosts[host] = { ...existing, tunnel: input.tunnel || undefined, updatedAt: new Date().toISOString() };
+            if (existing.remote)
+                throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; set its allowed addresses on that machine.`);
+            registry.hosts[host] = { ...existing, allow: allow.length ? allow : undefined, updatedAt: new Date().toISOString() };
             return registry.hosts[host];
         });
         return { host, entry };

package/dist/proxy/guard.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
+exports.notSelfAgents = exports.isSelfAddress = exports.publicOnlyAgents = exports.isPublicHost = exports.isLoopbackHost = exports.isPublicAddress = void 0;
 const dns_1 = __importDefault(require("dns"));
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
+const os_1 = __importDefault(require("os"));
 /**
  * Tunnel visitors are the internet. Their --cors pass-through calls may only leave this machine
  * for public addresses, never loopback, the LAN or cloud metadata.
@@ -93,3 +94,31 @@ exports.publicOnlyAgents = {
     http: new http_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
     https: new https_1.default.Agent({ keepAlive: true, lookup: publicLookup }),
 };
+/** Loopback or one of this machine's own interface addresses (its LAN IP reaches the proxy just as well). */
+const isSelfAddress = (address) => {
+    if ((0, exports.isLoopbackHost)(address))
+        return true;
+    const own = Object.values(os_1.default.networkInterfaces()).flatMap((list) => (list || []).map((item) => item.address.toLowerCase()));
+    return own.includes(address.replace(/^\[|\]$/g, "").toLowerCase());
+};
+exports.isSelfAddress = isSelfAddress;
+// For an allowed address on the proxy's own port: whatever the name resolves to, it must not be this machine.
+const notSelfLookup = (hostname, options, callback) => {
+    dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err)
+            return callback(err, "", 0);
+        const allowed = addresses.filter((entry) => !(0, exports.isSelfAddress)(entry.address));
+        if (!allowed.length) {
+            const error = new Error(`${hostname} is this machine`);
+            error.code = "ESELF";
+            return callback(error, "", 0);
+        }
+        if (options.all)
+            return callback(null, allowed);
+        callback(null, allowed[0].address, allowed[0].family);
+    });
+};
+exports.notSelfAgents = {
+    http: new http_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+    https: new https_1.default.Agent({ keepAlive: true, lookup: notSelfLookup }),
+};

package/dist/proxy/options.js

@@ -22,14 +22,22 @@ const proxyOptions = (req, entry, lookup) => ({
     headers: { "X-Original-Host": req.headers.host || "", ...(entry.cors ? { ...(0, cors_1.sameOriginHeaders)(req, entry, lookup), ...DECODABLE } : {}) },
 });
 exports.proxyOptions = proxyOptions;
-const viaOptions = (req, entry, via) => ({
+const agentFor = (req, via, listed) => {
+    const tls = via.scheme === "https" || via.scheme === "wss";
+    if (listed === "not-self")
+        return { agent: tls ? guard_1.notSelfAgents.https : guard_1.notSelfAgents.http };
+    if ((0, request_1.fromTunnel)(req) && !listed)
+        return { agent: tls ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http };
+    return {};
+};
+const viaOptions = (req, entry, via, listed) => ({
     target: (0, exports.viaOrigin)(via),
     changeOrigin: true,
     ws: true,
     secure: !entry.insecure,
     cookieDomainRewrite: { "*": "" },
     headers: { ...(0, passthrough_1.viaHeaders)(req, via, entry.target), ...DECODABLE },
-    ...((0, request_1.fromTunnel)(req) ? { agent: via.scheme === "https" || via.scheme === "wss" ? guard_1.publicOnlyAgents.https : guard_1.publicOnlyAgents.http } : {}),
+    ...agentFor(req, via, listed),
 });
 exports.viaOptions = viaOptions;
 const viaOrigin = (via) => `${via.scheme}://${via.host}`;

package/dist/proxy/router.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRequest = handleRequest;
 exports.handleUpgrade = handleUpgrade;
 const http_1 = __importDefault(require("http"));
+const net_1 = __importDefault(require("net"));
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
@@ -14,6 +15,7 @@ const remote_1 = require("./remote");
 const cors_1 = require("./cors");
 const options_1 = require("./options");
 const guard_1 = require("./guard");
+const allow_1 = require("../lib/allow");
 const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
@@ -55,8 +57,23 @@ const peerMayReach = (req, via) => {
     const port = Number(via.host.match(/:(\d+)$/)?.[1] || (via.scheme === "https" || via.scheme === "wss" ? 443 : 80));
     return Boolean(allowed && !allowed.includes(port));
 };
-/** Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost. */
-const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via);
+/**
+ * An address on the mapping's `allow` list. The proxy's own ports on this machine never are (the dashboard is behind
+ * them): "not-self" means the name must be checked at connect time, on the address actually dialled.
+ */
+const listed = (req, ctx, entry, via) => {
+    if (!((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req)) || !(0, allow_1.allowMatches)(entry.allow, via.host, via.scheme))
+        return undefined;
+    const { host, port } = (0, allow_1.splitHost)(via.host, via.scheme);
+    if (!(ctx.ownPorts?.() ?? []).includes(port))
+        return "open";
+    return (0, guard_1.isSelfAddress)(host) ? undefined : net_1.default.isIP(host) ? "open" : "not-self";
+};
+/**
+ * Same-origin only, a tunnel visitor may only reach public hosts (see guard.ts), and a peer only its share of localhost,
+ * unless the mapping's owner listed the address in `allow`.
+ */
+const viaAllowed = (req, via, allowed) => (0, passthrough_1.isSameOrigin)(req) && (Boolean(allowed) || ((!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host)) && peerMayReach(req, via)));
 /**
  * Receiver side: `<sender host>=<our URL for it>` for every mapping of this remote, so a --cors sender rewrites
  * its apps' origins to the names this machine uses rather than its own.
@@ -136,9 +153,11 @@ function handleRequest(req, res, ctx) {
             return;
         }
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-            res.end("locadot: the pass-through only serves the page's own requests, and only public hosts through a tunnel.\n");
+            res.end(`locadot: the pass-through only serves the page's own requests, and only public hosts to shared visitors. ` +
+                `To let them reach ${via.host}, run \`locadot allow --host ${host} ${via.host}\` on this machine, or use Internal access on the mapping in the dashboard.\n`);
             return;
         }
         const started = Date.now();
@@ -148,7 +167,7 @@ function handleRequest(req, res, ctx) {
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
             (0, request_1.tag)(req, { via });
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         const upstream = via ? (0, options_1.viaOrigin)(via) : entry.target;
@@ -252,14 +271,15 @@ function handleUpgrade(req, socket, head, ctx) {
             return;
         }
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
-        if (via && !viaAllowed(req, via)) {
+        const allowed = via && listed(req, ctx, entry, via);
+        if (via && !viaAllowed(req, via, allowed)) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
             return;
         }
         logger_1.default.debug(`WebSocket upgrade for ${host}`);
         let options = (0, options_1.proxyOptions)(req, entry, ctx.lookup);
         if (via) {
-            options = (0, options_1.viaOptions)(req, entry, via);
+            options = (0, options_1.viaOptions)(req, entry, via, allowed);
             req.url = via.path;
         }
         ctx.proxy.ws(req, socket, head, options, (err) => {

package/dist/proxy/tunnel.js

@@ -11,8 +11,10 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
+const hub_tunnel_1 = require("./hub-tunnel");
 /**
- * Public sharing through Cloudflare quick tunnels (https://<random>.trycloudflare.com, no account).
+ * Public sharing through Cloudflare quick tunnels (https://<random>.trycloudflare.com, no account),
+ * or through a named tunnel per mapping on the user's own hostname (`tunnelDomain`).
  * cloudflared forwards to the proxy's HTTP port with the public Host header, and the proxy maps
  * that name back to the mapping, so redirects and cookies stay on the public name.
  */
@@ -20,6 +22,7 @@ const exe = os_1.default.platform() === "win32" ? "cloudflared.exe" : "cloudflar
 const BIN_DIR = path_1.default.join(constants_1.default.paths.HOME, "bin");
 const RELEASES = "https://github.com/cloudflare/cloudflared/releases/latest/download/";
 const URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+const REGISTERED_PATTERN = /Registered tunnel connection/i;
 const onPath = () => {
     const finder = os_1.default.platform() === "win32" ? "where" : "which";
     const result = (0, child_process_1.spawnSync)(finder, ["cloudflared"], { encoding: "utf8", windowsHide: true });
@@ -37,11 +40,12 @@ const cloudflaredInfo = (fresh = false) => {
     if (!fresh && cached && Date.now() - cached.at < 60000)
         return cached.info;
     const file = (0, exports.cloudflaredPath)();
-    let info = { installed: false };
+    const loggedIn = fs_1.default.existsSync(path_1.default.join(os_1.default.homedir(), ".cloudflared", "cert.pem"));
+    let info = { installed: false, loggedIn };
     if (file) {
         const result = (0, child_process_1.spawnSync)(file, ["--version"], { encoding: "utf8", timeout: 5000, windowsHide: true });
         const version = `${result.stdout || ""}${result.stderr || ""}`.match(/version\s+(\S+)/i)?.[1];
-        info = { installed: result.status === 0, path: file, ...(version ? { version } : {}) };
+        info = { installed: result.status === 0, loggedIn, path: file, ...(version ? { version } : {}) };
     }
     cached = { at: Date.now(), info };
     return info;
@@ -121,7 +125,7 @@ class TunnelManager {
         this.origin = origin;
         this.tunnels = new Map();
     }
-    /** The mapping a public trycloudflare.com Host belongs to. */
+    /** The mapping a public Host (trycloudflare.com or a custom hostname) belongs to. */
     hostFor(publicHost) {
         for (const [host, tunnel] of this.tunnels)
             if (tunnel.publicHost === publicHost)
@@ -137,38 +141,73 @@ class TunnelManager {
     }
     /** Starts and stops tunnels to match the registry; `retry` also restarts ones that failed. */
     sync(hosts, retry = false) {
-        for (const [host, tunnel] of [...this.tunnels])
-            if (!hosts[host]?.tunnel || (retry && tunnel.status === "error"))
+        for (const [host, tunnel] of [...this.tunnels]) {
+            const entry = hosts[host];
+            if (!entry?.tunnel || (retry && tunnel.status === "error") || tunnel.domain !== (entry.tunnelDomain || undefined))
                 this.stop(host);
+        }
         for (const [host, entry] of Object.entries(hosts))
             if (entry.tunnel && !this.tunnels.has(host))
-                this.start(host);
+                this.start(host, entry.tunnelDomain);
     }
-    start(host) {
+    start(host, domain) {
+        const mode = domain ? "custom" : "quick";
         const file = (0, exports.cloudflaredPath)();
         if (!file) {
-            this.tunnels.set(host, { enabled: true, status: "error", error: "cloudflared is not installed. Run `locadot tunnel:install`." });
+            this.tunnels.set(host, { enabled: true, status: "error", mode, domain, error: "cloudflared is not installed. Run `locadot tunnel:install`." });
             return;
         }
-        const tunnel = { enabled: true, status: "starting" };
+        const tunnel = { enabled: true, status: "starting", mode, domain };
         this.tunnels.set(host, tunnel);
+        if (domain) {
+            this.startCustom(file, host, domain, tunnel);
+            return;
+        }
         // An empty config file keeps a user's ~/.cloudflared/config.yml (named tunnels) out of the way.
         const config = path_1.default.join(constants_1.default.paths.HOME, "cloudflared-quick.yml");
         fs_1.default.writeFileSync(config, "");
-        const child = (0, child_process_1.spawn)(file, ["tunnel", "--no-autoupdate", "--config", config, "--url", this.origin()], {
-            stdio: ["ignore", "pipe", "pipe"],
-            windowsHide: true,
+        this.run(host, tunnel, file, ["tunnel", "--no-autoupdate", "--config", config, "--url", this.origin()], (text) => {
+            const url = text.match(URL_PATTERN)?.[0];
+            if (url)
+                Object.assign(tunnel, { status: "up", url, publicHost: new URL(url).hostname });
+        });
+    }
+    /** Logs in if needed, creates the mapping's own named tunnel and points the hostname's DNS at it, then runs it. */
+    startCustom(file, host, domain, tunnel) {
+        const name = `locadot-${host.replace(/[^a-z0-9-]/gi, "-")}`;
+        tunnel.publicHost = domain;
+        (0, hub_tunnel_1.setupNamedTunnel)(domain, name, (loginUrl) => {
+            if (this.tunnels.get(host) === tunnel)
+                Object.assign(tunnel, { status: "login", loginUrl });
+        })
+            .then(() => {
+            if (this.tunnels.get(host) !== tunnel)
+                return;
+            Object.assign(tunnel, { status: "starting", loginUrl: undefined });
+            this.run(host, tunnel, file, ["tunnel", "--no-autoupdate", "run", "--url", this.origin(), name], (text) => {
+                if (REGISTERED_PATTERN.test(text))
+                    Object.assign(tunnel, { status: "up", url: `https://${domain}` });
+            });
+        })
+            .catch((error) => {
+            if (this.tunnels.get(host) !== tunnel)
+                return;
+            Object.assign(tunnel, { status: "error", error: error?.message || String(error), loginUrl: undefined });
+            logger_1.default.warn(`🌍 tunnel for ${host} failed: ${tunnel.error}`);
         });
+    }
+    run(host, tunnel, file, args, onData) {
+        const child = (0, child_process_1.spawn)(file, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
         tunnel.child = child;
         let tail = "";
         const read = (chunk) => {
             const text = chunk.toString("utf8");
             tail = (tail + text).slice(-2000);
-            const url = text.match(URL_PATTERN)?.[0];
-            if (url && tunnel.status !== "up") {
-                Object.assign(tunnel, { status: "up", url, publicHost: new URL(url).hostname });
-                logger_1.default.info(`🌍 ${host} is public at ${url}`);
-            }
+            if (tunnel.status === "up")
+                return;
+            onData(text);
+            if (tunnel.status === "up")
+                logger_1.default.info(`🌍 ${host} is public at ${tunnel.url}`);
         };
         child.stdout?.on("data", read);
         child.stderr?.on("data", read);
@@ -177,17 +216,18 @@ class TunnelManager {
             if (this.tunnels.get(host) !== tunnel)
                 return;
             const reason = tail.split(/\r?\n/).filter((line) => /ERR|error|failed/i.test(line)).pop()?.trim();
-            Object.assign(tunnel, { status: "error", error: reason || `cloudflared exited (${code})`, url: undefined, publicHost: undefined, child: undefined });
+            Object.assign(tunnel, { status: "error", error: reason || `cloudflared exited (${code})`, url: undefined, child: undefined });
+            if (!tunnel.domain)
+                tunnel.publicHost = undefined;
             logger_1.default.warn(`🌍 tunnel for ${host} stopped: ${tunnel.error}`);
         });
     }
     stop(host) {
         const tunnel = this.tunnels.get(host);
         this.tunnels.delete(host);
-        if (tunnel?.child) {
-            tunnel.child.kill();
+        if (tunnel?.child || tunnel?.status === "login")
             logger_1.default.info(`🌍 ${host} is no longer public`);
-        }
+        tunnel?.child?.kill();
     }
     stopAll() {
         for (const host of [...this.tunnels.keys()])

package/dist/server/index.js

@@ -67,6 +67,7 @@ async function startCentralProxy() {
         stats,
         lookup: (host) => registry.get().hosts[tunnels.hostFor(host) ?? host],
         tunnelFor: (host) => tunnels.hostFor(host),
+        ownPorts: () => [info.httpPort, info.httpsPort],
         remoteFor: remote_1.remoteFor,
         localFor: remote_1.localFor,
         remoteHosts: (name) => Object.entries(registry.get().hosts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",