nixamp 0.8.0 → 0.9.3

package/dist/naming.js

@@ -0,0 +1,150 @@
+/**
+ * A name and a certificate for this machine, from nixamp.com.
+ *
+ * The DNS keys never leave nixamp.com: a server signed in to an account asks
+ * for `<label>.<handle>.nixamp.com` and the site makes the record for the
+ * address the request came from, A and AAAA both. The certificate is one
+ * wildcard per handle, issued and renewed by the site, handed to the account's
+ * own servers over the authenticated API and kept on disk here so a restart
+ * serves https at once rather than after a round trip.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** A certificate this close to expiry is not worth serving: fetch a fresh one. */
+const TOO_CLOSE_MS = 24 * 60 * 60 * 1000;
+function bearer(token) {
+    return { authorization: `Bearer ${token}`, "content-type": "application/json" };
+}
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export async function claimName(site, token, label, say, fetcher = fetch) {
+    try {
+        const answer = await fetcher(`${site}/api/v1/dns/${encodeURIComponent(label)}`, {
+            method: "PUT",
+            headers: bearer(token),
+            body: JSON.stringify({ a: "auto", aaaa: "auto" }),
+        });
+        const body = (await answer.json().catch(() => ({})));
+        if (!answer.ok || !body.name?.host) {
+            say(`nixamp: ${site} would not name this machine: ${body.error ?? `answered ${answer.status}`}`);
+            return null;
+        }
+        return { host: body.name.host, a: body.name.a ?? "", aaaa: body.name.aaaa ?? "" };
+    }
+    catch (error) {
+        say(`nixamp: could not reach ${site} to claim a name: ${error.message}`);
+        return null;
+    }
+}
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export async function fetchCert(site, token, opts, say) {
+    const waitMs = opts.waitMs ?? 240_000;
+    const everyMs = opts.everyMs ?? 10_000;
+    const sleep = opts.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+    const fetcher = opts.fetcher ?? fetch;
+    let waited = 0;
+    let announced = false;
+    for (;;) {
+        let answer;
+        try {
+            answer = await fetcher(`${site}/api/v1/certs`, { headers: bearer(token) });
+        }
+        catch (error) {
+            say(`nixamp: could not reach ${site} for a certificate: ${error.message}`);
+            return null;
+        }
+        const body = (await answer.json().catch(() => ({})));
+        if (answer.ok && body.status === "ready" && body.cert && body.key && body.host) {
+            return { cert: body.cert, key: body.key, expiresAt: body.expiresAt ?? 0, host: body.host };
+        }
+        if (answer.status === 202 || body.status === "issuing") {
+            if (!announced) {
+                announced = true;
+                const host = body.host ?? "your handle";
+                say(`Getting a certificate for ${host}… the first one takes a couple of minutes.`);
+            }
+            if (waited >= waitMs) {
+                say(`nixamp: ${site} is still issuing the certificate; serving http until it is ready.`);
+                return null;
+            }
+            await sleep(everyMs);
+            waited += everyMs;
+            continue;
+        }
+        say(`nixamp: ${site} could not issue a certificate: ${body.error ?? `answered ${answer.status}`}`);
+        return null;
+    }
+}
+/** `*.chovy.nixamp.com` becomes `chovy.nixamp.com`, which is a filename. */
+function fileStem(host) {
+    return host.replace(/^\*\./, "").replace(/[^A-Za-z0-9.-]/g, "_");
+}
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export function writeCertFiles(stateDir, files) {
+    const dir = join(stateDir, "tls");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const stem = join(dir, fileStem(files.host));
+    const cert = `${stem}.cert.pem`;
+    const key = `${stem}.key.pem`;
+    writeFileSync(cert, files.cert, { mode: 0o600 });
+    writeFileSync(key, files.key, { mode: 0o600 });
+    chmodSync(cert, 0o600);
+    chmodSync(key, 0o600);
+    writeFileSync(`${stem}.json`, JSON.stringify({ host: files.host, expiresAt: files.expiresAt }), { mode: 0o600 });
+    return { cert, key };
+}
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export function readCertFiles(stateDir, host) {
+    const stem = join(stateDir, "tls", fileStem(host));
+    try {
+        const meta = JSON.parse(readFileSync(`${stem}.json`, "utf8"));
+        const expiresAt = typeof meta.expiresAt === "number" ? meta.expiresAt : 0;
+        if (expiresAt - Date.now() < TOO_CLOSE_MS)
+            return null;
+        const cert = readFileSync(`${stem}.cert.pem`, "utf8");
+        const key = readFileSync(`${stem}.key.pem`, "utf8");
+        if (!cert || !key)
+            return null;
+        return { cert, key, expiresAt };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export function labelFor(name, hostname) {
+    for (const candidate of [name, hostname.split(".")[0] ?? ""]) {
+        const label = candidate
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-")
+            .replace(/^-+|-+$/g, "")
+            .slice(0, 30)
+            .replace(/-+$/g, "");
+        if (label.length >= 2)
+            return label;
+    }
+    return "server";
+}

package/dist/publish.d.ts

@@ -21,6 +21,8 @@ export interface PublishTarget {
      */
     tracks: () => number;
     nowPlaying: () => string;
+    /** The admin share link, kept by the directory for the owner alone. */
+    admin?: string;
     /** Whether the player is actually running, so a stopped server is not listed as live. */
     playing?: () => boolean;
     /** The live channels on this server, by name, for the listing to show. */

package/dist/publish.js

@@ -58,6 +58,9 @@ export class Publisher {
                     name: this.target.name,
                     url: this.target.url,
                     ...(this.target.audio ? { audio: this.target.audio } : {}),
+                    // The link that drives this server. The directory keeps it for the
+                    // account that owns the listing and shows it to nobody else.
+                    ...(this.target.admin ? { admin: this.target.admin } : {}),
                     tracks: this.target.tracks(),
                     nowPlaying: this.target.nowPlaying(),
                     ...(this.target.playing ? { playing: this.target.playing() } : {}),

package/dist/server.d.ts

@@ -14,6 +14,9 @@ import { PartyLine } from "./partyline.ts";
 import { Follows } from "./follows.ts";
 import { Favorites } from "./favorites.ts";
 import { Catalogs } from "./catalogs.ts";
+import { Names } from "./names.ts";
+import { Certs } from "./certs.ts";
+import { type Throttle } from "@profullstack/throttle";
 import { type Tools, type Track } from "./audio.ts";
 import { type Command, type RemoteTrack, type Snapshot } from "./protocol.ts";
 export declare const SERVE_BAND_COUNT = 24;
@@ -35,6 +38,8 @@ export interface ServeOptions {
     newKey: boolean;
     /** Start without the noise it makes when it wakes up. */
     noJingle: boolean;
+    /** Do not ask nixamp.com for a name and a certificate, even when signed in. */
+    noName: boolean;
     /**
      * Ask the local firewall to let the port through, and put it back on the way
      * out. Off by default because it changes the machine, not just this process.
@@ -338,6 +343,17 @@ export declare class PlayerEngine implements Engine {
  * looking at what is on wants "that album from the web", not every track in
  * it. An entry names where to start, so clicking it plays.
  */
+/**
+ * A fetch-shaped Request for the throttle, built from the Node one.
+ *
+ * @profullstack/throttle is written against the web Request so it runs at an
+ * edge; this server is Node's http. Only what the throttle reads is carried
+ * across: method, URL and headers. The body is not, because metering is
+ * decided before anybody reads it.
+ */
+export declare function requestFor(request: IncomingMessage, origin?: string): Request;
+/** Write a refusal the throttle produced back through the Node response. */
+export declare function answerWith(response: ServerResponse, refused: Response): Promise<void>;
 /**
  * How many channels a server will start on demand at once. Each is an ffmpeg,
  * and a catalog has thousands of entries; this is what keeps a room full of
@@ -520,6 +536,18 @@ export interface HandlerOptions {
     follows?: Follows;
     /** The servers an account hearted. nixamp.com only, like follows. */
     favorites?: Favorites;
+    /** Names under `<handle>.<zone>` for an account's servers. nixamp.com only. */
+    names?: Names;
+    /** One wildcard certificate per handle, issued and renewed here. nixamp.com only. */
+    certs?: Certs;
+    /** The zone the names live in, e.g. "nixamp.com". */
+    dnsZone?: string;
+    /**
+     * The rate limit over everything, from @profullstack/throttle. Fetch-shaped,
+     * so the handler builds a Request from the Node one and writes back the
+     * Response it is refused with.
+     */
+    throttle?: Throttle;
     /** The VAPID public key a browser needs before it can subscribe. */
     vapidPublicKey?: string;
 }

package/dist/server.js

@@ -39,6 +39,12 @@ import pg from "pg";
 import { Follows, phoneFrom } from "./follows.js";
 import { Favorites, favoriteUrl } from "./favorites.js";
 import { Catalogs, shownCatalog, shownEntry } from "./catalogs.js";
+import { Porkbun, isIPv4, isIPv6 } from "./dns.js";
+import { NameError, Names } from "./names.js";
+import { AcmeIssuer, Certs } from "./certs.js";
+import { claimName, fetchCert, labelFor, readCertFiles, writeCertFiles } from "./naming.js";
+import { forbiddenLibrary, readLibrary } from "./library.js";
+import { createThrottle, presentedCredential } from "@profullstack/throttle";
 import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
 import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.js";
@@ -63,7 +69,9 @@ export function parseServeArgs(argv) {
     // A platform that hands out the port does it through PORT; a flag still wins.
     const fromEnv = Number(process.env.PORT);
     const options = {
-        root: ".",
+        // Empty, not ".": nothing about a server should depend on where it was
+        // started from. The saved library fills it in, or the start refuses.
+        root: "",
         port: Number.isInteger(fromEnv) && fromEnv > 0 && fromEnv <= 65535 ? fromEnv : DEFAULT_PORT,
         // Every interface, because a player nobody else can reach is not much of a
         // remote. The key in the link is what makes that safe; --no-key gives up
@@ -74,6 +82,7 @@ export function parseServeArgs(argv) {
         key: true,
         newKey: false,
         noJingle: false,
+        noName: false,
         openPort: false,
         announce: false,
         directory: false,
@@ -169,6 +178,9 @@ export function parseServeArgs(argv) {
         else if (arg === "--no-jingle") {
             options.noJingle = true;
         }
+        else if (arg === "--no-name") {
+            options.noName = true;
+        }
         else if (arg === "--ingest") {
             options.ingest = true;
         }
@@ -709,6 +721,37 @@ export class PlayerEngine {
  * looking at what is on wants "that album from the web", not every track in
  * it. An entry names where to start, so clicking it plays.
  */
+/**
+ * A fetch-shaped Request for the throttle, built from the Node one.
+ *
+ * @profullstack/throttle is written against the web Request so it runs at an
+ * edge; this server is Node's http. Only what the throttle reads is carried
+ * across: method, URL and headers. The body is not, because metering is
+ * decided before anybody reads it.
+ */
+export function requestFor(request, origin = "http://localhost") {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (typeof value === "string")
+            headers.set(name, value);
+        else if (Array.isArray(value))
+            headers.set(name, value.join(", "));
+    }
+    // The address, for a throttle that has no socket to ask.
+    if (!headers.has("x-forwarded-for") && request.socket?.remoteAddress) {
+        headers.set("x-forwarded-for", request.socket.remoteAddress);
+    }
+    return new Request(`${origin}${request.url ?? "/"}`, { method: request.method ?? "GET", headers });
+}
+/** Write a refusal the throttle produced back through the Node response. */
+export async function answerWith(response, refused) {
+    const headers = { ...CORS };
+    refused.headers.forEach((value, name) => {
+        headers[name] = value;
+    });
+    response.writeHead(refused.status, headers);
+    response.end(Buffer.from(await refused.arrayBuffer()));
+}
 /**
  * How many channels a server will start on demand at once. Each is an ffmpeg,
  * and a catalog has thousands of entries; this is what keeps a room full of
@@ -784,7 +827,7 @@ const CORS = {
     // control API has to be reachable cross-origin. It exposes no filesystem
     // paths and takes six commands; binding to 127.0.0.1 is what keeps it shut.
     "access-control-allow-origin": "*",
-    "access-control-allow-methods": "GET, POST, OPTIONS",
+    "access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
     "access-control-allow-headers": "content-type",
     "access-control-max-age": "86400",
 };
@@ -878,6 +921,16 @@ export function createHandler(engine, options) {
             response.end();
             return;
         }
+        // Metered before anything is done for the request, so a caller over its
+        // allowance costs nothing but this check. The throttle decides; this only
+        // carries its refusal back through Node's response.
+        if (options.throttle) {
+            const refused = await options.throttle.handle(requestFor(request));
+            if (refused) {
+                await answerWith(response, refused);
+                return;
+            }
+        }
         // Opening a share link is what hands a browser its key. It comes back as a
         // cookie, so every later fetch, EventSource and <audio src> carries it
         // without the page knowing anything about keys. Either key works here, and
@@ -918,6 +971,101 @@ export function createHandler(engine, options) {
         // Behind the sign-in rather than the share key: a follow belongs to an
         // account, and an account is the only thing that makes "notify me on my
         // other device" mean anything.
+        // --- names and certificates for an account's servers --------------------
+        //
+        // A server that is signed in becomes `<label>.<handle>.<zone>`, with A and
+        // AAAA records nixamp.com writes with keys only nixamp.com holds, and it
+        // serves https with the one wildcard certificate its handle has. Nothing
+        // about DNS or ACME ever reaches the box; it asks, and is answered.
+        if ((path === "/api/v1/dns" || path.startsWith("/api/v1/dns/")) && options.names && options.accounts && options.handles) {
+            const me = await options.accounts.whoIs(tokenFrom(request.headers));
+            if (me === null) {
+                json(response, 401, { error: "sign in to name a server" });
+                return;
+            }
+            const handle = await options.handles.of(me.id);
+            if (!handle) {
+                json(response, 422, { error: "this account has no handle yet" });
+                return;
+            }
+            const names = options.names;
+            const zone = `${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+            if (path === "/api/v1/dns" && request.method === "GET") {
+                json(response, 200, { zone, names: await names.list(me.id, handle) });
+                return;
+            }
+            const label = decodeURIComponent(path.slice("/api/v1/dns/".length));
+            if (!label) {
+                json(response, 404, { error: "no such endpoint" });
+                return;
+            }
+            if (request.method === "PUT" || request.method === "POST") {
+                let body = {};
+                try {
+                    body = JSON.parse((await readBody(request)) || "{}");
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                // "auto" is the address this request came from, for whichever family
+                // it came in on: a server names itself without knowing its address.
+                const caller = callerOf(request.headers, request.socket.remoteAddress, options.behindProxy ?? false);
+                const family = (value, is) => {
+                    if (value === null)
+                        return null;
+                    if (value === undefined)
+                        return undefined;
+                    if (value === "auto")
+                        return is(caller) ? caller : undefined;
+                    return String(value);
+                };
+                try {
+                    const name = await names.set(me.id, handle, label, {
+                        a: family(body.a, isIPv4),
+                        aaaa: family(body.aaaa, isIPv6),
+                        ...(typeof body.ttl === "number" ? { ttl: body.ttl } : {}),
+                    });
+                    json(response, 200, { name });
+                }
+                catch (error) {
+                    const status = error instanceof NameError ? error.status : 500;
+                    json(response, status, { error: error.message });
+                }
+                return;
+            }
+            if (request.method === "DELETE") {
+                const gone = await names.remove(me.id, handle, label);
+                json(response, gone ? 200 : 404, gone ? { ok: true } : { error: "no such name of yours" });
+                return;
+            }
+            json(response, 405, { error: "GET, PUT or DELETE" });
+            return;
+        }
+        if (path === "/api/v1/certs" && options.certs && options.accounts && options.handles) {
+            const me = await options.accounts.whoIs(tokenFrom(request.headers));
+            if (me === null) {
+                json(response, 401, { error: "sign in to get a certificate" });
+                return;
+            }
+            const handle = await options.handles.of(me.id);
+            if (!handle) {
+                json(response, 422, { error: "this account has no handle yet" });
+                return;
+            }
+            const state = await options.certs.forHandle(handle);
+            const host = `*.${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+            if (state.status === "ready") {
+                json(response, 200, { status: "ready", cert: state.cert, key: state.key, expiresAt: state.expiresAt, host, renewing: state.renewing });
+                return;
+            }
+            if (state.status === "failed") {
+                json(response, 503, { status: "failed", error: state.error, host });
+                return;
+            }
+            json(response, 202, { status: "issuing", host });
+            return;
+        }
         // Favourites: the servers you hearted, kept against your account. Reading
         // the directory and listening need no account; remembering where you
         // listened does, because there has to be somebody to remember it for.
@@ -1695,9 +1843,14 @@ export function createHandler(engine, options) {
                 // phone for it. The code is published on purpose: it is a public
                 // call-in line, and a listing you cannot dial is a listing of nothing.
                 const onThePhone = options.partyLine;
-                const streams = options.directory.list().map((stream) => ({
+                // The admin link goes only to the account that owns the listing. A
+                // directory that handed out control links would be a directory of
+                // machines anyone could take over.
+                const me = options.accounts ? await options.accounts.whoIs(tokenFrom(request.headers)) : null;
+                const streams = options.directory.list().map(({ admin, ...stream }) => ({
                     ...stream,
                     callers: onThePhone ? onThePhone.listenersOn(stream.code) : 0,
+                    ...(admin && me !== null && stream.ownerId === me.id ? { admin } : {}),
                 }));
                 // Recently ended too, because following exists to hear about
                 // broadcasts you would otherwise miss -- and a list of only what is on
@@ -2976,7 +3129,18 @@ export function createServer(engine, options) {
 }
 export async function serve(argv, version = "0.1.0") {
     const options = parseServeArgs(argv);
-    const root = isRemote(options.root) ? options.root : resolve(options.root);
+    // Told which folder, or the one that was saved. Never the directory this
+    // happens to be running in: a daemon restarted from a home directory served
+    // the home directory, keys and all, under a public listing.
+    const chosen = options.root || readLibrary();
+    if (!chosen) {
+        throw new Error("nixamp serve: which folder? Say `nixamp library ~/Music` once, or `nixamp daemon start ~/Music`.");
+    }
+    const root = isRemote(chosen) ? chosen : resolve(chosen);
+    const why = isRemote(root) ? "" : forbiddenLibrary(root);
+    if (why) {
+        throw new Error(`nixamp will not serve ${why}. Pick a folder with your media in it: nixamp library ~/Music`);
+    }
     const tools = detectTools();
     // Names now, tags later.
     //
@@ -3066,6 +3230,53 @@ export async function serve(argv, version = "0.1.0") {
         : undefined;
     const follows = pool ? new Follows(pool) : undefined;
     const favorites = pool ? new Favorites(pool) : undefined;
+    // Names and certificates for signed-in servers, and the rate limit over
+    // everything. All of it is nixamp.com's business: the DNS keys live only
+    // here, the certificates are issued here, and a personal nixamp has neither
+    // a database nor strangers to meter. Without the registrar's keys the names
+    // are simply not offered, rather than written into a zone that does not
+    // exist.
+    const zoneName = (() => {
+        try {
+            return new URL(process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).hostname;
+        }
+        catch {
+            return "nixamp.com";
+        }
+    })();
+    const porkbunKey = process.env["PORKBUN_API_KEY"] ?? "";
+    const porkbunSecret = process.env["PORKBUN_SECRET_API_KEY"] ?? "";
+    const zone = porkbunKey && porkbunSecret ? new Porkbun(zoneName, porkbunKey, porkbunSecret) : null;
+    const names = pool && zone ? new Names(pool, zone) : undefined;
+    let certs;
+    if (pool && zone) {
+        const issuer = new AcmeIssuer({
+            directoryUrl: process.env["NIXAMP_ACME_DIRECTORY"] ?? "https://acme-v02.api.letsencrypt.org/directory",
+            email: process.env["NIXAMP_ACME_EMAIL"] ?? `hostmaster@${zoneName}`,
+            // The key is kept by the store, so the issuer asks for it each time
+            // rather than holding one that a second instance would not share.
+            accountKey: () => certs.accountKey(),
+        });
+        certs = new Certs(pool, zone, issuer, { log: (line) => console.log(`  ${line}`) });
+    }
+    const throttle = pool
+        ? createThrottle({
+            rules: [
+                // Sign-in stays address-bucketed however the request is dressed, or
+                // a guess with an Authorization header buys itself the bigger budget.
+                { path: "/api/v1/auth/", limit: 20, credential: false },
+                { path: "/api/v1/dns/", limit: 30 },
+                { path: "/api/v1/dns", limit: 30 },
+                { path: "/api/v1/certs", limit: 30 },
+                { path: "/api/health", open: true },
+                { path: "/api/directory", limit: 120 },
+            ],
+            // A signed-in browser carries its session as a cookie, and is a
+            // credential the same as a bearer token: a person on a dashboard is
+            // not an anonymous scraper.
+            credentialFrom: (request) => presentedCredential(request.headers) ?? (tokenFrom(Object.fromEntries(request.headers)) || null),
+        })
+        : undefined;
     // The two things that were promises kept only in memory: a caller who was
     // told they would be texted, and the ended stream a code still points at.
     const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
@@ -3206,7 +3417,7 @@ export async function serve(argv, version = "0.1.0") {
     }
     // Read before listening, so a missing or unreadable certificate is a sentence
     // now rather than a connection that resets later.
-    const tls = options.tlsCert
+    let tls = options.tlsCert
         ? (() => {
             try {
                 return { cert: readFileSync(options.tlsCert, "utf8"), key: readFileSync(options.tlsKey, "utf8") };
@@ -3216,6 +3427,42 @@ export async function serve(argv, version = "0.1.0") {
             }
         })()
         : undefined;
+    // A signed-in server names itself.
+    //
+    // Nothing about DNS or certificates reaches this machine: it asks nixamp.com
+    // for `<label>.<handle>.<zone>` pointing at the address it is calling from,
+    // and for the handle's wildcard certificate, and serves https under that
+    // name. The registrar's keys stay on nixamp.com. Skipped when the operator
+    // named or certified the server by hand, when it listens on one interface
+    // only, or with --no-name.
+    let certExpiresAt = 0;
+    let namedHost = "";
+    const namedSession = readSession();
+    if (!options.noName && !options.publicUrl && !options.tlsCert &&
+        (options.host === "0.0.0.0" || options.host === "::") && namedSession?.token) {
+        const say = (line) => console.log(`  ${line}`);
+        const named = await claimName(namedSession.site, namedSession.token, labelFor(options.name, hostname()), say);
+        if (named) {
+            namedHost = named.host;
+            // The certificate is the handle's, so the cache is keyed by the handle's
+            // wildcard rather than by this machine's label.
+            const wildcard = `*.${named.host.split(".").slice(1).join(".")}`;
+            let files = readCertFiles(stateDir(), wildcard);
+            if (!files) {
+                const got = await fetchCert(namedSession.site, namedSession.token, {}, say);
+                if (got) {
+                    writeCertFiles(stateDir(), got);
+                    files = { cert: got.cert, key: got.key, expiresAt: got.expiresAt };
+                }
+            }
+            if (files) {
+                tls = { cert: files.cert, key: files.key };
+                certExpiresAt = files.expiresAt;
+            }
+            options.publicUrl = `${tls ? "https" : "http"}://${named.host}:${options.port}`;
+            console.log(`  This server is ${named.host}${tls ? "" : " -- no certificate yet, so http for now"}.`);
+        }
+    }
     // Filled in below, when the RTMP listeners are opened. Read through a
     // function so the handler sees the list rather than the empty array it was
     // built with.
@@ -3291,6 +3538,10 @@ export async function serve(argv, version = "0.1.0") {
         ...(directory ? { directory } : {}),
         ...(follows ? { follows, vapidPublicKey } : {}),
         ...(favorites ? { favorites } : {}),
+        ...(names ? { names } : {}),
+        ...(certs ? { certs } : {}),
+        dnsZone: zoneName,
+        ...(throttle ? { throttle } : {}),
         ...(partyLine ? { partyLine } : {}),
         // Accounts live where the directory lives, and only there: a nixamp on a
         // laptop has nobody to be an account of.
@@ -3333,6 +3584,23 @@ export async function serve(argv, version = "0.1.0") {
     });
     const bound = server.address();
     const port = typeof bound === "object" && bound !== null ? bound.port : options.port;
+    // A named server keeps its certificate fresh without a restart: once a day
+    // it asks for the handle's certificate again and, when a newer one has been
+    // issued, swaps it into the running listener.
+    if (namedHost && namedSession?.token) {
+        const renew = setInterval(() => {
+            void fetchCert(namedSession.site, namedSession.token, { waitMs: 0 }, () => undefined).then((got) => {
+                if (!got || got.expiresAt <= certExpiresAt)
+                    return;
+                writeCertFiles(stateDir(), got);
+                certExpiresAt = got.expiresAt;
+                const secure = server;
+                secure.setSecureContext?.({ cert: got.cert, key: got.key });
+                console.log(`  Renewed the certificate for ${namedHost}.`);
+            });
+        }, 24 * 60 * 60 * 1000);
+        renew.unref();
+    }
     const io = {
         read: readIfPossible,
         run: (command, args) => {
@@ -3538,6 +3806,10 @@ export async function serve(argv, version = "0.1.0") {
             name: options.name || hostname(),
             url: listen,
             audio,
+            // The control link, for the owner to open this machine as its
+            // administrator from the directory. The directory shows it to the
+            // owning account and strips it for everyone else.
+            ...(key ? { admin: shareLink(publishable_.url, key) } : {}),
             // Asked at every heartbeat rather than once, because the library is
             // read after the port opens and is still arriving when this is made.
             tracks: () => engine.snapshot(false).trackCount,

package/dist/session.d.ts

@@ -95,6 +95,14 @@ export declare function chooseWay(ways: SiteWays, options: LoginOptions): Promis
  * server keeps only its hash and has nothing to show a second time.
  */
 export declare function tokens(argv: string[], fetcher?: typeof fetch): Promise<number>;
+/**
+ * `nixamp dns list|set|rm`: names under your handle, for your servers.
+ *
+ * The DNS keys stay on nixamp.com; this only says which label should point
+ * where. "auto" is the address the request arrives from, which is what a
+ * server naming itself wants and what nobody behind a router can type.
+ */
+export declare function dns(argv: string[], fetcher?: typeof fetch): Promise<number>;
 export declare function logout(): number;
 /** `nixamp whoami`, which asks the server rather than trusting the file. */
 export declare function whoami(fetcher?: typeof fetch): Promise<number>;