nixamp 0.8.0 → 0.9.4

package/src/naming.ts

@@ -0,0 +1,197 @@
+/**
+ * A name and a certificate for this machine, from nixamp.com.
+ *
+ * The DNS keys never leave nixamp.com: a server signed in to an account asks
+ * for `<label>.<handle>.nixamp.com` and the site makes the record for the
+ * address the request came from, A and AAAA both. The certificate is one
+ * wildcard per handle, issued and renewed by the site, handed to the account's
+ * own servers over the authenticated API and kept on disk here so a restart
+ * serves https at once rather than after a round trip.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface Named {
+  host: string;
+  a: string;
+  aaaa: string;
+}
+
+export interface CertFiles {
+  cert: string;
+  key: string;
+  expiresAt: number;
+  /** The name on the certificate, e.g. `*.chovy.nixamp.com`. */
+  host: string;
+}
+
+/** A certificate this close to expiry is not worth serving: fetch a fresh one. */
+const TOO_CLOSE_MS = 24 * 60 * 60 * 1000;
+
+function bearer(token: string): Record<string, string> {
+  return { authorization: `Bearer ${token}`, "content-type": "application/json" };
+}
+
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export async function claimName(
+  site: string,
+  token: string,
+  label: string,
+  say: (line: string) => void,
+  fetcher: typeof fetch = fetch,
+): Promise<Named | null> {
+  try {
+    const answer = await fetcher(`${site}/api/v1/dns/${encodeURIComponent(label)}`, {
+      method: "PUT",
+      headers: bearer(token),
+      body: JSON.stringify({ a: "auto", aaaa: "auto" }),
+    });
+    const body = (await answer.json().catch(() => ({}))) as {
+      name?: { host?: string; a?: string | null; aaaa?: string | null };
+      error?: string;
+    };
+    if (!answer.ok || !body.name?.host) {
+      say(`nixamp: ${site} would not name this machine: ${body.error ?? `answered ${answer.status}`}`);
+      return null;
+    }
+    return { host: body.name.host, a: body.name.a ?? "", aaaa: body.name.aaaa ?? "" };
+  } catch (error) {
+    say(`nixamp: could not reach ${site} to claim a name: ${(error as Error).message}`);
+    return null;
+  }
+}
+
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export async function fetchCert(
+  site: string,
+  token: string,
+  opts: {
+    waitMs?: number;
+    everyMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    fetcher?: typeof fetch;
+  },
+  say: (line: string) => void,
+): Promise<CertFiles | null> {
+  const waitMs = opts.waitMs ?? 240_000;
+  const everyMs = opts.everyMs ?? 10_000;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((done) => setTimeout(done, ms)));
+  const fetcher = opts.fetcher ?? fetch;
+  let waited = 0;
+  let announced = false;
+
+  for (;;) {
+    let answer: Response;
+    try {
+      answer = await fetcher(`${site}/api/v1/certs`, { headers: bearer(token) });
+    } catch (error) {
+      say(`nixamp: could not reach ${site} for a certificate: ${(error as Error).message}`);
+      return null;
+    }
+    const body = (await answer.json().catch(() => ({}))) as {
+      status?: string;
+      cert?: string;
+      key?: string;
+      expiresAt?: number;
+      host?: string;
+      error?: string;
+    };
+
+    if (answer.ok && body.status === "ready" && body.cert && body.key && body.host) {
+      return { cert: body.cert, key: body.key, expiresAt: body.expiresAt ?? 0, host: body.host };
+    }
+    if (answer.status === 202 || body.status === "issuing") {
+      if (!announced) {
+        announced = true;
+        const host = body.host ?? "your handle";
+        say(`Getting a certificate for ${host}… the first one takes a couple of minutes.`);
+      }
+      if (waited >= waitMs) {
+        say(`nixamp: ${site} is still issuing the certificate; serving http until it is ready.`);
+        return null;
+      }
+      await sleep(everyMs);
+      waited += everyMs;
+      continue;
+    }
+    say(`nixamp: ${site} could not issue a certificate: ${body.error ?? `answered ${answer.status}`}`);
+    return null;
+  }
+}
+
+/** `*.chovy.nixamp.com` becomes `chovy.nixamp.com`, which is a filename. */
+function fileStem(host: string): string {
+  return host.replace(/^\*\./, "").replace(/[^A-Za-z0-9.-]/g, "_");
+}
+
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export function writeCertFiles(stateDir: string, files: CertFiles): { cert: string; key: string } {
+  const dir = join(stateDir, "tls");
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const stem = join(dir, fileStem(files.host));
+  const cert = `${stem}.cert.pem`;
+  const key = `${stem}.key.pem`;
+  writeFileSync(cert, files.cert, { mode: 0o600 });
+  writeFileSync(key, files.key, { mode: 0o600 });
+  chmodSync(cert, 0o600);
+  chmodSync(key, 0o600);
+  writeFileSync(`${stem}.json`, JSON.stringify({ host: files.host, expiresAt: files.expiresAt }), { mode: 0o600 });
+  return { cert, key };
+}
+
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export function readCertFiles(
+  stateDir: string,
+  host: string,
+): { cert: string; key: string; expiresAt: number } | null {
+  const stem = join(stateDir, "tls", fileStem(host));
+  try {
+    const meta = JSON.parse(readFileSync(`${stem}.json`, "utf8")) as { expiresAt?: number };
+    const expiresAt = typeof meta.expiresAt === "number" ? meta.expiresAt : 0;
+    if (expiresAt - Date.now() < TOO_CLOSE_MS) return null;
+    const cert = readFileSync(`${stem}.cert.pem`, "utf8");
+    const key = readFileSync(`${stem}.key.pem`, "utf8");
+    if (!cert || !key) return null;
+    return { cert, key, expiresAt };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export function labelFor(name: string, hostname: string): string {
+  for (const candidate of [name, hostname.split(".")[0] ?? ""]) {
+    const label = candidate
+      .toLowerCase()
+      .replace(/[^a-z0-9-]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 30)
+      .replace(/-+$/g, "");
+    if (label.length >= 2) return label;
+  }
+  return "server";
+}

package/src/publish.ts

@@ -30,6 +30,8 @@ export interface PublishTarget {
    */
   tracks: () => number;
   nowPlaying: () => string;
+  /** The admin share link, kept by the directory for the owner alone. */
+  admin?: string;
   /** Whether the player is actually running, so a stopped server is not listed as live. */
   playing?: () => boolean;
   /** The live channels on this server, by name, for the listing to show. */
@@ -103,6 +105,9 @@ export class Publisher {
           name: this.target.name,
           url: this.target.url,
           ...(this.target.audio ? { audio: this.target.audio } : {}),
+          // The link that drives this server. The directory keeps it for the
+          // account that owns the listing and shows it to nobody else.
+          ...(this.target.admin ? { admin: this.target.admin } : {}),
           tracks: this.target.tracks(),
           nowPlaying: this.target.nowPlaying(),
           ...(this.target.playing ? { playing: this.target.playing() } : {}),

package/src/server.ts

@@ -56,6 +56,12 @@ import pg from "pg";
 import { Follows, phoneFrom } from "./follows.ts";
 import { Favorites, favoriteUrl } from "./favorites.ts";
 import { Catalogs, shownCatalog, shownEntry } from "./catalogs.ts";
+import { Porkbun, isIPv4, isIPv6, type DnsZone } from "./dns.ts";
+import { NameError, Names } from "./names.ts";
+import { AcmeIssuer, Certs } from "./certs.ts";
+import { claimName, fetchCert, labelFor, readCertFiles, writeCertFiles } from "./naming.ts";
+import { forbiddenLibrary, readLibrary } from "./library.ts";
+import { createThrottle, presentedCredential, type Throttle } from "@profullstack/throttle";
 import { Durable } from "./durable.ts";
 import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
 import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.ts";
@@ -120,6 +126,8 @@ export interface ServeOptions {
   newKey: boolean;
   /** Start without the noise it makes when it wakes up. */
   noJingle: boolean;
+  /** Do not ask nixamp.com for a name and a certificate, even when signed in. */
+  noName: boolean;
   /**
    * Ask the local firewall to let the port through, and put it back on the way
    * out. Off by default because it changes the machine, not just this process.
@@ -203,7 +211,9 @@ export function parseServeArgs(argv: string[]): ServeOptions {
   // A platform that hands out the port does it through PORT; a flag still wins.
   const fromEnv = Number(process.env.PORT);
   const options: ServeOptions = {
-    root: ".",
+    // Empty, not ".": nothing about a server should depend on where it was
+    // started from. The saved library fills it in, or the start refuses.
+    root: "",
     port: Number.isInteger(fromEnv) && fromEnv > 0 && fromEnv <= 65535 ? fromEnv : DEFAULT_PORT,
     // Every interface, because a player nobody else can reach is not much of a
     // remote. The key in the link is what makes that safe; --no-key gives up
@@ -214,6 +224,7 @@ export function parseServeArgs(argv: string[]): ServeOptions {
     key: true,
     newKey: false,
     noJingle: false,
+    noName: false,
     openPort: false,
     announce: false,
     directory: false,
@@ -290,6 +301,8 @@ export function parseServeArgs(argv: string[]): ServeOptions {
       options.newKey = true;
     } else if (arg === "--no-jingle") {
       options.noJingle = true;
+    } else if (arg === "--no-name") {
+      options.noName = true;
     } else if (arg === "--ingest") {
       options.ingest = true;
     } else if (arg === "--rtmp-streams") {
@@ -913,6 +926,37 @@ export class PlayerEngine implements Engine {
  * looking at what is on wants "that album from the web", not every track in
  * it. An entry names where to start, so clicking it plays.
  */
+/**
+ * A fetch-shaped Request for the throttle, built from the Node one.
+ *
+ * @profullstack/throttle is written against the web Request so it runs at an
+ * edge; this server is Node's http. Only what the throttle reads is carried
+ * across: method, URL and headers. The body is not, because metering is
+ * decided before anybody reads it.
+ */
+export function requestFor(request: IncomingMessage, origin = "http://localhost"): Request {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (typeof value === "string") headers.set(name, value);
+    else if (Array.isArray(value)) headers.set(name, value.join(", "));
+  }
+  // The address, for a throttle that has no socket to ask.
+  if (!headers.has("x-forwarded-for") && request.socket?.remoteAddress) {
+    headers.set("x-forwarded-for", request.socket.remoteAddress);
+  }
+  return new Request(`${origin}${request.url ?? "/"}`, { method: request.method ?? "GET", headers });
+}
+
+/** Write a refusal the throttle produced back through the Node response. */
+export async function answerWith(response: ServerResponse, refused: Response): Promise<void> {
+  const headers: Record<string, string> = { ...CORS };
+  refused.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  response.writeHead(refused.status, headers);
+  response.end(Buffer.from(await refused.arrayBuffer()));
+}
+
 /**
  * How many channels a server will start on demand at once. Each is an ffmpeg,
  * and a catalog has thousands of entries; this is what keeps a room full of
@@ -993,7 +1037,7 @@ const CORS: Record<string, string> = {
   // control API has to be reachable cross-origin. It exposes no filesystem
   // paths and takes six commands; binding to 127.0.0.1 is what keeps it shut.
   "access-control-allow-origin": "*",
-  "access-control-allow-methods": "GET, POST, OPTIONS",
+  "access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
   "access-control-allow-headers": "content-type",
   "access-control-max-age": "86400",
 };
@@ -1181,6 +1225,18 @@ export interface HandlerOptions {
   follows?: Follows;
   /** The servers an account hearted. nixamp.com only, like follows. */
   favorites?: Favorites;
+  /** Names under `<handle>.<zone>` for an account's servers. nixamp.com only. */
+  names?: Names;
+  /** One wildcard certificate per handle, issued and renewed here. nixamp.com only. */
+  certs?: Certs;
+  /** The zone the names live in, e.g. "nixamp.com". */
+  dnsZone?: string;
+  /**
+   * The rate limit over everything, from @profullstack/throttle. Fetch-shaped,
+   * so the handler builds a Request from the Node one and writes back the
+   * Response it is refused with.
+   */
+  throttle?: Throttle;
   /** The VAPID public key a browser needs before it can subscribe. */
   vapidPublicKey?: string;
 }
@@ -1229,6 +1285,17 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    // Metered before anything is done for the request, so a caller over its
+    // allowance costs nothing but this check. The throttle decides; this only
+    // carries its refusal back through Node's response.
+    if (options.throttle) {
+      const refused = await options.throttle.handle(requestFor(request));
+      if (refused) {
+        await answerWith(response, refused);
+        return;
+      }
+    }
+
     // Opening a share link is what hands a browser its key. It comes back as a
     // cookie, so every later fetch, EventSource and <audio src> carries it
     // without the page knowing anything about keys. Either key works here, and
@@ -1271,6 +1338,99 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // Behind the sign-in rather than the share key: a follow belongs to an
     // account, and an account is the only thing that makes "notify me on my
     // other device" mean anything.
+    // --- names and certificates for an account's servers --------------------
+    //
+    // A server that is signed in becomes `<label>.<handle>.<zone>`, with A and
+    // AAAA records nixamp.com writes with keys only nixamp.com holds, and it
+    // serves https with the one wildcard certificate its handle has. Nothing
+    // about DNS or ACME ever reaches the box; it asks, and is answered.
+    if ((path === "/api/v1/dns" || path.startsWith("/api/v1/dns/")) && options.names && options.accounts && options.handles) {
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in to name a server" });
+        return;
+      }
+      const handle = await options.handles.of(me.id);
+      if (!handle) {
+        json(response, 422, { error: "this account has no handle yet" });
+        return;
+      }
+      const names = options.names;
+      const zone = `${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+
+      if (path === "/api/v1/dns" && request.method === "GET") {
+        json(response, 200, { zone, names: await names.list(me.id, handle) });
+        return;
+      }
+      const label = decodeURIComponent(path.slice("/api/v1/dns/".length));
+      if (!label) {
+        json(response, 404, { error: "no such endpoint" });
+        return;
+      }
+      if (request.method === "PUT" || request.method === "POST") {
+        let body: { a?: unknown; aaaa?: unknown; ttl?: unknown } = {};
+        try {
+          body = JSON.parse((await readBody(request)) || "{}") as typeof body;
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        // "auto" is the address this request came from, for whichever family
+        // it came in on: a server names itself without knowing its address.
+        const caller = callerOf(request.headers, request.socket.remoteAddress, options.behindProxy ?? false);
+        const family = (value: unknown, is: (ip: unknown) => boolean): string | null | undefined => {
+          if (value === null) return null;
+          if (value === undefined) return undefined;
+          if (value === "auto") return is(caller) ? caller : undefined;
+          return String(value);
+        };
+        try {
+          const name = await names.set(me.id, handle, label, {
+            a: family(body.a, isIPv4),
+            aaaa: family(body.aaaa, isIPv6),
+            ...(typeof body.ttl === "number" ? { ttl: body.ttl } : {}),
+          });
+          json(response, 200, { name });
+        } catch (error) {
+          const status = error instanceof NameError ? error.status : 500;
+          json(response, status, { error: (error as Error).message });
+        }
+        return;
+      }
+      if (request.method === "DELETE") {
+        const gone = await names.remove(me.id, handle, label);
+        json(response, gone ? 200 : 404, gone ? { ok: true } : { error: "no such name of yours" });
+        return;
+      }
+      json(response, 405, { error: "GET, PUT or DELETE" });
+      return;
+    }
+
+    if (path === "/api/v1/certs" && options.certs && options.accounts && options.handles) {
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in to get a certificate" });
+        return;
+      }
+      const handle = await options.handles.of(me.id);
+      if (!handle) {
+        json(response, 422, { error: "this account has no handle yet" });
+        return;
+      }
+      const state = await options.certs.forHandle(handle);
+      const host = `*.${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+      if (state.status === "ready") {
+        json(response, 200, { status: "ready", cert: state.cert, key: state.key, expiresAt: state.expiresAt, host, renewing: state.renewing });
+        return;
+      }
+      if (state.status === "failed") {
+        json(response, 503, { status: "failed", error: state.error, host });
+        return;
+      }
+      json(response, 202, { status: "issuing", host });
+      return;
+    }
+
     // Favourites: the servers you hearted, kept against your account. Reading
     // the directory and listening need no account; remembering where you
     // listened does, because there has to be somebody to remember it for.
@@ -2108,9 +2268,14 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         // phone for it. The code is published on purpose: it is a public
         // call-in line, and a listing you cannot dial is a listing of nothing.
         const onThePhone = options.partyLine;
-        const streams = options.directory.list().map((stream) => ({
+        // The admin link goes only to the account that owns the listing. A
+        // directory that handed out control links would be a directory of
+        // machines anyone could take over.
+        const me = options.accounts ? await options.accounts.whoIs(tokenFrom(request.headers)) : null;
+        const streams = options.directory.list().map(({ admin, ...stream }) => ({
           ...stream,
           callers: onThePhone ? onThePhone.listenersOn(stream.code) : 0,
+          ...(admin && me !== null && stream.ownerId === me.id ? { admin } : {}),
         }));
         // Recently ended too, because following exists to hear about
         // broadcasts you would otherwise miss -- and a list of only what is on
@@ -3467,7 +3632,20 @@ export function createServer(engine: Engine, options: HandlerOptions): Server {
 
 export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const options = parseServeArgs(argv);
-  const root = isRemote(options.root) ? options.root : resolve(options.root);
+  // Told which folder, or the one that was saved. Never the directory this
+  // happens to be running in: a daemon restarted from a home directory served
+  // the home directory, keys and all, under a public listing.
+  const chosen = options.root || readLibrary();
+  if (!chosen) {
+    throw new Error(
+      "nixamp serve: which folder? Say `nixamp library ~/Music` once, or `nixamp daemon start ~/Music`.",
+    );
+  }
+  const root = isRemote(chosen) ? chosen : resolve(chosen);
+  const why = isRemote(root) ? "" : forbiddenLibrary(root);
+  if (why) {
+    throw new Error(`nixamp will not serve ${why}. Pick a folder with your media in it: nixamp library ~/Music`);
+  }
   const tools = detectTools();
   // Names now, tags later.
   //
@@ -3566,6 +3744,54 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       : undefined;
   const follows = pool ? new Follows(pool) : undefined;
   const favorites = pool ? new Favorites(pool) : undefined;
+
+  // Names and certificates for signed-in servers, and the rate limit over
+  // everything. All of it is nixamp.com's business: the DNS keys live only
+  // here, the certificates are issued here, and a personal nixamp has neither
+  // a database nor strangers to meter. Without the registrar's keys the names
+  // are simply not offered, rather than written into a zone that does not
+  // exist.
+  const zoneName = (() => {
+    try {
+      return new URL(process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).hostname;
+    } catch {
+      return "nixamp.com";
+    }
+  })();
+  const porkbunKey = process.env["PORKBUN_API_KEY"] ?? "";
+  const porkbunSecret = process.env["PORKBUN_SECRET_API_KEY"] ?? "";
+  const zone: DnsZone | null = porkbunKey && porkbunSecret ? new Porkbun(zoneName, porkbunKey, porkbunSecret) : null;
+  const names = pool && zone ? new Names(pool, zone) : undefined;
+  let certs: Certs | undefined;
+  if (pool && zone) {
+    const issuer = new AcmeIssuer({
+      directoryUrl: process.env["NIXAMP_ACME_DIRECTORY"] ?? "https://acme-v02.api.letsencrypt.org/directory",
+      email: process.env["NIXAMP_ACME_EMAIL"] ?? `hostmaster@${zoneName}`,
+      // The key is kept by the store, so the issuer asks for it each time
+      // rather than holding one that a second instance would not share.
+      accountKey: () => (certs as Certs).accountKey(),
+    });
+    certs = new Certs(pool, zone, issuer, { log: (line) => console.log(`  ${line}`) });
+  }
+  const throttle = pool
+    ? createThrottle({
+        rules: [
+          // Sign-in stays address-bucketed however the request is dressed, or
+          // a guess with an Authorization header buys itself the bigger budget.
+          { path: "/api/v1/auth/", limit: 20, credential: false },
+          { path: "/api/v1/dns/", limit: 30 },
+          { path: "/api/v1/dns", limit: 30 },
+          { path: "/api/v1/certs", limit: 30 },
+          { path: "/api/health", open: true },
+          { path: "/api/directory", limit: 120 },
+        ],
+        // A signed-in browser carries its session as a cookie, and is a
+        // credential the same as a bearer token: a person on a dashboard is
+        // not an anonymous scraper.
+        credentialFrom: (request) =>
+          presentedCredential(request.headers) ?? (tokenFrom(Object.fromEntries(request.headers)) || null),
+      })
+    : undefined;
   // The two things that were promises kept only in memory: a caller who was
   // told they would be texted, and the ended stream a code still points at.
   const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
@@ -3717,7 +3943,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
 
   // Read before listening, so a missing or unreadable certificate is a sentence
   // now rather than a connection that resets later.
-  const tls = options.tlsCert
+  let tls: { cert: string; key: string } | undefined = options.tlsCert
     ? (() => {
         try {
           return { cert: readFileSync(options.tlsCert, "utf8"), key: readFileSync(options.tlsKey, "utf8") };
@@ -3727,6 +3953,45 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       })()
     : undefined;
 
+  // A signed-in server names itself.
+  //
+  // Nothing about DNS or certificates reaches this machine: it asks nixamp.com
+  // for `<label>.<handle>.<zone>` pointing at the address it is calling from,
+  // and for the handle's wildcard certificate, and serves https under that
+  // name. The registrar's keys stay on nixamp.com. Skipped when the operator
+  // named or certified the server by hand, when it listens on one interface
+  // only, or with --no-name.
+  let certExpiresAt = 0;
+  let namedHost = "";
+  const namedSession = readSession();
+  if (
+    !options.noName && !options.publicUrl && !options.tlsCert &&
+    (options.host === "0.0.0.0" || options.host === "::") && namedSession?.token
+  ) {
+    const say = (line: string): void => console.log(`  ${line}`);
+    const named = await claimName(namedSession.site, namedSession.token, labelFor(options.name, hostname()), say);
+    if (named) {
+      namedHost = named.host;
+      // The certificate is the handle's, so the cache is keyed by the handle's
+      // wildcard rather than by this machine's label.
+      const wildcard = `*.${named.host.split(".").slice(1).join(".")}`;
+      let files = readCertFiles(stateDir(), wildcard);
+      if (!files) {
+        const got = await fetchCert(namedSession.site, namedSession.token, {}, say);
+        if (got) {
+          writeCertFiles(stateDir(), got);
+          files = { cert: got.cert, key: got.key, expiresAt: got.expiresAt };
+        }
+      }
+      if (files) {
+        tls = { cert: files.cert, key: files.key };
+        certExpiresAt = files.expiresAt;
+      }
+      options.publicUrl = `${tls ? "https" : "http"}://${named.host}:${options.port}`;
+      console.log(`  This server is ${named.host}${tls ? "" : " -- no certificate yet, so http for now"}.`);
+    }
+  }
+
   // Filled in below, when the RTMP listeners are opened. Read through a
   // function so the handler sees the list rather than the empty array it was
   // built with.
@@ -3803,6 +4068,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(directory ? { directory } : {}),
     ...(follows ? { follows, vapidPublicKey } : {}),
     ...(favorites ? { favorites } : {}),
+    ...(names ? { names } : {}),
+    ...(certs ? { certs } : {}),
+    dnsZone: zoneName,
+    ...(throttle ? { throttle } : {}),
     ...(partyLine ? { partyLine } : {}),
     // Accounts live where the directory lives, and only there: a nixamp on a
     // laptop has nobody to be an account of.
@@ -3855,6 +4124,23 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const bound = server.address();
   const port = typeof bound === "object" && bound !== null ? bound.port : options.port;
 
+  // A named server keeps its certificate fresh without a restart: once a day
+  // it asks for the handle's certificate again and, when a newer one has been
+  // issued, swaps it into the running listener.
+  if (namedHost && namedSession?.token) {
+    const renew = setInterval(() => {
+      void fetchCert(namedSession.site, namedSession.token, { waitMs: 0 }, () => undefined).then((got) => {
+        if (!got || got.expiresAt <= certExpiresAt) return;
+        writeCertFiles(stateDir(), got);
+        certExpiresAt = got.expiresAt;
+        const secure = server as unknown as { setSecureContext?: (context: { cert: string; key: string }) => void };
+        secure.setSecureContext?.({ cert: got.cert, key: got.key });
+        console.log(`  Renewed the certificate for ${namedHost}.`);
+      });
+    }, 24 * 60 * 60 * 1000);
+    renew.unref();
+  }
+
   const io = {
     read: readIfPossible,
     run: (command: string, args: string[]) => {
@@ -4073,6 +4359,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
         name: options.name || hostname(),
         url: listen,
         audio,
+        // The control link, for the owner to open this machine as its
+        // administrator from the directory. The directory shows it to the
+        // owning account and strips it for everyone else.
+        ...(key ? { admin: shareLink(publishable_.url, key) } : {}),
         // Asked at every heartbeat rather than once, because the library is
         // read after the port opens and is still arriving when this is made.
         tracks: () => engine.snapshot(false).trackCount,