openship 0.4.7 → 0.5.0

package/dist/{chunk-FXTBHTWY.js → chunk-RB35YN3J.js}

@@ -13,12 +13,13 @@ import {
   buildReloadCommand,
   detectOpenRestyPaths,
   luaSourceAvailable
-} from "./chunk-VFINNTUL.js";
+} from "./chunk-EAAGSQXN.js";
 import {
   PROXY_GZIP_TYPES,
+  resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-6APULWSU.js";
+} from "./chunk-UMQP7SYT.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -31,7 +32,7 @@ import {
   stat as fsStat
 } from "fs/promises";
 import { execFile as cpExecFile } from "child_process";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { promisify } from "util";
 import { dirname, join } from "path";
 
@@ -218,8 +219,13 @@ function validateCertFor(host, pems, source) {
 function isSafeCertPath(p) {
   return /^\/[A-Za-z0-9._/-]+$/.test(p) && !p.includes("..");
 }
+var BOOTSTRAP_CERT_SEGMENT = "openship-bootstrap";
+function isBootstrapCertPath(p) {
+  return p.split("/").includes(BOOTSTRAP_CERT_SEGMENT);
+}
 async function readDeclaredPair(exec, certPath, keyPath, container) {
   if (!isSafeCertPath(certPath) || !isSafeCertPath(keyPath)) return null;
+  if (isBootstrapCertPath(certPath) || isBootstrapCertPath(keyPath)) return null;
   const certPem = await readMaybeInContainer(exec, certPath, container);
   const keyPem = await readMaybeInContainer(exec, keyPath, container);
   return certPem && keyPem ? { certPem, keyPem } : null;
@@ -251,10 +257,16 @@ async function probeStaticOutput(executor, servedPath) {
 var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";`;
+var FORWARD_VARS = `    set $openship_fwd_proto $scheme;
+    set $openship_redirect_https 1;
+    if ($http_x_forwarded_proto = "https") {
+        set $openship_fwd_proto https;
+        set $openship_redirect_https 0;
+    }`;
 function renderProxyLocations(route) {
   if (!route.proxyLocations || route.proxyLocations.length === 0) return "";
   return route.proxyLocations.map((loc) => {
@@ -266,6 +278,12 @@ function renderProxyLocations(route) {
     }`;
   }).join("");
 }
+function renderHostRedirect(route) {
+  const redirect = route.redirectHost;
+  if (!redirect?.target) return null;
+  assertValidDomain(redirect.target);
+  return `return ${resolveRedirectStatus(redirect.statusCode)} https://${redirect.target}$request_uri;`;
+}
 function renderRedirects(route) {
   if (!route.redirects || route.redirects.length === 0) return "";
   return route.redirects.map(
@@ -360,6 +378,8 @@ function summarizeCertbotFailure(output, domain) {
     diagnosis = `Port 80 for ${domain} isn't reachable from the internet \u2014 a firewall / cloud security group is blocking it, the domain doesn't point at this server, or another proxy is still bound to :80.`;
   } else if (/NXDOMAIN|no\s+(A|AAAA)\s+record|DNS problem|could not be resolved|no records? found/i.test(text)) {
     diagnosis = `${domain} doesn't resolve to this server yet \u2014 the DNS A record is missing or hasn't propagated. Wait for propagation, then retry from the Domains tab.`;
+  } else if (/\b52[56]\b|ssl handshake failed|cloudflare/i.test(text)) {
+    diagnosis = `Cloudflare's proxy is answering the certificate challenge for ${domain} instead of forwarding it to this server: it redirects the request to HTTPS, then rejects the origin's TLS. Fix it one of three ways \u2014 set SSL/TLS \u2192 Overview to "Full" (not "Full (strict)") until the first certificate is issued, or turn the orange cloud off for this record until it is, or upload a Cloudflare Origin CA certificate from the Domains tab and skip Let's Encrypt entirely.`;
   } else if (/404|invalid response|unauthorized|"?status"?:?\s*40\d/i.test(text)) {
     diagnosis = `Port 80 answered but not with our ACME challenge \u2014 another web server is still serving :80, so the takeover didn't complete. Re-run and choose take-over / migrate.`;
   } else if (/too many certificates|rateLimited|rate limit/i.test(text)) {
@@ -377,12 +397,14 @@ var NginxProvider = class {
   executor;
   reloadCommand;
   pinPaths;
+  containerEdge;
   constructor(opts) {
     this.sitesDir = opts.paths.sitesDir;
     this.acmeEmail = opts.acmeEmail;
     this.certDir = opts.certDir ?? DEFAULT_CERT_DIR;
     this.executor = opts.executor ?? null;
-    this.reloadCommand = buildReloadCommand(opts.paths);
+    this.containerEdge = opts.containerEdge ?? false;
+    this.reloadCommand = buildReloadCommand(opts.paths, { containerEdge: this.containerEdge });
     this.pinPaths = opts.pinPaths ?? false;
   }
   // ── File operation helpers (dual-path: local or remote) ──────────────
@@ -433,7 +455,7 @@ var NginxProvider = class {
       await this.executor.rm(path);
     } else {
       try {
-        await fsRm(path);
+        await fsRm(path, { recursive: true, force: true });
       } catch {
       }
     }
@@ -476,6 +498,89 @@ var NginxProvider = class {
       await this._rm(staging).catch(() => void 0);
     }
   }
+  /**
+   * Where a domain's temporary self-signed cert lives — a SIBLING of certbot's
+   * `live/`, deliberately not inside it. See {@link ensureBootstrapCert}.
+   */
+  bootstrapCertDir(domain) {
+    return join(dirname(this.certDir), BOOTSTRAP_CERT_SEGMENT, domain);
+  }
+  /**
+   * Ensure a self-signed placeholder cert exists for `domain`, so a route whose TLS
+   * we terminate can ALWAYS complete a TLS handshake — including before certbot has
+   * issued anything.
+   *
+   * Why a missing :443 block is a hard failure, not a soft one: an unmatched SNI
+   * falls through to the edge's `ssl_reject_handshake` default (correct — it stops
+   * unrouted hosts being cross-served someone else's cert). But that means the
+   * origin REFUSES the handshake for a domain we do route. Behind Cloudflare's
+   * proxy every visitor sees error 525, and issuance deadlocks: Cloudflare answers
+   * the HTTP-01 challenge with a 301 to https, then can't reach an origin that
+   * refuses TLS, so the challenge fails and the vhost stays HTTP-only — forever
+   * (#308). A placeholder breaks the loop: Cloudflare "Full" accepts it, the
+   * challenge completes, and the real cert takes over.
+   *
+   * Deliberately NOT written under `certDir`: `certsExist()` / `readCertInfo()`
+   * read that path, so a self-signed cert there would short-circuit provisionCert
+   * and report an untrusted cert as `active`, with the renewal scheduler and the
+   * verify-pending sweep both satisfied. Keeping it in a sibling dir means cert
+   * STATUS is untouched — the domain still reads provisioning/error and keeps
+   * retrying until a real cert lands.
+   *
+   * Returns null when nothing could be produced (no `openssl` on the executor, exec
+   * failure); the caller falls back to an HTTP-only vhost, exactly as before.
+   * Never throws — a placeholder must not be able to fail a deploy.
+   */
+  async ensureBootstrapCert(domain) {
+    const dir = this.bootstrapCertDir(domain);
+    const certPath = join(dir, "fullchain.pem");
+    const keyPath = join(dir, "privkey.pem");
+    try {
+      if (await this._exists(certPath) && await this._exists(keyPath)) {
+        return { certPath, keyPath };
+      }
+    } catch {
+      return null;
+    }
+    const staging = `${dir}.staging-${process.pid}-${randomBytes(4).toString("hex")}`;
+    try {
+      await this._mkdir(staging);
+      await this._exec("openssl", [
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-keyout",
+        join(staging, "privkey.pem"),
+        "-out",
+        join(staging, "fullchain.pem"),
+        "-days",
+        "3650",
+        "-subj",
+        `/CN=${domain}`,
+        "-addext",
+        `subjectAltName=DNS:${domain}`
+      ]);
+      await this._mkdir(dir);
+      if (this.executor) {
+        await this.executor.exec(
+          `mv -f ${sq(join(staging, "fullchain.pem"))} ${sq(join(staging, "privkey.pem"))} ${sq(dir)}/`
+        );
+      } else {
+        await fsRename(join(staging, "fullchain.pem"), certPath);
+        await fsRename(join(staging, "privkey.pem"), keyPath);
+      }
+      return { certPath, keyPath };
+    } catch (err) {
+      console.warn(
+        `[SSL] could not create a temporary certificate for ${domain} \u2014 serving HTTP only until a real certificate is issued (is openssl installed on the edge?): ${safeErrorMessage(err)}`
+      );
+      return null;
+    } finally {
+      await this._rm(staging).catch(() => void 0);
+    }
+  }
   async _exec(command, args = []) {
     if (this.executor) {
       const full = args.length ? `${command} ${args.map(sq).join(" ")}` : command;
@@ -562,34 +667,61 @@ var NginxProvider = class {
   async registerRoute(route) {
     assertValidDomain(route.domain);
     await this._mkdir(this.sitesDir);
-    const slug = this.domainSlug(route.domain);
+    const slug = await this.resolveSlug(route.domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     if ("staticRoot" in route && route.staticRoot) {
       assertValidStaticRoot(route.staticRoot, { adopted: route.staticRootAdopted });
     } else {
       assertValidUpstream(route.targetUrl);
     }
-    const locationBody = "staticRoot" in route && route.staticRoot ? `root ${route.staticRoot};
+    const hostRedirect = renderHostRedirect(route);
+    const locationBody = hostRedirect ? hostRedirect : "staticRoot" in route && route.staticRoot ? `root ${route.staticRoot};
         index index.html;
         try_files $uri $uri/ /index.html;` : `proxy_pass ${route.targetUrl};
         ${PROXY_HEADERS}`;
-    const extraLocations = `${renderRedirects(route)}${renderProxyLocations(route)}`;
-    const serverHeaders = renderServerHeaders(route);
+    const extraLocations = hostRedirect ? "" : `${renderRedirects(route)}${renderProxyLocations(route)}`;
+    const serverHeaders = hostRedirect ? "" : renderServerHeaders(route);
     const proxyOpts = renderProxyOptions(route.proxy);
-    const webhookLocation = route.webhookProxy ? `
+    const webhookLocation = route.webhookProxy && !hostRedirect ? `
     location /_openship/hooks/ {
         proxy_pass ${route.webhookProxy};
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $openship_fwd_proto;
     }
 ` : "";
     const edgeLua = luaSourceAvailable();
-    const luaLogOnly = edgeLua ? `    log_by_lua_file ${LUA_LOGGER_PATH};` : "";
     const luaProxy = edgeLua ? `    log_by_lua_file ${LUA_LOGGER_PATH};
     access_by_lua_file ${RULES_GUARD_PATH};` : "";
+    const serveLocation = `    location / {
+        ${locationBody}
+    }`;
+    const redirectOrServeLocation = hostRedirect ? serveLocation : `    location / {
+        if ($openship_redirect_https) {
+            return 301 https://$server_name$request_uri;
+        }
+
+        ${locationBody}
+    }`;
+    const sharedBody = `${serverHeaders}${proxyOpts}
+${webhookLocation}${extraLocations}`;
+    const httpOnlyBlock = `# Auto-generated by Openship - do not edit manually
+server {
+    listen 80;
+    server_name ${route.domain};
+
+${FORWARD_VARS}
+
+${luaProxy}
+
+${ACME_CHALLENGE_LOCATION}
+${sharedBody}
+${serveLocation}
+}
+`;
     let serverBlock;
+    let bootstrapServed = false;
     if (route.tls && await this.certsExist(route.domain)) {
       const certPath = join(this.certDir, route.domain, "fullchain.pem");
       const keyPath = join(this.certDir, route.domain, "privkey.pem");
@@ -598,45 +730,65 @@ server {
     listen 80;
     server_name ${route.domain};
 
-${luaLogOnly}
+${FORWARD_VARS}
 
-${ACME_CHALLENGE_LOCATION}
+${luaProxy}
 
-    location / {
-        return 301 https://$server_name$request_uri;
-    }
+${ACME_CHALLENGE_LOCATION}
+${sharedBody}
+${redirectOrServeLocation}
 }
 
 server {
     listen 443 ssl;
     server_name ${route.domain};
 
+${FORWARD_VARS}
+
 ${luaProxy}
 
     ssl_certificate ${certPath};
     ssl_certificate_key ${keyPath};
-${serverHeaders}${proxyOpts}
-${webhookLocation}${extraLocations}
-    location / {
-        ${locationBody}
-    }
+${sharedBody}
+${serveLocation}
 }
 `;
-    } else {
-      serverBlock = `# Auto-generated by Openship - do not edit manually
+    } else if (route.tls && route.terminatesTlsLocally) {
+      const bootstrap = await this.ensureBootstrapCert(route.domain);
+      bootstrapServed = !!bootstrap;
+      serverBlock = bootstrap ? `# Auto-generated by Openship - do not edit manually
+# openship-bootstrap-tls: ${route.domain} is serving a TEMPORARY self-signed
+# certificate because its real certificate has not been issued yet. Openship
+# replaces this file automatically once it lands. Do not adopt this material.
 server {
     listen 80;
     server_name ${route.domain};
 
+${FORWARD_VARS}
+
 ${luaProxy}
-${serverHeaders}${proxyOpts}
+
 ${ACME_CHALLENGE_LOCATION}
-${webhookLocation}${extraLocations}
-    location / {
-        ${locationBody}
-    }
+${sharedBody}
+${serveLocation}
 }
-`;
+
+server {
+    listen 443 ssl;
+    server_name ${route.domain};
+
+${FORWARD_VARS}
+
+${luaProxy}
+
+    ssl_certificate ${bootstrap.certPath};
+    ssl_certificate_key ${bootstrap.keyPath};
+${sharedBody}
+${serveLocation}
+}
+` : httpOnlyBlock;
+    } else {
+      serverBlock = httpOnlyBlock;
     }
     const snapshot = await this._captureFile(configPath);
     await this._writeFile(configPath, serverBlock);
@@ -647,6 +799,9 @@ ${webhookLocation}${extraLocations}
       await this.reload().catch(() => void 0);
       throw err;
     }
+    if (!bootstrapServed) {
+      await this._rm(this.bootstrapCertDir(route.domain)).catch(() => void 0);
+    }
     await this._writeFile(this.routeStatePath(slug), JSON.stringify(route)).catch(() => void 0);
   }
   routeStatePath(slug) {
@@ -664,7 +819,7 @@ ${webhookLocation}${extraLocations}
    */
   async removeRoute(domain) {
     assertValidDomain(domain);
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     const statePath = this.routeStatePath(slug);
     const confSnapshot = await this._captureFile(configPath);
@@ -679,6 +834,7 @@ ${webhookLocation}${extraLocations}
       await this.reload().catch(() => void 0);
       throw err;
     }
+    await this._rm(this.bootstrapCertDir(domain)).catch(() => void 0);
   }
   // ── SSL ──────────────────────────────────────────────────────────────
   /**
@@ -725,7 +881,7 @@ ${webhookLocation}${extraLocations}
     } catch (err) {
       throw new Error(summarizeCertbotFailure(safeErrorMessage(err), domain));
     }
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     try {
       const state = await this._readFile(this.routeStatePath(slug));
@@ -816,7 +972,7 @@ ${tail}` : "")
     const { expiresAt } = candidate.cert;
     const dir = join(this.certDir, domain);
     await this.stageCertDir(dir, cert);
-    const slug = this.domainSlug(domain);
+    const slug = await this.resolveSlug(domain);
     try {
       const state = await this._readFile(this.routeStatePath(slug));
       const saved = JSON.parse(state);
@@ -832,9 +988,87 @@ ${tail}` : "")
     };
   }
   // ── Helpers ──────────────────────────────────────────────────────────
+  /**
+   * Filename stem for a domain. NOT injective — see `resolveSlug`.
+   *
+   * Kept exactly as-is on purpose: it names every vhost file on every existing
+   * install, so changing it would rename the lot and leave the old names behind
+   * still serving. `resolveSlug` handles the collisions instead.
+   */
   domainSlug(domain) {
     return domain.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-+/g, "-");
   }
+  /** Deterministic per-domain disambiguator for a slug collision. */
+  slugSuffix(domain) {
+    return createHash("sha1").update(domain).digest("hex").slice(0, 8);
+  }
+  /** Every `server_name` token declared in a vhost body. */
+  serverNamesIn(conf) {
+    const names = [];
+    for (const m of conf.matchAll(/server_name\s+([^;]+);/g)) {
+      for (const tok of m[1].trim().split(/\s+/)) {
+        if (tok) names.push(tok.toLowerCase().replace(/\.$/, ""));
+      }
+    }
+    return names;
+  }
+  /**
+   * The slug THIS domain's files live under.
+   *
+   * `domainSlug` folds every non-alphanumeric to `-`, so a dot and a literal dash
+   * collapse together and two different, separately-claimable hostnames land on
+   * one filename:
+   *
+   *     staging.app.example.com  ->  staging-app-example-com
+   *     staging-app.example.com  ->  staging-app-example-com
+   *
+   * Both are ordinary hostnames and can belong to different projects — even
+   * different orgs, since one edge fronts the whole box. Whichever registered last
+   * silently overwrote the other's vhost, and the loser's traffic fell through to
+   * `default_server`: a silent outage of somebody else's domain. `removeRoute` on
+   * either one deleted the shared file and took out both.
+   *
+   * Resolution, in this order, and the order is the whole correctness argument:
+   *
+   *   1. A disambiguated file for this domain already exists → keep using it.
+   *      MUST come first. If the incumbent is later removed, step 3 would hand
+   *      this domain the now-free base name while its real conf stayed on disk
+   *      under the suffixed name — two files serving one hostname, which is the
+   *      exact orphan class this whole change exists to remove.
+   *   2. The base file exists and does NOT list this domain in its `server_name`
+   *      → it is someone else's. Take a suffixed name; the incumbent is untouched.
+   *   3. Otherwise the base name is ours (free, or already ours).
+   *
+   * Containment, not equality, in step 2 — and the reason is narrower than it
+   * looks. Everything WE write carries exactly one `server_name` (see the server
+   * blocks above), and a takeover fans out one `registerRoute` per hostname
+   * (`registerImportedSites`), so no Openship-managed conf ever lists two. The
+   * only file that can is one the operator placed in `sites-enabled` themselves.
+   *
+   * For that file, reusing it is the lesser evil, not a free win: we rewrite it
+   * with a single `server_name`, so a sibling hostname it also served stops being
+   * served. The alternative is worse — a second vhost answering a name the first
+   * one already claims makes OpenResty warn "conflicting server name" and silently
+   * keep the FIRST, so the route we were asked to create would not take effect at
+   * all. Losing the sibling is at least the outcome the caller asked for.
+   */
+  async resolveSlug(domain) {
+    const base = this.domainSlug(domain);
+    const suffixed = `${base}-${this.slugSuffix(domain)}`;
+    const host = domain.toLowerCase().replace(/\.$/, "");
+    if (await this._exists(join(this.sitesDir, `${suffixed}.conf`)).catch(() => false)) {
+      return suffixed;
+    }
+    const basePath = join(this.sitesDir, `${base}.conf`);
+    if (await this._exists(basePath).catch(() => false)) {
+      const conf = await this._readFile(basePath).catch(() => "");
+      if (conf) {
+        const names = this.serverNamesIn(conf);
+        if (names.length > 0 && !names.includes(host)) return suffixed;
+      }
+    }
+    return base;
+  }
   /**
    * Re-detect OpenResty paths and reload.
    *
@@ -848,7 +1082,9 @@ ${tail}` : "")
         try {
           const freshPaths = await detectOpenRestyPaths(this.executor);
           this.sitesDir = freshPaths.sitesDir;
-          this.reloadCommand = buildReloadCommand(freshPaths);
+          this.reloadCommand = buildReloadCommand(freshPaths, {
+            containerEdge: this.containerEdge
+          });
         } catch {
         }
       }