querysub 0.313.0 → 0.315.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.313.0",
+  "version": "0.315.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",

package/src/-e-certs/EdgeCertController.ts

@@ -28,6 +28,7 @@ import { magenta, yellow } from "socket-function/src/formatting/logColors";
 import { timeInMinute, timeInSecond } from "socket-function/src/misc";
 import { nodeDiscoveryShutdown } from "../-f-node-discovery/NodeDiscovery";
 import { shutdown } from "../diagnostics/periodic";
+import { formatDateTime } from "socket-function/src/formatting/format";
 
 let publicPort = -1;
 
@@ -65,6 +66,8 @@ export async function getSNICerts(config: {
         },
     };
 
+    await publishEdgeDomain();
+
     return certs;
 }
 
@@ -93,7 +96,7 @@ const certUpdateLoop = lazy(() => {
     logErrors((async () => {
         let firstLoop = true;
         while (true) {
-            let curCert = await getCertFromRemote();
+            let curCert = await getHTTPSKeyCert(getDomain());
             if (!curCert) {
                 throw new Error(`Internal error, certUpdateLoop called before lastPromise was set`);
             }
@@ -102,14 +105,9 @@ const certUpdateLoop = lazy(() => {
             let expirationTime = +new Date(certObj.validity.notAfter);
             let createTime = +new Date(certObj.validity.notBefore);
 
-            // If 75% of the lifetime has passed, renew the cert
+            // If 75% of the lifetime has passed, getHTTPSKeyCert should have updated it, so wait until that, then get the new cert, and update our watchers (which should be the servers).
             let renewDate = createTime + (expirationTime - createTime) * 0.75;
             let timeToExpire = renewDate - Date.now();
-            if (timeToExpire < 0) {
-                console.log(`HTTPS certificate is looking too old. Renewing from remote.`);
-                getCertFromRemote = createGetCertFromRemote();
-                continue;
-            }
 
             if (!firstLoop) {
                 for (let callback of callbacks) {
@@ -118,43 +116,19 @@ const certUpdateLoop = lazy(() => {
             }
             firstLoop = false;
 
+            if (timeToExpire < 0) {
+                console.warn(`getHTTPSKeyCert gave as an almost expired. It is not supposed to do this. It should have updated it by now... Expires on ${formatDateTime(expirationTime)}`);
+                timeToExpire = timeInMinute * 15;
+            }
             // Max timeout a signed integer, but lower is fine too
-            timeToExpire = Math.min(timeToExpire, 2 ** 30);
-            console.log(`Certicates up to date, renewing on ${new Date(Date.now() + timeToExpire)}`);
+            timeToExpire = Math.min(Math.floor(timeToExpire), 2 ** 30);
             await delay(timeToExpire);
-            console.log(`Woke up to renew`);
+            console.log(`Woke up to propagate new certs`);
         }
     })());
 });
 
-function createGetCertFromRemote() {
-    return lazy(async () => {
-        return backoffRetryLoop(async () => {
-            // Skip the remote call if we have DNS write permissions, to
-            //  make bootstrapping easier.
-            if (await hasDNSWritePermissions()) {
-                let ip = SocketFunction.mountedIP;
-                if (ip === "0.0.0.0") {
-                    ip = await getExternalIP();
-                }
-                return await getHTTPSKeyCertInner(ip);
-            }
-
-            let edgeNodeId = await getControllerNodeId(EdgeCertController);
-            if (!edgeNodeId) {
-                throw new Error("No EdgeCertController found");
-            }
-            return await EdgeCertController.nodes[edgeNodeId].getHTTPSKeyCert();
-        });
-    });
-}
-let getCertFromRemote = createGetCertFromRemote();
 
-// NOTE: Only works if the machine is already listening. Needed for some special websocket
-//  stuff related to debugging.
-export function debugGetRawEdgeCert() {
-    return getCertFromRemote();
-}
 
 let callbacks: ((newCertPair: { cert: string; key: string }) => void)[] = [];
 async function EdgeCertController_watchHTTPSKeyCert(
@@ -163,7 +137,7 @@ async function EdgeCertController_watchHTTPSKeyCert(
     certUpdateLoop();
 
     callbacks.push(callback);
-    let certPair = await getCertFromRemote();
+    let certPair = await getHTTPSKeyCert(getDomain());
     callback(certPair);
 }
 
@@ -194,7 +168,7 @@ const runEdgeDomainAliveLoop = lazy(() => {
     // NOTE: Our DNS TTL is 1 minute, which means no matter how fast we poll,
     //  we can't get below that. Of course the worst case is that + our poll rate,
     //  but still, this means there is less and less benefit the lower this value is.
-    runInfinitePoll(timeInMinute, checkEdgeDomainsAlive);
+    runInfinitePoll(timeInMinute * 3, checkEdgeDomainsAlive);
 });
 async function checkEdgeDomainsAlive() {
     if (isNoNetwork()) return;
@@ -228,95 +202,62 @@ async function checkEdgeDomainsAlive() {
     }
 }
 
-async function getHTTPSKeyCertInner(callerIP: string) {
-    let cert = await getBaseCert();
-    // If the cert is 50% expired generate a new one
-    let certObj = parseCert(cert.cert);
-
-    // Get expiration date
-    let expirationTime = +new Date(certObj.validity.notAfter);
-    let createTime = +new Date(certObj.validity.notBefore);
-
-    // If 50% of the lifetime has passed, renew the cert
-    let renewDate = createTime + (expirationTime - createTime) * 0.5;
-    if (renewDate < Date.now()) {
-        console.log(`HTTPS certificate is looking too old, forcefully renewing`);
-        getHTTPSKeyCert.clear(getDomain());
-        getBaseCert = createGetBaseCert();
-        cert = await getBaseCert();
+async function publishEdgeDomain() {
+    let callerIP = SocketFunction.mountedIP;
+    if (callerIP === "0.0.0.0") {
+        callerIP = await getExternalIP();
+    }
+    if (!callerIP) {
+        console.warn(`publishEdgeDomain called before SocketFunction.mount was called, so we don't know the public ip.`);
+        return;
     }
-
     // IMPORTANT! We have to set our A record AFTER we create our cert, otherwise we might wait a while
     //  with our A record public while we create our cert.
     runEdgeDomainAliveLoop();
     const edgeDomain = getDomain();
-    if (callerIP && !isBootstrapOnly()) {
-        try {
-            let promises: Promise<void>[] = [];
-            let existingIPs = await getRecords("A", edgeDomain);
-            if (!isPublic()) {
+    try {
+        let promises: Promise<void>[] = [];
+        let existingIPs = await getRecords("A", edgeDomain);
+        if (!isPublic()) {
+            if (existingIPs.length === 0) {
+                promises.push(addRecord("A", edgeDomain, callerIP));
+            } else if (existingIPs.length === 1 && existingIPs[0] === "127.0.0.1") {
+                // Good, do nothing
+            } else {
+                // Don't remove the public servers, this is probably just us accidentally running a
+                //  test script for a public domain.
+                /*
+                // Maybe they took down all the public servers?
+                await removeDeadARecords();
+                existingIPs = await getRecords("A", edgeDomain);
                 if (existingIPs.length === 0) {
-                    promises.push(addRecord("A", edgeDomain, callerIP));
-                } else if (existingIPs.length === 1 && existingIPs[0] === "127.0.0.1") {
-                    // Good, do nothing
+                    await addRecord("A", edgeDomain, callerIP);
                 } else {
-                    // Don't remove the public servers, this is probably just us accidentally running a
-                    //  test script for a public domain.
-                    /*
-                    // Maybe they took down all the public servers?
-                    await removeDeadARecords();
-                    existingIPs = await getRecords("A", edgeDomain);
-                    if (existingIPs.length === 0) {
-                        await addRecord("A", edgeDomain, callerIP);
-                    } else {
-                        await addRecord("A", "127-0-0-1." + edgeDomain, "127.0.0.1");
-                        console.warn(`Tried to serve an edge node on the local domain, but SocketFunction.mount did NOT specify a public ip (ex, { ip: "0.0.0.0" }) AND there are already existing public servers. You can't load balance between real ips and 127.0.0.1! ${existingIPs.join(", ")}. You will need to use 127-0-0-1.${edgeDomain} to access the local server (instead of just ${edgeDomain}).`);
-                    }
-                    */
-                    console.log(yellow(`Current process is not marked as public, but machine previous had public services. NOT setting ${edgeDomain} to 127.0.0.1, as this would make the public services inaccessible. Assuming the current process is for development, I recommend using 127-0-0-1.${edgeDomain} or 127-0-0-1.${edgeDomain} to access the server.`));
+                    await addRecord("A", "127-0-0-1." + edgeDomain, "127.0.0.1");
+                    console.warn(`Tried to serve an edge node on the local domain, but SocketFunction.mount did NOT specify a public ip (ex, { ip: "0.0.0.0" }) AND there are already existing public servers. You can't load balance between real ips and 127.0.0.1! ${existingIPs.join(", ")}. You will need to use 127-0-0-1.${edgeDomain} to access the local server (instead of just ${edgeDomain}).`);
                 }
-            } else {
-                if (existingIPs.includes("127.0.0.1")) {
-                    console.log(magenta(`Switching from local development to production development (removing A record for 127.0.0.1, and using a real ip)`));
-                    promises.push(deleteRecord("A", edgeDomain, "127.0.0.1"));
-                }
-                promises.push(addRecord("A", edgeDomain, callerIP, "proxied"));
-                runInfinitePoll(timeInMinute * 1, async () => {
-                    let ips = await getRecords("A", edgeDomain);
-                    if (!ips.includes(callerIP)) {
-                        console.error(`Our A record for ${edgeDomain} is no longer pointing to our ip (${callerIP}, as it is now pointing to ${JSON.stringify(ips)}). Terminating, hopefully when we restart we will fix it. This SHOULDN'T happen often!`);
-                        await shutdown();
-                    }
-                });
+                */
+                console.log(yellow(`Current process is not marked as public, but machine previous had public services. NOT setting ${edgeDomain} to 127.0.0.1, as this would make the public services inaccessible. Assuming the current process is for development, I recommend using 127-0-0-1.${edgeDomain} or 127-0-0-1.${edgeDomain} to access the server.`));
+            }
+        } else {
+            if (existingIPs.includes("127.0.0.1")) {
+                console.log(magenta(`Switching from local development to production development (removing A record for 127.0.0.1, and using a real ip)`));
+                promises.push(deleteRecord("A", edgeDomain, "127.0.0.1"));
             }
-            promises.push(addRecord("A", "127-0-0-1." + edgeDomain, "127.0.0.1"));
-            // Add records in parallel, so we can wait for DNS propagation in parallel
-            await Promise.all(promises);
-        } catch (e) {
-            console.error(`Error updating DNS records, continuing without updating them`, e);
+            promises.push(addRecord("A", edgeDomain, callerIP, "proxied"));
+            runInfinitePoll(timeInMinute * 1, async () => {
+                let ips = await getRecords("A", edgeDomain);
+                if (!ips.includes(callerIP)) {
+                    console.error(`Our A record for ${edgeDomain} is no longer pointing to our ip (${callerIP}, as it is now pointing to ${JSON.stringify(ips)}). Terminating, hopefully when we restart we will fix it. This SHOULDN'T happen often!`);
+                    await shutdown();
+                }
+            });
         }
-    }
-
-    return cert;
-}
-
-class EdgeCertControllerBase {
-    public async getHTTPSKeyCert() {
-        // Ensure the a record is subscribed
-        const caller = SocketFunction.getCaller();
-        let callerIP = getNodeIdIP(caller.nodeId);
-        return await getHTTPSKeyCertInner(callerIP);
+        promises.push(addRecord("A", "127-0-0-1." + edgeDomain, "127.0.0.1"));
+        // Add records in parallel, so we can wait for DNS propagation in parallel
+        await Promise.all(promises);
+    } catch (e) {
+        console.error(`Error updating DNS records, continuing without updating them`, e);
     }
 }
 
-
-const EdgeCertController = SocketFunction.register(
-    "EdgeCertController-694c925b-fb10-4656-aed0-b53a48ded548",
-    new EdgeCertControllerBase(),
-    () => ({
-        getHTTPSKeyCert: {},
-    }),
-    () => ({
-        hooks: [requiresNetworkTrustHook],
-    })
-);

package/src/-e-certs/certAuthority.ts

@@ -40,6 +40,12 @@ export const getHTTPSKeyCert = cache(async (domain: string): Promise<{ key: stri
             console.log(magenta(`Renewing domain ${domain} (renew target is ${formatDateTime(renewDate)}).`));
             keyCert = undefined;
         }
+        let timeUntilRenew = renewDate - Date.now();
+        setTimeout(() => {
+            console.log(magenta(`Clearing getHTTPSKeyCert to try to renew ${domain} (renew target is ${formatDateTime(renewDate)}).`));
+            getHTTPSKeyCert.clear(domain);
+            void getHTTPSKeyCert(domain);
+        }, Math.min(Math.floor(timeUntilRenew * 1.1), 2 ** 30));
     } else {
         console.log(magenta(`No cert found for domain ${domain}, generating shortly.`));
     }

package/src/deployManager/components/ServiceDetailPage.tsx

@@ -338,7 +338,7 @@ export class ServiceDetailPage extends qreact.Component {
 
                                 <ATag values={[
                                     managementPageURL.getOverride("LogViewer2"),
-                                    filterParam.getOverride(`__nodeId = ${machineId}`),
+                                    filterParam.getOverride(`__machineId = ${machineId}`),
                                 ]}>
                                     Machine Logs
                                 </ATag>

package/src/deployManager/setupMachineMain.ts

@@ -171,7 +171,9 @@ async function main() {
     // Get RAM amount to calculate appropriate swap size
     const memInfo = await runPromise(`ssh ${sshRemote} "free -m | grep Mem"`);
     const ramMB = parseInt(memInfo.split(/\s+/)[1]);
-    if (swapTotal > 0) {
+    if (Number.isNaN(swapTotal) || Number.isNaN(ramMB)) {
+        console.error(`Error getting swap or memory info, swapInfo: ${swapInfo}, memInfo: ${memInfo}`);
+    } else if (swapTotal > 0) {
         console.log(`✅ Swap already configured: ${swapTotal}MB SWAP vs ${ramMB}MB REAL MEMORY`);
     } else {
         // Calculate swap size based on RAM:
@@ -213,6 +215,11 @@ async function main() {
 
     console.log("Setting up machine:", sshRemote);
 
+    // 0. Update apt
+    console.log("Updating apt...");
+    await runPromise(`ssh ${sshRemote} "sudo apt update"`);
+    console.log("✅ Apt updated");
+
     // 1. Copy backblaze file to remote server (~/backblaze.json)
     console.log("Copying backblaze credentials...");
     if (fs.existsSync(backblazePath)) {

package/src/diagnostics/NodeViewer.tsx

@@ -23,7 +23,6 @@ import { ValueAuditController } from "../../src/5-diagnostics/memoryValueAudit";
 import { getExternalIP } from "../../src/misc/networking";
 import dns from "dns";
 import { getNodeIdDomain, getNodeIdIP } from "socket-function/src/nodeCache";
-import { debugGetRawEdgeCert } from "../../src/-e-certs/EdgeCertController";
 import ws from "ws";
 import https from "https";
 import debugbreak from "debugbreak";
@@ -38,6 +37,7 @@ import { ATag } from "../library-components/ATag";
 import { getSyncedController } from "../library-components/SyncedController";
 import child_process from "child_process";
 import { filterParam } from "./logs/FastArchiveViewer";
+import { getHTTPSKeyCert } from "../-e-certs/certAuthority";
 
 
 type NodeData = {
@@ -431,7 +431,7 @@ class NodeViewerControllerBase {
         });
 
         let baseNodeIP = getNodeIdIP(nodeId);
-        let cert = await debugGetRawEdgeCert();
+        let cert = await getHTTPSKeyCert(getDomain());
 
         const child = child_process.spawn("node", [
             "-e",

package/src/diagnostics/logs/FastArchiveAppendable.ts

@@ -110,6 +110,14 @@ export function getFileTimeStamp(path: string): number {
     return new Date(dateStr).getTime();
 }
 
+
+// NOTE: Global, to prevent hot reloading, or redundant FastArchiveAppendable, from breaking things.
+const appendableSerialLock = (globalThis as any).appendableSerialLock ?? runInSerial(async (fnc: () => Promise<void>) => {
+    await fnc();
+});
+(globalThis as any).appendableSerialLock = appendableSerialLock;
+
+
 export class FastArchiveAppendable<Datum> {
     private lastSizeWarningTime = 0;
 
@@ -181,14 +189,10 @@ export class FastArchiveAppendable<Datum> {
         }
     }
 
-    private serialLock = runInSerial(async (fnc: () => Promise<void>) => {
-        await fnc();
-    });
-
     // NOTE: This is disk writing, which should be fast, but if it's slow we might be able to remove the measureWrap (as technically spending 50% of our time writing to the disk is fine, and won't lag anything).
     @measureFnc
     public async flushNow(now = Date.now()) {
-        await this.serialLock(async () => {
+        await appendableSerialLock(async () => {
             // 2025-09-06T07
             let hourFile = new Date(now).toISOString().slice(0, 13) + ".log";
             let localCacheFolder = this.getLocalPathRoot() + getOwnThreadId() + "/";
@@ -259,13 +263,15 @@ export class FastArchiveAppendable<Datum> {
 
     public static getBackblazePath(config: { fileName: string; threadId: string }): string {
         // 2025-09-06T07
-        let [year, month, day, hour] = config.fileName.split(/[-T:]/);
+        let mainName = config.fileName.replace(/\.log$/, "");
+        let [year, month, day, hour] = mainName.split(/[-T:]/);
         return `${year}/${month}/${day}/${hour}/${config.threadId}.log`;
     }
 
     public async moveLogsToBackblaze() {
-        await this.serialLock(async () => {
+        await appendableSerialLock(async () => {
             let rootCacheFolder = this.getLocalPathRoot();
+            console.log(magenta(`Moving old logs to Backblaze from ${rootCacheFolder}`));
 
             let archives = this.getArchives();
             async function moveLogsForFolder(threadId: string) {
@@ -274,22 +280,25 @@ export class FastArchiveAppendable<Datum> {
                 let files = await fs.promises.readdir(threadDir);
                 for (let file of files) {
                     if (file === "heartbeat") continue;
-                    // 2025-09-06T07
                     let fullPath = threadDir + file;
-
-                    // We could use modified time here? Although, this is nice if we move files around, and then manually have them moved, although even then... this could cause problem be tripping while we are copying the file, so... maybe this is just wrong?
-                    let timeStamp = getFileTimeStamp(fullPath);
-                    if (timeStamp > Date.now() - UPLOAD_THRESHOLD) continue;
-
-
-                    // NOTE: Because we use the same target path, if multiple services do this at the same time it's fine. Not great, but... fine.
-                    let backblazePath = FastArchiveAppendable.getBackblazePath({ fileName: file, threadId });
-                    console.log(magenta(`Moving ${fullPath} to Backblaze as ${backblazePath}`));
-                    let data = await measureBlock(async () => fs.promises.readFile(fullPath), "FastArchiveAppendable|readBeforeUploading");
-                    let compressed = await measureBlock(async () => Zip.gzip(data), "FastArchiveAppendable|compress");
-                    console.log(`Uploading ${formatNumber(data.length)}B (compressed to ${formatNumber(compressed.length)}B) logs to ${backblazePath} from ${fullPath}`);
-                    await archives.set(backblazePath, compressed);
-                    await fs.promises.unlink(fullPath);
+                    try {
+                        // We could use modified time here? Although, this is nice if we move files around, and then manually have them moved, although even then... this could cause problem be tripping while we are copying the file, so... maybe this is just wrong?
+                        let timeStamp = getFileTimeStamp(fullPath);
+                        if (timeStamp > Date.now() - UPLOAD_THRESHOLD) continue;
+
+                        // NOTE: Because we use the same target path, if multiple services do this at the same time it's fine. Not great, but... fine.
+                        let backblazePath = FastArchiveAppendable.getBackblazePath({ fileName: file, threadId });
+                        console.log(magenta(`Moving ${fullPath} to Backblaze as ${backblazePath}`));
+
+                        let data = await measureBlock(async () => fs.promises.readFile(fullPath), "FastArchiveAppendable|readBeforeUploading");
+                        let compressed = await measureBlock(async () => Zip.gzip(data), "FastArchiveAppendable|compress");
+                        console.log(`Uploading ${formatNumber(data.length)}B (compressed to ${formatNumber(compressed.length)}B) logs to ${backblazePath} from ${fullPath}`);
+                        await archives.set(backblazePath, compressed);
+                        await fs.promises.unlink(fullPath);
+                    } catch (e: any) {
+                        // Just skip it, if the first file in the directory is broken we don't want to never move any files
+                        console.error(`Error moving log file ${fullPath}: ${e.stack}`);
+                    }
                 }
             }
 

package/src/diagnostics/logs/FastArchiveViewer.tsx

@@ -553,7 +553,7 @@ export class FastArchiveViewer<T> extends qreact.Component<{
                     </div>
                 </div>
 
-                <div className={css.vbox(12).fillWidth}>
+                <div className={css.vbox(12).fillWidth.paddingBottom(20)}>
                     <InputLabelURL
                         label={
                             <div className={css.hbox(10)}>

package/src/diagnostics/logs/errorNotifications/ErrorWarning.tsx

@@ -179,7 +179,6 @@ export class ErrorWarning extends qreact.Component {
                             }
                         }}
                         className={css.fontSize(12).pad2(4, 6)}
-                        disabled={!this.state.suppressionInput.trim()}
                     >
                         Fixed
                     </Button>
@@ -196,7 +195,6 @@ export class ErrorWarning extends qreact.Component {
                             }
                         }}
                         className={css.fontSize(12).pad2(4, 6)}
-                        disabled={!this.state.suppressionInput.trim()}
                     >
                         Not a bug
                     </Button>

package/src/diagnostics/logs/lifeCycleAnalysis/spec.md

@@ -6,7 +6,9 @@ Very small amount of data
 
 
 4) Setup new hetnzer server
-    yarn setup-machine 176.9.2.136
+
+yarn setup-machine 176.9.2.136
+
 5) Update all services, and move them to that machine
 5) Verify the hezner server can run the site well
 6) Take down our digital ocean server
@@ -19,6 +21,7 @@ Very small amount of data
     - Reset filter in FastArchiveViewer
         - First observe the overlap with it and the BookOverview
         - If we are actually on the book overview page and we close the management page then that shouldn't reset it. We just want to reset it when you change pages. Because we want you to be able to hide and show the management page quickly if you want to double check something. Generally speaking though, you won't be on a page with filter and then going back and forth. And if you are, whatever. That's just the management page. We just want to avoid the overall confusion and annoyance of having lots of pre-filled values (And mostly the confusion of having filter prefilled all the time because it's always going to be set because everyone uses it and no one resets it at the moment. 
+    - DON'T reset tab. It's useful to remember the tab? Hmm... sometimes at least...