roster-server 2.0.4 → 2.1.0

package/index.js

@@ -33,6 +33,20 @@ function domainToPort(domain, minPort = 3000, maxPort = 65535) {
     return minPort + (hash % portRange);
 }
 
+// Wildcard helpers: *.example.com -> root "example.com"
+function wildcardRoot(pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return null;
+    return pattern.split('.').slice(1).join('.');
+}
+
+// Check if host matches wildcard pattern (e.g. api.example.com matches *.example.com)
+function hostMatchesWildcard(host, pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return false;
+    const h = (host || '').toLowerCase();
+    const suffix = pattern.slice(2).toLowerCase(); // "example.com"
+    return h.endsWith('.' + suffix) && h.length > suffix.length;
+}
+
 // Virtual Server that completely isolates applications
 class VirtualServer extends EventEmitter {
     constructor(domain) {
@@ -158,6 +172,7 @@ class Roster {
         this.local = options.local || false;
         this.domains = [];
         this.sites = {};
+        this.wildcardZones = new Set(); // Root domains that have a wildcard site (e.g. "example.com" for *.example.com)
         this.domainServers = {}; // Store separate servers for each domain
         this.portServers = {}; // Store servers by port
         this.domainPorts = {}; // Store domain → port mapping for local mode
@@ -166,84 +181,46 @@ class Roster {
         this.filename = options.filename || 'index';
         this.minLocalPort = options.minLocalPort || 4000;
         this.maxLocalPort = options.maxLocalPort || 9999;
+        this.tlsMinVersion = options.tlsMinVersion ?? 'TLSv1.2';
+        this.tlsMaxVersion = options.tlsMaxVersion ?? 'TLSv1.3';
 
         const port = options.port === undefined ? 443 : options.port;
         if (port === 80 && !this.local) {
             throw new Error('⚠️  Port 80 is reserved for ACME challenge. Please use a different port.');
         }
         this.defaultPort = port;
-
-        const validTlsModes = ['auto', 'greenlock', 'static'];
-        this.tlsMode = options.tlsMode || 'auto';
-        if (!validTlsModes.includes(this.tlsMode)) {
-            throw new Error(`Invalid tlsMode "${this.tlsMode}". Must be one of: ${validTlsModes.join(', ')}`);
-        }
-        this.tlsDomain = options.tlsDomain || null;
-        this.tlsOptions = options.tls || {};
-    }
-
-    detectRuntime() {
-        return typeof Bun !== 'undefined' ? 'bun' : 'node';
-    }
-
-    getEffectiveTlsMode() {
-        if (this.tlsMode !== 'auto') {
-            return this.tlsMode;
-        }
-        return this.detectRuntime() === 'bun' ? 'static' : 'greenlock';
-    }
-
-    getDefaultTlsOptions() {
-        return Object.assign({ minVersion: 'TLSv1.2', maxVersion: 'TLSv1.3' }, this.tlsOptions);
-    }
-
-    createSNICallback() {
-        return (domain, callback) => {
-            try {
-                const certPath = path.join(this.greenlockStorePath, 'live', domain);
-                const keyPath = path.join(certPath, 'privkey.pem');
-                const certFilePath = path.join(certPath, 'cert.pem');
-                const chainPath = path.join(certPath, 'chain.pem');
-
-                if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                    const key = fs.readFileSync(keyPath, 'utf8');
-                    const cert = fs.readFileSync(certFilePath, 'utf8');
-                    const chain = fs.readFileSync(chainPath, 'utf8');
-
-                    callback(null, tls.createSecureContext({ key, cert: cert + chain }));
-                } else {
-                    callback(new Error(`No certificate files available for ${domain} at ${certPath}`));
-                }
-            } catch (error) {
-                callback(error);
+        // Use a local wrapper around acme-dns-01-cli so we can provide propagationDelay,
+        // zones(), and Promise-style signatures expected by newer ACME validators.
+        const defaultDnsChallengeModule = path.join(__dirname, 'vendor', 'acme-dns-01-cli-wrapper.js');
+        const shouldUseCliWrapper = (moduleName) =>
+            typeof moduleName === 'string' &&
+            /(^|[\\/])acme-dns-01-cli([\\/]|$)/.test(moduleName);
+
+        if (options.dnsChallenge === false) {
+            this.dnsChallenge = null;
+        } else if (options.dnsChallenge) {
+            const provided = { ...options.dnsChallenge };
+            if (shouldUseCliWrapper(provided.module) || provided.module === 'acme-dns-01-cli') {
+                provided.module = defaultDnsChallengeModule;
             }
-        };
-    }
-
-    createStaticHttpsServer(dispatcher) {
-        const tlsOpts = Object.assign(this.getDefaultTlsOptions(), {
-            SNICallback: this.createSNICallback()
-        });
-
-        if (this.tlsDomain) {
-            const certPath = path.join(this.greenlockStorePath, 'live', this.tlsDomain);
-            const keyPath = path.join(certPath, 'privkey.pem');
-            const certFilePath = path.join(certPath, 'cert.pem');
-            const chainPath = path.join(certPath, 'chain.pem');
-
-            const missing = [keyPath, certFilePath, chainPath].filter(p => !fs.existsSync(p));
-            if (missing.length > 0) {
-                throw new Error(
-                    `Static TLS cert files missing for domain "${this.tlsDomain}":\n` +
-                    missing.map(p => `  - ${p}`).join('\n')
-                );
+            if (provided.propagationDelay === undefined) {
+                provided.propagationDelay = 120000;
             }
-
-            tlsOpts.key = fs.readFileSync(keyPath, 'utf8');
-            tlsOpts.cert = fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8');
+            if (provided.autoContinue === undefined) {
+                provided.autoContinue = false;
+            }
+            if (provided.dryRunDelay === undefined) {
+                provided.dryRunDelay = provided.propagationDelay;
+            }
+            this.dnsChallenge = provided;
+        } else {
+            this.dnsChallenge = {
+                module: defaultDnsChallengeModule,
+                propagationDelay: 120000,
+                autoContinue: false,
+                dryRunDelay: 120000
+            };
         }
-
-        return https.createServer(tlsOpts, dispatcher);
     }
 
     async loadSites() {
@@ -282,13 +259,21 @@ class Roster {
             }
 
             if (siteApp) {
-                const domainEntries = [domain, `www.${domain}`];
-                this.domains.push(...domainEntries);
-                domainEntries.forEach(d => {
-                    this.sites[d] = siteApp;
-                });
-
-                log.info(`(✔) Loaded site: https://${domain}`);
+                if (domain.startsWith('*.')) {
+                    // Wildcard site: one handler for all subdomains (e.g. *.example.com)
+                    this.domains.push(domain);
+                    this.sites[domain] = siteApp;
+                    const root = wildcardRoot(domain);
+                    if (root) this.wildcardZones.add(root);
+                    log.info(`(✔) Loaded wildcard site: https://${domain}`);
+                } else {
+                    const domainEntries = [domain, `www.${domain}`];
+                    this.domains.push(...domainEntries);
+                    domainEntries.forEach(d => {
+                        this.sites[d] = siteApp;
+                    });
+                    log.info(`(✔) Loaded site: https://${domain}`);
+                }
             } else {
                 log.warn(`⚠️  No index file (js/mjs/cjs) found in ${domainPath}`);
             }
@@ -307,8 +292,8 @@ class Roster {
         const uniqueDomains = new Set();
 
         this.domains.forEach(domain => {
-            const rootDomain = domain.replace(/^www\./, '');
-            uniqueDomains.add(rootDomain);
+            const root = domain.startsWith('*.') ? wildcardRoot(domain) : domain.replace(/^www\./, '');
+            if (root) uniqueDomains.add(root);
         });
 
         let existingConfig = {};
@@ -322,6 +307,9 @@ class Roster {
             if ((domain.match(/\./g) || []).length < 2) {
                 altnames.push(`www.${domain}`);
             }
+            if (this.wildcardZones.has(domain)) {
+                altnames.push(`*.${domain}`);
+            }
 
             let existingSite = null;
             if (existingConfig.sites) {
@@ -334,7 +322,35 @@ class Roster {
             };
 
             if (existingSite && existingSite.renewAt) {
-                siteConfig.renewAt = existingSite.renewAt;
+                const existingAltnames = Array.isArray(existingSite.altnames)
+                    ? [...existingSite.altnames].sort()
+                    : [];
+                const nextAltnames = [...altnames].sort();
+                const sameAltnames =
+                    existingAltnames.length === nextAltnames.length &&
+                    existingAltnames.every((name, idx) => name === nextAltnames[idx]);
+
+                // Keep renewAt only when certificate identifiers are unchanged.
+                // If altnames changed (e.g. wildcard added), force immediate re-issue.
+                if (sameAltnames) {
+                    siteConfig.renewAt = existingSite.renewAt;
+                }
+            }
+
+            if (this.wildcardZones.has(domain) && this.dnsChallenge) {
+                const dns01 = { ...this.dnsChallenge };
+                if (dns01.propagationDelay === undefined) {
+                    dns01.propagationDelay = 120000; // 120s default for manual DNS (acme-dns-01-cli)
+                }
+                if (dns01.autoContinue === undefined) {
+                    dns01.autoContinue = false;
+                }
+                if (dns01.dryRunDelay === undefined) {
+                    dns01.dryRunDelay = dns01.propagationDelay;
+                }
+                siteConfig.challenges = {
+                    'dns-01': dns01
+                };
             }
 
             sitesConfig.push(siteConfig);
@@ -380,6 +396,47 @@ class Roster {
         log.info(`📁  config.json generated at ${configPath}`);
     }
 
+    /**
+     * Resolve handler for a host (exact match, then wildcard). Used when port is not in the key.
+     */
+    getHandlerForHost(host) {
+        const resolved = this.getHandlerAndKeyForHost(host);
+        return resolved ? resolved.handler : null;
+    }
+
+    /**
+     * Resolve handler and site key for a host (exact match, then wildcard). Used by getUrl for wildcard lookups.
+     */
+    getHandlerAndKeyForHost(host) {
+        const siteApp = this.sites[host];
+        if (siteApp) return { handler: siteApp, siteKey: host };
+        for (const key of Object.keys(this.sites)) {
+            if (key.startsWith('*.')) {
+                const pattern = key.split(':')[0];
+                if (hostMatchesWildcard(host, pattern)) return { handler: this.sites[key], siteKey: key };
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Resolve virtualServer and appHandler for a host from portData (exact then wildcard).
+     */
+    getHandlerForPortData(host, portData) {
+        const virtualServer = portData.virtualServers[host];
+        const appHandler = portData.appHandlers[host];
+        if (virtualServer && appHandler !== undefined) return { virtualServer, appHandler };
+        for (const key of Object.keys(portData.appHandlers)) {
+            if (key.startsWith('*.') && hostMatchesWildcard(host, key)) {
+                return {
+                    virtualServer: portData.virtualServers[key],
+                    appHandler: portData.appHandlers[key]
+                };
+            }
+        }
+        return null;
+    }
+
     handleRequest(req, res) {
         const host = req.headers.host || '';
 
@@ -390,7 +447,8 @@ class Roster {
             return;
         }
 
-        const siteApp = this.sites[host];
+        const hostWithoutPort = host.split(':')[0];
+        const siteApp = this.getHandlerForHost(hostWithoutPort);
         if (siteApp) {
             siteApp(req, res);
         } else {
@@ -409,6 +467,16 @@ class Roster {
 
         const { domain, port } = this.parseDomainWithPort(domainString);
 
+        if (domain.startsWith('*.')) {
+            const domainKey = port === this.defaultPort ? domain : `${domain}:${port}`;
+            this.domains.push(domain);
+            this.sites[domainKey] = requestHandler;
+            const root = wildcardRoot(domain);
+            if (root) this.wildcardZones.add(root);
+            log.info(`(✔) Registered wildcard site: ${domain}${port !== this.defaultPort ? ':' + port : ''}`);
+            return this;
+        }
+
         const domainEntries = [domain];
         if ((domain.match(/\./g) || []).length < 2) {
             domainEntries.push(`www.${domain}`);
@@ -416,7 +484,6 @@ class Roster {
 
         this.domains.push(...domainEntries);
         domainEntries.forEach(d => {
-            // Store with port information
             const domainKey = port === this.defaultPort ? d : `${d}:${port}`;
             this.sites[domainKey] = requestHandler;
         });
@@ -440,31 +507,25 @@ class Roster {
 
     /**
      * Get the URL for a domain based on the current environment
-     * @param {string} domain - The domain name
-     * @returns {string|null} The URL if domain is registered, null otherwise
+     * @param {string} domain - The domain name (or subdomain that matches a wildcard site)
+     * @returns {string|null} The URL if domain is registered (exact or wildcard), null otherwise
      */
     getUrl(domain) {
-        // Remove www prefix if present
         const cleanDomain = domain.startsWith('www.') ? domain.slice(4) : domain;
-        
-        // Check if domain is registered
-        const isRegistered = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
-        if (!isRegistered) {
-            return null;
-        }
-        
-        // Return URL based on environment
+
+        const exactMatch = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
+        const resolved = exactMatch ? { handler: exactMatch, siteKey: cleanDomain } : this.getHandlerAndKeyForHost(cleanDomain);
+        if (!resolved) return null;
+
         if (this.local) {
-            // Local mode: return localhost URL with assigned port
-            if (this.domainPorts && this.domainPorts[cleanDomain]) {
-                return `http://localhost:${this.domainPorts[cleanDomain]}`;
+            const pattern = resolved.siteKey.split(':')[0];
+            if (this.domainPorts && this.domainPorts[pattern] !== undefined) {
+                return `http://localhost:${this.domainPorts[pattern]}`;
             }
             return null;
-        } else {
-            // Production mode: return HTTPS URL
-            const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
-            return `https://${cleanDomain}${port}`;
         }
+        const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
+        return `https://${cleanDomain}${port}`;
     }
 
     createVirtualServer(domain) {
@@ -509,7 +570,7 @@ class Roster {
     startLocalMode() {
         // Store mapping of domain to port for later retrieval
         this.domainPorts = {};
-        
+
         // Create a simple HTTP server for each domain with CRC32-based ports
         for (const [hostKey, siteApp] of Object.entries(this.sites)) {
             const domain = hostKey.split(':')[0]; // Remove port if present
@@ -521,7 +582,7 @@ class Roster {
 
             // Calculate deterministic port based on domain CRC32, with collision detection
             const port = this.assignPortToDomain(domain);
-            
+
             // Store domain → port mapping
             this.domainPorts[domain] = port;
 
@@ -587,7 +648,18 @@ class Roster {
             configDir: this.greenlockStorePath,
             maintainerEmail: this.email,
             cluster: this.cluster,
-            staging: this.staging
+            staging: this.staging,
+            notify: (event, details) => {
+                const msg = typeof details === 'string' ? details : (details?.message ?? JSON.stringify(details));
+                // Suppress known benign warnings from ACME when using acme-dns-01-cli
+                if (event === 'warning' && typeof msg === 'string') {
+                    if (/acme-dns-01-cli.*(incorrect function signatures|deprecated use of callbacks)/i.test(msg)) return;
+                    if (/dns-01 challenge plugin should have zones/i.test(msg)) return;
+                }
+                if (event === 'error') log.error(msg);
+                else if (event === 'warning') log.warn(msg);
+                else log.info(msg);
+            }
         });
 
         return greenlock.ready(glx => {
@@ -605,15 +677,15 @@ class Roster {
                         };
                     }
 
-                    // Create completely isolated virtual server
                     const virtualServer = this.createVirtualServer(domain);
                     sitesByPort[port].virtualServers[domain] = virtualServer;
                     this.domainServers[domain] = virtualServer;
 
-                    // Initialize app with virtual server
                     const appHandler = siteApp(virtualServer);
                     sitesByPort[port].appHandlers[domain] = appHandler;
-                    sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    if (!domain.startsWith('*.')) {
+                        sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    }
                 }
             }
 
@@ -622,27 +694,27 @@ class Roster {
                 return (req, res) => {
                     const host = req.headers.host || '';
 
-                    // Remove port from host header if present (e.g., "domain.com:8080" -> "domain.com")
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    // Handle www redirects
                     if (hostWithoutPort.startsWith('www.')) {
                         res.writeHead(301, { Location: `https://${domain}${req.url}` });
                         res.end();
                         return;
                     }
 
-                    const virtualServer = portData.virtualServers[domain];
-                    const appHandler = portData.appHandlers[domain];
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (!resolved) {
+                        res.writeHead(404);
+                        res.end('Site not found');
+                        return;
+                    }
+                    const { virtualServer, appHandler } = resolved;
 
                     if (virtualServer && virtualServer.requestListeners.length > 0) {
-                        // Set fallback handler on virtual server for non-Socket.IO requests
                         virtualServer.fallbackHandler = appHandler;
-                        // App registered listeners on virtual server - use them
                         virtualServer.processRequest(req, res);
                     } else if (appHandler) {
-                        // App returned a handler function - use it
                         appHandler(req, res);
                     } else {
                         res.writeHead(404);
@@ -651,76 +723,141 @@ class Roster {
                 };
             };
 
-            const runtime = this.detectRuntime();
-            const effectiveTlsMode = this.getEffectiveTlsMode();
-            log.info(`Runtime: ${runtime} | TLS mode: ${effectiveTlsMode}`);
-
             httpServer.listen(80, this.hostname, () => {
                 log.info('HTTP server listening on port 80');
             });
 
-            // Create upgrade handler for WebSocket connections
             const createUpgradeHandler = (portData) => {
                 return (req, socket, head) => {
                     const host = req.headers.host || '';
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    const virtualServer = portData.virtualServers[domain];
-
-                    if (virtualServer) {
-                        virtualServer.processUpgrade(req, socket, head);
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (resolved && resolved.virtualServer) {
+                        resolved.virtualServer.processUpgrade(req, socket, head);
                     } else {
                         socket.destroy();
                     }
                 };
             };
 
-            const attachHttpsListeners = (httpsServer, portNum, upgradeHandler) => {
-                httpsServer.on('upgrade', upgradeHandler);
-                httpsServer.on('error', (error) => {
-                    log.error(`HTTPS server error on port ${portNum}:`, error.message);
-                });
-                httpsServer.on('tlsClientError', (error) => {
-                    if (!error.message.includes('http request')) {
-                        log.error(`TLS error on port ${portNum}:`, error.message);
-                    }
-                });
-            };
-
             // Handle different port types
             for (const [port, portData] of Object.entries(sitesByPort)) {
                 const portNum = parseInt(port);
                 const dispatcher = createDispatcher(portData);
                 const upgradeHandler = createUpgradeHandler(portData);
 
-                let httpsServer;
+                if (portNum === this.defaultPort) {
+                    // Bun has known gaps around SNICallback compatibility.
+                    // Fallback to static cert loading for the primary domain on default HTTPS port.
+                    const isBunRuntime = typeof Bun !== 'undefined' || process.release?.name === 'bun';
+                    const tlsOpts = { minVersion: this.tlsMinVersion, maxVersion: this.tlsMaxVersion };
+                    let httpsServer;
+
+                    if (isBunRuntime) {
+                        const primaryDomain = Object.keys(portData.virtualServers)[0];
+                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
+                        const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                        const certPath = path.join(this.greenlockStorePath, 'live', certSubject);
+                        const keyPath = path.join(certPath, 'privkey.pem');
+                        const certFilePath = path.join(certPath, 'cert.pem');
+                        const chainPath = path.join(certPath, 'chain.pem');
+
+                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
+                            const key = fs.readFileSync(keyPath, 'utf8');
+                            const cert = fs.readFileSync(certFilePath, 'utf8');
+                            const chain = fs.readFileSync(chainPath, 'utf8');
+                            httpsServer = https.createServer({
+                                ...tlsOpts,
+                                key,
+                                cert: cert + chain
+                            }, dispatcher);
+                            log.warn(`⚠️  Bun runtime detected: using static TLS cert for ${primaryDomain} on port ${portNum}`);
+                        } else {
+                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${certSubject} (${primaryDomain}); falling back to Greenlock HTTPS server`);
+                            httpsServer = glx.httpsServer(tlsOpts, dispatcher);
+                        }
+                    } else {
+                        httpsServer = glx.httpsServer(tlsOpts, dispatcher);
+                    }
 
-                if (portNum === this.defaultPort && effectiveTlsMode === 'greenlock') {
-                    log.info(`HTTPS port ${portNum}: using Greenlock SNI (certs managed automatically)`);
-                    httpsServer = glx.httpsServer(null, dispatcher);
+                    this.portServers[portNum] = httpsServer;
+
+                    // Handle WebSocket upgrade events
+                    httpsServer.on('upgrade', upgradeHandler);
+
+                    httpsServer.listen(portNum, this.hostname, () => {
+                        log.info(`HTTPS server listening on port ${portNum}`);
+                    });
                 } else {
-                    const modeLabel = portNum === this.defaultPort ? effectiveTlsMode : 'static';
-                    log.info(`HTTPS port ${portNum}: using static certs from ${path.join(this.greenlockStorePath, 'live')} [${modeLabel}]`);
-                    const httpsOptions = Object.assign(this.getDefaultTlsOptions(), {
-                        SNICallback: this.createSNICallback()
+                    // Create HTTPS server for custom ports using Greenlock certificates
+                    const greenlockStorePath = this.greenlockStorePath;
+                    const loadCert = (subjectDir) => {
+                        const certPath = path.join(greenlockStorePath, 'live', subjectDir);
+                        const keyPath = path.join(certPath, 'privkey.pem');
+                        const certFilePath = path.join(certPath, 'cert.pem');
+                        const chainPath = path.join(certPath, 'chain.pem');
+                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
+                            return {
+                                key: fs.readFileSync(keyPath, 'utf8'),
+                                cert: fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8')
+                            };
+                        }
+                        return null;
+                    };
+                    const httpsOptions = {
+                        minVersion: this.tlsMinVersion,
+                        maxVersion: this.tlsMaxVersion,
+                        SNICallback: (servername, callback) => {
+                            try {
+                                let pems = loadCert(servername);
+                                if (!pems && hostMatchesWildcard(servername, '*.' + servername.split('.').slice(1).join('.'))) {
+                                    const zoneSubject = servername.split('.').slice(1).join('.');
+                                    pems = loadCert(zoneSubject);
+                                }
+                                if (pems) {
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                } else {
+                                    callback(new Error(`No certificate files available for ${servername}`));
+                                }
+                            } catch (error) {
+                                callback(error);
+                            }
+                        }
+                    };
+
+                    const httpsServer = https.createServer(httpsOptions, dispatcher);
+
+                    // Handle WebSocket upgrade events
+                    httpsServer.on('upgrade', upgradeHandler);
+
+                    httpsServer.on('error', (error) => {
+                        log.error(`HTTPS server error on port ${portNum}:`, error.message);
+                    });
+
+                    httpsServer.on('tlsClientError', (error) => {
+                        // Suppress HTTP request errors to avoid log spam
+                        if (!error.message.includes('http request')) {
+                            log.error(`TLS error on port ${portNum}:`, error.message);
+                        }
                     });
-                    httpsServer = https.createServer(httpsOptions, dispatcher);
-                }
 
-                attachHttpsListeners(httpsServer, portNum, upgradeHandler);
-                this.portServers[portNum] = httpsServer;
+                    this.portServers[portNum] = httpsServer;
 
-                httpsServer.listen(portNum, this.hostname, (error) => {
-                    if (error) {
-                        log.error(`Failed to start HTTPS server on port ${portNum}:`, error.message);
-                    } else {
-                        log.info(`HTTPS server listening on port ${portNum}`);
-                    }
-                });
+                    httpsServer.listen(portNum, this.hostname, (error) => {
+                        if (error) {
+                            log.error(`Failed to start HTTPS server on port ${portNum}:`, error.message);
+                        } else {
+                            log.info(`HTTPS server listening on port ${portNum}`);
+                        }
+                    });
+                }
             }
         });
     }
 }
 
-module.exports = Roster;
+module.exports = Roster;
+module.exports.wildcardRoot = wildcardRoot;
+module.exports.hostMatchesWildcard = hostMatchesWildcard;

package/package.json

@@ -1,10 +1,10 @@
 {
     "name": "roster-server",
-    "version": "2.0.4",
+    "version": "2.1.0",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {
-        "test": "echo \"Error: no test specified\" && exit 1"
+        "test": "node --test 'test/**/*.test.js'"
     },
     "repository": {
         "type": "git",
@@ -26,6 +26,7 @@
         "express",
         "greenlock-express",
         "shotx",
+        "bun",
         "clasen"
     ],
     "author": "Martin Clasen",
@@ -36,6 +37,7 @@
     "homepage": "https://github.com/clasen/RosterServer#readme",
     "dependencies": {
         "@root/greenlock": "^4.0.5",
+        "acme-dns-01-cli": "^3.0.7",
         "lemonlog": "^1.2.0",
         "redirect-https": "^1.3.1"
     }