roster-server 2.0.6 → 2.1.1

package/README.md

@@ -46,17 +46,42 @@ Your project should look something like this:
 └── www/
     ├── example.com/
     │   └── index.js
-    └── subdomain.example.com/
+    ├── subdomain.example.com/
     │   └── index.js
-    └── other-domain.com/
-        └── index.js        
+    ├── other-domain.com/
+    │   └── index.js
+    └── *.example.com/          # Wildcard: one handler for all subdomains (api.example.com, app.example.com, etc.)
+        └── index.js
 ```
 
+### Wildcard DNS (*.example.com)
+
+You can serve all subdomains of a domain with a single handler in three ways:
+
+1. **Folder**: Create a directory named literally `*.example.com` under `www` (e.g. `www/*.example.com/index.js`). Any request to `api.example.com`, `app.example.com`, etc. will use that handler.
+2. **Register (default port)**: `roster.register('*.example.com', handler)` for the default HTTPS port.
+3. **Register (custom port)**: `roster.register('*.example.com:8080', handler)` for a specific port.
+
+Wildcard SSL certificates require **DNS-01** validation (Let's Encrypt does not support HTTP-01 for wildcards). By default Roster uses `acme-dns-01-cli` through an internal wrapper (adds `propagationDelay` and modern plugin signatures). Override with a custom plugin:
+
+```javascript
+import Roster from 'roster-server';
+
+const roster = new Roster({
+    email: 'admin@example.com',
+    wwwPath: '/srv/www',
+    greenlockStorePath: '/srv/greenlock.d',
+    dnsChallenge: { module: 'acme-dns-01-route53', /* provider options */ }  // optional override
+});
+```
+
+Set `dnsChallenge: false` to disable. For other DNS providers install the plugin in your app and pass it. See [Greenlock DNS plugins](https://git.rootprojects.org/root/greenlock-express.js#dns-01-challenge-plugins).
+
 ### Setting Up Your Server
 
 ```javascript
 // /srv/roster/server.js
-const Roster = require('roster-server');
+import Roster from 'roster-server';
 
 const options = {
     email: 'admin@example.com',
@@ -78,7 +103,7 @@ I'll help analyze the example files shown. You have 3 different implementations
 
 1. **Basic HTTP Handler**:
 ```javascript:demo/www/example.com/index.js
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     return (req, res) => {
         res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
         res.end('"Loco de pensar, queriendo entrar en razón, y el corazón tiene razones que la propia razón nunca entenderá."');
@@ -88,9 +113,9 @@ module.exports = (httpsServer) => {
 
 2. **Express App**:
 ```javascript:demo/www/express.example.com/index.js
-const express = require('express');
+import express from 'express';
 
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     const app = express();
     app.get('/', (req, res) => {
         res.setHeader('Content-Type', 'text/plain; charset=utf-8');
@@ -103,9 +128,9 @@ module.exports = (httpsServer) => {
 
 3. **Socket.IO Server**:
 ```javascript:demo/www/sio.example.com/index.js
-const { Server } = require('socket.io');
+import { Server } from 'socket.io';
 
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     const io = new Server(httpsServer);
 
     io.on('connection', (socket) => {
@@ -185,6 +210,7 @@ When creating a new `RosterServer` instance, you can pass the following options:
 - `email` (string): Your email for Let's Encrypt notifications.
 - `wwwPath` (string): Path to your `www` directory containing your sites.
 - `greenlockStorePath` (string): Directory for Greenlock configuration.
+- `dnsChallenge` (object|false): Optional override for wildcard DNS-01 challenge config. Default is local/manual `acme-dns-01-cli` wrapper with `propagationDelay: 120000`, `autoContinue: false`, and `dryRunDelay: 120000`. This is safer for manual DNS providers (Linode/Cloudflare UI) because Roster waits longer and does not auto-advance in interactive terminals. Set `false` to disable. You can pass `{ module: '...', propagationDelay: 180000 }` to tune DNS wait time (ms). Set `autoContinue: true` (or env `ROSTER_DNS_AUTO_CONTINUE=1`) to continue automatically after delay. For Greenlock dry-runs (`_greenlock-dryrun-*`), delay defaults to `dryRunDelay` (same as `propagationDelay` unless overridden with `dnsChallenge.dryRunDelay` or env `ROSTER_DNS_DRYRUN_DELAY_MS`). When wildcard sites are present, Roster creates a separate wildcard certificate (`*.example.com`) that uses `dns-01`, while apex/www stay on the regular certificate flow (typically `http-01`), reducing manual TXT records.
 - `staging` (boolean): Set to `true` to use Let's Encrypt's staging environment (for testing).
 - `local` (boolean): Set to `true` to run in local development mode.
 - `minLocalPort` (number): Minimum port for local mode (default: 4000).
@@ -199,6 +225,8 @@ When `{ local: true }` is enabled, RosterServer **Skips SSL/HTTPS**: Runs pure H
 ### Setting Up Local Mode
 
 ```javascript
+import Roster from 'roster-server';
+
 const server = new Roster({
     wwwPath: '/srv/www',
     local: true,  // Enable local development mode
@@ -219,6 +247,8 @@ In local mode, domains are automatically assigned ports based on a CRC32 hash of
 You can customize the port range:
 
 ```javascript
+import Roster from 'roster-server';
+
 const roster = new Roster({ 
     local: true,
     minLocalPort: 5000,  // Start from port 5000
@@ -233,6 +263,8 @@ RosterServer provides a method to get the URL for a domain that adapts automatic
 **Instance Method: `roster.getUrl(domain)`**
 
 ```javascript
+import Roster from 'roster-server';
+
 const roster = new Roster({ local: true });
 roster.register('example.com', handler);
 
@@ -255,6 +287,8 @@ This method:
 **Example Usage:**
 
 ```javascript
+import Roster from 'roster-server';
+
 // Local development
 const localRoster = new Roster({ local: true });
 localRoster.register('example.com', handler);

package/demo/wildcard-example.js

@@ -0,0 +1,31 @@
+/**
+ * Wildcard DNS demo: one handler for all subdomains (*.example.com)
+ *
+ * Run from repo root: node demo/wildcard-example.js
+ * Then open the printed URL (or use curl with Host header) to see the wildcard response.
+ * Any subdomain (api.example.com, app.example.com, foo.example.com) uses the same handler.
+ */
+const Roster = require('../index.js');
+const path = require('path');
+const { wildcardRoot } = require('../index.js');
+
+const roster = new Roster({
+    local: true,
+    wwwPath: path.join(__dirname, 'www'),
+});
+
+roster.start().then(() => {
+    const wildcardPattern = roster.domains.find((d) => d.startsWith('*.'));
+    const subdomain = wildcardPattern ? 'api.' + wildcardRoot(wildcardPattern) : 'api.example.com';
+    const wildcardUrl = roster.getUrl(subdomain);
+
+    console.log('\n🌐 Wildcard demo');
+    console.log('   Loaded:', wildcardPattern ? `https://${wildcardPattern}` : '(none)');
+    console.log('   Any subdomain uses the same handler.\n');
+    console.log('   Try:', wildcardUrl || '(no wildcard site in www path)');
+    if (wildcardUrl) {
+        const host = wildcardPattern ? 'api.' + wildcardRoot(wildcardPattern) : 'api.example.com';
+        console.log('   Or:  curl -H "Host: ' + host + '"', wildcardUrl);
+    }
+    console.log('');
+});

package/index.js

@@ -33,6 +33,20 @@ function domainToPort(domain, minPort = 3000, maxPort = 65535) {
     return minPort + (hash % portRange);
 }
 
+// Wildcard helpers: *.example.com -> root "example.com"
+function wildcardRoot(pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return null;
+    return pattern.split('.').slice(1).join('.');
+}
+
+// Check if host matches wildcard pattern (e.g. api.example.com matches *.example.com)
+function hostMatchesWildcard(host, pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return false;
+    const h = (host || '').toLowerCase();
+    const suffix = pattern.slice(2).toLowerCase(); // "example.com"
+    return h.endsWith('.' + suffix) && h.length > suffix.length;
+}
+
 // Virtual Server that completely isolates applications
 class VirtualServer extends EventEmitter {
     constructor(domain) {
@@ -158,6 +172,7 @@ class Roster {
         this.local = options.local || false;
         this.domains = [];
         this.sites = {};
+        this.wildcardZones = new Set(); // Root domains that have a wildcard site (e.g. "example.com" for *.example.com)
         this.domainServers = {}; // Store separate servers for each domain
         this.portServers = {}; // Store servers by port
         this.domainPorts = {}; // Store domain → port mapping for local mode
@@ -174,6 +189,38 @@ class Roster {
             throw new Error('⚠️  Port 80 is reserved for ACME challenge. Please use a different port.');
         }
         this.defaultPort = port;
+        // Use a local wrapper around acme-dns-01-cli so we can provide propagationDelay,
+        // zones(), and Promise-style signatures expected by newer ACME validators.
+        const defaultDnsChallengeModule = path.join(__dirname, 'vendor', 'acme-dns-01-cli-wrapper.js');
+        const shouldUseCliWrapper = (moduleName) =>
+            typeof moduleName === 'string' &&
+            /(^|[\\/])acme-dns-01-cli([\\/]|$)/.test(moduleName);
+
+        if (options.dnsChallenge === false) {
+            this.dnsChallenge = null;
+        } else if (options.dnsChallenge) {
+            const provided = { ...options.dnsChallenge };
+            if (shouldUseCliWrapper(provided.module) || provided.module === 'acme-dns-01-cli') {
+                provided.module = defaultDnsChallengeModule;
+            }
+            if (provided.propagationDelay === undefined) {
+                provided.propagationDelay = 120000;
+            }
+            if (provided.autoContinue === undefined) {
+                provided.autoContinue = false;
+            }
+            if (provided.dryRunDelay === undefined) {
+                provided.dryRunDelay = provided.propagationDelay;
+            }
+            this.dnsChallenge = provided;
+        } else {
+            this.dnsChallenge = {
+                module: defaultDnsChallengeModule,
+                propagationDelay: 120000,
+                autoContinue: false,
+                dryRunDelay: 120000
+            };
+        }
     }
 
     async loadSites() {
@@ -212,13 +259,21 @@ class Roster {
             }
 
             if (siteApp) {
-                const domainEntries = [domain, `www.${domain}`];
-                this.domains.push(...domainEntries);
-                domainEntries.forEach(d => {
-                    this.sites[d] = siteApp;
-                });
-
-                log.info(`(✔) Loaded site: https://${domain}`);
+                if (domain.startsWith('*.')) {
+                    // Wildcard site: one handler for all subdomains (e.g. *.example.com)
+                    this.domains.push(domain);
+                    this.sites[domain] = siteApp;
+                    const root = wildcardRoot(domain);
+                    if (root) this.wildcardZones.add(root);
+                    log.info(`(✔) Loaded wildcard site: https://${domain}`);
+                } else {
+                    const domainEntries = [domain, `www.${domain}`];
+                    this.domains.push(...domainEntries);
+                    domainEntries.forEach(d => {
+                        this.sites[d] = siteApp;
+                    });
+                    log.info(`(✔) Loaded site: https://${domain}`);
+                }
             } else {
                 log.warn(`⚠️  No index file (js/mjs/cjs) found in ${domainPath}`);
             }
@@ -237,8 +292,8 @@ class Roster {
         const uniqueDomains = new Set();
 
         this.domains.forEach(domain => {
-            const rootDomain = domain.replace(/^www\./, '');
-            uniqueDomains.add(rootDomain);
+            const root = domain.startsWith('*.') ? wildcardRoot(domain) : domain.replace(/^www\./, '');
+            if (root) uniqueDomains.add(root);
         });
 
         let existingConfig = {};
@@ -248,26 +303,63 @@ class Roster {
         }
 
         uniqueDomains.forEach(domain => {
-            const altnames = [domain];
-            if ((domain.match(/\./g) || []).length < 2) {
-                altnames.push(`www.${domain}`);
-            }
+            const applyRenewAtIfUnchanged = (siteConfig, existingSite) => {
+                if (!existingSite || !existingSite.renewAt) return;
+                const existingAltnames = Array.isArray(existingSite.altnames)
+                    ? [...existingSite.altnames].sort()
+                    : [];
+                const nextAltnames = Array.isArray(siteConfig.altnames)
+                    ? [...siteConfig.altnames].sort()
+                    : [];
+                const sameAltnames =
+                    existingAltnames.length === nextAltnames.length &&
+                    existingAltnames.every((name, idx) => name === nextAltnames[idx]);
+                if (sameAltnames) {
+                    siteConfig.renewAt = existingSite.renewAt;
+                }
+            };
 
-            let existingSite = null;
-            if (existingConfig.sites) {
-                existingSite = existingConfig.sites.find(site => site.subject === domain);
+            // Primary cert for apex/www uses default challenge flow (typically http-01).
+            const primaryAltnames = [domain];
+            if ((domain.match(/\./g) || []).length < 2) {
+                primaryAltnames.push(`www.${domain}`);
             }
-
-            const siteConfig = {
+            const primarySite = {
                 subject: domain,
-                altnames: altnames
+                altnames: primaryAltnames
             };
-
-            if (existingSite && existingSite.renewAt) {
-                siteConfig.renewAt = existingSite.renewAt;
+            const existingPrimarySite = Array.isArray(existingConfig.sites)
+                ? existingConfig.sites.find(site => site.subject === domain)
+                : null;
+            applyRenewAtIfUnchanged(primarySite, existingPrimarySite);
+            sitesConfig.push(primarySite);
+
+            // Wildcard cert is issued separately and uses dns-01 only.
+            if (this.wildcardZones.has(domain) && this.dnsChallenge) {
+                const wildcardSubject = `*.${domain}`;
+                const dns01 = { ...this.dnsChallenge };
+                if (dns01.propagationDelay === undefined) {
+                    dns01.propagationDelay = 120000; // 120s default for manual DNS (acme-dns-01-cli)
+                }
+                if (dns01.autoContinue === undefined) {
+                    dns01.autoContinue = false;
+                }
+                if (dns01.dryRunDelay === undefined) {
+                    dns01.dryRunDelay = dns01.propagationDelay;
+                }
+                const wildcardSite = {
+                    subject: wildcardSubject,
+                    altnames: [wildcardSubject],
+                    challenges: {
+                        'dns-01': dns01
+                    }
+                };
+                const existingWildcardSite = Array.isArray(existingConfig.sites)
+                    ? existingConfig.sites.find(site => site.subject === wildcardSubject)
+                    : null;
+                applyRenewAtIfUnchanged(wildcardSite, existingWildcardSite);
+                sitesConfig.push(wildcardSite);
             }
-
-            sitesConfig.push(siteConfig);
         });
 
         const newConfig = {
@@ -310,6 +402,47 @@ class Roster {
         log.info(`📁  config.json generated at ${configPath}`);
     }
 
+    /**
+     * Resolve handler for a host (exact match, then wildcard). Used when port is not in the key.
+     */
+    getHandlerForHost(host) {
+        const resolved = this.getHandlerAndKeyForHost(host);
+        return resolved ? resolved.handler : null;
+    }
+
+    /**
+     * Resolve handler and site key for a host (exact match, then wildcard). Used by getUrl for wildcard lookups.
+     */
+    getHandlerAndKeyForHost(host) {
+        const siteApp = this.sites[host];
+        if (siteApp) return { handler: siteApp, siteKey: host };
+        for (const key of Object.keys(this.sites)) {
+            if (key.startsWith('*.')) {
+                const pattern = key.split(':')[0];
+                if (hostMatchesWildcard(host, pattern)) return { handler: this.sites[key], siteKey: key };
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Resolve virtualServer and appHandler for a host from portData (exact then wildcard).
+     */
+    getHandlerForPortData(host, portData) {
+        const virtualServer = portData.virtualServers[host];
+        const appHandler = portData.appHandlers[host];
+        if (virtualServer && appHandler !== undefined) return { virtualServer, appHandler };
+        for (const key of Object.keys(portData.appHandlers)) {
+            if (key.startsWith('*.') && hostMatchesWildcard(host, key)) {
+                return {
+                    virtualServer: portData.virtualServers[key],
+                    appHandler: portData.appHandlers[key]
+                };
+            }
+        }
+        return null;
+    }
+
     handleRequest(req, res) {
         const host = req.headers.host || '';
 
@@ -320,7 +453,8 @@ class Roster {
             return;
         }
 
-        const siteApp = this.sites[host];
+        const hostWithoutPort = host.split(':')[0];
+        const siteApp = this.getHandlerForHost(hostWithoutPort);
         if (siteApp) {
             siteApp(req, res);
         } else {
@@ -339,6 +473,16 @@ class Roster {
 
         const { domain, port } = this.parseDomainWithPort(domainString);
 
+        if (domain.startsWith('*.')) {
+            const domainKey = port === this.defaultPort ? domain : `${domain}:${port}`;
+            this.domains.push(domain);
+            this.sites[domainKey] = requestHandler;
+            const root = wildcardRoot(domain);
+            if (root) this.wildcardZones.add(root);
+            log.info(`(✔) Registered wildcard site: ${domain}${port !== this.defaultPort ? ':' + port : ''}`);
+            return this;
+        }
+
         const domainEntries = [domain];
         if ((domain.match(/\./g) || []).length < 2) {
             domainEntries.push(`www.${domain}`);
@@ -346,7 +490,6 @@ class Roster {
 
         this.domains.push(...domainEntries);
         domainEntries.forEach(d => {
-            // Store with port information
             const domainKey = port === this.defaultPort ? d : `${d}:${port}`;
             this.sites[domainKey] = requestHandler;
         });
@@ -370,31 +513,25 @@ class Roster {
 
     /**
      * Get the URL for a domain based on the current environment
-     * @param {string} domain - The domain name
-     * @returns {string|null} The URL if domain is registered, null otherwise
+     * @param {string} domain - The domain name (or subdomain that matches a wildcard site)
+     * @returns {string|null} The URL if domain is registered (exact or wildcard), null otherwise
      */
     getUrl(domain) {
-        // Remove www prefix if present
         const cleanDomain = domain.startsWith('www.') ? domain.slice(4) : domain;
 
-        // Check if domain is registered
-        const isRegistered = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
-        if (!isRegistered) {
-            return null;
-        }
+        const exactMatch = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
+        const resolved = exactMatch ? { handler: exactMatch, siteKey: cleanDomain } : this.getHandlerAndKeyForHost(cleanDomain);
+        if (!resolved) return null;
 
-        // Return URL based on environment
         if (this.local) {
-            // Local mode: return localhost URL with assigned port
-            if (this.domainPorts && this.domainPorts[cleanDomain]) {
-                return `http://localhost:${this.domainPorts[cleanDomain]}`;
+            const pattern = resolved.siteKey.split(':')[0];
+            if (this.domainPorts && this.domainPorts[pattern] !== undefined) {
+                return `http://localhost:${this.domainPorts[pattern]}`;
             }
             return null;
-        } else {
-            // Production mode: return HTTPS URL
-            const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
-            return `https://${cleanDomain}${port}`;
         }
+        const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
+        return `https://${cleanDomain}${port}`;
     }
 
     createVirtualServer(domain) {
@@ -517,7 +654,18 @@ class Roster {
             configDir: this.greenlockStorePath,
             maintainerEmail: this.email,
             cluster: this.cluster,
-            staging: this.staging
+            staging: this.staging,
+            notify: (event, details) => {
+                const msg = typeof details === 'string' ? details : (details?.message ?? JSON.stringify(details));
+                // Suppress known benign warnings from ACME when using acme-dns-01-cli
+                if (event === 'warning' && typeof msg === 'string') {
+                    if (/acme-dns-01-cli.*(incorrect function signatures|deprecated use of callbacks)/i.test(msg)) return;
+                    if (/dns-01 challenge plugin should have zones/i.test(msg)) return;
+                }
+                if (event === 'error') log.error(msg);
+                else if (event === 'warning') log.warn(msg);
+                else log.info(msg);
+            }
         });
 
         return greenlock.ready(glx => {
@@ -535,15 +683,15 @@ class Roster {
                         };
                     }
 
-                    // Create completely isolated virtual server
                     const virtualServer = this.createVirtualServer(domain);
                     sitesByPort[port].virtualServers[domain] = virtualServer;
                     this.domainServers[domain] = virtualServer;
 
-                    // Initialize app with virtual server
                     const appHandler = siteApp(virtualServer);
                     sitesByPort[port].appHandlers[domain] = appHandler;
-                    sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    if (!domain.startsWith('*.')) {
+                        sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    }
                 }
             }
 
@@ -552,27 +700,27 @@ class Roster {
                 return (req, res) => {
                     const host = req.headers.host || '';
 
-                    // Remove port from host header if present (e.g., "domain.com:8080" -> "domain.com")
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    // Handle www redirects
                     if (hostWithoutPort.startsWith('www.')) {
                         res.writeHead(301, { Location: `https://${domain}${req.url}` });
                         res.end();
                         return;
                     }
 
-                    const virtualServer = portData.virtualServers[domain];
-                    const appHandler = portData.appHandlers[domain];
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (!resolved) {
+                        res.writeHead(404);
+                        res.end('Site not found');
+                        return;
+                    }
+                    const { virtualServer, appHandler } = resolved;
 
                     if (virtualServer && virtualServer.requestListeners.length > 0) {
-                        // Set fallback handler on virtual server for non-Socket.IO requests
                         virtualServer.fallbackHandler = appHandler;
-                        // App registered listeners on virtual server - use them
                         virtualServer.processRequest(req, res);
                     } else if (appHandler) {
-                        // App returned a handler function - use it
                         appHandler(req, res);
                     } else {
                         res.writeHead(404);
@@ -585,19 +733,16 @@ class Roster {
                 log.info('HTTP server listening on port 80');
             });
 
-            // Create upgrade handler for WebSocket connections
             const createUpgradeHandler = (portData) => {
                 return (req, socket, head) => {
                     const host = req.headers.host || '';
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    const virtualServer = portData.virtualServers[domain];
-
-                    if (virtualServer) {
-                        virtualServer.processUpgrade(req, socket, head);
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (resolved && resolved.virtualServer) {
+                        resolved.virtualServer.processUpgrade(req, socket, head);
                     } else {
-                        // No virtual server found, destroy the socket
                         socket.destroy();
                     }
                 };
@@ -608,6 +753,29 @@ class Roster {
                 const portNum = parseInt(port);
                 const dispatcher = createDispatcher(portData);
                 const upgradeHandler = createUpgradeHandler(portData);
+                const greenlockStorePath = this.greenlockStorePath;
+                const loadCert = (subjectDir) => {
+                    const certPath = path.join(greenlockStorePath, 'live', subjectDir);
+                    const keyPath = path.join(certPath, 'privkey.pem');
+                    const certFilePath = path.join(certPath, 'cert.pem');
+                    const chainPath = path.join(certPath, 'chain.pem');
+                    if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
+                        return {
+                            key: fs.readFileSync(keyPath, 'utf8'),
+                            cert: fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8')
+                        };
+                    }
+                    return null;
+                };
+                const zoneSubjectForHost = (servername) => {
+                    const labels = String(servername || '').split('.').filter(Boolean);
+                    if (labels.length < 3) return null;
+                    return labels.slice(1).join('.');
+                };
+                const resolvePemsForServername = (servername) => {
+                    if (!servername) return null;
+                    return loadCert(servername) || loadCert(zoneSubjectForHost(servername));
+                };
 
                 if (portNum === this.defaultPort) {
                     // Bun has known gaps around SNICallback compatibility.
@@ -618,23 +786,27 @@ class Roster {
 
                     if (isBunRuntime) {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        const certPath = path.join(this.greenlockStorePath, 'live', primaryDomain);
-                        const keyPath = path.join(certPath, 'privkey.pem');
-                        const certFilePath = path.join(certPath, 'cert.pem');
-                        const chainPath = path.join(certPath, 'chain.pem');
-
-                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                            const key = fs.readFileSync(keyPath, 'utf8');
-                            const cert = fs.readFileSync(certFilePath, 'utf8');
-                            const chain = fs.readFileSync(chainPath, 'utf8');
+                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
+                        const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                        const defaultPems = resolvePemsForServername(certSubject);
+
+                        if (defaultPems) {
                             httpsServer = https.createServer({
                                 ...tlsOpts,
-                                key,
-                                cert: cert + chain
+                                key: defaultPems.key,
+                                cert: defaultPems.cert,
+                                SNICallback: (servername, callback) => {
+                                    try {
+                                        const pems = resolvePemsForServername(servername) || defaultPems;
+                                        callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                    } catch (error) {
+                                        callback(error);
+                                    }
+                                }
                             }, dispatcher);
-                            log.warn(`⚠️  Bun runtime detected: using static TLS cert for ${primaryDomain} on port ${portNum}`);
+                            log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                         } else {
-                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${primaryDomain}; falling back to Greenlock HTTPS server`);
+                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${certSubject} (${primaryDomain}); falling back to Greenlock HTTPS server`);
                             httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                         }
                     } else {
@@ -654,25 +826,13 @@ class Roster {
                     const httpsOptions = {
                         minVersion: this.tlsMinVersion,
                         maxVersion: this.tlsMaxVersion,
-                        // SNI callback to get certificates dynamically
-                        SNICallback: (domain, callback) => {
+                        SNICallback: (servername, callback) => {
                             try {
-                                const certPath = path.join(this.greenlockStorePath, 'live', domain);
-                                const keyPath = path.join(certPath, 'privkey.pem');
-                                const certFilePath = path.join(certPath, 'cert.pem');
-                                const chainPath = path.join(certPath, 'chain.pem');
-
-                                if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                                    const key = fs.readFileSync(keyPath, 'utf8');
-                                    const cert = fs.readFileSync(certFilePath, 'utf8');
-                                    const chain = fs.readFileSync(chainPath, 'utf8');
-
-                                    callback(null, tls.createSecureContext({
-                                        key: key,
-                                        cert: cert + chain
-                                    }));
+                                const pems = resolvePemsForServername(servername);
+                                if (pems) {
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
                                 } else {
-                                    callback(new Error(`No certificate files available for ${domain}`));
+                                    callback(new Error(`No certificate files available for ${servername}`));
                                 }
                             } catch (error) {
                                 callback(error);
@@ -711,4 +871,6 @@ class Roster {
     }
 }
 
-module.exports = Roster;
+module.exports = Roster;
+module.exports.wildcardRoot = wildcardRoot;
+module.exports.hostMatchesWildcard = hostMatchesWildcard;