roster-server 2.1.0 → 2.1.1

package/README.md

@@ -210,7 +210,7 @@ When creating a new `RosterServer` instance, you can pass the following options:
 - `email` (string): Your email for Let's Encrypt notifications.
 - `wwwPath` (string): Path to your `www` directory containing your sites.
 - `greenlockStorePath` (string): Directory for Greenlock configuration.
-- `dnsChallenge` (object|false): Optional override for wildcard DNS-01 challenge config. Default is local/manual `acme-dns-01-cli` wrapper with `propagationDelay: 120000`, `autoContinue: false`, and `dryRunDelay: 120000`. This is safer for manual DNS providers (Linode/Cloudflare UI) because Roster waits longer and does not auto-advance in interactive terminals. Set `false` to disable. You can pass `{ module: '...', propagationDelay: 180000 }` to tune DNS wait time (ms). Set `autoContinue: true` (or env `ROSTER_DNS_AUTO_CONTINUE=1`) to continue automatically after delay. For Greenlock dry-runs (`_greenlock-dryrun-*`), delay defaults to `dryRunDelay` (same as `propagationDelay` unless overridden with `dnsChallenge.dryRunDelay` or env `ROSTER_DNS_DRYRUN_DELAY_MS`).
+- `dnsChallenge` (object|false): Optional override for wildcard DNS-01 challenge config. Default is local/manual `acme-dns-01-cli` wrapper with `propagationDelay: 120000`, `autoContinue: false`, and `dryRunDelay: 120000`. This is safer for manual DNS providers (Linode/Cloudflare UI) because Roster waits longer and does not auto-advance in interactive terminals. Set `false` to disable. You can pass `{ module: '...', propagationDelay: 180000 }` to tune DNS wait time (ms). Set `autoContinue: true` (or env `ROSTER_DNS_AUTO_CONTINUE=1`) to continue automatically after delay. For Greenlock dry-runs (`_greenlock-dryrun-*`), delay defaults to `dryRunDelay` (same as `propagationDelay` unless overridden with `dnsChallenge.dryRunDelay` or env `ROSTER_DNS_DRYRUN_DELAY_MS`). When wildcard sites are present, Roster creates a separate wildcard certificate (`*.example.com`) that uses `dns-01`, while apex/www stay on the regular certificate flow (typically `http-01`), reducing manual TXT records.
 - `staging` (boolean): Set to `true` to use Let's Encrypt's staging environment (for testing).
 - `local` (boolean): Set to `true` to run in local development mode.
 - `minLocalPort` (number): Minimum port for local mode (default: 4000).

package/index.js

@@ -303,41 +303,40 @@ class Roster {
         }
 
         uniqueDomains.forEach(domain => {
-            const altnames = [domain];
-            if ((domain.match(/\./g) || []).length < 2) {
-                altnames.push(`www.${domain}`);
-            }
-            if (this.wildcardZones.has(domain)) {
-                altnames.push(`*.${domain}`);
-            }
-
-            let existingSite = null;
-            if (existingConfig.sites) {
-                existingSite = existingConfig.sites.find(site => site.subject === domain);
-            }
-
-            const siteConfig = {
-                subject: domain,
-                altnames: altnames
-            };
-
-            if (existingSite && existingSite.renewAt) {
+            const applyRenewAtIfUnchanged = (siteConfig, existingSite) => {
+                if (!existingSite || !existingSite.renewAt) return;
                 const existingAltnames = Array.isArray(existingSite.altnames)
                     ? [...existingSite.altnames].sort()
                     : [];
-                const nextAltnames = [...altnames].sort();
+                const nextAltnames = Array.isArray(siteConfig.altnames)
+                    ? [...siteConfig.altnames].sort()
+                    : [];
                 const sameAltnames =
                     existingAltnames.length === nextAltnames.length &&
                     existingAltnames.every((name, idx) => name === nextAltnames[idx]);
-
-                // Keep renewAt only when certificate identifiers are unchanged.
-                // If altnames changed (e.g. wildcard added), force immediate re-issue.
                 if (sameAltnames) {
                     siteConfig.renewAt = existingSite.renewAt;
                 }
+            };
+
+            // Primary cert for apex/www uses default challenge flow (typically http-01).
+            const primaryAltnames = [domain];
+            if ((domain.match(/\./g) || []).length < 2) {
+                primaryAltnames.push(`www.${domain}`);
             }
+            const primarySite = {
+                subject: domain,
+                altnames: primaryAltnames
+            };
+            const existingPrimarySite = Array.isArray(existingConfig.sites)
+                ? existingConfig.sites.find(site => site.subject === domain)
+                : null;
+            applyRenewAtIfUnchanged(primarySite, existingPrimarySite);
+            sitesConfig.push(primarySite);
 
+            // Wildcard cert is issued separately and uses dns-01 only.
             if (this.wildcardZones.has(domain) && this.dnsChallenge) {
+                const wildcardSubject = `*.${domain}`;
                 const dns01 = { ...this.dnsChallenge };
                 if (dns01.propagationDelay === undefined) {
                     dns01.propagationDelay = 120000; // 120s default for manual DNS (acme-dns-01-cli)
@@ -348,12 +347,19 @@ class Roster {
                 if (dns01.dryRunDelay === undefined) {
                     dns01.dryRunDelay = dns01.propagationDelay;
                 }
-                siteConfig.challenges = {
-                    'dns-01': dns01
+                const wildcardSite = {
+                    subject: wildcardSubject,
+                    altnames: [wildcardSubject],
+                    challenges: {
+                        'dns-01': dns01
+                    }
                 };
+                const existingWildcardSite = Array.isArray(existingConfig.sites)
+                    ? existingConfig.sites.find(site => site.subject === wildcardSubject)
+                    : null;
+                applyRenewAtIfUnchanged(wildcardSite, existingWildcardSite);
+                sitesConfig.push(wildcardSite);
             }
-
-            sitesConfig.push(siteConfig);
         });
 
         const newConfig = {
@@ -747,6 +753,29 @@ class Roster {
                 const portNum = parseInt(port);
                 const dispatcher = createDispatcher(portData);
                 const upgradeHandler = createUpgradeHandler(portData);
+                const greenlockStorePath = this.greenlockStorePath;
+                const loadCert = (subjectDir) => {
+                    const certPath = path.join(greenlockStorePath, 'live', subjectDir);
+                    const keyPath = path.join(certPath, 'privkey.pem');
+                    const certFilePath = path.join(certPath, 'cert.pem');
+                    const chainPath = path.join(certPath, 'chain.pem');
+                    if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
+                        return {
+                            key: fs.readFileSync(keyPath, 'utf8'),
+                            cert: fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8')
+                        };
+                    }
+                    return null;
+                };
+                const zoneSubjectForHost = (servername) => {
+                    const labels = String(servername || '').split('.').filter(Boolean);
+                    if (labels.length < 3) return null;
+                    return labels.slice(1).join('.');
+                };
+                const resolvePemsForServername = (servername) => {
+                    if (!servername) return null;
+                    return loadCert(servername) || loadCert(zoneSubjectForHost(servername));
+                };
 
                 if (portNum === this.defaultPort) {
                     // Bun has known gaps around SNICallback compatibility.
@@ -759,21 +788,23 @@ class Roster {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
                         // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
                         const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
-                        const certPath = path.join(this.greenlockStorePath, 'live', certSubject);
-                        const keyPath = path.join(certPath, 'privkey.pem');
-                        const certFilePath = path.join(certPath, 'cert.pem');
-                        const chainPath = path.join(certPath, 'chain.pem');
-
-                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                            const key = fs.readFileSync(keyPath, 'utf8');
-                            const cert = fs.readFileSync(certFilePath, 'utf8');
-                            const chain = fs.readFileSync(chainPath, 'utf8');
+                        const defaultPems = resolvePemsForServername(certSubject);
+
+                        if (defaultPems) {
                             httpsServer = https.createServer({
                                 ...tlsOpts,
-                                key,
-                                cert: cert + chain
+                                key: defaultPems.key,
+                                cert: defaultPems.cert,
+                                SNICallback: (servername, callback) => {
+                                    try {
+                                        const pems = resolvePemsForServername(servername) || defaultPems;
+                                        callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                    } catch (error) {
+                                        callback(error);
+                                    }
+                                }
                             }, dispatcher);
-                            log.warn(`⚠️  Bun runtime detected: using static TLS cert for ${primaryDomain} on port ${portNum}`);
+                            log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                         } else {
                             log.warn(`⚠️  Bun runtime detected but cert files missing for ${certSubject} (${primaryDomain}); falling back to Greenlock HTTPS server`);
                             httpsServer = glx.httpsServer(tlsOpts, dispatcher);
@@ -792,30 +823,12 @@ class Roster {
                     });
                 } else {
                     // Create HTTPS server for custom ports using Greenlock certificates
-                    const greenlockStorePath = this.greenlockStorePath;
-                    const loadCert = (subjectDir) => {
-                        const certPath = path.join(greenlockStorePath, 'live', subjectDir);
-                        const keyPath = path.join(certPath, 'privkey.pem');
-                        const certFilePath = path.join(certPath, 'cert.pem');
-                        const chainPath = path.join(certPath, 'chain.pem');
-                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                            return {
-                                key: fs.readFileSync(keyPath, 'utf8'),
-                                cert: fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8')
-                            };
-                        }
-                        return null;
-                    };
                     const httpsOptions = {
                         minVersion: this.tlsMinVersion,
                         maxVersion: this.tlsMaxVersion,
                         SNICallback: (servername, callback) => {
                             try {
-                                let pems = loadCert(servername);
-                                if (!pems && hostMatchesWildcard(servername, '*.' + servername.split('.').slice(1).join('.'))) {
-                                    const zoneSubject = servername.split('.').slice(1).join('.');
-                                    pems = loadCert(zoneSubject);
-                                }
+                                const pems = resolvePemsForServername(servername);
                                 if (pems) {
                                     callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
                                 } else {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {

package/test/roster-server.test.js

@@ -444,3 +444,40 @@ describe('Roster loadSites', () => {
         await assert.doesNotReject(roster.loadSites());
     });
 });
+
+describe('Roster generateConfigJson', () => {
+    it('uses http-01 for apex/www and dns-01 only for wildcard cert', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-config-'));
+        try {
+            const roster = new Roster({
+                local: false,
+                greenlockStorePath: tmpDir,
+                dnsChallenge: {
+                    module: 'acme-dns-01-cli',
+                    propagationDelay: 120000,
+                    autoContinue: false,
+                    dryRunDelay: 120000
+                }
+            });
+
+            roster.domains = ['tagnu.com', 'www.tagnu.com', '*.tagnu.com'];
+            roster.wildcardZones.add('tagnu.com');
+            roster.generateConfigJson();
+
+            const configPath = path.join(tmpDir, 'config.json');
+            const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+            const apexSite = config.sites.find((site) => site.subject === 'tagnu.com');
+            const wildcardSite = config.sites.find((site) => site.subject === '*.tagnu.com');
+
+            assert.ok(apexSite);
+            assert.deepStrictEqual(apexSite.altnames.sort(), ['tagnu.com', 'www.tagnu.com'].sort());
+            assert.strictEqual(apexSite.challenges, undefined);
+
+            assert.ok(wildcardSite);
+            assert.deepStrictEqual(wildcardSite.altnames, ['*.tagnu.com']);
+            assert.ok(wildcardSite.challenges && wildcardSite.challenges['dns-01']);
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+});