roster-server 2.1.10 → 2.1.14

package/index.js

@@ -5,6 +5,7 @@ const https = require('https');
 const tls = require('tls');
 const { EventEmitter } = require('events');
 const Greenlock = require('./vendor/greenlock-express/greenlock-express.js');
+const GreenlockShim = require('./vendor/greenlock-express/greenlock-shim.js');
 const log = require('lemonlog')('roster');
 
 // CRC32 implementation for deterministic port assignment
@@ -707,7 +708,7 @@ class Roster {
             return this.startLocalMode();
         }
 
-        const greenlock = Greenlock.init({
+        const greenlockOptions = {
             packageRoot: __dirname,
             configDir: this.greenlockStorePath,
             maintainerEmail: this.email,
@@ -724,6 +725,13 @@ class Roster {
                 else if (event === 'warning') log.warn(msg);
                 else log.info(msg);
             }
+        };
+        // Keep a direct greenlock runtime handle so we can call get() explicitly under Bun
+        // before binding :443, avoiding invalid non-TLS responses on startup.
+        const greenlockRuntime = GreenlockShim.create(greenlockOptions);
+        const greenlock = Greenlock.init({
+            ...greenlockOptions,
+            greenlock: greenlockRuntime
         });
 
         return greenlock.ready(async glx => {
@@ -845,14 +853,46 @@ class Roster {
                     }
                     return null;
                 };
+                const issueAndReloadPemsForServername = async (servername) => {
+                    const host = normalizeHostInput(servername).trim().toLowerCase();
+                    if (!host) return null;
+
+                    let pems = resolvePemsForServername(host);
+                    if (pems) return pems;
+
+                    try {
+                        await greenlockRuntime.get({ servername: host });
+                    } catch (error) {
+                        log.warn(`⚠️  Greenlock issuance failed for ${host}: ${error?.message || error}`);
+                    }
+
+                    pems = resolvePemsForServername(host);
+                    if (pems) return pems;
+
+                    // For wildcard zones, try a valid subdomain bootstrap host so Greenlock can
+                    // resolve the wildcard site without relying on invalid "*.domain" servername input.
+                    const wildcardSubject = wildcardSubjectForHost(host);
+                    const zone = wildcardSubject ? wildcardRoot(wildcardSubject) : null;
+                    if (zone) {
+                        const bootstrapHost = `bun-bootstrap.${zone}`;
+                        try {
+                            await greenlockRuntime.get({ servername: bootstrapHost });
+                        } catch (error) {
+                            log.warn(`⚠️  Greenlock wildcard bootstrap failed for ${bootstrapHost}: ${error?.message || error}`);
+                        }
+                        pems = resolvePemsForServername(host);
+                    }
+
+                    return pems;
+                };
                 const ensureBunDefaultPems = async (primaryDomain) => {
-                    let pems = resolvePemsForServername(primaryDomain);
+                    let pems = await issueAndReloadPemsForServername(primaryDomain);
                     if (pems) return pems;
 
                     const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
                     log.warn(`⚠️  Bun runtime detected and cert files missing for ${primaryDomain}; requesting certificate via Greenlock before HTTPS bind`);
                     try {
-                        await greenlock.get({ servername: certSubject });
+                        await greenlockRuntime.get({ servername: certSubject });
                     } catch (error) {
                         log.error(`❌ Failed to obtain certificate for ${certSubject} under Bun:`, error?.message || error);
                     }
@@ -883,12 +923,12 @@ class Roster {
                             key: defaultPems.key,
                             cert: defaultPems.cert,
                             SNICallback: (servername, callback) => {
-                                try {
-                                    const pems = resolvePemsForServername(servername) || defaultPems;
-                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
-                                } catch (error) {
-                                    callback(error);
-                                }
+                                issueAndReloadPemsForServername(servername)
+                                    .then((pems) => {
+                                        const selected = pems || defaultPems;
+                                        callback(null, tls.createSecureContext({ key: selected.key, cert: selected.cert }));
+                                    })
+                                    .catch(callback);
                             }
                         }, dispatcher);
                         log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.10",
+    "version": "2.1.14",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {