roster-server 2.1.34 → 2.2.0

package/index.js

@@ -8,6 +8,8 @@ const Greenlock = require('./vendor/greenlock-express/greenlock-express.js');
 const GreenlockShim = require('./vendor/greenlock-express/greenlock-shim.js');
 const log = require('lemonlog')('roster');
 
+const isBunRuntime = typeof Bun !== 'undefined' || (typeof process !== 'undefined' && process.release?.name === 'bun');
+
 // CRC32 implementation for deterministic port assignment
 function crc32(str) {
     const crcTable = [];
@@ -234,9 +236,13 @@ class Roster {
         this.disableWildcard = options.disableWildcard !== undefined
             ? parseBooleanFlag(options.disableWildcard, false)
             : parseBooleanFlag(process.env.ROSTER_DISABLE_WILDCARD, false);
+        const combineDefault = isBunRuntime;
         this.combineWildcardCerts = options.combineWildcardCerts !== undefined
-            ? parseBooleanFlag(options.combineWildcardCerts, false)
-            : parseBooleanFlag(process.env.ROSTER_COMBINE_WILDCARD_CERTS, false);
+            ? parseBooleanFlag(options.combineWildcardCerts, combineDefault)
+            : parseBooleanFlag(process.env.ROSTER_COMBINE_WILDCARD_CERTS, combineDefault);
+        if (isBunRuntime && this.combineWildcardCerts) {
+            log.info('Bun runtime detected: combined wildcard certificates enabled by default (SNI bypass)');
+        }
 
         const port = options.port === undefined ? 443 : options.port;
         if (port === 80 && !this.local) {
@@ -775,38 +781,7 @@ class Roster {
                 }
             }
 
-            const isBunRuntime = typeof Bun !== 'undefined' || process.release?.name === 'bun';
-            if (isBunRuntime && this.wildcardZones.size > 0) {
-                const retryDelayMs = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
-                    ? Math.max(1000, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
-                    : 30000;
-                const maxAttempts = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
-                    ? Math.max(0, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
-                    : 0; // 0 = retry forever
-
-                for (const zone of this.wildcardZones) {
-                    const bootstrapHost = `bun-bootstrap.${zone}`;
-                    const attemptPrewarm = async (attempt = 1) => {
-                        try {
-                            log.warn(`⚠️  Bun runtime detected: prewarming wildcard certificate via ${bootstrapHost} (attempt ${attempt})`);
-                            await greenlockRuntime.get({ servername: bootstrapHost });
-                            log.info(`✅ Bun wildcard prewarm succeeded for ${zone} on attempt ${attempt}`);
-                        } catch (error) {
-                            log.warn(`⚠️  Bun wildcard prewarm failed for ${zone} (attempt ${attempt}): ${error?.message || error}`);
-                            if (maxAttempts > 0 && attempt >= maxAttempts) {
-                                log.warn(`⚠️  Bun wildcard prewarm stopped for ${zone} after ${attempt} attempts`);
-                                return;
-                            }
-                            setTimeout(() => {
-                                attemptPrewarm(attempt + 1).catch(() => {});
-                            }, retryDelayMs);
-                        }
-                    };
-
-                    // Background prewarm + retries so HTTPS startup is not blocked by DNS propagation timing.
-                    attemptPrewarm().catch(() => {});
-                }
-            }
+            const bunTlsHotReloadHandlers = [];
 
             // Create dispatcher for each port
             const createDispatcher = (portData) => {
@@ -963,7 +938,7 @@ class Roster {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
                         // Under Bun, avoid glx.httpsServer fallback (may serve invalid TLS on :443).
                         // Require concrete PEM files and create native https server directly.
-                        const defaultPems = await ensureBunDefaultPems(primaryDomain);
+                        let defaultPems = await ensureBunDefaultPems(primaryDomain);
                         httpsServer = https.createServer({
                             ...tlsOpts,
                             key: defaultPems.key,
@@ -977,6 +952,21 @@ class Roster {
                                     .catch(callback);
                             }
                         }, dispatcher);
+                        const reloadBunDefaultTls = async (servername, reason) => {
+                            const nextPems = await issueAndReloadPemsForServername(servername);
+                            if (!nextPems) return false;
+                            defaultPems = nextPems;
+                            if (typeof httpsServer.setSecureContext === 'function') {
+                                try {
+                                    httpsServer.setSecureContext({ key: defaultPems.key, cert: defaultPems.cert });
+                                    log.info(`🔄 Bun TLS default certificate reloaded on port ${portNum} (${reason})`);
+                                } catch (error) {
+                                    log.warn(`⚠️  Failed to hot-reload Bun TLS context on port ${portNum}: ${error?.message || error}`);
+                                }
+                            }
+                            return true;
+                        };
+                        bunTlsHotReloadHandlers.push(reloadBunDefaultTls);
                         log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                     } else {
                         httpsServer = glx.httpsServer(tlsOpts, dispatcher);
@@ -1036,11 +1026,51 @@ class Roster {
                     });
                 }
             }
+
+            if (isBunRuntime && !this.combineWildcardCerts && this.wildcardZones.size > 0 && bunTlsHotReloadHandlers.length > 0) {
+                const retryDelayMs = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
+                    ? Math.max(1000, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
+                    : 30000;
+                const maxAttempts = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
+                    ? Math.max(0, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
+                    : 0; // 0 = retry forever
+
+                for (const zone of this.wildcardZones) {
+                    const bootstrapHost = `bun-bootstrap.${zone}`;
+                    const attemptPrewarm = async (attempt = 1) => {
+                        try {
+                            log.warn(`⚠️  Bun runtime detected: prewarming wildcard certificate via ${bootstrapHost} (attempt ${attempt})`);
+                            let reloaded = false;
+                            for (const reloadTls of bunTlsHotReloadHandlers) {
+                                // Trigger issuance + immediately hot-reload default TLS context when ready.
+                                reloaded = (await reloadTls(bootstrapHost, `prewarm ${bootstrapHost} attempt ${attempt}`)) || reloaded;
+                            }
+                            if (!reloaded) {
+                                throw new Error(`No certificate could be loaded for ${bootstrapHost}`);
+                            }
+                            log.info(`✅ Bun wildcard prewarm succeeded for ${zone} on attempt ${attempt}`);
+                        } catch (error) {
+                            log.warn(`⚠️  Bun wildcard prewarm failed for ${zone} (attempt ${attempt}): ${error?.message || error}`);
+                            if (maxAttempts > 0 && attempt >= maxAttempts) {
+                                log.warn(`⚠️  Bun wildcard prewarm stopped for ${zone} after ${attempt} attempts`);
+                                return;
+                            }
+                            setTimeout(() => {
+                                attemptPrewarm(attempt + 1).catch(() => {});
+                            }, retryDelayMs);
+                        }
+                    };
+
+                    // Background prewarm + retries so HTTPS startup is not blocked by DNS propagation timing.
+                    attemptPrewarm().catch(() => {});
+                }
+            }
         });
     }
 }
 
 module.exports = Roster;
+module.exports.isBunRuntime = isBunRuntime;
 module.exports.wildcardRoot = wildcardRoot;
 module.exports.hostMatchesWildcard = hostMatchesWildcard;
 module.exports.wildcardSubjectForHost = wildcardSubjectForHost;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.34",
+    "version": "2.2.0",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {

package/test/roster-server.test.js

@@ -8,6 +8,7 @@ const http = require('http');
 const os = require('os');
 const Roster = require('../index.js');
 const {
+    isBunRuntime,
     wildcardRoot,
     hostMatchesWildcard,
     wildcardSubjectForHost,
@@ -324,6 +325,14 @@ describe('Roster', () => {
                 else process.env.ROSTER_COMBINE_WILDCARD_CERTS = previous;
             }
         });
+        it('defaults combineWildcardCerts based on isBunRuntime', () => {
+            const roster = new Roster({ local: false });
+            assert.strictEqual(roster.combineWildcardCerts, isBunRuntime);
+        });
+        it('explicit combineWildcardCerts=false overrides Bun default', () => {
+            const roster = new Roster({ local: false, combineWildcardCerts: false });
+            assert.strictEqual(roster.combineWildcardCerts, false);
+        });
     });
 
     describe('register (normal domain)', () => {