roster-server 2.1.6 → 2.1.10

package/index.js

@@ -86,6 +86,14 @@ function buildCertLookupCandidates(servername) {
     return candidates;
 }
 
+function parseBooleanFlag(value, fallback = false) {
+    if (value === undefined || value === null || value === '') return fallback;
+    const normalized = String(value).trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+    return fallback;
+}
+
 // Virtual Server that completely isolates applications
 class VirtualServer extends EventEmitter {
     constructor(domain) {
@@ -222,6 +230,9 @@ class Roster {
         this.maxLocalPort = options.maxLocalPort || 9999;
         this.tlsMinVersion = options.tlsMinVersion ?? 'TLSv1.2';
         this.tlsMaxVersion = options.tlsMaxVersion ?? 'TLSv1.3';
+        this.disableWildcard = options.disableWildcard !== undefined
+            ? parseBooleanFlag(options.disableWildcard, false)
+            : parseBooleanFlag(process.env.ROSTER_DISABLE_WILDCARD, false);
 
         const port = options.port === undefined ? 443 : options.port;
         if (port === 80 && !this.local) {
@@ -299,6 +310,10 @@ class Roster {
 
             if (siteApp) {
                 if (domain.startsWith('*.')) {
+                    if (this.disableWildcard) {
+                        log.warn(`⚠️  Wildcard site skipped (disableWildcard enabled): ${domain}`);
+                        continue;
+                    }
                     // Wildcard site: one handler for all subdomains (e.g. *.example.com)
                     this.domains.push(domain);
                     this.sites[domain] = siteApp;
@@ -513,6 +528,10 @@ class Roster {
         const { domain, port } = this.parseDomainWithPort(domainString);
 
         if (domain.startsWith('*.')) {
+            if (this.disableWildcard) {
+                log.warn(`⚠️  Wildcard registration ignored (disableWildcard enabled): ${domain}`);
+                return this;
+            }
             const domainKey = port === this.defaultPort ? domain : `${domain}:${port}`;
             this.domains.push(domain);
             this.sites[domainKey] = requestHandler;
@@ -707,7 +726,7 @@ class Roster {
             }
         });
 
-        return greenlock.ready(glx => {
+        return greenlock.ready(async glx => {
             const httpServer = glx.httpServer();
 
             // Group sites by port
@@ -826,6 +845,26 @@ class Roster {
                     }
                     return null;
                 };
+                const ensureBunDefaultPems = async (primaryDomain) => {
+                    let pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                    log.warn(`⚠️  Bun runtime detected and cert files missing for ${primaryDomain}; requesting certificate via Greenlock before HTTPS bind`);
+                    try {
+                        await greenlock.get({ servername: certSubject });
+                    } catch (error) {
+                        log.error(`❌ Failed to obtain certificate for ${certSubject} under Bun:`, error?.message || error);
+                    }
+
+                    pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    throw new Error(
+                        `Bun runtime could not load TLS certificate files for ${primaryDomain}. ` +
+                        `Refusing to start HTTPS on port ${portNum} to avoid serving invalid TLS.`
+                    );
+                };
 
                 if (portNum === this.defaultPort) {
                     // Bun has known gaps around SNICallback compatibility.
@@ -836,28 +875,23 @@ class Roster {
 
                     if (isBunRuntime) {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
-                        const defaultPems = resolvePemsForServername(primaryDomain);
-
-                        if (defaultPems) {
-                            httpsServer = https.createServer({
-                                ...tlsOpts,
-                                key: defaultPems.key,
-                                cert: defaultPems.cert,
-                                SNICallback: (servername, callback) => {
-                                    try {
-                                        const pems = resolvePemsForServername(servername) || defaultPems;
-                                        callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
-                                    } catch (error) {
-                                        callback(error);
-                                    }
+                        // Under Bun, avoid glx.httpsServer fallback (may serve invalid TLS on :443).
+                        // Require concrete PEM files and create native https server directly.
+                        const defaultPems = await ensureBunDefaultPems(primaryDomain);
+                        httpsServer = https.createServer({
+                            ...tlsOpts,
+                            key: defaultPems.key,
+                            cert: defaultPems.cert,
+                            SNICallback: (servername, callback) => {
+                                try {
+                                    const pems = resolvePemsForServername(servername) || defaultPems;
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                } catch (error) {
+                                    callback(error);
                                 }
-                            }, dispatcher);
-                            log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
-                        } else {
-                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${primaryDomain}; falling back to Greenlock HTTPS server`);
-                            httpsServer = glx.httpsServer(tlsOpts, dispatcher);
-                        }
+                            }
+                        }, dispatcher);
+                        log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                     } else {
                         httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.6",
+    "version": "2.1.10",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {

package/test/roster-server.test.js

@@ -168,6 +168,14 @@ describe('Roster', () => {
             roster.register('*.example.com', wildcardHandler);
             assert.strictEqual(roster.getHandlerForHost('api.example.com'), exactHandler);
         });
+        it('ignores wildcard registration when disableWildcard is true', () => {
+            const roster = new Roster({ local: true, disableWildcard: true });
+            const handler = () => {};
+            roster.register('*.example.com', handler);
+            assert.strictEqual(roster.sites['*.example.com'], undefined);
+            assert.strictEqual(roster.getHandlerForHost('api.example.com'), null);
+            assert.strictEqual(roster.wildcardZones.has('example.com'), false);
+        });
     });
 
     describe('getHandlerForPortData', () => {
@@ -290,6 +298,21 @@ describe('Roster', () => {
             const roster = new Roster({ local: false, dnsChallenge: false });
             assert.strictEqual(roster.dnsChallenge, null);
         });
+        it('enables disableWildcard from constructor option', () => {
+            const roster = new Roster({ local: true, disableWildcard: true });
+            assert.strictEqual(roster.disableWildcard, true);
+        });
+        it('reads disableWildcard from env var', () => {
+            const previous = process.env.ROSTER_DISABLE_WILDCARD;
+            process.env.ROSTER_DISABLE_WILDCARD = '1';
+            try {
+                const roster = new Roster({ local: true });
+                assert.strictEqual(roster.disableWildcard, true);
+            } finally {
+                if (previous === undefined) delete process.env.ROSTER_DISABLE_WILDCARD;
+                else process.env.ROSTER_DISABLE_WILDCARD = previous;
+            }
+        });
     });
 
     describe('register (normal domain)', () => {
@@ -470,6 +493,26 @@ describe('Roster loadSites', () => {
         }
     });
 
+    it('skips wildcard site from www when disableWildcard is true', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, '*.wildcard.example');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(
+            path.join(siteDir, 'index.js'),
+            'module.exports = () => (req, res) => { res.writeHead(200); res.end("wildcard"); };',
+            'utf8'
+        );
+        try {
+            const roster = new Roster({ wwwPath, local: true, disableWildcard: true });
+            await roster.loadSites();
+            assert.strictEqual(roster.sites['*.wildcard.example'], undefined);
+            assert.strictEqual(roster.wildcardZones.has('wildcard.example'), false);
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
     it('does not throw when www path does not exist', async () => {
         const roster = new Roster({
             wwwPath: path.join(os.tmpdir(), 'roster-nonexistent-' + Date.now()),