roster-server 2.1.8 → 2.1.10

package/index.js

@@ -726,7 +726,7 @@ class Roster {
             }
         });
 
-        return greenlock.ready(glx => {
+        return greenlock.ready(async glx => {
             const httpServer = glx.httpServer();
 
             // Group sites by port
@@ -845,6 +845,26 @@ class Roster {
                     }
                     return null;
                 };
+                const ensureBunDefaultPems = async (primaryDomain) => {
+                    let pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                    log.warn(`⚠️  Bun runtime detected and cert files missing for ${primaryDomain}; requesting certificate via Greenlock before HTTPS bind`);
+                    try {
+                        await greenlock.get({ servername: certSubject });
+                    } catch (error) {
+                        log.error(`❌ Failed to obtain certificate for ${certSubject} under Bun:`, error?.message || error);
+                    }
+
+                    pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    throw new Error(
+                        `Bun runtime could not load TLS certificate files for ${primaryDomain}. ` +
+                        `Refusing to start HTTPS on port ${portNum} to avoid serving invalid TLS.`
+                    );
+                };
 
                 if (portNum === this.defaultPort) {
                     // Bun has known gaps around SNICallback compatibility.
@@ -855,28 +875,23 @@ class Roster {
 
                     if (isBunRuntime) {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
-                        const defaultPems = resolvePemsForServername(primaryDomain);
-
-                        if (defaultPems) {
-                            httpsServer = https.createServer({
-                                ...tlsOpts,
-                                key: defaultPems.key,
-                                cert: defaultPems.cert,
-                                SNICallback: (servername, callback) => {
-                                    try {
-                                        const pems = resolvePemsForServername(servername) || defaultPems;
-                                        callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
-                                    } catch (error) {
-                                        callback(error);
-                                    }
+                        // Under Bun, avoid glx.httpsServer fallback (may serve invalid TLS on :443).
+                        // Require concrete PEM files and create native https server directly.
+                        const defaultPems = await ensureBunDefaultPems(primaryDomain);
+                        httpsServer = https.createServer({
+                            ...tlsOpts,
+                            key: defaultPems.key,
+                            cert: defaultPems.cert,
+                            SNICallback: (servername, callback) => {
+                                try {
+                                    const pems = resolvePemsForServername(servername) || defaultPems;
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                } catch (error) {
+                                    callback(error);
                                 }
-                            }, dispatcher);
-                            log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
-                        } else {
-                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${primaryDomain}; falling back to Greenlock HTTPS server`);
-                            httpsServer = glx.httpsServer(tlsOpts, dispatcher);
-                        }
+                            }
+                        }, dispatcher);
+                        log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                     } else {
                         httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.8",
+    "version": "2.1.10",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {