roster-server 2.1.8 → 2.1.12

package/index.js

@@ -5,6 +5,7 @@ const https = require('https');
 const tls = require('tls');
 const { EventEmitter } = require('events');
 const Greenlock = require('./vendor/greenlock-express/greenlock-express.js');
+const GreenlockShim = require('./vendor/greenlock-express/greenlock-shim.js');
 const log = require('lemonlog')('roster');
 
 // CRC32 implementation for deterministic port assignment
@@ -707,7 +708,7 @@ class Roster {
             return this.startLocalMode();
         }
 
-        const greenlock = Greenlock.init({
+        const greenlockOptions = {
             packageRoot: __dirname,
             configDir: this.greenlockStorePath,
             maintainerEmail: this.email,
@@ -724,9 +725,16 @@ class Roster {
                 else if (event === 'warning') log.warn(msg);
                 else log.info(msg);
             }
+        };
+        // Keep a direct greenlock runtime handle so we can call get() explicitly under Bun
+        // before binding :443, avoiding invalid non-TLS responses on startup.
+        const greenlockRuntime = GreenlockShim.create(greenlockOptions);
+        const greenlock = Greenlock.init({
+            ...greenlockOptions,
+            greenlock: greenlockRuntime
         });
 
-        return greenlock.ready(glx => {
+        return greenlock.ready(async glx => {
             const httpServer = glx.httpServer();
 
             // Group sites by port
@@ -845,6 +853,26 @@ class Roster {
                     }
                     return null;
                 };
+                const ensureBunDefaultPems = async (primaryDomain) => {
+                    let pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                    log.warn(`⚠️  Bun runtime detected and cert files missing for ${primaryDomain}; requesting certificate via Greenlock before HTTPS bind`);
+                    try {
+                        await greenlockRuntime.get({ servername: certSubject });
+                    } catch (error) {
+                        log.error(`❌ Failed to obtain certificate for ${certSubject} under Bun:`, error?.message || error);
+                    }
+
+                    pems = resolvePemsForServername(primaryDomain);
+                    if (pems) return pems;
+
+                    throw new Error(
+                        `Bun runtime could not load TLS certificate files for ${primaryDomain}. ` +
+                        `Refusing to start HTTPS on port ${portNum} to avoid serving invalid TLS.`
+                    );
+                };
 
                 if (portNum === this.defaultPort) {
                     // Bun has known gaps around SNICallback compatibility.
@@ -855,28 +883,23 @@ class Roster {
 
                     if (isBunRuntime) {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
-                        const defaultPems = resolvePemsForServername(primaryDomain);
-
-                        if (defaultPems) {
-                            httpsServer = https.createServer({
-                                ...tlsOpts,
-                                key: defaultPems.key,
-                                cert: defaultPems.cert,
-                                SNICallback: (servername, callback) => {
-                                    try {
-                                        const pems = resolvePemsForServername(servername) || defaultPems;
-                                        callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
-                                    } catch (error) {
-                                        callback(error);
-                                    }
+                        // Under Bun, avoid glx.httpsServer fallback (may serve invalid TLS on :443).
+                        // Require concrete PEM files and create native https server directly.
+                        const defaultPems = await ensureBunDefaultPems(primaryDomain);
+                        httpsServer = https.createServer({
+                            ...tlsOpts,
+                            key: defaultPems.key,
+                            cert: defaultPems.cert,
+                            SNICallback: (servername, callback) => {
+                                try {
+                                    const pems = resolvePemsForServername(servername) || defaultPems;
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
+                                } catch (error) {
+                                    callback(error);
                                 }
-                            }, dispatcher);
-                            log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
-                        } else {
-                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${primaryDomain}; falling back to Greenlock HTTPS server`);
-                            httpsServer = glx.httpsServer(tlsOpts, dispatcher);
-                        }
+                            }
+                        }, dispatcher);
+                        log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
                     } else {
                         httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.8",
+    "version": "2.1.12",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {