roster-server 3.0.1 → 3.1.0

package/README.md

@@ -272,6 +272,8 @@ const dnsChallenge = {
 
 Pass this as the constructor's `dnsChallenge` option. To use another provider, install its Greenlock DNS plugin in the consuming application and supply its module name and provider options. Configure DNS timing on that object with `propagationDelay`, `dryRunDelay`, `dnsPollIntervalMs`, and `dnsPollTimeoutMs`; the wrapper's polling interval defaults to `15000` ms.
 
+`serverKeyType: 'EC-P256'` makes each full TLS handshake much cheaper for the server than the default RSA key. It applies to certificates issued after the change: renewal reuses a certificate's existing key. To move an existing name to the new key type, remove its directory under `greenlockStorePath/live/` and restart; Roster issues a new certificate on the first connection for that name.
+
 Roster's file-based SNI resolvers cache TLS contexts and detect changed certificate files through metadata, including updates from another process. Concurrent requests for the same certificate name share loads and checks. Standalone startup reuses the initialized certificate runtime and Roster's cancellable renewal loop. Loading an existing certificate does not itself force renewal.
 
 ## Configuration reference
@@ -296,6 +298,8 @@ Pass operational settings through the constructor, using the consuming applicati
 | `handleSignals` | `false` | Close this instance on `SIGINT`/`SIGTERM`; does not force process exit. |
 | `isolation` | `true` (`false` with `cluster`) | One process per site directory under `start()`; `false` or `{ restartDelayMs, backlog, helloTimeoutMs }` (defaults `1000`, `511`, `10000`). See [site isolation](#site-isolation). |
 | `tlsMinVersion`, `tlsMaxVersion` | `TLSv1.2`, `TLSv1.3` | Protocol limits for created HTTPS servers. |
+| `keepAliveTimeoutMs` | Node.js default (`5000`) | Idle time before a site server closes a keep-alive connection, in isolated and main-process sites. Set it above the interval at which clients repeat requests so they reuse the connection instead of paying a new TLS handshake. |
+| `serverKeyType` | `RSA-2048` | Key for newly issued certificates: `RSA-2048`, `RSA-3072`, `RSA-4096`, `EC-P256`, or `EC-P384`. See [certificates](#certificates-and-dns). |
 | `skipLocalCheck` | `true` | Skips Greenlock dry-run/local challenge checks. |
 | `dnsChallenge` | CLI wrapper | DNS-01 options or `false`; see [certificates](#certificates-and-dns). |
 | `disableWildcard`, `combineWildcardCerts` | `false`, `false` | Wildcard registration and certificate behavior. |

package/index.js

@@ -13,6 +13,7 @@ const { IsolatedSite } = require('./lib/isolated-site.js');
 const { parseClientHello } = require('./lib/client-hello.js');
 const log = require('lemonlog')('roster');
 const SHUTDOWN_SIGNALS = ['SIGINT', 'SIGTERM'];
+const SERVER_KEY_TYPES = ['RSA-2048', 'RSA-3072', 'RSA-4096', 'EC-P256', 'EC-P384'];
 // A request plugin carrying { module, export, options } under this key can be recreated in isolated site processes.
 const PLUGIN_SOURCE = Symbol.for('roster-server.plugin-source');
 
@@ -355,6 +356,14 @@ class Roster {
         this.maxLocalPort = options.maxLocalPort || 9999;
         this.tlsMinVersion = options.tlsMinVersion ?? 'TLSv1.2';
         this.tlsMaxVersion = options.tlsMaxVersion ?? 'TLSv1.3';
+        this.keepAliveTimeoutMs = options.keepAliveTimeoutMs;
+        if (this.keepAliveTimeoutMs !== undefined && (!Number.isFinite(this.keepAliveTimeoutMs) || this.keepAliveTimeoutMs <= 0)) {
+            throw new TypeError('keepAliveTimeoutMs must be a positive finite number');
+        }
+        this.serverKeyType = options.serverKeyType ?? 'RSA-2048';
+        if (!SERVER_KEY_TYPES.includes(this.serverKeyType)) {
+            throw new TypeError(`serverKeyType must be one of ${SERVER_KEY_TYPES.join(', ')}`);
+        }
         this.disableWildcard = parseBooleanFlag(options.disableWildcard, false);
         this.combineWildcardCerts = parseBooleanFlag(options.combineWildcardCerts, false);
         if (isBunRuntime && this.combineWildcardCerts) {
@@ -607,7 +616,7 @@ class Roster {
                 renewOffset: "-45d",
                 renewStagger: "3d",
                 accountKeyType: "EC-P256",
-                serverKeyType: "RSA-2048",
+                serverKeyType: this.serverKeyType,
                 subscriberEmail: this.email
             },
             sites: sitesConfig
@@ -937,6 +946,7 @@ class Roster {
             greenlockStorePath: this.greenlockStorePath,
             tlsMinVersion: this.tlsMinVersion,
             tlsMaxVersion: this.tlsMaxVersion,
+            keepAliveTimeoutMs: this.keepAliveTimeoutMs,
             closeTimeoutMs: this.closeTimeoutMs
         };
         const sitesByPath = new Map();
@@ -985,7 +995,7 @@ class Roster {
             socket.setTimeout(0);
             const site = servername && this._isolatedSiteFor(routes, servername);
             if (site) {
-                site.handoff(port, head, socket);
+                site.handoff(port, head, socket, () => this._sockets.delete(socket));
                 return;
             }
             socket.unshift(head);
@@ -994,7 +1004,14 @@ class Roster {
         socket.on('data', read);
     }
 
+    // Applies the options shared by every server that serves sites.
+    _configureSiteServer(server) {
+        if (this.keepAliveTimeoutMs !== undefined) server.keepAliveTimeout = this.keepAliveTimeoutMs;
+        return server;
+    }
+
     _listenSite(server, port) {
+        this._configureSiteServer(server);
         const routes = this._isolatedRoutes[port];
         if (!routes) {
             this.portServers[port] = server;
@@ -1545,14 +1562,14 @@ class Roster {
             ? await this.ensureCertificate(normalizedServername)
             : this.loadCertificate(normalizedServername);
 
-        const server = https.createServer({
+        const server = this._configureSiteServer(https.createServer({
             minVersion: this.tlsMinVersion,
             maxVersion: this.tlsMaxVersion,
             ...tlsOptions,
             key: pems.key,
             cert: pems.cert,
             SNICallback: this.sniCallback()
-        });
+        }));
 
         this.attach(server, { port });
         return server;
@@ -1591,7 +1608,7 @@ class Roster {
                     }
                 };
 
-                const httpServer = http.createServer(dispatcher);
+                const httpServer = this._configureSiteServer(http.createServer(dispatcher));
                 this.portServers[port] = httpServer;
 
                 httpServer.on('upgrade', (req, socket, head) => {

package/lib/isolated-site.js

@@ -108,8 +108,10 @@ class IsolatedSite {
 
     /**
      * Pass an accepted client socket, with the bytes already read from it, to the site process.
+     * `onHandedOff` runs once the site process owns the connection; the main process never
+     * sees a 'close' event for it.
      */
-    handoff(port, head, socket) {
+    handoff(port, head, socket, onHandedOff) {
         const child = this.child;
         if (!this.ready || this.pending >= this.isolation.backlog) {
             socket.destroy();
@@ -119,6 +121,7 @@ class IsolatedSite {
         child.send({ type: 'connection', port, head: head.toString('base64') }, socket, error => {
             if (this.child === child) this.pending--;
             if (error) socket.destroy();
+            else onHandedOff();
         });
     }
 

package/lib/site-worker.js

@@ -67,13 +67,13 @@ class SiteWorkerRoster extends Roster {
         for (const port of ports) {
             // Only the default port issues missing certificates, as in the main process.
             const issue = port === this.defaultPort;
-            const server = https.createServer({
+            const server = this._configureSiteServer(https.createServer({
                 minVersion: this.tlsMinVersion,
                 maxVersion: this.tlsMaxVersion,
                 SNICallback: (servername, callback) => {
                     this._getSecureContext(servername, issue).then(context => callback(null, context), callback);
                 }
-            });
+            }));
             this.attach(server, { port });
             this._ownedServers.add(server);
             this._httpsServers.set(port, server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roster-server",
-  "version": "3.0.1",
+  "version": "3.1.0",
   "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
   "main": "index.js",
   "repository": {

package/test/isolation.test.js

@@ -52,11 +52,13 @@ function createWww(t, sites) {
     return { root, wwwPath };
 }
 
-async function startProduction(t, sites, { certificates = [], issue = async () => {}, configure = () => {} } = {}) {
+async function startProduction(t, sites, { certificates = [], issue = async () => {}, configure = () => {}, options = {} } = {}) {
     const { root, wwwPath } = createWww(t, sites);
     const store = path.join(root, 'greenlock.d');
     for (const subject of certificates) installCertificate(store, subject);
-    const roster = new Roster({ wwwPath, greenlockStorePath: store, isolation: { restartDelayMs: 50 }, closeTimeoutMs: 5000 });
+    const roster = new Roster({
+        wwwPath, greenlockStorePath: store, isolation: { restartDelayMs: 50 }, closeTimeoutMs: 5000, ...options
+    });
     t.mock.method(shim, 'create', () => ({ get: issue }));
     t.mock.method(greenlock, 'init', () => ({
         ready(callback) {
@@ -154,6 +156,43 @@ it('keeps serving in the same worker when a connection arrives without a socket'
     assert.equal(child.exitCode, null);
 });
 
+it('stops tracking connections in the main process once they are handed to a site process', { timeout: 20000 }, async t => {
+    const { roster, port } = await startProduction(t, { 'handoff.example.com': REPORT_SITE }, {
+        certificates: ['handoff.example.com']
+    });
+    for (let request = 0; request < 20; request++) {
+        assert.equal((await get(port, 'handoff.example.com')).status, 200);
+    }
+    for (let attempt = 0; attempt < 50 && roster._sockets.size > 0; attempt++) {
+        await new Promise(resolve => setTimeout(resolve, 20));
+    }
+    assert.equal(roster._sockets.size, 0, 'handed-off sockets are still tracked by the main process');
+});
+
+// Resolves with how long the server kept the connection open after answering one request.
+function idleKeepAliveMs(port, servername) {
+    return new Promise((resolve, reject) => {
+        const socket = tls.connect({ host: '127.0.0.1', port, servername, rejectUnauthorized: false }, () => {
+            socket.write(`GET / HTTP/1.1\r\nHost: ${servername}\r\nConnection: keep-alive\r\n\r\n`);
+        });
+        let answeredAt = null;
+        socket.on('data', () => { answeredAt ??= Date.now(); });
+        socket.on('close', () => answeredAt ? resolve(Date.now() - answeredAt) : reject(new Error('closed before answering')));
+        socket.on('error', reject);
+    });
+}
+
+for (const isolation of [true, false]) {
+    it(`closes idle keep-alive connections after keepAliveTimeoutMs (isolation ${isolation})`, { timeout: 20000 }, async t => {
+        const { port } = await startProduction(t, { 'idle.example.com': REPORT_SITE }, {
+            certificates: ['idle.example.com'],
+            options: { keepAliveTimeoutMs: 300, ...(isolation ? {} : { isolation: false }) }
+        });
+        const idleMs = await idleKeepAliveMs(port, 'idle.example.com');
+        assert.ok(idleMs >= 250 && idleMs < 2500, `connection stayed open ${idleMs} ms`);
+    });
+}
+
 it('keeps serving other sites while one blocks its event loop', { timeout: 20000 }, async t => {
     const { port } = await startProduction(t, {
         'busy.example.com': `module.exports = () => (req, res) => {

package/test/roster-server.test.js

@@ -813,6 +813,34 @@ describe('Roster generateConfigJson', () => {
             fs.rmSync(tmpDir, { recursive: true, force: true });
         }
     });
+    it('issues certificates with the configured server key type', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-config-'));
+        try {
+            const keyTypeFor = (options) => {
+                const roster = new Roster({ local: false, greenlockStorePath: tmpDir, ...options });
+                roster.domains = ['example.com', 'www.example.com'];
+                roster.generateConfigJson();
+                return JSON.parse(fs.readFileSync(path.join(tmpDir, 'config.json'), 'utf8')).defaults.serverKeyType;
+            };
+            assert.strictEqual(keyTypeFor({}), 'RSA-2048');
+            assert.strictEqual(keyTypeFor({ serverKeyType: 'EC-P256' }), 'EC-P256');
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+});
+
+describe('Roster TLS and keep-alive options', () => {
+    it('rejects unsupported server key types', () => {
+        for (const serverKeyType of ['EC-P521', 'DSA-1024', 'ec-p256', '']) {
+            assert.throws(() => new Roster({ serverKeyType }), TypeError);
+        }
+    });
+    it('rejects keep-alive timeouts that are not positive finite numbers', () => {
+        for (const keepAliveTimeoutMs of [0, -1, Infinity, '30000']) {
+            assert.throws(() => new Roster({ keepAliveTimeoutMs }), TypeError);
+        }
+    });
 });
 
 describe('Roster init() (cluster-friendly API)', () => {