roster-server 3.3.0 → 3.4.0

package/README.md

@@ -191,6 +191,10 @@ A site directory whose entry exports an object with a `connection(socket, head)`
 ```javascript
 // www/game.example.com/index.js
 export default {
+    async start({ certificate }) {
+        // Runs once before the first connection, e.g. to fork workers.
+        // certificate(servername) resolves { key, cert } PEM strings; cert includes the chain.
+    },
     connection(socket, head) {
         // Terminate TLS here, or pass socket and head to another process.
     },
@@ -202,7 +206,7 @@ export default {
 
 In production, `socket` is the client's TCP connection and `head` holds the TLS ClientHello that Roster already read; put it back with `socket.unshift(head)` before terminating TLS, and do not `resume()` the socket after wrapping it. In local mode, the site's assigned port accepts plain TCP connections, `socket` arrives paused, and `head` is empty. `connection()` runs synchronously; if it throws, Roster destroys the socket.
 
-Roster keeps issuing and renewing the site's certificates under `greenlockStorePath/live/<domain>`, but the site loads them and must pick up renewed files itself. Request plugins, `www.` redirects, and `onClose` hooks do not apply: the site owns every connection it receives. A socket site must run isolated; Roster rejects it when it would be served by the main process.
+`certificate(servername)` returns the certificate Roster would serve for that host, with the same wildcard and zone matching. A missing certificate is issued by the main process first, as for any isolated site. Roster also renews it; call `certificate()` again to pick up a renewal, for example on an interval or when a cached copy gets old. It is not available in local mode. Request plugins, `www.` redirects, and `onClose` hooks do not apply: the site owns every connection it receives. A socket site must run isolated; Roster rejects it when it would be served by the main process.
 
 ## Startup and shutdown
 

package/lib/resolve-site-app.js

@@ -42,8 +42,8 @@ async function resolveSiteApp(domainPath, options = {}) {
 }
 
 /**
- * A socket site exports `{ connection(socket, head), close?() }` and serves raw client
- * connections itself, including TLS. Only an isolated site process can hand it sockets.
+ * A socket site exports `{ start?(context), connection(socket, head), close?() }` and serves
+ * raw client connections itself, including TLS. Only an isolated site process can hand it sockets.
  */
 function isSocketSite(siteApp) {
     return typeof siteApp === 'object' && siteApp !== null && typeof siteApp.connection === 'function';

package/lib/site-worker.js

@@ -45,6 +45,11 @@ class SiteWorkerRoster extends Roster {
         return this._socketSite !== null;
     }
 
+    // The site terminates TLS with certificates Roster resolves: read from the store, or issued by the main process.
+    startSocketSite() {
+        return this._socketSite.start?.({ certificate: servername => this.ensureCertificate(servername) });
+    }
+
     // In local mode a socket site gets plain connections on its assigned ports, with no ClientHello.
     async serveLocalSockets() {
         const head = Buffer.alloc(0);
@@ -167,6 +172,7 @@ async function start(site) {
         }
         await roster.init();
         if (roster.socketSite) {
+            await roster.startSocketSite();
             if (roster.local) await roster.serveLocalSockets();
         } else if (roster.local) {
             await roster.start();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "3.3.0",
+    "version": "3.4.0",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {

package/test/isolation.test.js

@@ -405,11 +405,11 @@ it('closes isolated sites when the main process dies without closing', { timeout
     assert.equal(fs.readFileSync(marker, 'utf8'), 'closed');
 });
 
-function socketSite(server, marker) {
+function socketSite(server, marker, start = 'async start() {}') {
     return `const fs = require('fs');
-const server = ${server};
-server.on('request', (req, res) => res.end(JSON.stringify({ pid: process.pid, address: req.socket.remoteAddress })));
+let server = ${server};
 module.exports = {
+    ${start},
     connection(socket, head) {
         fs.writeFileSync(${JSON.stringify(marker)} + '.head', String(head.length));
         // A ClientHello read by Roster goes back on the stream; a local connection arrives paused.
@@ -417,6 +417,9 @@ module.exports = {
         server.emit('connection', socket);
         if (head.length === 0) socket.resume();
     },
+    reply(req, res) {
+        res.end(JSON.stringify({ pid: process.pid, address: req.socket.remoteAddress }));
+    },
     close() {
         fs.writeFileSync(${JSON.stringify(marker)}, 'closed');
     }
@@ -426,14 +429,15 @@ module.exports = {
 it('hands raw client sockets with their ClientHello to a socket site that terminates TLS', { timeout: 20000 }, async t => {
     const marker = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'roster-socket-site-')), 'closed');
     t.after(() => fs.rmSync(path.dirname(marker), { recursive: true, force: true }));
-    const tlsServer = `require('https').createServer({
-        key: fs.readFileSync(${JSON.stringify(path.join(pki, 'key.pem'))}),
-        cert: fs.readFileSync(${JSON.stringify(path.join(pki, 'cert.pem'))})
-    })`;
+    // The site gets its certificate from Roster's store through start(), not from files it reads.
+    const start = `async start({ certificate }) {
+        const pems = await certificate('raw.example.com');
+        server = require('https').createServer(pems, (req, res) => module.exports.reply(req, res));
+    }`;
     const { roster, port } = await startProduction(t, {
-        'raw.example.com': socketSite(tlsServer, marker),
+        'raw.example.com': socketSite('null', marker, start),
         'plain.example.com': REPORT_SITE
-    }, { certificates: ['plain.example.com'] });
+    }, { certificates: ['plain.example.com', 'raw.example.com'] });
     const raw = JSON.parse((await get(port, 'raw.example.com')).body);
     const plain = JSON.parse((await get(port, 'plain.example.com')).body);
     assert.notEqual(raw.pid, process.pid);
@@ -445,10 +449,31 @@ it('hands raw client sockets with their ClientHello to a socket site that termin
     assert.equal(isRunning(raw.pid), false);
 });
 
+it('issues a missing certificate through the main process when a socket site asks for it', { timeout: 20000 }, async t => {
+    const marker = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'roster-socket-site-')), 'closed');
+    t.after(() => fs.rmSync(path.dirname(marker), { recursive: true, force: true }));
+    const store = path.join(path.dirname(marker), 'greenlock.d');
+    const issued = [];
+    const start = `async start({ certificate }) {
+        server = require('https').createServer(await certificate('fresh.example.com'), (req, res) => module.exports.reply(req, res));
+    }`;
+    const { port } = await startProduction(t, { 'fresh.example.com': socketSite('null', marker, start) }, {
+        options: { greenlockStorePath: store },
+        issue: async ({ servername }) => {
+            issued.push(servername);
+            installCertificate(store, servername);
+        }
+    });
+    assert.deepEqual(issued, ['fresh.example.com']);
+    assert.notEqual(JSON.parse((await get(port, 'fresh.example.com')).body).pid, process.pid);
+});
+
 it('gives a socket site plain connections on its local port', { timeout: 20000 }, async t => {
     const marker = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'roster-socket-site-')), 'closed');
     t.after(() => fs.rmSync(path.dirname(marker), { recursive: true, force: true }));
-    const { wwwPath } = createWww(t, { 'raw.example': socketSite(`require('http').createServer()`, marker) });
+    const { wwwPath } = createWww(t, {
+        'raw.example': socketSite(`require('http').createServer((req, res) => module.exports.reply(req, res))`, marker)
+    });
     const roster = new Roster({ local: true, wwwPath, minLocalPort: 19370, maxLocalPort: 19379 });
     t.after(() => roster.close().catch(() => {}));
     await roster.start();