serverless-ircd 0.2.0 → 0.4.0

package/apps/cf-tcp-container/terraform/spectrum.tf

@@ -0,0 +1,81 @@
+###############################################################################
+# Cloudflare Spectrum config for the ServerlessIRCd TCP+TLS transport.
+#
+# Spectrum terminates TLS on port 6697 and forwards plaintext TCP to the
+# container origin. The origin is the Cloudflare Container (or external
+# compute) running the IRC core on port 6667.
+#
+# Usage:
+#   terraform init
+#   terraform apply \
+#     -var zone_id=YOUR_ZONE_ID \
+#     -var origin_address=container-origin.example.com \
+#     -var hostname=irc.example.com
+#
+# The `tls = "flexible"` mode means TLS is terminated by Spectrum and the
+# connection to the origin is plaintext (matching the container's plaintext
+# TCP listener). For mTLS passthrough (SASL EXTERNAL via client cert), set
+# `tls = "full"` and configure the origin to present its own certificate.
+###############################################################################
+
+variable "zone_id" {
+  type        = string
+  description = "Cloudflare zone ID for the domain (e.g. example.com)."
+}
+
+variable "origin_address" {
+  type        = string
+  description = "Hostname or IP of the TCP origin (CF Container or external compute)."
+}
+
+variable "origin_port" {
+  type        = number
+  default     = 6667
+  description = "Port the TCP origin listens on (plaintext IRC)."
+}
+
+variable "hostname" {
+  type        = string
+  default     = "irc.example.com"
+  description = "Public hostname clients connect to (irc+tls on :6697)."
+}
+
+variable "spectrum_port" {
+  type        = number
+  default     = 6697
+  description = "Public port Spectrum listens on (IRC-over-TLS)."
+}
+
+variable "tls_mode" {
+  type        = string
+  default     = "flexible"
+  description = "Spectrum TLS mode: flexible (TLS→CF, plain→origin) or full (TLS end-to-end)."
+
+  validation {
+    condition     = contains(["flexible", "full", "strict"], var.tls_mode)
+    error_message = "tls_mode must be one of: flexible, full, strict."
+  }
+}
+
+resource "cloudflare_spectrum_application" "irc_tls" {
+  zone_id  = var.zone_id
+  protocol = "tcp/${var.spectrum_port}"
+
+  dns {
+    type = "CNAME"
+    name = var.hostname
+  }
+
+  origin_dns {
+    name = var.origin_address
+  }
+
+  origin_port        = var.origin_port
+  tls                = var.tls_mode
+  ip_firewall        = true
+  argo_smart_routing = true
+
+  # PROXY protocol v1 forwards the real client IP to the origin so the
+  # container's admission gate (per-IP limits) sees the actual source.
+  proxy_protocol = "v1"
+}

package/apps/cf-tcp-container/tests/config-loader.test.ts

@@ -0,0 +1,217 @@
+import { describe, expect, it } from 'vitest';
+import { type ContainerConfigEnv, loadContainerConfig } from '../src/config-loader.js';
+
+describe('config-loader — IRC server config', () => {
+  it('parses required serverName and networkName', () => {
+    const cfg = loadContainerConfig({ SERVER_NAME: 'irc.example.com', NETWORK_NAME: 'ExampleNet' });
+    expect(cfg.server.serverName).toBe('irc.example.com');
+    expect(cfg.server.networkName).toBe('ExampleNet');
+  });
+
+  it('splits MOTD_LINES on newline', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      MOTD_LINES: 'line one\nline two\nline three',
+    });
+    expect(cfg.server.motdLines).toEqual(['line one', 'line two', 'line three']);
+  });
+
+  it('coerces numeric env vars', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      MAX_CHANNELS_PER_USER: '5',
+      NICK_LEN: '20',
+    });
+    expect(cfg.server.maxChannelsPerUser).toBe(5);
+    expect(cfg.server.nickLen).toBe(20);
+  });
+
+  it('parses SASL accounts from newline-delimited user:password', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SASL_ACCOUNTS: 'alice:secret\nbob:pass2',
+    });
+    expect(cfg.server.saslAccounts).toEqual([
+      { username: 'alice', password: 'secret' },
+      { username: 'bob', password: 'pass2' },
+    ]);
+  });
+
+  it('applies schema default serverName when unset', () => {
+    const cfg = loadContainerConfig({ NETWORK_NAME: 'TestNet' } as ContainerConfigEnv);
+    expect(cfg.server.serverName).toBe('irc.example.com');
+  });
+});
+
+describe('config-loader — container-specific knobs', () => {
+  it('defaults tcpPort to 6667', () => {
+    const cfg = loadContainerConfig({ SERVER_NAME: 'irc.test', NETWORK_NAME: 'TestNet' });
+    expect(cfg.tcpPort).toBe(6667);
+  });
+
+  it('defaults tcpHost to 0.0.0.0 (bind-all for Spectrum origin)', () => {
+    const cfg = loadContainerConfig({ SERVER_NAME: 'irc.test', NETWORK_NAME: 'TestNet' });
+    expect(cfg.tcpHost).toBe('0.0.0.0');
+  });
+
+  it('reads TCP_PORT override', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      TCP_PORT: '7000',
+    });
+    expect(cfg.tcpPort).toBe(7000);
+  });
+
+  it('reads TCP_HOST override', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      TCP_HOST: '127.0.0.1',
+    });
+    expect(cfg.tcpHost).toBe('127.0.0.1');
+  });
+
+  it('persistencePath is undefined when PERSISTENCE_PATH is unset', () => {
+    const cfg = loadContainerConfig({ SERVER_NAME: 'irc.test', NETWORK_NAME: 'TestNet' });
+    expect(cfg.persistencePath).toBeUndefined();
+  });
+
+  it('reads PERSISTENCE_PATH', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      PERSISTENCE_PATH: '/data/state.json',
+    });
+    expect(cfg.persistencePath).toBe('/data/state.json');
+  });
+
+  it('defaults snapshotIntervalMs to 60_000', () => {
+    const cfg = loadContainerConfig({ SERVER_NAME: 'irc.test', NETWORK_NAME: 'TestNet' });
+    expect(cfg.snapshotIntervalMs).toBe(60_000);
+  });
+
+  it('reads SNAPSHOT_INTERVAL_MS override', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SNAPSHOT_INTERVAL_MS: '5000',
+    });
+    expect(cfg.snapshotIntervalMs).toBe(5000);
+  });
+
+  it('passes through SERVER_VERSION, CREATED_AT, CHANNEL_PREFIXES, and QUIT_MESSAGE', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SERVER_VERSION: '2.0.0',
+      CREATED_AT: '1700000000000',
+      CHANNEL_PREFIXES: '#&',
+      QUIT_MESSAGE: 'Bye',
+    });
+    expect(cfg.server.serverVersion).toBe('2.0.0');
+    expect(cfg.server.createdAt).toBe(1_700_000_000_000);
+    expect(cfg.server.channelPrefixes).toBe('#&');
+    expect(cfg.server.quitMessage).toBe('Bye');
+  });
+
+  it('passes CREATED_AT string verbatim when non-numeric', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      CREATED_AT: 'a sunny day',
+    });
+    expect(cfg.server.createdAt).toBe('a sunny day');
+  });
+
+  it('coerces MAX_CLIENTS, MAX_TARGETS_PER_COMMAND, CHANNEL_LEN, TOPIC_LEN, MAX_LIST_ENTRIES', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      MAX_CLIENTS: '500',
+      MAX_TARGETS_PER_COMMAND: '3',
+      CHANNEL_LEN: '64',
+      TOPIC_LEN: '500',
+      MAX_LIST_ENTRIES: '10',
+    });
+    expect(cfg.server.maxClients).toBe(500);
+    expect(cfg.server.maxTargetsPerCommand).toBe(3);
+    expect(cfg.server.channelLen).toBe(64);
+    expect(cfg.server.topicLen).toBe(500);
+    expect(cfg.server.maxListEntries).toBe(10);
+  });
+
+  it('parses OPER_USER + OPER_PASSWORD into operCreds', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      OPER_USER: 'admin',
+      OPER_PASSWORD: 'secret',
+    });
+    expect(cfg.server.operCreds).toEqual([{ user: 'admin', password: 'secret' }]);
+  });
+
+  it('skips malformed SASL account lines', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SASL_ACCOUNTS: 'alice:secret\nbadline\n  \n:bobpass',
+    });
+    expect(cfg.server.saslAccounts).toEqual([{ username: 'alice', password: 'secret' }]);
+  });
+
+  it('defaults tcpPort when TCP_PORT is empty or invalid', () => {
+    const cfg1 = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      TCP_PORT: '',
+    });
+    expect(cfg1.tcpPort).toBe(6667);
+    const cfg2 = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      TCP_PORT: 'not-a-number',
+    });
+    expect(cfg2.tcpPort).toBe(6667);
+  });
+
+  it('defaults tcpHost when TCP_HOST is empty', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      TCP_HOST: '  ',
+    });
+    expect(cfg.tcpHost).toBe('0.0.0.0');
+  });
+
+  it('defaults snapshotIntervalMs when SNAPSHOT_INTERVAL_MS is invalid', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SNAPSHOT_INTERVAL_MS: 'abc',
+    });
+    expect(cfg.snapshotIntervalMs).toBe(60_000);
+  });
+
+  it('disables persistence when PERSISTENCE_PATH is empty', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      PERSISTENCE_PATH: '',
+    });
+    expect(cfg.persistencePath).toBeUndefined();
+  });
+
+  it('omits motdLines when MOTD_LINES is empty', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      MOTD_LINES: '',
+    });
+    // Schema default applies; just verify it doesn't crash.
+    expect(cfg.server.serverName).toBe('irc.test');
+  });
+});