tosijs-ui 1.16.26 → 1.16.27

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.16.27
+
+### Deploy
+
+- **`tosijs-caddy-install --go` installs a Caddyfile Caddy can read** (affected: 1.10.0 to
+  1.16.26). It installed the file readable by root only, so a Caddy running as its own user
+  (Debian's package does) refused the reload. Caddy kept serving the old config, the new file
+  stayed on disk, and the bin said "Nothing was installed", so the next restart would have
+  taken down every site on the box. The file is now mode `640` with the group systemd runs
+  Caddy as, or `600` when Caddy runs as root; it holds both keys, so never world-readable.
+  **If you ran `--go` with an affected version, re-run it.**
+- **The installer starts a stopped Caddy** instead of failing to reload it, and if Caddy
+  refuses the new config it puts the previous one back and exits non-zero.
+- **The installer refuses a `PREVIEW_TOKEN`** containing anything but letters, digits, `-` and
+  `_`. It goes into the gate's cookie regex, where a `.` loosened the match.
+- **The preview gate matches a key cookie exactly** (affected: 1.9.0 to 1.16.26; the edit
+  cookie since 1.16.26). It matched by prefix, so `tosi_edit=<key>x` passed. That still
+  required the whole key, but the dev servers compare exactly and the gate now agrees with
+  them. Re-run the installer to pick it up.
+
 ## 1.16.26
 
 ### Tunnel

package/bin/caddy-install.ts

@@ -120,6 +120,12 @@ if [ ! -f /etc/caddy/preview.env ]; then
 fi
 set -a; . /etc/caddy/preview.env; set +a
 : "\${PREVIEW_TOKEN:?set PREVIEW_TOKEN in /etc/caddy/preview.env}"
+# It goes into a sed replacement and into the gate's cookie regex, where \`.\` would loosen the
+# match and \`|\` would break the substitution.
+if ! printf '%s' "$PREVIEW_TOKEN" | grep -qE '^[A-Za-z0-9_-]+$'; then
+  echo "PREVIEW_TOKEN may contain only letters, digits, - and _ — refusing to install." >&2
+  exit 1
+fi
 : "\${ACME_EMAIL:?set ACME_EMAIL in /etc/caddy/preview.env}"
 : "\${PREVIEW_DOMAIN:?set PREVIEW_DOMAIN in /etc/caddy/preview.env}"
 
@@ -155,12 +161,53 @@ caddy validate --config /etc/caddy/Caddyfile.new
 if [ "${go ? '1' : '0'}" = "1" ]; then
   # Keep the outgoing config. This replaces a file that may be serving OTHER sites, and
   # "validated" only means it parses — it does not mean it is the config you wanted.
+  had_config=0
   if [ -f /etc/caddy/Caddyfile ]; then
     cp -p /etc/caddy/Caddyfile /etc/caddy/Caddyfile.bak
+    had_config=1
+  fi
+  # Readable by the group Caddy runs as, and by nobody else: the file holds both keys.
+  # umask 077 left it root-only, and Debian's Caddy runs as its own user, so the reload failed
+  # reading it with the new file already in place (the maintainer's box, 1.16.26). Ask systemd
+  # who that is rather than guess; a Caddy run as root needs no group.
+  caddy_group=$(systemctl show -p Group --value caddy)
+  if [ -z "$caddy_group" ]; then
+    caddy_user=$(systemctl show -p User --value caddy)
+    if [ -n "$caddy_user" ] && [ "$caddy_user" != root ]; then
+      caddy_group=$(id -gn "$caddy_user")
+    fi
+  fi
+  if [ -n "$caddy_group" ]; then
+    chgrp "$caddy_group" /etc/caddy/Caddyfile.new
+    chmod 640 /etc/caddy/Caddyfile.new
+  else
+    chmod 600 /etc/caddy/Caddyfile.new
   fi
   mv /etc/caddy/Caddyfile.new /etc/caddy/Caddyfile
-  systemctl reload caddy
-  echo "Installed /etc/caddy/Caddyfile and reloaded caddy."
+  # A stopped Caddy cannot reload. Start it instead, or a box left down by the bug above could
+  # never be repaired by re-running this.
+  if systemctl is-active --quiet caddy; then
+    verb=reload
+  else
+    verb=start
+  fi
+  if ! systemctl "$verb" caddy; then
+    # A refused reload leaves Caddy serving what it had, but its next restart reads this file.
+    if [ "$had_config" = 1 ]; then
+      # Not \`cp -p\`: copying ONTO the installed file keeps its mode and group, and the
+      # previous file may be one an affected version left root-only.
+      cp /etc/caddy/Caddyfile.bak /etc/caddy/Caddyfile
+      echo "caddy refused to $verb with the new config; restored the previous /etc/caddy/Caddyfile." >&2
+    else
+      rm -f /etc/caddy/Caddyfile
+      echo "caddy refused to $verb with the new config; removed it." >&2
+    fi
+    if [ "$verb" = start ]; then
+      echo "caddy is not running. \`systemctl status caddy\` says why." >&2
+    fi
+    exit 1
+  fi
+  echo "Installed /etc/caddy/Caddyfile (caddy: $verb)."
   echo "Previous config saved as /etc/caddy/Caddyfile.bak"
 else
   echo "--- would change /etc/caddy/Caddyfile (token redacted) ---"

package/deploy/Caddyfile

@@ -84,9 +84,11 @@
 		redir * / 302
 	}
 
+	# Anchored at both ends: unanchored, `tosi_edit=<key>x` matched too. That needed the key
+	# anyway, but the dev servers compare exactly, and the gate should agree with them.
 	@unauthed {
-		not header_regexp Cookie "tosi_preview=__PREVIEW_TOKEN__"
-		not header_regexp Cookie "tosi_edit=__PREVIEW_EDIT_TOKEN__"
+		not header_regexp Cookie "(^|; *)tosi_preview=__PREVIEW_TOKEN__(;|$)"
+		not header_regexp Cookie "(^|; *)tosi_edit=__PREVIEW_EDIT_TOKEN__(;|$)"
 	}
 	handle @unauthed {
 		header Content-Type "text/html; charset=utf-8"