unplugin-https-reverse-proxy 4.0.1 → 4.0.3

package/src/caddy/index.ts

@@ -14,6 +14,8 @@ import { chmodRecursive, consola, once } from '../utils'
 import { genCaddyfile, validateTemplateContext } from './caddyfile'
 import { useCaddyConfig } from './config'
 import { caddyFilePath, caddyLockFilePath, caddyPath, supportList, TEMP_DIR } from './constants'
+import { isCaddyReloadCancellation } from './log'
+import { formatTlsHealthFailure, waitForLocalTls } from './tls-health'
 import { kill, logProgress, logProgressOver, tryPort } from './utils'
 
 export async function download(): Promise<string> {
@@ -114,6 +116,19 @@ function getCaddyConfig(): ReturnType<typeof useCaddyConfig> {
   return caddyConfig
 }
 
+/** Split `host:port` (IPv4 or hostname); supports `[::1]:port`. */
+function splitHostPort(addr: string): { host: string, port: string } {
+  const lastColon = addr.lastIndexOf(':')
+  if (lastColon === -1)
+    return { host: addr, port: '' }
+  if (addr.startsWith('[')) {
+    const end = addr.indexOf(']')
+    if (end !== -1 && addr[end + 1] === ':')
+      return { host: addr.slice(1, end), port: addr.slice(end + 2) }
+  }
+  return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) }
+}
+
 export class CaddyInstant {
   private inited = false
   private stoped = false
@@ -174,12 +189,52 @@ export class CaddyInstant {
     this.inited = true
   }
 
+  private async ensureTlsReady(targetHost: string): Promise<void> {
+    const health = await waitForLocalTls(targetHost)
+    if (!health.healthy)
+      throw new Error(formatTlsHealthFailure(targetHost, health))
+  }
+
+  private async updateCaddyfile(): Promise<void> {
+    const { configJsonRef } = getCaddyConfig()
+    const proxies = Object.values(configJsonRef() || {})
+    const ctx = validateTemplateContext({
+      caddy_root: this.caddyRoot,
+      proxies,
+    })
+
+    this.caddyfile = await genCaddyfile(ctx)
+    await this.writeCaddyfile()
+  }
+
+  private async stopCaddy(): Promise<void> {
+    try {
+      await got.post('http://127.0.0.1:2019/stop', {
+        headers: {
+          Origin: 'http://localhost:2019',
+        },
+        retry: {
+          limit: 0,
+        },
+        timeout: {
+          request: 2000,
+        },
+      })
+    }
+    catch {}
+
+    this._caddyChild?.kill()
+  }
+
   /**
    * @param source like `127.0.0.1:8080`
    * @param target like `test.abc.com`. And if you provide a port ,it will be ignore.
    */
   async run(source: string, target: string, options?: Partial<RunOptions>): Promise<void> {
     source = source.replace('0.0.0.0', '127.0.0.1')
+    // Caddy dials the upstream host via DNS; `localhost` can hit lookup timeouts (VPN/DNS).
+    // Use loopback IP so the proxy never depends on resolving "localhost".
+    source = source.replace(/^localhost(?=:)/i, '127.0.0.1')
     const {
       restore = true,
       base = '/',
@@ -194,11 +249,11 @@ export class CaddyInstant {
     if (!this.inited)
       await this.init()
 
-    if (!await addHost(source.split(':')[0], target.split(':')[0]))
+    const sourceHost = splitHostPort(source).host
+    const targetHost = splitHostPort(target).host
+    if (!await addHost(sourceHost, targetHost))
       throw new Error('update host failed')
     consola.success('update host success\n')
-
-    const targetHost = target.split(':')[0]
     const normalizeBase = (b: string): string => {
       let out = b || '/'
       if (!out.startsWith('/'))
@@ -223,17 +278,17 @@ export class CaddyInstant {
     const { writeCaddyConfig } = getCaddyConfig()
     writeCaddyConfig(proxies)
 
-    this._stopEffects.push(
-      effect(async () => {
-        const { configJsonRef } = getCaddyConfig()
-        const proxies = Object.values(configJsonRef() || {})
-        const ctx = validateTemplateContext({
-          caddy_root: this.caddyRoot,
-          proxies,
-        })
+    await this.updateCaddyfile()
 
-        this.caddyfile = await genCaddyfile(ctx)
-        await this.writeCaddyfile()
+    let skipInitialCaddyfileEffect = true
+    this._stopEffects.push(
+      effect(() => {
+        getCaddyConfig().configJsonRef()
+        if (skipInitialCaddyfileEffect) {
+          skipInitialCaddyfileEffect = false
+          return
+        }
+        void this.updateCaddyfile()
       }),
     )
 
@@ -248,6 +303,25 @@ export class CaddyInstant {
     }
 
     return new Promise<void>((resolve, reject) => {
+      let startupCheckStarted = false
+
+      const resolveWhenReady = async (): Promise<void> => {
+        if (startupCheckStarted)
+          return
+        startupCheckStarted = true
+
+        try {
+          if (https)
+            await this.ensureTlsReady(targetHost)
+          resolve()
+        }
+        catch (error) {
+          if (!this.locked)
+            await this.baseCleanup(restore)
+          reject(error)
+        }
+      }
+
       const setupCleanup = (): void => {
         process.on('SIGINT', async () => {
           if (this.stoped)
@@ -270,7 +344,7 @@ export class CaddyInstant {
 
         // @ts-expect-error override
         process.exit = async (code?: number) => {
-          const port = Number(source.split(':')[1])
+          const port = Number(splitHostPort(source).port)
           if (!Number.isNaN(port) && await tryPort(port))
             await kill(port)
 
@@ -279,6 +353,9 @@ export class CaddyInstant {
           const viteCacheDir = `${pwd}/node_modules/.vite`
           if (existsSync(viteCacheDir))
             await chmodRecursive(viteCacheDir, 0o777).catch(() => { })
+          const viteTempCacheDir = `${pwd}/node_modules/.vite-temp`
+          if (existsSync(viteTempCacheDir))
+            await chmodRecursive(viteTempCacheDir, 0o777).catch(() => { })
           const nuxtCacheDir = `${pwd}/.nuxt`
           if (existsSync(nuxtCacheDir))
             await chmodRecursive(nuxtCacheDir, 0o777).catch(() => { })
@@ -321,6 +398,10 @@ export class CaddyInstant {
             // caddy log
             // eslint-disable-next-line no-console
             showCaddyLog && line && console.info(line)
+            if (isCaddyReloadCancellation(line)) {
+              consola.info('Caddy restarted before TLS issuance completed; retrying.\n')
+              continue
+            }
             try {
               if (line.includes('Error:') || (line && JSON.parse(line).level === 'error')) {
                 if (line.includes('parsing caddyfile tokens')) {
@@ -341,13 +422,13 @@ export class CaddyInstant {
               consola.success('Detect added a new reverse proxy config, restarted.\n')
 
             if (line.includes('caddy proxying') || line.includes('serving initial'))
-              return resolve()
+              void resolveWhenReady()
           }
         })
 
         this._caddyChild!.stdout?.on('data', (_data) => {
           consola.info(_data.toString())
-          resolve()
+          void resolveWhenReady()
         })
 
         setupCleanup()
@@ -355,9 +436,17 @@ export class CaddyInstant {
       else {
         consola.info('Caddy is running in another process.')
 
-        setupCleanup()
-
-        return resolve()
+        void (async () => {
+          try {
+            if (https)
+              await this.ensureTlsReady(targetHost)
+            setupCleanup()
+            resolve()
+          }
+          catch (error) {
+            reject(error)
+          }
+        })()
       }
     })
   }
@@ -367,7 +456,7 @@ export class CaddyInstant {
 
     try {
       if (restore && this._source && this._target) {
-        if (await removeHost(this._source.split(':')[0], this._target.split(':')[0]))
+        if (await removeHost(splitHostPort(this._source).host, splitHostPort(this._target).host))
           consola.success('Restore host success.\n')
 
         else
@@ -379,7 +468,7 @@ export class CaddyInstant {
       consola.fail('Restore host failed.\n')
     }
     if (!this.locked && !this.stoped) {
-      this._caddyChild?.kill()
+      await this.stopCaddy()
       try {
         await lockfile.unlock(caddyLockFilePath).catch(() => { })
         await unlink(caddyFilePath).catch(() => { })

package/src/caddy/log.ts

@@ -0,0 +1,16 @@
+interface CaddyLogEntry {
+  error?: unknown
+  logger?: unknown
+}
+
+export function isCaddyReloadCancellation(line: string): boolean {
+  try {
+    const entry = JSON.parse(line) as CaddyLogEntry
+    return entry.logger === 'tls'
+      && typeof entry.error === 'string'
+      && entry.error.endsWith('context canceled')
+  }
+  catch {
+    return false
+  }
+}

package/src/caddy/tls-health.ts

@@ -0,0 +1,142 @@
+import type { ConnectionOptions, PeerCertificate, TLSSocket } from 'node:tls'
+import { checkServerIdentity, connect } from 'node:tls'
+
+export type TlsHealthReason =
+  | 'certificate_expired'
+  | 'certificate_invalid'
+  | 'certificate_missing'
+  | 'connection_failed'
+  | 'hostname_mismatch'
+
+export type TlsHealthResult =
+  | {
+    healthy: true
+    expiresAt: Date
+  }
+  | {
+    healthy: false
+    reason: TlsHealthReason
+    expiresAt?: Date
+  }
+
+export type HostnameVerifier = (hostname: string, certificate: PeerCertificate) => Error | undefined
+
+type TlsConnector = (options: ConnectionOptions) => TLSSocket
+type TlsProbe = (hostname: string, options: ProbeLocalTlsOptions) => Promise<TlsHealthResult>
+type Sleep = (ms: number) => Promise<void>
+
+export function assessTlsCertificate(
+  certificate: PeerCertificate,
+  hostname: string,
+  now = Date.now(),
+  verifyHostname: HostnameVerifier = checkServerIdentity,
+): TlsHealthResult {
+  if (!certificate.valid_to)
+    return { healthy: false, reason: 'certificate_missing' }
+
+  const expiresAt = new Date(certificate.valid_to)
+  if (Number.isNaN(expiresAt.getTime()))
+    return { healthy: false, reason: 'certificate_invalid' }
+
+  if (expiresAt.getTime() <= now)
+    return { healthy: false, reason: 'certificate_expired', expiresAt }
+
+  try {
+    if (verifyHostname(hostname, certificate))
+      return { healthy: false, reason: 'hostname_mismatch' }
+  }
+  catch {
+    return { healthy: false, reason: 'certificate_invalid' }
+  }
+
+  return { healthy: true, expiresAt }
+}
+
+interface ProbeLocalTlsOptions {
+  connect?: TlsConnector
+  port?: number
+  timeoutMs?: number
+}
+
+export function probeLocalTls(hostname: string, options: ProbeLocalTlsOptions = {}): Promise<TlsHealthResult> {
+  const {
+    connect: openTlsConnection = connect,
+    port = 443,
+    timeoutMs = 1000,
+  } = options
+
+  return new Promise((resolve) => {
+    let settled = false
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    const socket = openTlsConnection({
+      host: '127.0.0.1',
+      port,
+      servername: hostname,
+      rejectUnauthorized: false,
+    })
+
+    const finish = (result: TlsHealthResult): void => {
+      if (settled)
+        return
+      settled = true
+      if (timeout)
+        clearTimeout(timeout)
+      socket.destroy()
+      resolve(result)
+    }
+
+    timeout = setTimeout(() => {
+      finish({ healthy: false, reason: 'connection_failed' })
+    }, timeoutMs)
+
+    socket.once('secureConnect', () => {
+      finish(assessTlsCertificate(socket.getPeerCertificate(), hostname))
+    })
+    socket.once('error', () => {
+      finish({ healthy: false, reason: 'connection_failed' })
+    })
+  })
+}
+
+interface WaitForLocalTlsOptions extends ProbeLocalTlsOptions {
+  probe?: TlsProbe
+  retryIntervalMs?: number
+  retryWindowMs?: number
+  sleep?: Sleep
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+export async function waitForLocalTls(hostname: string, options: WaitForLocalTlsOptions = {}): Promise<TlsHealthResult> {
+  const {
+    probe: checkTls = probeLocalTls,
+    retryIntervalMs = 250,
+    retryWindowMs = 30_000,
+    sleep: wait = sleep,
+    ...probeOptions
+  } = options
+  const deadline = Date.now() + retryWindowMs
+  let result: TlsHealthResult = { healthy: false, reason: 'connection_failed' }
+
+  do {
+    result = await checkTls(hostname, probeOptions)
+    if (result.healthy)
+      return result
+
+    const remaining = deadline - Date.now()
+    if (remaining > 0)
+      await wait(Math.min(retryIntervalMs, remaining))
+  } while (Date.now() < deadline)
+
+  return result
+}
+
+export function formatTlsHealthFailure(hostname: string, result: Exclude<TlsHealthResult, { healthy: true }>): string {
+  const reason = result.reason === 'certificate_expired' && result.expiresAt
+    ? `the certificate expired at ${result.expiresAt.toISOString()}`
+    : result.reason.replaceAll('_', ' ')
+
+  return `[unplugin-https-reverse-proxy] Caddy cannot serve valid HTTPS for ${hostname}: ${reason}. Restart Caddy to retry its automatic certificate renewal. Do not remove Caddy PKI data automatically because that replaces the trusted local root certificate.`
+}