unplugin-https-reverse-proxy 4.0.4 → 4.1.0-beta.2

package/src/privileged-helper.ts

@@ -0,0 +1,109 @@
+import process from 'node:process'
+import { startHelper } from './privileged/bootstrap'
+
+interface ParsedArgs {
+  socket: string
+  token: string
+  hosts?: string
+  caddyBin: string
+  caddyConfig: string
+  ownerUid?: number
+  ownerGid?: number
+  caddyStorage?: string
+}
+
+function parseArgs(argv: string[]): ParsedArgs {
+  let socket = ''
+  let token = ''
+  let hosts: string | undefined
+  let caddyBin = ''
+  let caddyConfig = ''
+  let ownerUid: number | undefined
+  let ownerGid: number | undefined
+  let caddyStorage: string | undefined
+
+  for (let index = 0; index < argv.length; index++) {
+    const current = argv[index]
+    if (current === '--socket')
+      socket = argv[++index] ?? ''
+    else if (current === '--token')
+      token = argv[++index] ?? ''
+    else if (current === '--hosts')
+      hosts = argv[++index] ?? undefined
+    else if (current === '--caddy')
+      caddyBin = argv[++index] ?? ''
+    else if (current === '--caddy-config')
+      caddyConfig = argv[++index] ?? ''
+    else if (current === '--owner-uid')
+      ownerUid = Number(argv[++index])
+    else if (current === '--owner-gid')
+      ownerGid = Number(argv[++index])
+    else if (current === '--caddy-storage')
+      caddyStorage = argv[++index] ?? undefined
+  }
+
+  if (!socket || !token)
+    throw new Error('usage: privileged-helper --socket <path> --token <token> --caddy <bin> --caddy-config <path>')
+  if (!caddyBin || !caddyConfig)
+    throw new Error('privileged-helper requires --caddy and --caddy-config')
+
+  return {
+    socket,
+    token,
+    hosts,
+    caddyBin,
+    caddyConfig,
+    ownerUid: Number.isInteger(ownerUid) ? ownerUid : undefined,
+    ownerGid: Number.isInteger(ownerGid) ? ownerGid : undefined,
+    caddyStorage,
+  }
+}
+
+/**
+ * Entry point of the process that runs with elevated privileges.
+ *
+ * It owns no product logic. The Caddy binary and Caddyfile are fixed on the
+ * command line, so requests on the socket can only say *when* to act, never
+ * what* to execute.
+ */
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2))
+
+  const helper = await startHelper({
+    socketPath: args.socket,
+    token: args.token,
+    hostsPath: args.hosts,
+    caddyBin: args.caddyBin,
+    caddyConfigPath: args.caddyConfig,
+    ownerUid: args.ownerUid,
+    ownerGid: args.ownerGid,
+    caddyStoragePath: args.caddyStorage,
+    caddyEnv: {
+      HOME: process.env.HOME ?? '',
+      // Keep Caddy's storage next to the invoking user's home even though the
+      // process runs as root.
+      XDG_DATA_HOME: process.env.XDG_DATA_HOME ?? '',
+    },
+  })
+
+  // Ctrl+C is delivered to the whole foreground process group. The plugin also
+  // receives it and will drop the socket, which is the signal this helper acts
+  // on; exiting here would race that cleanup.
+  process.on('SIGINT', () => {})
+
+  const shutdown = (): void => {
+    void helper.runtime.dispose().finally(() => process.exit(0))
+  }
+
+  process.on('SIGTERM', shutdown)
+  process.on('SIGHUP', shutdown)
+
+  // A closed stdout (the parent died) must not interrupt the cleanup path.
+  process.stdout.on('error', () => {})
+  process.stderr.on('error', () => {})
+}
+
+main().catch((error: Error) => {
+  process.stderr.write(`[uhrp-helper] fatal: ${error.message}\n`)
+  process.exit(1)
+})

package/src/utils.ts

@@ -1,8 +1,4 @@
-import { execSync } from 'node:child_process'
-import { chmod, readdir, stat } from 'node:fs/promises'
 import { networkInterfaces } from 'node:os'
-import path from 'node:path'
-import process from 'node:process'
 import { createConsola } from 'consola'
 import c from 'picocolors'
 import qrcode from 'qrcode-terminal'
@@ -11,15 +7,6 @@ export const consola = createConsola({
   level: 3,
 }).withTag('reverse-proxy')
 
-export async function chmodRecursive(_path: string, mode: number): Promise<void> {
-  await chmod(_path, mode)
-  if ((await stat(_path)).isDirectory()) {
-    const children = await readdir(_path)
-    for (const child of children)
-      await chmodRecursive(path.join(_path, child), mode)
-  }
-}
-
 export function once<T extends (...args: any[]) => any>(fn: T): (...args: Parameters<T>) => ReturnType<T> {
   let called = false
   return (...args: any[]) => {
@@ -30,21 +17,6 @@ export function once<T extends (...args: any[]) => any>(fn: T): (...args: Parame
   }
 }
 
-export function isAdmin(): boolean {
-  if (process.platform === 'win32') {
-    try {
-      execSync('net session', { stdio: 'ignore' })
-      return true
-    }
-    catch {
-      return false
-    }
-  }
-  else {
-    return !!(process.getuid && process.getuid() === 0)
-  }
-}
-
 export function getIpv4List(): string[] {
   const interfaces = networkInterfaces()
 

package/src/host/index.ts

@@ -1,52 +0,0 @@
-import { exec } from 'node:child_process'
-import { chmodSync } from 'node:fs'
-import process from 'node:process'
-import { promisify } from 'node:util'
-
-import hostile from 'hostile'
-import { consola } from '../utils'
-
-const _setHost = promisify(hostile.set)
-const _removeHost = promisify(hostile.remove)
-
-function getPathOfSystemHostsPath(): string {
-  return process.platform === 'win32'
-    ? `${process.env.windir || 'C:\\WINDOWS'}\\system32\\drivers\\etc\\hosts`
-    : '/etc/hosts'
-}
-
-async function syncHost(): Promise<boolean> {
-  return new Promise<boolean>((resolve, _reject) => {
-    exec(
-      process.platform === 'win32'
-        ? 'ipconfig /flushdns'
-        : 'sudo -E killall -HUP mDNSResponder',
-      (error, _stdout, _stderr) => {
-        if (error) {
-          consola.error(`exec error: ${error}`)
-          return resolve(false)
-        }
-        return resolve(true)
-      },
-    )
-  })
-}
-
-export async function addHost(ip: string, host: string): Promise<boolean> {
-  if (process.platform !== 'win32')
-    chmodSync(getPathOfSystemHostsPath(), 0o777)
-  await _setHost('127.0.0.1', 'localhost')
-  await _setHost(ip, host)
-  if (ip === 'localhost')
-    await _setHost('127.0.0.1', host)
-  return await syncHost()
-}
-
-export async function removeHost(ip: string, host: string): Promise<boolean> {
-  if (process.platform !== 'win32')
-    chmodSync(getPathOfSystemHostsPath(), 0o777)
-  await _removeHost(ip, host)
-  if (ip === 'localhost')
-    await _removeHost('127.0.0.1', host)
-  return await syncHost()
-}