mirror of
https://github.com/therootcompany/greenlock-express.js.git
synced 2025-03-13 20:10:40 +00:00
Compare commits
No commits in common. "v1.1.2" and "master" have entirely different histories.
20
.gitignore
vendored
20
.gitignore
vendored
@ -1,6 +1,13 @@
|
||||
app.js
|
||||
server.js
|
||||
greenlock.js
|
||||
.greenlockrc
|
||||
|
||||
# Logs
|
||||
logs
|
||||
*.log
|
||||
npm-debug.log*
|
||||
.vscode
|
||||
|
||||
# Runtime data
|
||||
pids
|
||||
@ -13,6 +20,9 @@ lib-cov
|
||||
# Coverage directory used by tools like istanbul
|
||||
coverage
|
||||
|
||||
# nyc test coverage
|
||||
.nyc_output
|
||||
|
||||
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
|
||||
.grunt
|
||||
|
||||
@ -22,6 +32,12 @@ coverage
|
||||
# Compiled binary addons (http://nodejs.org/api/addons.html)
|
||||
build/Release
|
||||
|
||||
# Dependency directory
|
||||
# https://www.npmjs.org/doc/misc/npm-faq.html#should-i-check-my-node_modules-folder-into-git
|
||||
# Dependency directories
|
||||
node_modules
|
||||
jspm_packages
|
||||
|
||||
# Optional npm cache directory
|
||||
.npm
|
||||
|
||||
# Optional REPL history
|
||||
.node_repl_history
|
||||
|
||||
7
.prettierrc
Normal file
7
.prettierrc
Normal file
@ -0,0 +1,7 @@
|
||||
{
|
||||
"bracketSpacing": true,
|
||||
"printWidth": 120,
|
||||
"tabWidth": 4,
|
||||
"trailingComma": "none",
|
||||
"useTabs": false
|
||||
}
|
||||
511
LICENSE
511
LICENSE
@ -1,202 +1,375 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
Copyright 2015-2019 AJ ONeal
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
Mozilla Public License Version 2.0
|
||||
==================================
|
||||
|
||||
1. Definitions.
|
||||
1. Definitions
|
||||
--------------
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
1.1. "Contributor"
|
||||
means each individual or legal entity that creates, contributes to
|
||||
the creation of, or owns Covered Software.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
1.2. "Contributor Version"
|
||||
means the combination of the Contributions of others (if any) used
|
||||
by a Contributor and that particular Contributor's Contribution.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
1.3. "Contribution"
|
||||
means Covered Software of a particular Contributor.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
1.4. "Covered Software"
|
||||
means Source Code Form to which the initial Contributor has attached
|
||||
the notice in Exhibit A, the Executable Form of such Source Code
|
||||
Form, and Modifications of such Source Code Form, in each case
|
||||
including portions thereof.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
1.5. "Incompatible With Secondary Licenses"
|
||||
means
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
(a) that the initial Contributor has attached the notice described
|
||||
in Exhibit B to the Covered Software; or
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
(b) that the Covered Software was made available under the terms of
|
||||
version 1.1 or earlier of the License, but not also under the
|
||||
terms of a Secondary License.
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
1.6. "Executable Form"
|
||||
means any form of the work other than Source Code Form.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
1.7. "Larger Work"
|
||||
means a work that combines Covered Software with other material, in
|
||||
a separate file or files, that is not Covered Software.
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
1.8. "License"
|
||||
means this document.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
1.9. "Licensable"
|
||||
means having the right to grant, to the maximum extent possible,
|
||||
whether at the time of the initial grant or subsequently, any and
|
||||
all of the rights conveyed by this License.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
1.10. "Modifications"
|
||||
means any of the following:
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
(a) any file in Source Code Form that results from an addition to,
|
||||
deletion from, or modification of the contents of Covered
|
||||
Software; or
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
(b) any new file in Source Code Form that contains any Covered
|
||||
Software.
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
1.11. "Patent Claims" of a Contributor
|
||||
means any patent claim(s), including without limitation, method,
|
||||
process, and apparatus claims, in any patent Licensable by such
|
||||
Contributor that would be infringed, but for the grant of the
|
||||
License, by the making, using, selling, offering for sale, having
|
||||
made, import, or transfer of either its Contributions or its
|
||||
Contributor Version.
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
1.12. "Secondary License"
|
||||
means either the GNU General Public License, Version 2.0, the GNU
|
||||
Lesser General Public License, Version 2.1, the GNU Affero General
|
||||
Public License, Version 3.0, or any later versions of those
|
||||
licenses.
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
1.13. "Source Code Form"
|
||||
means the form of the work preferred for making modifications.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
1.14. "You" (or "Your")
|
||||
means an individual or a legal entity exercising rights under this
|
||||
License. For legal entities, "You" includes any entity that
|
||||
controls, is controlled by, or is under common control with You. For
|
||||
purposes of this definition, "control" means (a) the power, direct
|
||||
or indirect, to cause the direction or management of such entity,
|
||||
whether by contract or otherwise, or (b) ownership of more than
|
||||
fifty percent (50%) of the outstanding shares or beneficial
|
||||
ownership of such entity.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
2. License Grants and Conditions
|
||||
--------------------------------
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
2.1. Grants
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
Each Contributor hereby grants You a world-wide, royalty-free,
|
||||
non-exclusive license:
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
(a) under intellectual property rights (other than patent or trademark)
|
||||
Licensable by such Contributor to use, reproduce, make available,
|
||||
modify, display, perform, distribute, and otherwise exploit its
|
||||
Contributions, either on an unmodified basis, with Modifications, or
|
||||
as part of a Larger Work; and
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
(b) under Patent Claims of such Contributor to make, use, sell, offer
|
||||
for sale, have made, import, and otherwise transfer either its
|
||||
Contributions or its Contributor Version.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
2.2. Effective Date
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
The licenses granted in Section 2.1 with respect to any Contribution
|
||||
become effective for each Contribution on the date the Contributor first
|
||||
distributes such Contribution.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
2.3. Limitations on Grant Scope
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
The licenses granted in this Section 2 are the only rights granted under
|
||||
this License. No additional rights or licenses will be implied from the
|
||||
distribution or licensing of Covered Software under this License.
|
||||
Notwithstanding Section 2.1(b) above, no patent license is granted by a
|
||||
Contributor:
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
(a) for any code that a Contributor has removed from Covered Software;
|
||||
or
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
(b) for infringements caused by: (i) Your and any other third party's
|
||||
modifications of Covered Software, or (ii) the combination of its
|
||||
Contributions with other software (except as part of its Contributor
|
||||
Version); or
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
(c) under Patent Claims infringed by Covered Software in the absence of
|
||||
its Contributions.
|
||||
|
||||
This License does not grant any rights in the trademarks, service marks,
|
||||
or logos of any Contributor (except as may be necessary to comply with
|
||||
the notice requirements in Section 3.4).
|
||||
|
||||
2.4. Subsequent Licenses
|
||||
|
||||
No Contributor makes additional grants as a result of Your choice to
|
||||
distribute the Covered Software under a subsequent version of this
|
||||
License (see Section 10.2) or under the terms of a Secondary License (if
|
||||
permitted under the terms of Section 3.3).
|
||||
|
||||
2.5. Representation
|
||||
|
||||
Each Contributor represents that the Contributor believes its
|
||||
Contributions are its original creation(s) or it has sufficient rights
|
||||
to grant the rights to its Contributions conveyed by this License.
|
||||
|
||||
2.6. Fair Use
|
||||
|
||||
This License is not intended to limit any rights You have under
|
||||
applicable copyright doctrines of fair use, fair dealing, or other
|
||||
equivalents.
|
||||
|
||||
2.7. Conditions
|
||||
|
||||
Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
|
||||
in Section 2.1.
|
||||
|
||||
3. Responsibilities
|
||||
-------------------
|
||||
|
||||
3.1. Distribution of Source Form
|
||||
|
||||
All distribution of Covered Software in Source Code Form, including any
|
||||
Modifications that You create or to which You contribute, must be under
|
||||
the terms of this License. You must inform recipients that the Source
|
||||
Code Form of the Covered Software is governed by the terms of this
|
||||
License, and how they can obtain a copy of this License. You may not
|
||||
attempt to alter or restrict the recipients' rights in the Source Code
|
||||
Form.
|
||||
|
||||
3.2. Distribution of Executable Form
|
||||
|
||||
If You distribute Covered Software in Executable Form then:
|
||||
|
||||
(a) such Covered Software must also be made available in Source Code
|
||||
Form, as described in Section 3.1, and You must inform recipients of
|
||||
the Executable Form how they can obtain a copy of such Source Code
|
||||
Form by reasonable means in a timely manner, at a charge no more
|
||||
than the cost of distribution to the recipient; and
|
||||
|
||||
(b) You may distribute such Executable Form under the terms of this
|
||||
License, or sublicense it under different terms, provided that the
|
||||
license for the Executable Form does not attempt to limit or alter
|
||||
the recipients' rights in the Source Code Form under this License.
|
||||
|
||||
3.3. Distribution of a Larger Work
|
||||
|
||||
You may create and distribute a Larger Work under terms of Your choice,
|
||||
provided that You also comply with the requirements of this License for
|
||||
the Covered Software. If the Larger Work is a combination of Covered
|
||||
Software with a work governed by one or more Secondary Licenses, and the
|
||||
Covered Software is not Incompatible With Secondary Licenses, this
|
||||
License permits You to additionally distribute such Covered Software
|
||||
under the terms of such Secondary License(s), so that the recipient of
|
||||
the Larger Work may, at their option, further distribute the Covered
|
||||
Software under the terms of either this License or such Secondary
|
||||
License(s).
|
||||
|
||||
3.4. Notices
|
||||
|
||||
You may not remove or alter the substance of any license notices
|
||||
(including copyright notices, patent notices, disclaimers of warranty,
|
||||
or limitations of liability) contained within the Source Code Form of
|
||||
the Covered Software, except that You may alter any license notices to
|
||||
the extent required to remedy known factual inaccuracies.
|
||||
|
||||
3.5. Application of Additional Terms
|
||||
|
||||
You may choose to offer, and to charge a fee for, warranty, support,
|
||||
indemnity or liability obligations to one or more recipients of Covered
|
||||
Software. However, You may do so only on Your own behalf, and not on
|
||||
behalf of any Contributor. You must make it absolutely clear that any
|
||||
such warranty, support, indemnity, or liability obligation is offered by
|
||||
You alone, and You hereby agree to indemnify every Contributor for any
|
||||
liability incurred by such Contributor as a result of warranty, support,
|
||||
indemnity or liability terms You offer. You may include additional
|
||||
disclaimers of warranty and limitations of liability specific to any
|
||||
jurisdiction.
|
||||
|
||||
4. Inability to Comply Due to Statute or Regulation
|
||||
---------------------------------------------------
|
||||
|
||||
If it is impossible for You to comply with any of the terms of this
|
||||
License with respect to some or all of the Covered Software due to
|
||||
statute, judicial order, or regulation then You must: (a) comply with
|
||||
the terms of this License to the maximum extent possible; and (b)
|
||||
describe the limitations and the code they affect. Such description must
|
||||
be placed in a text file included with all distributions of the Covered
|
||||
Software under this License. Except to the extent prohibited by statute
|
||||
or regulation, such description must be sufficiently detailed for a
|
||||
recipient of ordinary skill to be able to understand it.
|
||||
|
||||
5. Termination
|
||||
--------------
|
||||
|
||||
5.1. The rights granted under this License will terminate automatically
|
||||
if You fail to comply with any of its terms. However, if You become
|
||||
compliant, then the rights granted under this License from a particular
|
||||
Contributor are reinstated (a) provisionally, unless and until such
|
||||
Contributor explicitly and finally terminates Your grants, and (b) on an
|
||||
ongoing basis, if such Contributor fails to notify You of the
|
||||
non-compliance by some reasonable means prior to 60 days after You have
|
||||
come back into compliance. Moreover, Your grants from a particular
|
||||
Contributor are reinstated on an ongoing basis if such Contributor
|
||||
notifies You of the non-compliance by some reasonable means, this is the
|
||||
first time You have received notice of non-compliance with this License
|
||||
from such Contributor, and You become compliant prior to 30 days after
|
||||
Your receipt of the notice.
|
||||
|
||||
5.2. If You initiate litigation against any entity by asserting a patent
|
||||
infringement claim (excluding declaratory judgment actions,
|
||||
counter-claims, and cross-claims) alleging that a Contributor Version
|
||||
directly or indirectly infringes any patent, then the rights granted to
|
||||
You by any and all Contributors for the Covered Software under Section
|
||||
2.1 of this License shall terminate.
|
||||
|
||||
5.3. In the event of termination under Sections 5.1 or 5.2 above, all
|
||||
end user license agreements (excluding distributors and resellers) which
|
||||
have been validly granted by You or Your distributors under this License
|
||||
prior to termination shall survive termination.
|
||||
|
||||
************************************************************************
|
||||
* *
|
||||
* 6. Disclaimer of Warranty *
|
||||
* ------------------------- *
|
||||
* *
|
||||
* Covered Software is provided under this License on an "as is" *
|
||||
* basis, without warranty of any kind, either expressed, implied, or *
|
||||
* statutory, including, without limitation, warranties that the *
|
||||
* Covered Software is free of defects, merchantable, fit for a *
|
||||
* particular purpose or non-infringing. The entire risk as to the *
|
||||
* quality and performance of the Covered Software is with You. *
|
||||
* Should any Covered Software prove defective in any respect, You *
|
||||
* (not any Contributor) assume the cost of any necessary servicing, *
|
||||
* repair, or correction. This disclaimer of warranty constitutes an *
|
||||
* essential part of this License. No use of any Covered Software is *
|
||||
* authorized under this License except under this disclaimer. *
|
||||
* *
|
||||
************************************************************************
|
||||
|
||||
************************************************************************
|
||||
* *
|
||||
* 7. Limitation of Liability *
|
||||
* -------------------------- *
|
||||
* *
|
||||
* Under no circumstances and under no legal theory, whether tort *
|
||||
* (including negligence), contract, or otherwise, shall any *
|
||||
* Contributor, or anyone who distributes Covered Software as *
|
||||
* permitted above, be liable to You for any direct, indirect, *
|
||||
* special, incidental, or consequential damages of any character *
|
||||
* including, without limitation, damages for lost profits, loss of *
|
||||
* goodwill, work stoppage, computer failure or malfunction, or any *
|
||||
* and all other commercial damages or losses, even if such party *
|
||||
* shall have been informed of the possibility of such damages. This *
|
||||
* limitation of liability shall not apply to liability for death or *
|
||||
* personal injury resulting from such party's negligence to the *
|
||||
* extent applicable law prohibits such limitation. Some *
|
||||
* jurisdictions do not allow the exclusion or limitation of *
|
||||
* incidental or consequential damages, so this exclusion and *
|
||||
* limitation may not apply to You. *
|
||||
* *
|
||||
************************************************************************
|
||||
|
||||
8. Litigation
|
||||
-------------
|
||||
|
||||
Any litigation relating to this License may be brought only in the
|
||||
courts of a jurisdiction where the defendant maintains its principal
|
||||
place of business and such litigation shall be governed by laws of that
|
||||
jurisdiction, without reference to its conflict-of-law provisions.
|
||||
Nothing in this Section shall prevent a party's ability to bring
|
||||
cross-claims or counter-claims.
|
||||
|
||||
9. Miscellaneous
|
||||
----------------
|
||||
|
||||
This License represents the complete agreement concerning the subject
|
||||
matter hereof. If any provision of this License is held to be
|
||||
unenforceable, such provision shall be reformed only to the extent
|
||||
necessary to make it enforceable. Any law or regulation which provides
|
||||
that the language of a contract shall be construed against the drafter
|
||||
shall not be used to construe this License against a Contributor.
|
||||
|
||||
10. Versions of the License
|
||||
---------------------------
|
||||
|
||||
10.1. New Versions
|
||||
|
||||
Mozilla Foundation is the license steward. Except as provided in Section
|
||||
10.3, no one other than the license steward has the right to modify or
|
||||
publish new versions of this License. Each version will be given a
|
||||
distinguishing version number.
|
||||
|
||||
10.2. Effect of New Versions
|
||||
|
||||
You may distribute the Covered Software under the terms of the version
|
||||
of the License under which You originally received the Covered Software,
|
||||
or under the terms of any subsequent version published by the license
|
||||
steward.
|
||||
|
||||
10.3. Modified Versions
|
||||
|
||||
If you create software not governed by this License, and you want to
|
||||
create a new license for such software, you may create and use a
|
||||
modified version of this License if you rename the license and remove
|
||||
any references to the name of the license steward (except to note that
|
||||
such modified license differs from this License).
|
||||
|
||||
10.4. Distributing Source Code Form that is Incompatible With Secondary
|
||||
Licenses
|
||||
|
||||
If You choose to distribute Source Code Form that is Incompatible With
|
||||
Secondary Licenses under the terms of this version of the License, the
|
||||
notice described in Exhibit B of this License must be attached.
|
||||
|
||||
Exhibit A - Source Code Form License Notice
|
||||
-------------------------------------------
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
If it is not possible or desirable to put the notice in a particular
|
||||
file, then You may include the notice in a location (such as a LICENSE
|
||||
file in a relevant directory) where a recipient would be likely to look
|
||||
for such a notice.
|
||||
|
||||
You may add additional accurate notices of copyright ownership.
|
||||
|
||||
Exhibit B - "Incompatible With Secondary Licenses" Notice
|
||||
---------------------------------------------------------
|
||||
|
||||
This Source Code Form is "Incompatible With Secondary Licenses", as
|
||||
defined by the Mozilla Public License, v. 2.0.
|
||||
|
||||
807
README.md
807
README.md
@ -1,439 +1,536 @@
|
||||
# LetsEncrypt Express
|
||||
# [Greenlock Express v4](https://git.rootprojects.org/root/greenlock-express.js) is Let's Encrypt for Node
|
||||
|
||||
Free SSL and managed or automatic HTTPS for node.js with Express, Koa, Connect, Hapi, and all other middleware systems.
|
||||
| Built by [Root](https://therootcompany.com) for [Hub](https://rootprojects.org/hub/) |
|
||||
|
||||
* Automatic Registration via SNI (`httpsOptions.SNICallback`)
|
||||
* **registrations** require an **approval callback** in *production*
|
||||
* Automatic Renewal (around 80 days)
|
||||
* **renewals** are *fully automatic* and happen in the *background*, with **no downtime**
|
||||
* Automatic vhost / virtual hosting
|
||||
|
||||
|
||||
All you have to do is start the webserver and then visit it at it's domain name.
|
||||
### Free SSL for Node Web Servers
|
||||
|
||||
## Install
|
||||
Greenlock Express is a **Web Server** with **Fully Automated HTTPS** and renewals.
|
||||
|
||||
```
|
||||
npm install --save letsencrypt-express
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
* standalone
|
||||
* express
|
||||
* http / https
|
||||
* http / http2
|
||||
* koa
|
||||
|
||||
### Setup (same for all examples)
|
||||
|
||||
```javascript
|
||||
'use strict';
|
||||
|
||||
/* Note: using staging server url, remove .testing() for production
|
||||
Using .testing() will overwrite the debug flag with true */
|
||||
var LEX = require('letsencrypt-express').testing();
|
||||
|
||||
var lex = LEX.create({
|
||||
configDir: require('os').homedir() + '/letsencrypt/etc'
|
||||
, approveRegistration: function (hostname, cb) { // leave `null` to disable automatic registration
|
||||
// Note: this is the place to check your database to get the user associated with this domain
|
||||
cb(null, {
|
||||
domains: [hostname]
|
||||
, email: 'CHANGE_ME' // user@example.com
|
||||
, agreeTos: true
|
||||
});
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
WARNING: If you don't do any checks and simply complete `approveRegistration` callback, an attacker will spoof SNI packets with bad hostnames and that will cause you to be rate-limited and or blocked from the ACME server. Alternatively, You can run registration *manually*:
|
||||
You define your app and let Greenlock handle issuing and renewing Free SSL Certificates.
|
||||
|
||||
```bash
|
||||
npm install -g letsencrypt-cli
|
||||
|
||||
letsencrypt certonly --standalone \
|
||||
--config-dir ~/letsencrypt/etc \
|
||||
--agree-tos --domains example.com --email user@example.com
|
||||
|
||||
# Note: the '--webrootPath' option is also available if you don't want to shut down your webserver to get the cert.
|
||||
npm init
|
||||
npm install --save greenlock-express@v4
|
||||
```
|
||||
|
||||
### Standalone
|
||||
`server.js`:
|
||||
|
||||
```javascript
|
||||
lex.onRequest = function (req, res) {
|
||||
res.end('Hello, World!');
|
||||
```js
|
||||
"use strict";
|
||||
|
||||
var app = require("./app.js");
|
||||
|
||||
require("greenlock-express")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
// contact for security and critical bug notices
|
||||
maintainerEmail: "jon@example.com",
|
||||
|
||||
// whether or not to run at cloudscale
|
||||
cluster: false
|
||||
})
|
||||
// Serves on 80 and 443
|
||||
// Get's SSL certificates magically!
|
||||
.serve(app);
|
||||
```
|
||||
|
||||
`./greenlock.d/config.json`:
|
||||
|
||||
```json
|
||||
{ "sites": [{ "subject": "example.com", "altnames": ["example.com"] }] }
|
||||
```
|
||||
|
||||
# Let's Encrypt for...
|
||||
|
||||
- IoT
|
||||
- Enterprise On-Prem
|
||||
- Local Development
|
||||
- Home Servers
|
||||
- Quitting Heroku
|
||||
|
||||
# Features
|
||||
|
||||
- [x] Let's Encrypt v2 (November 2019)
|
||||
- [x] ACME Protocol (RFC 8555)
|
||||
- [x] HTTP Validation (HTTP-01)
|
||||
- [x] DNS Validation (DNS-01)
|
||||
- [ ] ALPN Validation (TLS-ALPN-01)
|
||||
- Need ALPN validation? [contact us](mailto:greenlock-support@therootcompany.com)
|
||||
- [x] Automated HTTPS
|
||||
- [x] Fully Automatic Renewals every 45 days
|
||||
- [x] Free SSL
|
||||
- [x] **Wildcard** SSL
|
||||
- [x] **Localhost** certificates
|
||||
- [x] HTTPS-enabled Secure **WebSockets** (`wss://`)
|
||||
- [x] **Cloud-ready** with Node `cluster`.
|
||||
- [x] Fully customizable
|
||||
- [x] **Reasonable defaults**
|
||||
- [x] Domain Management
|
||||
- [x] Key and Certificate Management
|
||||
- [x] ACME Challenge Plugins
|
||||
|
||||
# Compatibility
|
||||
|
||||
Works with _any_ node http app, including
|
||||
|
||||
- [x] Express
|
||||
- [x] Koa
|
||||
- [x] hapi
|
||||
- [x] rill
|
||||
- [x] http2
|
||||
- [x] cluster
|
||||
- [x] etc...
|
||||
|
||||
# v4 QuickStart
|
||||
|
||||
Serving sites with Free SSL is as easy as 1, 2, 3... 4
|
||||
|
||||
## Overview
|
||||
|
||||
1. Create a Project with Greenlock Express
|
||||
- `server.js`
|
||||
- `app.js`
|
||||
2. Setup the config file (or database)
|
||||
- `.greenlockrc`
|
||||
- `greenlock.d/config.json`
|
||||
3. Add Domains
|
||||
- `npx greenlock add --subject example.com --altnames example.com`
|
||||
4. Hello, World!
|
||||
- `npm start -- --staging`
|
||||
|
||||
### TL;DR
|
||||
|
||||
If you're familiar with node, npm, and npx: this is all you need to do:
|
||||
|
||||
```bash
|
||||
npm init
|
||||
npm install --save greenlock-express@v4
|
||||
|
||||
npx greenlock init --config-dir greenlock.d --maintainer-email jon@example.com
|
||||
npx greenlock add --subject example.com --altnames example.com
|
||||
|
||||
npm start -- --staging
|
||||
```
|
||||
|
||||
Once you've tested that that works, you can change `app.js` to suit your needs replace the built-in callbacks for things like certificate storage as you like.
|
||||
|
||||
## 1. Create your Project
|
||||
|
||||
If you need to install Node.js, do so:
|
||||
|
||||
Mac, Linux:
|
||||
|
||||
```bash
|
||||
curl -fsS https://webinstall.dev/node | bash
|
||||
```
|
||||
|
||||
Windows 10:
|
||||
|
||||
```pwsh
|
||||
curl -fsSA "MS" https://webinstall.dev/node | powershell
|
||||
```
|
||||
|
||||
Then create a directory for your project, and initialize it:
|
||||
|
||||
```bash
|
||||
mkdir -p my-sites
|
||||
pushd my-sites
|
||||
npm init
|
||||
npm install --save greenlock-express@v4
|
||||
```
|
||||
|
||||
## 2. Initialize and Config (Dir or DB)
|
||||
|
||||
You can use **local file storage** or a **database**. The default is to use file storage.
|
||||
|
||||
You'll need to create `server.js` and `greenlock.d/config.json`. You can do so using the CLI, API, or by hand.
|
||||
|
||||
### Using the CLI (simplest, recommended)
|
||||
|
||||
Anytime you install an npm module that contains an executable,
|
||||
you can run it using `npx`.
|
||||
|
||||
To initialize the Greenlock config, run `npx greenlock init`:
|
||||
|
||||
```bash
|
||||
npx greenlock init --config-dir ./greenlock.d --maintainer-email 'jon@example.com'
|
||||
```
|
||||
|
||||
### By Hand (for advanced users)
|
||||
|
||||
Create `server.js` like so:
|
||||
|
||||
`server.js`:
|
||||
|
||||
```js
|
||||
'use strict';
|
||||
|
||||
var app = require('./app.js');
|
||||
|
||||
require('greenlock-express')
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
|
||||
// where to look for configuration
|
||||
configDir: './greenlock.d',
|
||||
|
||||
// whether or not to run at cloudscale
|
||||
cluster: false
|
||||
})
|
||||
// Serves on 80 and 443
|
||||
// Get's SSL certificates magically!
|
||||
.serve(app);
|
||||
```
|
||||
|
||||
Create `app.js` like so:
|
||||
|
||||
`app.js`:
|
||||
|
||||
```js
|
||||
'use strict';
|
||||
|
||||
// Here's a vanilla HTTP app to start,
|
||||
// but feel free to replace it with Express, Koa, etc
|
||||
var app = function(req, res) {
|
||||
res.end('Hello, Encrypted World!');
|
||||
};
|
||||
|
||||
lex.listen([80], [443, 5001], function () {
|
||||
console.log("ENCRYPT __ALL__ THE DOMAINS!");
|
||||
});
|
||||
|
||||
// NOTE:
|
||||
// `~/letsencrypt/etc` is the default `configDir`
|
||||
// ports 80, 443, and 5001 are the default ports to listen on.
|
||||
module.exports = app;
|
||||
```
|
||||
|
||||
## Express
|
||||
Greenlock uses `.greenlockrc` to figure out whether to use the file system or a database for config,
|
||||
as well as where its root directory is.
|
||||
|
||||
```javascript
|
||||
// A happy little express app
|
||||
var app = require('express')();
|
||||
`.greenlockrc`
|
||||
|
||||
app.use(function (req, res) {
|
||||
res.send({ success: true });
|
||||
});
|
||||
|
||||
lex.onRequest = app;
|
||||
|
||||
lex.listen([80], [443, 5001], function () {
|
||||
var protocol = ('requestCert' in this) ? 'https': 'http';
|
||||
console.log("Listening at " + protocol + '://localhost:' + this.address().port);
|
||||
});
|
||||
```json
|
||||
{"manager":{"module":"@greenlock/manager"},"configDir":"greenlock.d"}
|
||||
```
|
||||
|
||||
### Use with raw http / https modules
|
||||
The `greenlock.d/config.json` is NOT intended to be edited by hand, as it is a substitute for a database, but it looks like this:
|
||||
|
||||
Let's say you want to redirect all http to https.
|
||||
|
||||
```javascript
|
||||
var http = require('http');
|
||||
var https = require('http2');
|
||||
// NOTE: you could use the old https module if for some reason you don't want to support modern browsers
|
||||
|
||||
function redirectHttp() {
|
||||
http.createServer(LEX.createAcmeResponder(lex, function redirectHttps(req, res) {
|
||||
res.setHeader('Location', 'https://' + req.headers.host + req.url);
|
||||
res.end('<!-- Hello Developer Person! Please use HTTPS instead -->');
|
||||
})).listen(80);
|
||||
}
|
||||
|
||||
function serveHttps() {
|
||||
var app = require('express')();
|
||||
|
||||
app.use('/', function (req, res) {
|
||||
res.end('Hello!');
|
||||
});
|
||||
|
||||
https.createServer(lex.httpsOptions, LEX.createAcmeResponder(lex, app)).listen(443);
|
||||
}
|
||||
|
||||
redirectHttp();
|
||||
serveHttps();
|
||||
```json
|
||||
{ "defaults": { "subscriberEmail": "john.doe@example.com" }, "sites": [] }
|
||||
```
|
||||
|
||||
### Let's Encrypt with Koa
|
||||
## 3. Add Sites
|
||||
|
||||
```javascript
|
||||
var koa = require('koa');
|
||||
var app = koa();
|
||||
For security, you must specify which sites you allow to request certificates. If you need this to be dynamic (i.e. checking a database or API, see the section below on custom site managers).
|
||||
|
||||
app.use(function *() {
|
||||
this.body = 'Hello World';
|
||||
});
|
||||
Every site has a "subject" (its primary domain name) and one or more "altnames" (secondary or related domain names on the same certificate).
|
||||
|
||||
var server = require('http2').createServer(lex.httpsOptions, LEX.createAcmeResponder(lex, app.callback()));
|
||||
server.listen(443, function () {
|
||||
console.log('Listening at https://localhost:' + this.address().port);
|
||||
});
|
||||
### Using CLI (simple, recommended)
|
||||
|
||||
Simply supply the names of sites that you manage and they will be added to the file system config, or database.
|
||||
|
||||
```bash
|
||||
npx greenlock add --subject example.com --altnames example.com,www.example.com
|
||||
```
|
||||
|
||||
### WebSockets with Let's Encrypt
|
||||
### By Hand (debugging only)
|
||||
|
||||
Note: you don't need to create websockets for the plain ports.
|
||||
You should NOT edit `greenlock.d/config.json` with your own tools. Use `greenlock.manager.add({})` instead.
|
||||
|
||||
```javascript
|
||||
var WebSocketServer = require('ws').Server;
|
||||
var https = require('http2');
|
||||
var server = https.createServer(lex.httpsOptions, LEX.createAcmeResponder(lex, app));
|
||||
var wss = new WebSocketServer({ server: server });
|
||||
`greenlock.d/config.json`:
|
||||
|
||||
wss.on('connection', onConnection);
|
||||
server.listen(443);
|
||||
<!-- TODO update manager to write array rather than object -->
|
||||
|
||||
function onConnection(ws) {
|
||||
var location = url.parse(ws.upgradeReq.url, true);
|
||||
// you might use location.query.access_token to authenticate or share sessions
|
||||
// or ws.upgradeReq.headers.cookie (see http://stackoverflow.com/a/16395220/151312)
|
||||
|
||||
ws.on('message', function incoming(message) {
|
||||
console.log('received: %s', message);
|
||||
});
|
||||
|
||||
ws.send('something');
|
||||
}
|
||||
```json
|
||||
{ "sites": [{ "subject": "example.com", "altnames": [ "example.com", "www.example.com" ] }] }
|
||||
```
|
||||
|
||||
## API
|
||||
## 4. Hello, Encrypted World!
|
||||
|
||||
```
|
||||
// checks options and sets up defaults. returns object with `listen`
|
||||
LEX.create(options) // (it was really just done this way to appeal to what people are used to seeing)
|
||||
That was it! Now you can run your server!
|
||||
|
||||
lex.listen(plain, tls, fn) // actually creates the servers and causes them to listen
|
||||
When you run `npm start`, it will automatically run `node server.js` (or `package.json.scripts.start`).
|
||||
|
||||
For arguments that `npm start` should ignore, place them after `--`.
|
||||
|
||||
// receives an instance of letsencrypt, returns an SNICallback handler for https.createServer()
|
||||
LEX.createSniCallback(opts) // this will call letsencrypt.renew and letsencrypt.register as appropriate
|
||||
// it will randomly stagger renewals such that they don't all happen at once on boot
|
||||
// or at any other time. registrations will be handled as per `handleRegistration`
|
||||
opts = {
|
||||
letsencrypt: <obj> // letsencrypt instance
|
||||
, memorizeFor: <1 day> // how long to wait before checking the disk for updated certificates
|
||||
, renewWithin: <3 days> // the first possible moment the certificate staggering should begin
|
||||
, failedWait: <5 minutes> // how long to wait before trying again if the certificate registration failed
|
||||
Here we use `--staging` in order to tell greenlock to issue test certificates rather than real certificates.
|
||||
|
||||
|
||||
// registrations are NOT approved automatically by default due to security concerns
|
||||
, approveRegistration: func // (someone can spoof servername indication to your server and cause you to be rate-limited)
|
||||
// but you can implement handling of them if you wish
|
||||
// (note that you should probably call the callback immediately with a tlsContext)
|
||||
//
|
||||
// default function (hostname, cb) { cb(null, null); }
|
||||
//
|
||||
// example function (hostname, cb) {
|
||||
// cb(null, { domains: [hostname], agreeTos: true, email: 'user@example.com' });
|
||||
// }
|
||||
|
||||
|
||||
, handleRenewFailure: func // renewals are automatic, but sometimes they may fail. If that happens, you should handle it
|
||||
// (note that renewals happen in the background)
|
||||
//
|
||||
// default function (err, letsencrypt, hostname, certInfo) {}
|
||||
}
|
||||
|
||||
|
||||
// uses `opts.webrootPath` to read from the filesystem
|
||||
LEX.getChallenge(opts, hostname, key cb)
|
||||
|
||||
LEX.createAcmeResponder(opts, fn) // this will return the necessary request handler for /.well-known/acme-challenges
|
||||
// which then calls `fn` (such as express app) to complete the request
|
||||
//
|
||||
// opts lex instance created with LEX.create(opts)
|
||||
// more generally, any object with a compatible `getChallenge` will work:
|
||||
// `lex.getChallenge(opts, domain, key, function (err, val) {})`
|
||||
//
|
||||
// fn function (req, res) {
|
||||
// console.log(req.method, req.url);
|
||||
//
|
||||
// res.end('Hello!');
|
||||
// }
|
||||
```bash
|
||||
# Note: you can use npm start to run server.js with the --staging flag set
|
||||
npm start -- --staging
|
||||
```
|
||||
|
||||
## Options
|
||||
```txt
|
||||
> my-project@1.0.0 start /srv/www/my-project
|
||||
> node server.js
|
||||
|
||||
If any of these values are `undefined` or `null` the will assume use reasonable defaults.
|
||||
|
||||
Partially defined values will be merged with the defaults.
|
||||
|
||||
Setting the value to `false` will, in many cases (as documented), disable the defaults.
|
||||
|
||||
```
|
||||
configDir: string // string the letsencrypt configuration path (de facto /etc/letsencrypt)
|
||||
//
|
||||
// default os.homedir() + '/letsencrypt/etc'
|
||||
|
||||
|
||||
webrootPath: string // string a path to a folder where temporary challenge files will be stored and read
|
||||
//
|
||||
// default os.tmpdir() + '/acme-challenge'
|
||||
|
||||
|
||||
getChallenge: func | false // false do not handle getChallenge
|
||||
//
|
||||
// func Example:
|
||||
//
|
||||
// default function (defaults, hostname, key, cb) {
|
||||
// var filename = path.join(defaults.webrootPath.replace(':hostname', hostname), key);
|
||||
// fs.readFile(filename, 'ascii', function (cb, text) {
|
||||
// cb(null, text);
|
||||
// })
|
||||
// }
|
||||
|
||||
|
||||
httpsOptions: object // object will be merged with internal defaults and passed to https.createServer()
|
||||
// { pfx, key, cert, passphrase, ca, ciphers, rejectUnauthorized, secureProtocol }
|
||||
// See https://nodejs.org/api/https.html
|
||||
// Note: if SNICallback is specified, it will be run *before*
|
||||
// the internal SNICallback that manages automated certificates
|
||||
//
|
||||
// default uses a localhost cert and key to prevent https.createServer() from throwing an error
|
||||
// and also uses our SNICallback, which manages certificates
|
||||
|
||||
|
||||
sniCallback: func // func replace the default sniCallback handler (which manages certificates) with your own
|
||||
|
||||
|
||||
letsencrypt: object // object configure the letsencrypt object yourself and pass it in directly
|
||||
//
|
||||
// default we create the letsencrypt object using parameters you specify
|
||||
|
||||
server: url // url use letsencrypt.productionServerUrl (i.e. https://acme-v01.api.letsencrypt.org/directory)
|
||||
// or letsencrypt.stagingServerUrl (i.e. https://acme-staging.api.letsencrypt.org/directory)
|
||||
//
|
||||
// default production
|
||||
Listening on 0.0.0.0:80 for ACME challenges and HTTPS redirects
|
||||
Listening on 0.0.0.0:443 for secure traffic
|
||||
```
|
||||
|
||||
## More Examples
|
||||
If everything worked you can visit your site in your browser, and after a few seconds you'll get a certificate warning and, after that, see a "Hello World" message. The debug (staging) certificates will be saved in `greenlock.d/staging`. Run again without `--staging` and you will get real certificates.
|
||||
|
||||
### < 140 Characters
|
||||
### Season to taste
|
||||
|
||||
Let's Encrypt in 128 characters, with spaces!
|
||||
Now you're ready to update `app.js` with your code. For example, try this next:
|
||||
|
||||
```
|
||||
node -e 'require("letsencrypt-express").testing().create( require("express")().use(function (_, r) { r.end("Hi!") }) ).listen()'
|
||||
```bash
|
||||
npm install --save express
|
||||
mkdir -p public
|
||||
echo '<h1>Hello!</h1>' >> public/index.html
|
||||
```
|
||||
|
||||
### More realistic
|
||||
`app.js`:
|
||||
|
||||
```javascript
|
||||
```js
|
||||
'use strict';
|
||||
|
||||
// Note: using staging server url, remove .testing() for production
|
||||
var LEX = require('letsencrypt-express').testing();
|
||||
var path = require('path');
|
||||
var express = require('express');
|
||||
var app = express();
|
||||
|
||||
app.use('/', function (req, res) {
|
||||
res.send({ success: true });
|
||||
});
|
||||
app.get('/', express.static(path.join(__dirname, "public")));
|
||||
|
||||
LEX.create({
|
||||
configDir: './letsencrypt.config' // ~/letsencrypt, /etc/letsencrypt, whatever you want
|
||||
module.exports = app;
|
||||
|
||||
, onRequest: app // your express app (or plain node http app)
|
||||
|
||||
, letsencrypt: null // you can provide you own instance of letsencrypt
|
||||
// if you need to configure it (with an agreeToTerms
|
||||
// callback, for example)
|
||||
|
||||
, approveRegistration: function (hostname, cb) { // PRODUCTION MODE needs this function, but only if you want
|
||||
// automatic registration (usually not necessary)
|
||||
// renewals for registered domains will still be automatic
|
||||
cb(null, {
|
||||
domains: [hostname]
|
||||
, email: 'user@example.com'
|
||||
, agreeTos: true // you
|
||||
// for development and debugging
|
||||
if (require.main === module) {
|
||||
require('http').createServer(app).listen(3000, function () {
|
||||
console.info("Listening for HTTP on", this.address());
|
||||
});
|
||||
}
|
||||
}).listen([80], [443, 5001], function () {
|
||||
console.log("ENCRYPT __ALL__ THE DOMAINS!");
|
||||
});
|
||||
}
|
||||
```
|
||||
|
||||
### More Options Exposed
|
||||
# Walkthrough
|
||||
|
||||
```javascript
|
||||
'use strict';
|
||||
For a more detail read the full
|
||||
[WALKTHROUGH](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/WALKTHROUGH.md).
|
||||
|
||||
var lex = require('letsencrypt-express');
|
||||
var express = require('express');
|
||||
var app = express();
|
||||
# Examples
|
||||
|
||||
app.use('/', function (req, res) {
|
||||
res.send({ success: true });
|
||||
});
|
||||
To see all of the examples, just browse [greenlock-express.js/examples/](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples)
|
||||
|
||||
var results = lex.create({
|
||||
configDir: '/etc/letsencrypt'
|
||||
, onRequest: app
|
||||
, server: require('letsencrypt').productionServerUrl
|
||||
}).listen(
|
||||
| Example | Location + Description |
|
||||
| :--------------------: | :----------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Express | [./examples/express/][ex-express] how to export an express app |
|
||||
| Node's **http2** | [./examples/http2/][ex-http2] how to use Node's built-in http2 server |
|
||||
| Node's https | [./examples/https][ex-https] how to customize the https server |
|
||||
| **WebSockets** | [./examples/websockets/][ex-websockets] how to use `on('upgrade')` |
|
||||
| <span>Socket.IO</span> | [./examples/socket.io][ex-socketio] how to overcomplicate a persistent connection |
|
||||
| Cluster | [./examples/cluster/][ex-cluster] how to use Node's built-in clustering with master and worker processes |
|
||||
| **Wildcards** | [coming someday][ex-wildcards] (ask to help create this) how to use DNS-01 for wildcard certs |
|
||||
| **Localhost** | [coming someday][ex-localhost] (ask to help create this) how to use DNS-01 for domains that resolve to private networks, such as 127.0.0.1 |
|
||||
| **CI/CD** | [coming someday][ex-cicd] (ask to help create this) how to use the `--staging` environment for test deployments |
|
||||
| HTTP Proxy | [examples/http-proxy][ex-http-proxy] how to (reverse) proxy decrypted traffic to another server |
|
||||
| - | Build your own<br>Be sure to tell me about it (open an issue) |
|
||||
|
||||
// you can give just the port, or expand out to the full options
|
||||
[80, { port: 8080, address: 'localhost', onListening: function () { console.log('http://localhost'); } }]
|
||||
[ex-express]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/express/
|
||||
[ex-http2]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http2/
|
||||
[ex-https]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/https/
|
||||
[ex-websockets]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/websockets/
|
||||
[ex-socketio]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/socketo.io/
|
||||
[ex-cluster]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/cluster/
|
||||
[ex-wildcards]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/
|
||||
[ex-localhost]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/
|
||||
[ex-cicd]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/
|
||||
[ex-http-proxy]: https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http-proxy/
|
||||
|
||||
// you can give just the port, or expand out to the full options
|
||||
, [443, 5001, { port: 8443, address: 'localhost' }]
|
||||
|
||||
// this is pretty much the default onListening handler
|
||||
, function onListening() {
|
||||
var server = this;
|
||||
var protocol = ('requestCert' in server) ? 'https': 'http';
|
||||
console.log("Listening at " + protocol + '://localhost:' + this.address().port);
|
||||
}
|
||||
);
|
||||
# FAQ
|
||||
## 1. But did YOU read the QuickStart?
|
||||
|
||||
// In case you need access to the raw servers (i.e. using websockets)
|
||||
console.log(results.plainServers);
|
||||
console.log(results.tlsServers);
|
||||
99% of the questions I get are answered in the QuickStart, or in the Examples.
|
||||
|
||||
Before you go into your specific use case, just try out the QuickStart from start to finish so that you can see that the default setup works, you get feel for the "lay of the land", and you know what to edit.
|
||||
|
||||
## 2. How to use JavaScript configuration?
|
||||
|
||||
You don't. It's JSON on purpose.
|
||||
|
||||
The configuration has to be serializable (i.e. could go in a database).
|
||||
|
||||
The config file is meant for **simple** use cases, for the average dev and it is managed with `npx greenlock ...`, as shown in the QuickStart.
|
||||
|
||||
If you have a **dynamic** or **advanced** use case (i.e. you need stuff in a database, or to change config on-the-fly), you can use the Greenlock API (not Greenlock Express) and you'll love it.
|
||||
|
||||
If you're layering a lot of **complexity** with dev ops tools, but you don't really understand the tools that well (i.e. **Docker**), either use ENVIRONMENT variables or put the `npx greenlock ...` commands in your setup script. You MUST use a database for **lambda** "cloud functions" and such.
|
||||
|
||||
You can also just mangle the Greenlock API to do what you want... but I don't recommend it. Keep it simple and your future self with thank you.
|
||||
|
||||
General rule of thumb: commit code, not data / config.
|
||||
|
||||
## 3. How to use non-standard ports (not 80, 443)?
|
||||
|
||||
You don't. Not usually.
|
||||
|
||||
Let's Encrypt **REQUIRES port 80** for HTTP-01 challenges.
|
||||
|
||||
But if you're using DNS-01 or you have a proxy in place, just use the raw node server. See these examples:
|
||||
|
||||
- [examples/http/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http/server.js)
|
||||
- [examples/https/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/https/server.js)
|
||||
|
||||
If you want to use Greenlock as a proxy, see this example:
|
||||
|
||||
- [examples/http-proxy/server.js](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/http-proxy/server.js)
|
||||
|
||||
# Troubleshooting
|
||||
|
||||
### What if the example didn't work?
|
||||
|
||||
Double check the following:
|
||||
|
||||
- **Public Facing IP** for `http-01` challenges
|
||||
- Are you running this _as_ a public-facing webserver (good)? or localhost (bad)?
|
||||
- Does `ifconfig` show a public address (good)? or a private one - 10.x, 192.168.x, etc (bad)?
|
||||
- If you're on a non-public server, are you using the `dns-01` challenge?
|
||||
- **valid email**
|
||||
- You MUST set `maintainerEmail` to a **valid address**
|
||||
- MX records must validate (`dig MX example.com` for `'john@example.com'`)
|
||||
- **valid DNS records**
|
||||
- Must have public DNS records (test with `dig +trace A example.com; dig +trace www.example.com` for `[ 'example.com', 'www.example.com' ]`)
|
||||
- **write access**
|
||||
- You MUST set `configDir` to a writeable location (test with `touch ./greenlock.d/config.json`)
|
||||
- **port binding privileges**
|
||||
- You MUST be able to bind to ports 80 and 443
|
||||
- You can do this via `sudo` or [`setcap`](https://gist.github.com/firstdoit/6389682)
|
||||
- **API limits**
|
||||
- You MUST NOT exceed the API [**usage limits**](https://letsencrypt.org/docs/staging-environment/) per domain, certificate, IP address, etc
|
||||
- **Red Lock, Untrusted**
|
||||
- You MUST switch from `npm start -- --staging` to `npm start` to use the **production** server
|
||||
- The API URL should not have 'acme-staging-v02', but should have 'acme-v02'
|
||||
|
||||
# Using a Database, S3, etc
|
||||
|
||||
If you have a small site, the default file storage will work well for you.
|
||||
|
||||
If you have many sites with many users, you'll probably want to store config in a database of some sort.
|
||||
|
||||
See the section on **Custom** callbacks and plugins below.
|
||||
|
||||
# Advanced Configuration
|
||||
|
||||
All of the advanced configuration is done by replacing the default behavior with callbacks.
|
||||
|
||||
You can whip up your own, or you can use something that's published to npm.
|
||||
|
||||
See the section on **Custom** callbacks and plugins below.
|
||||
|
||||
# Easy to Customize
|
||||
|
||||
<!-- greenlock-manager-test => greenlock-manager-custom -->
|
||||
|
||||
<!--
|
||||
- [greenlock.js/examples/](https://git.rootprojects.org/root/greenlock.js/src/branch/master/examples)
|
||||
-->
|
||||
|
||||
- [Custom Domain Management](https://git.rootprojects.org/root/greenlock-manager-test.js)
|
||||
- edit `server.js` and/or `.greenlockrc` to switch from the default `configDir` manager to your config system or database
|
||||
- CLI example: `npx greenlock init --manager ./path-or-npm-name.js --manager-FOO 'set option FOO'`
|
||||
- [Custom Key & Cert Storage](https://git.rootprojects.org/root/greenlock-store-test.js)
|
||||
- edit the `defaults` section of `greenlock.d/config.json` to change the certificate store or database
|
||||
- CLI example: `npx greenlock defaults --store greenlock-store-fs --store-base-path ./greenlock.d`
|
||||
- [Custom ACME HTTP-01 Challenges](https://git.rootprojects.org/root/acme-http-01-test.js)
|
||||
- edit the `defaults` section of `greenlock.d/config.json` to change the challenges by hand
|
||||
- CLI example: `npx greenlock defaults --challenge-http-01 ./you-http-01.js`
|
||||
- [Custom ACME DNS-01 Challenges](https://git.rootprojects.org/root/acme-dns-01-test.js)
|
||||
- edit the `defaults` section of `greenlock.d/config.json` to change the challenges by hand
|
||||
- CLI example: `npx greenlock defaults --challenge-dns-01 acme-dns-01-ovh --challenge-dns-01-token xxxx`
|
||||
- Per-site example: `npx greenlock update --subject example.com --challenge-dns-01 ./your-dns-01.js`
|
||||
- API example:
|
||||
```js
|
||||
greenlock.sites.set({
|
||||
subject: "example.com",
|
||||
challenges: {
|
||||
"dns-01": {
|
||||
module: "my-npm-module-name",
|
||||
foo: "some option",
|
||||
bar: "some other option"
|
||||
}
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
If you're using the default `configDir` management you can edit `greenlock.d/config.json` by hand to change
|
||||
which default and per-site modules are used.
|
||||
|
||||
You can use the CLI, even if you're using a database, buckets, or your own file storage.
|
||||
|
||||
You can also use the API, particularly if you need to set values dynamically per-site or per-user
|
||||
rather than using the global defaults. The certificate store and all challenges can be set
|
||||
per-site, but most per-site use cases are for DNS-01.
|
||||
|
||||
# Ready-made Integrations
|
||||
|
||||
Greenlock Express integrates between Let's Encrypt's ACME Challenges and many popular services.
|
||||
|
||||
| Type | Service | Plugin |
|
||||
| ----------- | ----------------------------------------------------------------------------------- | ------------------------ |
|
||||
| dns-01 | CloudFlare | acme-dns-01-cloudflare |
|
||||
| dns-01 | [Digital Ocean](https://git.rootprojects.org/root/acme-dns-01-digitalocean.js) | acme-dns-01-digitalocean |
|
||||
| dns-01 | [DNSimple](https://git.rootprojects.org/root/acme-dns-01-dnsimple.js) | acme-dns-01-dnsimple |
|
||||
| dns-01 | [DuckDNS](https://git.rootprojects.org/root/acme-dns-01-duckdns.js) | acme-dns-01-duckdns |
|
||||
| http-01 | File System / [Web Root](https://git.rootprojects.org/root/acme-http-01-webroot.js) | acme-http-01-webroot |
|
||||
| dns-01 | [GoDaddy](https://git.rootprojects.org/root/acme-dns-01-godaddy.js) | acme-dns-01-godaddy |
|
||||
| dns-01 | [Gandi](https://git.rootprojects.org/root/acme-dns-01-gandi.js) | acme-dns-01-gandi |
|
||||
| dns-01 | [NameCheap](https://git.rootprojects.org/root/acme-dns-01-namecheap.js) | acme-dns-01-namecheap |
|
||||
| dns-01 | [Name.com](https://git.rootprojects.org/root/acme-dns-01-namedotcom.js) | acme-dns-01-namedotcom |
|
||||
| dns-01 | Route53 (AWS) | acme-dns-01-route53 |
|
||||
| http-01 | S3 (AWS, Digital Ocean, Scaleway) | acme-http-01-s3 |
|
||||
| dns-01 | [Vultr](https://git.rootprojects.org/root/acme-dns-01-vultr.js) | acme-dns-01-vultr |
|
||||
| dns-01 | [Build your own](https://git.rootprojects.org/root/acme-dns-01-test.js) | acme-dns-01-test |
|
||||
| http-01 | [Build your own](https://git.rootprojects.org/root/acme-http-01-test.js) | acme-http-01-test |
|
||||
| tls-alpn-01 | [Contact us](mailto:support@therootcompany.com) | - |
|
||||
|
||||
Example Usage:
|
||||
|
||||
```bash
|
||||
npx greenlock defaults --challenge-dns-01 acme-dns-01-ovh --challenge-dns-01-token xxxx
|
||||
npx greenlock defaults --challenge-http-01 acme-http-01-s3 --challenge-http-01-bucket my-bucket
|
||||
```
|
||||
|
||||
Search `acme-http-01-` or `acme-dns-01-` on npm to find more.
|
||||
|
||||
### All Options Exposed
|
||||
# Full Documentation
|
||||
|
||||
Here's absolutely every option and function exposed
|
||||
<!--
|
||||
- Greenlock CLI
|
||||
- Greenlock JavaScript API
|
||||
-->
|
||||
|
||||
```javascript
|
||||
var http = require('http');
|
||||
var https = require('http2');
|
||||
var LEX = require('letsencrypt-express');
|
||||
var LE = require('letsencrypt');
|
||||
var lex;
|
||||
Most of the documentation is done by use-case examples, as shown up at the top of the README.
|
||||
|
||||
lex = LEX.create({
|
||||
webrootPath: '/tmp/.well-known/acme-challenge'
|
||||
We're working on more comprehensive documentation for this newly released version.
|
||||
**Please open an issue** with questions in the meantime.
|
||||
|
||||
, lifetime: 90 * 24 * 60 * 60 * 1000 // expect certificates to last 90 days
|
||||
, failedWait: 5 * 60 * 1000 // if registering fails wait 5 minutes before trying again
|
||||
, renewWithin: 3 * 24 * 60 * 60 * 1000 // renew at least 3 days before expiration
|
||||
, memorizeFor: 1 * 24 * 60 * 60 * 1000 // keep certificates in memory for 1 day
|
||||
# Commercial Support
|
||||
|
||||
, approveRegistration: function (hostname, cb) {
|
||||
cb(null, {
|
||||
domains: [hostname]
|
||||
, email: 'user@example.com'
|
||||
, agreeTos: true
|
||||
});
|
||||
}
|
||||
Do you need...
|
||||
|
||||
, handleRenewFailure: function (err, hostname, certInfo) {
|
||||
console.error("ERROR: Failed to renew domain '", hostname, "':");
|
||||
if (err) {
|
||||
console.error(err.stack || err);
|
||||
}
|
||||
if (certInfo) {
|
||||
console.error(certInfo);
|
||||
}
|
||||
}
|
||||
- training?
|
||||
- specific features?
|
||||
- different integrations?
|
||||
- bugfixes, on _your_ timeline?
|
||||
- custom code, built by experts?
|
||||
- commercial support and licensing?
|
||||
|
||||
, letsencrypt: LE.create(
|
||||
// options
|
||||
{ configDir: './letsencrypt.config'
|
||||
, manual: true
|
||||
You're welcome to [contact us](mailto:aj@therootcompany.com) in regards to IoT, On-Prem,
|
||||
Enterprise, and Internal installations, integrations, and deployments.
|
||||
|
||||
, server: LE.productionServerUrl
|
||||
, privkeyPath: LE.privkeyPath
|
||||
, fullchainPath: LE.fullchainPath
|
||||
, certPath: LE.certPath
|
||||
, chainPath: LE.chainPath
|
||||
, renewalPath: LE.renewalPath
|
||||
, accountsDir: LE.accountsDir
|
||||
We have both commercial support and commercial licensing available.
|
||||
|
||||
, debug: false
|
||||
}
|
||||
We also offer consulting for all-things-ACME and Let's Encrypt.
|
||||
|
||||
// handlers
|
||||
, { setChallenge: LEX.setChallenge
|
||||
, removeChallenge: LEX.removeChallenge
|
||||
}
|
||||
)
|
||||
# Legal & Rules of the Road
|
||||
|
||||
, debug: false
|
||||
});
|
||||
Greenlock™ is a [trademark](https://rootprojects.org/legal/#trademark) of AJ ONeal
|
||||
|
||||
http.createServer(LEX.createAcmeResponder(lex, function (req, res) {
|
||||
res.setHeader('Location', 'https://' + req.headers.host + req.url);
|
||||
res.end('<!-- Hello Mr Developer! Please use HTTPS instead -->');
|
||||
}));
|
||||
The rule of thumb is "attribute, but don't confuse". For example:
|
||||
|
||||
https.createServer(lex.httpsOptions, LEX.createAcmeResponder(lex, function (req, res) {
|
||||
res.end('Hello!');
|
||||
}));
|
||||
```
|
||||
> Built with [Greenlock Express](https://git.rootprojects.org/root/greenlock.js) (a [Root](https://rootprojects.org) project).
|
||||
|
||||
## Heroku?
|
||||
Please [contact us](mailto:aj@therootcompany.com) if you have any questions in regards to our trademark,
|
||||
attribution, and/or visible source policies. We want to build great software and a great community.
|
||||
|
||||
This doesn't work on heroku because heroku uses a proxy with built-in https
|
||||
(which is a smart thing to do) and besides, they want you to pay big bucks
|
||||
for https. (hopefully not for long?...)
|
||||
[Greenlock™](https://git.rootprojects.org/root/greenlock.js) |
|
||||
MPL-2.0 |
|
||||
[Terms of Use](https://therootcompany.com/legal/#terms) |
|
||||
[Privacy Policy](https://therootcompany.com/legal/#privacy)
|
||||
|
||||
256
WALKTHROUGH.md
Normal file
256
WALKTHROUGH.md
Normal file
@ -0,0 +1,256 @@
|
||||
# Greenlock Express Walkthrough
|
||||
|
||||
This will show you the basics of how to
|
||||
|
||||
1. Create a node project
|
||||
2. Create an http app (i.e. express)
|
||||
3. Serve with Greenlock Express
|
||||
4. Manage SSL Certificates and Domains
|
||||
|
||||
## 1. Create a node project
|
||||
|
||||
Create an empty node project.
|
||||
|
||||
Be sure to fill out the package name, version, and an author email.
|
||||
|
||||
```bash
|
||||
mkdir ~/my-project
|
||||
pushd ~/my-project
|
||||
npm init
|
||||
```
|
||||
|
||||
## 2. Create an http app (i.e. express)
|
||||
|
||||
This example is shown with Express, but any node app will do. Greenlock
|
||||
works with everything.
|
||||
(or any node-style http app)
|
||||
|
||||
`my-express-app.js`:
|
||||
|
||||
```js
|
||||
"use strict";
|
||||
|
||||
// A plain, node-style app
|
||||
|
||||
function myPlainNodeHttpApp(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
}
|
||||
|
||||
// Wrap that plain app in express,
|
||||
// because that's what you're used to
|
||||
|
||||
var express = require("express");
|
||||
var app = express();
|
||||
app.get("/", myPlainNodeHttpApp);
|
||||
|
||||
// export the app normally
|
||||
// do not .listen()
|
||||
|
||||
module.exports = app;
|
||||
```
|
||||
|
||||
## 3. Serve with Greenlock Express
|
||||
|
||||
Greenlock Express is designed with these goals in mind:
|
||||
|
||||
- Simplicity and ease-of-use
|
||||
- Performance and scalability
|
||||
- Configurability and control
|
||||
|
||||
You can start with **near-zero configuration** and
|
||||
slowly add options for greater performance and customization
|
||||
later, if you need them.
|
||||
|
||||
`server.js`:
|
||||
|
||||
```js
|
||||
"use strict";
|
||||
|
||||
//var pkg = require("./package.json");
|
||||
var app = require("./app.js");
|
||||
|
||||
require("greenlock-express")
|
||||
.init({
|
||||
// where to find .greenlockrc and set default paths
|
||||
packageRoot: __dirname,
|
||||
|
||||
// where config and certificate stuff go
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
// contact for security and critical bug notices
|
||||
maintainerEmail: pkg.author,
|
||||
|
||||
// name & version for ACME client user agent
|
||||
//packageAgent: pkg.name + "/" + pkg.version,
|
||||
|
||||
// whether or not to run at cloudscale
|
||||
cluster: false
|
||||
})
|
||||
.serve(app);
|
||||
```
|
||||
|
||||
And start your server:
|
||||
|
||||
```bash
|
||||
# Allow non-root node to use ports 80 (HTTP) and 443 (HTTPS)
|
||||
sudo setcap 'cap_net_bind_service=+ep' $(which node)
|
||||
```
|
||||
|
||||
```bash
|
||||
# `npm start` will call `node ./server.js` by default
|
||||
npm start
|
||||
```
|
||||
|
||||
```bash
|
||||
# use --staging to use the development API until you're ready to get real certificates
|
||||
npm start -- --staging
|
||||
```
|
||||
|
||||
```txt
|
||||
Greenlock v4.0.0
|
||||
Greenlock Config Dir/File: ./greenlock.d/config.json
|
||||
|
||||
Listening on 0.0.0.0:80 for ACME challenges and HTTPS redirects
|
||||
Listening on 0.0.0.0:443 for secure traffic
|
||||
```
|
||||
|
||||
## 4. Manage SSL Certificates and Domains
|
||||
|
||||
The management API is built to work with Databases, S3, etc.
|
||||
|
||||
By default, it's just a simple config file and directory.
|
||||
|
||||
```bash
|
||||
# see which manager and what options are in use
|
||||
cat .greenlockrc
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary>Example Output</summary>
|
||||
|
||||
```json
|
||||
{
|
||||
"manager": {
|
||||
"module": "@greenlock/manager"
|
||||
},
|
||||
"configDir": "./greenlock.d"
|
||||
}
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
```bash
|
||||
# show the global defaults with the CLI
|
||||
npx greenlock defaults
|
||||
```
|
||||
|
||||
```js
|
||||
// show the global defaults with the API
|
||||
var defaults = await greenlock.defaults();
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary>Example Output</summary>
|
||||
|
||||
```json
|
||||
{
|
||||
"store": {
|
||||
"module": "greenlock-store-fs",
|
||||
"basePath": "./greenlock.d"
|
||||
},
|
||||
"challenges": {
|
||||
"http-01": {
|
||||
"module": "acme-http-01-standalone"
|
||||
}
|
||||
},
|
||||
"renewOffset": "-45d",
|
||||
"renewStagger": "3d",
|
||||
"accountKeyType": "EC-P256",
|
||||
"serverKeyType": "RSA-2048",
|
||||
"subscriberEmail": "jon@example.com",
|
||||
"agreeToTerms": true
|
||||
}
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
```bash
|
||||
# show per-site configs with the CLI
|
||||
npx greenlock config --subject example.com
|
||||
```
|
||||
|
||||
```js
|
||||
// show a site config with the API
|
||||
greenlock.sites.get({ subject: "example.com" });
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary>Example Output</summary>
|
||||
|
||||
```json
|
||||
{
|
||||
"subject": "example.com",
|
||||
"altnames": ["example.com"],
|
||||
"renewAt": 1576638107754,
|
||||
"defaults": {
|
||||
"store": {
|
||||
"module": "greenlock-store-fs",
|
||||
"basePath": "./greenlock.d"
|
||||
},
|
||||
"challenges": {
|
||||
"http-01": {
|
||||
"module": "acme-http-01-standalone"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
Management can be done via the **CLI** or the JavaScript [**API**](https://git.rootprojects.org/root/greenlock.js).
|
||||
Since this is the QuickStart, we'll demo the **CLI**:
|
||||
|
||||
You need to create a Let's Encrypt _subscriber account_, which can be done globally, or per-site.
|
||||
All individuals, and most businesses, should set this globally:
|
||||
|
||||
```bash
|
||||
# Set a global subscriber account with the CLI
|
||||
npx greenlock defaults --subscriber-email 'mycompany@example.com' --agree-to-terms true
|
||||
```
|
||||
|
||||
```js
|
||||
// set a global subscriber account with the API
|
||||
greenlock.manager.defaults({
|
||||
subscriberEmail: "mycompany@example.com",
|
||||
agreeToTerms: true
|
||||
});
|
||||
```
|
||||
|
||||
<!-- todo print where the key was saved -->
|
||||
|
||||
A Let's Encrypt SSL certificate has a "Subject" (Primary Domain) and up to 100 "Alternative Names"
|
||||
(of which the first _must_ be the subject).
|
||||
|
||||
```bash
|
||||
# Add a certificate with specific domains with the CLI
|
||||
npx greenlock add --subject example.com --altnames example.com,www.example.com
|
||||
```
|
||||
|
||||
```js
|
||||
// Add a certificate with specific domains with the API
|
||||
greenlock.sites.add({
|
||||
subject: "example.com",
|
||||
altnames: ["example.com"]
|
||||
});
|
||||
```
|
||||
|
||||
<!-- todo print where the cert was saved -->
|
||||
|
||||
Note: **Localhost**, **Wildcard**, and Certificates for Private Networks require
|
||||
[**DNS validation**](https://git.rootprojects.org/root/greenlock-exp).
|
||||
|
||||
- DNS Validation
|
||||
- [**Wildcards**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/wildcards/) (coming soon)
|
||||
- [**Localhost**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/localhost/) (coming soon)
|
||||
- [**CI/CD**](https://git.rootprojects.org/root/greenlock-express.js/src/branch/master/examples/ci-cd/) (coming soon)
|
||||
226
bin/lex.js
226
bin/lex.js
@ -1,226 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
'use strict';
|
||||
|
||||
var fs = require('fs');
|
||||
var path = require('path');
|
||||
var mkdirp = require('fs');
|
||||
var cli = require('cli');
|
||||
var mkdirp = require('mkdirp');
|
||||
var homedir = require('os').homedir();
|
||||
var configDir = path.join(homedir, 'letsencrypt');
|
||||
var desktop = path.join(homedir, 'Desktop');
|
||||
var vhostDir = path.join(fs.existsSync(desktop) ? desktop : configDir, 'www');
|
||||
var welcomeHtml = fs.readFileSync(path.join(__dirname, '..', 'lib', 'public', 'welcome.html'), 'utf8');
|
||||
var express = require('express');
|
||||
|
||||
cli.parse({
|
||||
'agree-tos': [ false, " Agree to the Let's Encrypt Subscriber Agreement", 'boolean', false ]
|
||||
, email: [ false, " Email used for registration and recovery contact. (default: null)", 'email' ]
|
||||
, domains: [ false, " Domain names to apply. To include the www domain with your main domain your can enter both with a comma. Ex --domains example.com,www.example.com (default: [])", 'string' ]
|
||||
, debug: [ false, " show traces and logs", 'boolean', false ]
|
||||
, server: [ false, " ACME Directory Resource URI.", 'string', 'https://acme-v01.api.letsencrypt.org/directory)' ]
|
||||
});
|
||||
|
||||
// ignore certonly and extraneous arguments
|
||||
cli.main(function(_, options) {
|
||||
console.log('');
|
||||
var args = {};
|
||||
|
||||
Object.keys(options).forEach(function (key) {
|
||||
var val = options[key];
|
||||
|
||||
if ('string' === typeof val) {
|
||||
val = val.replace(/^~/, homedir);
|
||||
}
|
||||
|
||||
key = key.replace(/\-([a-z0-9A-Z])/g, function (c) { return c[1].toUpperCase(); });
|
||||
args[key] = val;
|
||||
});
|
||||
|
||||
if (args.domains) {
|
||||
args.domains = args.domains.split(',');
|
||||
}
|
||||
|
||||
makeDirectories();
|
||||
|
||||
function makeDirectories() {
|
||||
mkdirp(configDir, function (err) {
|
||||
if (err) {
|
||||
console.error("Could not create config directory '" + configDir + "':", err.code);
|
||||
console.error(err.stack);
|
||||
return;
|
||||
}
|
||||
|
||||
mkdirp(vhostDir, function (err) {
|
||||
if (err) {
|
||||
console.error("Could not create vhost directory '" + vhostDir + "':", err.code);
|
||||
console.error(err.stack);
|
||||
return;
|
||||
}
|
||||
|
||||
startServers();
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function configure(le, args, cb) {
|
||||
var vhost;
|
||||
var pubDir;
|
||||
var index;
|
||||
|
||||
if (!(args.email && args.agreeTos && args.server && args.domains)) {
|
||||
cb({ error : { message: "missing one or more of agreeTos,domains,email,server" } });
|
||||
return;
|
||||
}
|
||||
|
||||
vhost = args.domains[0];
|
||||
pubDir = path.join(vhostDir, vhost);
|
||||
index = path.join(pubDir, 'index.html');
|
||||
|
||||
makeLandingPage();
|
||||
|
||||
function makeLandingPage() {
|
||||
mkdirp(pubDir, function (err) {
|
||||
if (err) {
|
||||
cb(err);
|
||||
return;
|
||||
}
|
||||
|
||||
fs.exists(index, function (exists) {
|
||||
if (exists) {
|
||||
configureForHttps();
|
||||
return;
|
||||
}
|
||||
|
||||
fs.writeFile(path.join(pubDir, 'index.html'), welcomeHtml.replace(/:hostname/g, vhost), 'utf8', function (err) {
|
||||
if (err) {
|
||||
cb(err);
|
||||
return;
|
||||
}
|
||||
|
||||
configureForHttps();
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function configureForHttps() {
|
||||
if (args.debug) {
|
||||
console.log('[LEX] configureForHttps');
|
||||
console.log(args);
|
||||
}
|
||||
le.setConfig(args, cb);
|
||||
}
|
||||
}
|
||||
|
||||
function createConfigurator(le) {
|
||||
var app = express();
|
||||
|
||||
app.use('/', express.static(path.join(__dirname, '..', 'lib', 'configurator')));
|
||||
|
||||
app.use(require('body-parser').json());
|
||||
|
||||
app.get('/api/com.daplie.lex/sites', function (req, res, next) {
|
||||
le.getConfigs({ configDir: configDir }, function (err, configs) {
|
||||
if (err) {
|
||||
next(err);
|
||||
return;
|
||||
}
|
||||
res.send(configs);
|
||||
});
|
||||
});
|
||||
|
||||
app.post('/api/com.daplie.lex/sites', function (req, res, next) {
|
||||
var data = req.body;
|
||||
|
||||
configure(le, data, function (err, configs) {
|
||||
if (err) {
|
||||
console.error("[LEX/bin] configure");
|
||||
console.error(err.stack);
|
||||
next(err);
|
||||
return;
|
||||
}
|
||||
|
||||
res.send(configs);
|
||||
});
|
||||
});
|
||||
|
||||
return app;
|
||||
}
|
||||
|
||||
function startServers() {
|
||||
// Note: using staging server url, remove .testing() for production
|
||||
var LE = require('letsencrypt');
|
||||
var LEX = require('../');
|
||||
var le = LE.create({
|
||||
configDir: configDir
|
||||
, manual: true
|
||||
|
||||
, privkeyPath: LE.privkeyPath
|
||||
, fullchainPath: LE.fullchainPath
|
||||
, certPath: LE.certPath
|
||||
, chainPath: LE.chainPath
|
||||
, renewalPath: LE.renewalPath
|
||||
, accountsDir: LE.accountsDir
|
||||
}, {
|
||||
setChallenge: LEX.setChallenge
|
||||
, removeChallenge: LEX.removeChallenge
|
||||
});
|
||||
var app = express();
|
||||
var vhosts = {};
|
||||
|
||||
vhosts['localhost.daplie.com'] = createConfigurator(le, vhosts);
|
||||
|
||||
app.use('/', function (req, res, next) {
|
||||
var hostname = (req.hostname||req.headers.host||'').replace(/^www\./, '');
|
||||
var pubDir = path.join(vhostDir, hostname);
|
||||
|
||||
if (vhosts[hostname]) {
|
||||
vhosts[hostname](req, res, next);
|
||||
return;
|
||||
}
|
||||
|
||||
fs.exists(pubDir, function (exists) {
|
||||
if (exists) {
|
||||
vhosts[hostname] = express().use('/', express.static(pubDir));
|
||||
vhosts[hostname](req, res, next);
|
||||
} else {
|
||||
vhosts['localhost.daplie.com'](req, res, next);
|
||||
}
|
||||
});
|
||||
});
|
||||
app.use('/', express.static(path.join(__dirname, '..', 'lib', 'public')));
|
||||
|
||||
LEX.create({
|
||||
onRequest: app
|
||||
, configDir: configDir
|
||||
, letsencrypt: le
|
||||
, approveRegistration: function (domain, cb) {
|
||||
le.getConfig({ domains: [domain] }, function (err, config) {
|
||||
if (!(config && config.checkpoints >= 0)) {
|
||||
cb(null, null);
|
||||
return;
|
||||
}
|
||||
|
||||
cb(null, {
|
||||
email: config.email
|
||||
// can't remember which it is, but the pyconf is different that the regular variable
|
||||
, agreeTos: config.tos || config.agree || config.agreeTos
|
||||
, server: config.server || LE.productionServerUrl
|
||||
, domains: config.domains || [domain]
|
||||
});
|
||||
});
|
||||
}
|
||||
}).listen([80], [443, 5001]);
|
||||
}
|
||||
|
||||
/*
|
||||
// should get back account, path to certs, pems, etc?
|
||||
console.log('\nCertificates installed at:');
|
||||
console.log(Object.keys(results).filter(function (key) {
|
||||
return /Path/.test(key);
|
||||
}).map(function (key) {
|
||||
return results[key];
|
||||
}).join('\n'));
|
||||
*/
|
||||
});
|
||||
20
config.js
Normal file
20
config.js
Normal file
@ -0,0 +1,20 @@
|
||||
"use strict";
|
||||
|
||||
var path = require("path");
|
||||
module.exports = {
|
||||
email: "jon.doe@example.com",
|
||||
configDir: path.join(__dirname, "acme"),
|
||||
srv: "/srv/www/",
|
||||
api: "/srv/api/",
|
||||
proxy: {
|
||||
"example.com": "http://localhost:4080",
|
||||
"*.example.com": "http://localhost:4080"
|
||||
},
|
||||
|
||||
// DNS-01 challenges only
|
||||
challenges: {
|
||||
"*.example.com": require("acme-dns-01-YOUR_DNS_HOST").create({
|
||||
token: "xxxx"
|
||||
})
|
||||
}
|
||||
};
|
||||
35
demo.js
Normal file
35
demo.js
Normal file
@ -0,0 +1,35 @@
|
||||
"use strict";
|
||||
|
||||
require("./")
|
||||
.init(initialize)
|
||||
.serve(worker)
|
||||
.master(function() {
|
||||
console.log("Hello from master");
|
||||
});
|
||||
|
||||
function initialize() {
|
||||
var pkg = require("./package.json");
|
||||
var config = {
|
||||
package: {
|
||||
name: "Greenlock_Express_Demo",
|
||||
version: pkg.version,
|
||||
author: pkg.author
|
||||
},
|
||||
staging: true,
|
||||
cluster: true,
|
||||
|
||||
notify: function(ev, params) {
|
||||
console.info(ev, params);
|
||||
}
|
||||
};
|
||||
return config;
|
||||
}
|
||||
|
||||
function worker(glx) {
|
||||
console.info();
|
||||
console.info("Hello from worker #" + glx.id());
|
||||
|
||||
glx.serveApp(function(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
});
|
||||
}
|
||||
53
dist/etc/systemd/system/greenlock-express.service
vendored
Normal file
53
dist/etc/systemd/system/greenlock-express.service
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
# sudo systemctl daemon-reload
|
||||
# sudo systemctl restart greenlock-express
|
||||
# sudo journalctl -xefu greenlock-express
|
||||
[Unit]
|
||||
Description=Greenlock Static Server
|
||||
Documentation=https://git.coolaj86.com/coolaj86/greenlock-express.js/
|
||||
After=network.target
|
||||
Wants=network.target systemd-networkd-wait-online.service
|
||||
|
||||
[Service]
|
||||
# Restart on crash (bad signal), 'clean' failure (error exit code), everything
|
||||
# Allow up to 3 restarts within 10 seconds
|
||||
# (it's unlikely that a user or properly-running script will do this)
|
||||
Restart=always
|
||||
StartLimitInterval=10
|
||||
StartLimitBurst=3
|
||||
|
||||
# User and group the process will run as
|
||||
# (git is the de facto standard on most systems)
|
||||
User=ubuntu
|
||||
Group=ubuntu
|
||||
|
||||
WorkingDirectory=/srv/www
|
||||
# custom directory cannot be set and will be the place where gitea exists, not the working directory
|
||||
ExecStart=/opt/node/bin/node /opt/greenlock-express.js/server.js /opt/greenlock-express.js/config.js
|
||||
|
||||
# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings.
|
||||
# greenlock is not expected to use more than this.
|
||||
LimitNOFILE=1048576
|
||||
LimitNPROC=64
|
||||
|
||||
# Use private /tmp and /var/tmp, which are discarded after gitea stops.
|
||||
PrivateTmp=true
|
||||
# Use a minimal /dev
|
||||
PrivateDevices=true
|
||||
# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
|
||||
ProtectHome=true
|
||||
# Make /usr, /boot, /etc and possibly some more folders read-only.
|
||||
ProtectSystem=full
|
||||
# ... except /opt/greenlock-express.js/acme because we want a place for the database
|
||||
# and /opt/greenlock-express.js/var because we want a place where logs can go.
|
||||
# This merely retains r/w access rights, it does not add any new.
|
||||
# Must still be writable on the host!
|
||||
ReadWriteDirectories=/srv/www /opt/greenlock-express.js
|
||||
|
||||
# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories
|
||||
; ReadWritePaths=/opt/gitea /var/log/gitea
|
||||
|
||||
# The following additional security directives only work with systemd v229 or later.
|
||||
# They further retrict privileges that can be gained by gitea.
|
||||
# Note that you may have to add capabilities required by any plugins in use.
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
@ -1,9 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
// Don't try this at home kids, it's just for fun
|
||||
//
|
||||
|
||||
// require('letsencrypt-express')
|
||||
require('../').testing().create(require('express')().use(function (_, r) {
|
||||
r.end('Hi!');
|
||||
})).listen();
|
||||
12
examples/cluster/package.json
Normal file
12
examples/cluster/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "cluster-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
41
examples/cluster/server.js
Normal file
41
examples/cluster/server.js
Normal file
@ -0,0 +1,41 @@
|
||||
"use strict";
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
|
||||
// When you're ready to go full cloud scale, you just change this to true:
|
||||
// Note: in cluster you CANNOT use in-memory state (see below)
|
||||
cluster: true,
|
||||
|
||||
// This will default to the number of workers being equal to
|
||||
// n-1 cpus, with a minimum of 2
|
||||
workers: 4
|
||||
})
|
||||
// ready is only executed by workers (no-op in master)
|
||||
.ready(httpsWorker)
|
||||
// master is only executed by master (no-op in a worker)
|
||||
.master(function() {
|
||||
console.info("I'm the master");
|
||||
});
|
||||
|
||||
function httpsWorker(glx) {
|
||||
// WRONG
|
||||
// This won't work like you
|
||||
// think because EACH worker
|
||||
// has ITS OWN `count`.
|
||||
var count = 0;
|
||||
|
||||
var app = function(req, res) {
|
||||
res.end("Hello... how many times now? Oh, " + count + " times");
|
||||
count += 1;
|
||||
};
|
||||
|
||||
// Serves on 80 and 443... for each worker
|
||||
// Get's SSL certificates magically!
|
||||
glx.serveApp(app);
|
||||
}
|
||||
17
examples/express/my-express-app.js
Normal file
17
examples/express/my-express-app.js
Normal file
@ -0,0 +1,17 @@
|
||||
"use strict";
|
||||
|
||||
var express = require("express");
|
||||
var app = express();
|
||||
|
||||
app.use("/", function(req, res) {
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
res.end("Hello, World!\n\n💚 🔒.js");
|
||||
});
|
||||
|
||||
// DO NOT DO app.listen() unless we're testing this directly
|
||||
if (require.main === module) {
|
||||
app.listen(3000);
|
||||
}
|
||||
|
||||
// Instead do export the app:
|
||||
module.exports = app;
|
||||
12
examples/express/package.json
Normal file
12
examples/express/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "express-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
22
examples/express/server.js
Normal file
22
examples/express/server.js
Normal file
@ -0,0 +1,22 @@
|
||||
"use strict";
|
||||
|
||||
var app = require("./my-express-app.js");
|
||||
|
||||
app.get("/hello", function(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
});
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
|
||||
cluster: false
|
||||
})
|
||||
|
||||
// Serves on 80 and 443
|
||||
// Get's SSL certificates magically!
|
||||
.serve(app);
|
||||
12
examples/http-proxy/package.json
Normal file
12
examples/http-proxy/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "http-proxy-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
46
examples/http-proxy/server.js
Normal file
46
examples/http-proxy/server.js
Normal file
@ -0,0 +1,46 @@
|
||||
"use strict";
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init(function getConfig() {
|
||||
// Greenlock Config
|
||||
|
||||
return {
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
|
||||
cluster: false
|
||||
};
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
// we need the raw https server
|
||||
var server = glx.httpsServer();
|
||||
var proxy = require("http-proxy").createProxyServer({ xfwd: true });
|
||||
|
||||
// catches error events during proxying
|
||||
proxy.on("error", function(err, req, res) {
|
||||
console.error(err);
|
||||
res.statusCode = 500;
|
||||
res.end();
|
||||
return;
|
||||
});
|
||||
|
||||
// We'll proxy websockets too
|
||||
server.on("upgrade", function(req, socket, head) {
|
||||
proxy.ws(req, socket, head, {
|
||||
ws: true,
|
||||
target: "ws://localhost:3000"
|
||||
});
|
||||
});
|
||||
|
||||
// servers a node app that proxies requests to a localhost
|
||||
glx.serveApp(function(req, res) {
|
||||
proxy.web(req, res, {
|
||||
target: "http://localhost:3000"
|
||||
});
|
||||
});
|
||||
}
|
||||
12
examples/http/package.json
Normal file
12
examples/http/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "http-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
38
examples/http/server.js
Normal file
38
examples/http/server.js
Normal file
@ -0,0 +1,38 @@
|
||||
"use strict";
|
||||
|
||||
// The WRONG way:
|
||||
//var http = require('http');
|
||||
//var httpServer = http.createServer(redirectToHttps);
|
||||
//
|
||||
// Why is that wrong?
|
||||
// Greenlock needs to change some low-level http and https options.
|
||||
// Use glx.httpServer(redirectToHttps) instead.
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
cluster: false
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
//
|
||||
// HTTP can only be used for ACME HTTP-01 Challenges
|
||||
// (and it is not required for DNS-01 challenges)
|
||||
//
|
||||
|
||||
// Get the raw http server:
|
||||
var httpServer = glx.httpServer(function(req, res) {
|
||||
res.statusCode = 301;
|
||||
res.setHeader("Location", "https://" + req.headers.host + req.path);
|
||||
res.end("Insecure connections are not allowed. Redirecting...");
|
||||
});
|
||||
|
||||
httpServer.listen(80, "0.0.0.0", function() {
|
||||
console.info("Listening on ", httpServer.address());
|
||||
});
|
||||
}
|
||||
12
examples/http2/package.json
Normal file
12
examples/http2/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "http2-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
46
examples/http2/server.js
Normal file
46
examples/http2/server.js
Normal file
@ -0,0 +1,46 @@
|
||||
"use strict";
|
||||
|
||||
// The WRONG way:
|
||||
//var http2 = require('http2');
|
||||
//var http2Server = https.createSecureServer(tlsOptions, app);
|
||||
//
|
||||
// Why is that wrong?
|
||||
// Greenlock needs to change some low-level http and https options.
|
||||
// Use glx.httpsServer(tlsOptions, app) instead.
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
cluster: false
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
//
|
||||
// HTTP2 would have been the default httpsServer for node v12+
|
||||
// However... https://github.com/expressjs/express/issues/3388
|
||||
//
|
||||
|
||||
// Get the raw http2 server:
|
||||
var tlsOptions = null;
|
||||
var http2Server = glx.http2Server(tlsOptions, function(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
});
|
||||
|
||||
http2Server.listen(443, "0.0.0.0", function() {
|
||||
console.info("Listening on ", http2Server.address());
|
||||
});
|
||||
|
||||
// Note:
|
||||
// You must ALSO listen on port 80 for ACME HTTP-01 Challenges
|
||||
// (the ACME and http->https middleware are loaded by glx.httpServer)
|
||||
var httpServer = glx.httpServer();
|
||||
|
||||
httpServer.listen(80, "0.0.0.0", function() {
|
||||
console.info("Listening on ", httpServer.address());
|
||||
});
|
||||
}
|
||||
12
examples/https/package.json
Normal file
12
examples/https/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "https1-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
45
examples/https/server.js
Normal file
45
examples/https/server.js
Normal file
@ -0,0 +1,45 @@
|
||||
"use strict";
|
||||
|
||||
// The WRONG way:
|
||||
//var https = require('https');
|
||||
//var httpsServer = https.createServer(tlsOptions, app);
|
||||
//
|
||||
// Why is that wrong?
|
||||
// Greenlock needs to change some low-level http and https options.
|
||||
// Use glx.httpsServer(tlsOptions, app) instead.
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
cluster: false
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
//
|
||||
// HTTPS 1.1 is the default
|
||||
// (HTTP2 would be the default but... https://github.com/expressjs/express/issues/3388)
|
||||
//
|
||||
|
||||
// Get the raw https server:
|
||||
var httpsServer = glx.httpsServer(null, function(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
});
|
||||
|
||||
httpsServer.listen(443, "0.0.0.0", function() {
|
||||
console.info("Listening on ", httpsServer.address());
|
||||
});
|
||||
|
||||
// Note:
|
||||
// You must ALSO listen on port 80 for ACME HTTP-01 Challenges
|
||||
// (the ACME and http->https middleware are loaded by glx.httpServer)
|
||||
var httpServer = glx.httpServer();
|
||||
|
||||
httpServer.listen(80, "0.0.0.0", function() {
|
||||
console.info("Listening on ", httpServer.address());
|
||||
});
|
||||
}
|
||||
22
examples/quickstart/README.md
Normal file
22
examples/quickstart/README.md
Normal file
@ -0,0 +1,22 @@
|
||||
# Quick Start for Let's Encrypt with Node.js
|
||||
|
||||
```js
|
||||
npm install --save greenlock-express
|
||||
```
|
||||
|
||||
Manage via API or the config file:
|
||||
|
||||
`~/.config/greenlock/manage.json`: (default filesystem config)
|
||||
|
||||
```json
|
||||
{
|
||||
"subscriberEmail": "letsencrypt-test@therootcompany.com",
|
||||
"agreeToTerms": true,
|
||||
"sites": {
|
||||
"example.com": {
|
||||
"subject": "example.com",
|
||||
"altnames": ["example.com", "www.example.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
12
examples/quickstart/package.json
Normal file
12
examples/quickstart/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "quickstart-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
27
examples/quickstart/server.js
Normal file
27
examples/quickstart/server.js
Normal file
@ -0,0 +1,27 @@
|
||||
"use strict";
|
||||
|
||||
// This can be a node http app (shown),
|
||||
// an Express app, or Hapi, Koa, Rill, etc
|
||||
var app = function(req, res) {
|
||||
res.end("Hello, Encrypted World!");
|
||||
};
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
// Package name+version are taken from <packageRoot>/package.json and used for ACME client user agent
|
||||
packageRoot: __dirname,
|
||||
// configDir is relative to packageRoot, not _this_ file
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
// Maintainer email is the contact for critical bug and security notices
|
||||
// by default package.json.author.email will be used
|
||||
//maintainerEmail: "jon@example.com",
|
||||
|
||||
// Change to true when you're ready to make your app cloud-scale
|
||||
cluster: false
|
||||
})
|
||||
|
||||
// Serves on 80 and 443
|
||||
// Get's SSL certificates magically!
|
||||
.serve(app);
|
||||
@ -1,14 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
// Note: using staging server url, remove .testing() for production
|
||||
var lex = require('letsencrypt-express').testing();
|
||||
var express = require('express');
|
||||
var app = express();
|
||||
|
||||
app.use('/', function (req, res) {
|
||||
res.send({ success: true });
|
||||
});
|
||||
|
||||
lex.create('./letsencrypt.config', app).listen([80], [443, 5001], function () {
|
||||
console.log("ENCRYPT __ALL__ THE DOMAINS!");
|
||||
});
|
||||
12
examples/socket.io/package.json
Normal file
12
examples/socket.io/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "socket-io-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
46
examples/socket.io/server.js
Normal file
46
examples/socket.io/server.js
Normal file
@ -0,0 +1,46 @@
|
||||
// First and foremost:
|
||||
// I'm not a fan of `socket.io` because it's huge and complex.
|
||||
// I much prefer `ws` because it's very simple and easy.
|
||||
// That said, it's popular.......
|
||||
"use strict";
|
||||
|
||||
// Note: You DO NOT NEED socket.io
|
||||
// You can just use WebSockets
|
||||
// (see the websocket example)
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
cluster: false
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
var socketio = require("socket.io");
|
||||
var io;
|
||||
|
||||
// we need the raw https server
|
||||
var server = glx.httpsServer();
|
||||
|
||||
io = socketio(server);
|
||||
|
||||
// Then you do your socket.io stuff
|
||||
io.on("connection", function(socket) {
|
||||
console.log("a user connected");
|
||||
socket.emit("Welcome");
|
||||
|
||||
socket.on("chat message", function(msg) {
|
||||
socket.broadcast.emit("chat message", msg);
|
||||
});
|
||||
});
|
||||
|
||||
// servers a node app that proxies requests to a localhost
|
||||
glx.serveApp(function(req, res) {
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
res.end("Hello, World!\n\n💚 🔒.js");
|
||||
});
|
||||
}
|
||||
3
examples/spdy/server.js
Normal file
3
examples/spdy/server.js
Normal file
@ -0,0 +1,3 @@
|
||||
// SPDY is dead. It was replaced by HTTP2, which is a native node module
|
||||
//
|
||||
// Check out the http2 example just up one folder
|
||||
@ -1 +0,0 @@
|
||||
116.js
|
||||
12
examples/websockets/package.json
Normal file
12
examples/websockets/package.json
Normal file
@ -0,0 +1,12 @@
|
||||
{
|
||||
"name": "websockets-example",
|
||||
"version": "1.0.0",
|
||||
"description": "",
|
||||
"main": "server.js",
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1",
|
||||
"start": "node server.js"
|
||||
},
|
||||
"author": "John Doe <j.doe@example.com> (https://example.com/)",
|
||||
"license": "ISC"
|
||||
}
|
||||
39
examples/websockets/server.js
Normal file
39
examples/websockets/server.js
Normal file
@ -0,0 +1,39 @@
|
||||
"use strict";
|
||||
|
||||
//require("greenlock-express")
|
||||
require("../../")
|
||||
.init({
|
||||
packageRoot: __dirname,
|
||||
configDir: "./greenlock.d",
|
||||
|
||||
maintainerEmail: "jon@example.com",
|
||||
cluster: false
|
||||
})
|
||||
.ready(httpsWorker);
|
||||
|
||||
function httpsWorker(glx) {
|
||||
// we need the raw https server
|
||||
var server = glx.httpsServer();
|
||||
var WebSocket = require("ws");
|
||||
var ws = new WebSocket.Server({ server: server });
|
||||
ws.on("connection", function(ws, req) {
|
||||
// inspect req.headers.authorization (or cookies) for session info
|
||||
ws.send(
|
||||
"[Secure Echo Server] Hello!\nAuth: '" +
|
||||
(req.headers.authorization || "none") +
|
||||
"'\n" +
|
||||
"Cookie: '" +
|
||||
(req.headers.cookie || "none") +
|
||||
"'\n"
|
||||
);
|
||||
ws.on("message", function(data) {
|
||||
ws.send(data);
|
||||
});
|
||||
});
|
||||
|
||||
// servers a node app that proxies requests to a localhost
|
||||
glx.serveApp(function(req, res) {
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
res.end("Hello, World!\n\n💚 🔒.js");
|
||||
});
|
||||
}
|
||||
48
greenlock-express.js
Normal file
48
greenlock-express.js
Normal file
@ -0,0 +1,48 @@
|
||||
"use strict";
|
||||
|
||||
require("./lib/compat");
|
||||
var cluster = require("cluster");
|
||||
|
||||
// Greenlock Express
|
||||
var GLE = module.exports;
|
||||
|
||||
// Node's cluster is awesome, because it encourages writing scalable services.
|
||||
//
|
||||
// The point of this provide an API that is consistent between single-process
|
||||
// and multi-process services so that beginners can more easily take advantage
|
||||
// of what cluster has to offer.
|
||||
//
|
||||
// This API provides just enough abstraction to make it easy, but leaves just
|
||||
// enough hoopla so that there's not a large gap in understanding what happens
|
||||
// under the hood. That's the hope, anyway.
|
||||
|
||||
GLE.init = function(fn) {
|
||||
// See https://git.coolaj86.com/coolaj86/greenlock-express.js/issues/80
|
||||
if (fn && false !== fn.cluster && cluster.isWorker) {
|
||||
// ignore the init function and launch the worker
|
||||
return require("./worker.js").create();
|
||||
}
|
||||
|
||||
var opts;
|
||||
if ("function" === typeof fn) {
|
||||
opts = fn();
|
||||
} else if ("object" === typeof fn) {
|
||||
opts = fn;
|
||||
}
|
||||
if (!opts || "object" !== typeof opts) {
|
||||
throw new Error("the `Greenlock.init(fn)` function should return an object `{ packageRoot, cluster }`");
|
||||
}
|
||||
|
||||
// just for ironic humor
|
||||
["cloudnative", "cloudscale", "webscale", "distributed", "blockchain"].forEach(function(k) {
|
||||
if (opts[k]) {
|
||||
opts.cluster = true;
|
||||
}
|
||||
});
|
||||
|
||||
if (opts.cluster) {
|
||||
return require("./master.js").create(opts);
|
||||
}
|
||||
|
||||
return require("./single.js").create(opts);
|
||||
};
|
||||
72
greenlock-shim.js
Normal file
72
greenlock-shim.js
Normal file
@ -0,0 +1,72 @@
|
||||
"use strict";
|
||||
|
||||
module.exports.create = function(opts) {
|
||||
var Greenlock = require("@root/greenlock");
|
||||
//var Init = require("@root/greenlock/lib/init.js");
|
||||
var greenlock = opts.greenlock;
|
||||
|
||||
/*
|
||||
if (!greenlock && opts.packageRoot) {
|
||||
try {
|
||||
greenlock = require(path.resolve(opts.packageRoot, "greenlock.js"));
|
||||
} catch (e) {
|
||||
if ("MODULE_NOT_FOUND" !== e.code) {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
|
||||
if (!greenlock) {
|
||||
//opts = Init._init(opts);
|
||||
greenlock = Greenlock.create(opts);
|
||||
}
|
||||
opts.packageAgent = addGreenlockAgent(opts);
|
||||
|
||||
try {
|
||||
if (opts.notify) {
|
||||
greenlock._defaults.notify = opts.notify;
|
||||
}
|
||||
} catch (e) {
|
||||
console.error("Developer Error: notify not attached correctly");
|
||||
}
|
||||
|
||||
// re-export as top-level function to simplify rpc with workers
|
||||
greenlock.getAcmeHttp01ChallengeResponse = function(opts) {
|
||||
return greenlock.challenges.get(opts);
|
||||
};
|
||||
|
||||
greenlock._find({}).then(function(sites) {
|
||||
if (sites.length <= 0) {
|
||||
console.warn("Warning: `find({})` returned 0 sites.");
|
||||
console.warn(" Does `" + greenlock.manager._modulename + "` implement `find({})`?");
|
||||
console.warn(" Did you add sites?");
|
||||
console.warn(" npx greenlock add --subject example.com --altnames example.com");
|
||||
return;
|
||||
}
|
||||
console.info("Ready to Serve:");
|
||||
|
||||
var max = 3;
|
||||
if (sites.length >= 1) {
|
||||
sites.slice(0, max).forEach(function(site) {
|
||||
console.info("\t", site.altnames.join(" "));
|
||||
});
|
||||
}
|
||||
if (sites.length > max) {
|
||||
console.info("and %d others", sites.length - max);
|
||||
}
|
||||
});
|
||||
|
||||
return greenlock;
|
||||
};
|
||||
|
||||
function addGreenlockAgent(opts) {
|
||||
// Add greenlock as part of Agent, unless this is greenlock
|
||||
var packageAgent = opts.packageAgent || "";
|
||||
if (!/greenlock(-express|-pro)?/i.test(packageAgent)) {
|
||||
var pkg = require("./package.json");
|
||||
packageAgent += " Greenlock_Express/" + pkg.version;
|
||||
}
|
||||
|
||||
return packageAgent.trim();
|
||||
}
|
||||
154
http-middleware.js
Normal file
154
http-middleware.js
Normal file
@ -0,0 +1,154 @@
|
||||
"use strict";
|
||||
|
||||
var HttpMiddleware = module.exports;
|
||||
var servernameRe = /^[a-z0-9\.\-]+$/i;
|
||||
var challengePrefix = "/.well-known/acme-challenge/";
|
||||
|
||||
HttpMiddleware.create = function(gl, defaultApp) {
|
||||
if (defaultApp && "function" !== typeof defaultApp) {
|
||||
throw new Error("use greenlock.httpMiddleware() or greenlock.httpMiddleware(function (req, res) {})");
|
||||
}
|
||||
|
||||
return function(req, res, next) {
|
||||
var hostname = HttpMiddleware.sanitizeHostname(req);
|
||||
|
||||
req.on("error", function(err) {
|
||||
explainError(gl, err, "http_01_middleware_socket", hostname);
|
||||
});
|
||||
|
||||
// Skip unless the path begins with /.well-known/acme-challenge/
|
||||
if (!hostname || 0 !== req.url.indexOf(challengePrefix)) {
|
||||
skipChallenge(req, res, next, defaultApp);
|
||||
return;
|
||||
}
|
||||
|
||||
// HEADERS SENT DEBUG NOTE #2
|
||||
// at this point, it's most likely Let's Encrypt server
|
||||
// (or greenlock itself) performing the verification process
|
||||
// Hmmm... perhaps we should change the greenlock prefix to test
|
||||
// Anyway, we just got fast the first place where we could
|
||||
// be sending headers.
|
||||
|
||||
var token = req.url.slice(challengePrefix.length);
|
||||
|
||||
var done = false;
|
||||
var countA = 0;
|
||||
var countB = 0;
|
||||
gl.getAcmeHttp01ChallengeResponse({ type: "http-01", servername: hostname, token: token })
|
||||
.catch(function(err) {
|
||||
countA += 1;
|
||||
// HEADERS SENT DEBUG NOTE #3
|
||||
// This is the second possible time we could be sending headers
|
||||
respondToError(gl, res, err, "http_01_middleware_challenge_response", hostname);
|
||||
done = true;
|
||||
return { __done: true };
|
||||
})
|
||||
.then(function(result) {
|
||||
countB += 1;
|
||||
if (result && result.__done) {
|
||||
return;
|
||||
}
|
||||
if (done) {
|
||||
console.error("Sanity check fail: `done` is in a quantum state of both true and false... huh?");
|
||||
return;
|
||||
}
|
||||
// HEADERS SENT DEBUG NOTE #4b
|
||||
// This is the third/fourth possible time send headers
|
||||
return respondWithGrace(res, result, hostname, token);
|
||||
})
|
||||
.catch(function(err) {
|
||||
// HEADERS SENT DEBUG NOTE #5
|
||||
// I really don't see how this can be possible.
|
||||
// Every case appears to be accounted for
|
||||
console.error();
|
||||
console.error("[warning] Developer Error:" + (err.code || err.context || ""), countA, countB);
|
||||
console.error(err.stack);
|
||||
console.error();
|
||||
console.error(
|
||||
"This is probably the error that happens routinely on http2 connections, but we're not sure why."
|
||||
);
|
||||
console.error("To track the status or help contribute,");
|
||||
console.error("visit: https://git.rootprojects.org/root/greenlock-express.js/issues/9");
|
||||
console.error();
|
||||
try {
|
||||
res.end("Internal Server Error [1003]: See logs for details.");
|
||||
} catch (e) {
|
||||
// ignore
|
||||
}
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
function skipChallenge(req, res, next, defaultApp) {
|
||||
if ("function" === typeof defaultApp) {
|
||||
defaultApp(req, res, next);
|
||||
} else if ("function" === typeof next) {
|
||||
next();
|
||||
} else {
|
||||
res.statusCode = 500;
|
||||
res.end("[500] Developer Error: app.use('/', greenlock.httpMiddleware()) or greenlock.httpMiddleware(app)");
|
||||
}
|
||||
}
|
||||
|
||||
function respondWithGrace(res, result, hostname, token) {
|
||||
var keyAuth = result && result.keyAuthorization;
|
||||
|
||||
// HEADERS SENT DEBUG NOTE #4b
|
||||
// This is (still) the third/fourth possible time we could be sending headers
|
||||
if (keyAuth && "string" === typeof keyAuth) {
|
||||
res.setHeader("Content-Type", "text/plain; charset=utf-8");
|
||||
res.end(keyAuth);
|
||||
return;
|
||||
}
|
||||
|
||||
res.statusCode = 404;
|
||||
res.setHeader("Content-Type", "application/json; charset=utf-8");
|
||||
res.end(JSON.stringify({ error: { message: "domain '" + hostname + "' has no token '" + token + "'." } }));
|
||||
}
|
||||
|
||||
function explainError(gl, err, ctx, hostname) {
|
||||
if (!err.servername) {
|
||||
err.servername = hostname;
|
||||
}
|
||||
if (!err.context) {
|
||||
err.context = ctx;
|
||||
}
|
||||
// leaving this in the build for now because it will help with existing error reports
|
||||
console.error("[warning] network connection error:", (err.context || "") + " " + err.message);
|
||||
(gl.notify || gl._notify)("error", err);
|
||||
return err;
|
||||
}
|
||||
|
||||
function respondToError(gl, res, err, ctx, hostname) {
|
||||
// HEADERS SENT DEBUG NOTE #3b
|
||||
// This is (still) the second possible time we could be sending headers
|
||||
err = explainError(gl, err, ctx, hostname);
|
||||
res.statusCode = 500;
|
||||
res.end("Internal Server Error [1004]: See logs for details.");
|
||||
}
|
||||
|
||||
HttpMiddleware.getHostname = function(req) {
|
||||
return req.hostname || req.headers["x-forwarded-host"] || (req.headers.host || "");
|
||||
};
|
||||
HttpMiddleware.sanitizeHostname = function(req) {
|
||||
// we can trust XFH because spoofing causes no ham in this limited use-case scenario
|
||||
// (and only telebit would be legitimately setting XFH)
|
||||
var servername = HttpMiddleware.getHostname(req)
|
||||
.toLowerCase()
|
||||
.replace(/:.*/, "");
|
||||
try {
|
||||
req.hostname = servername;
|
||||
} catch (e) {
|
||||
// read-only express property
|
||||
}
|
||||
if (req.headers["x-forwarded-host"]) {
|
||||
req.headers["x-forwarded-host"] = servername;
|
||||
}
|
||||
try {
|
||||
req.headers.host = servername;
|
||||
} catch (e) {
|
||||
// TODO is this a possible error?
|
||||
}
|
||||
|
||||
return (servernameRe.test(servername) && -1 === servername.indexOf("..") && servername) || "";
|
||||
};
|
||||
139
https-middleware.js
Normal file
139
https-middleware.js
Normal file
@ -0,0 +1,139 @@
|
||||
"use strict";
|
||||
|
||||
var SanitizeHost = module.exports;
|
||||
var HttpMiddleware = require("./http-middleware.js");
|
||||
|
||||
SanitizeHost.create = function(gl, app) {
|
||||
return function(req, res, next) {
|
||||
function realNext() {
|
||||
if ("function" === typeof app) {
|
||||
app(req, res);
|
||||
} else if ("function" === typeof next) {
|
||||
next();
|
||||
} else {
|
||||
res.statusCode = 500;
|
||||
res.end("Error: no middleware assigned");
|
||||
}
|
||||
}
|
||||
|
||||
var hostname = HttpMiddleware.getHostname(req);
|
||||
// Replace the hostname, and get the safe version
|
||||
var safehost = HttpMiddleware.sanitizeHostname(req);
|
||||
|
||||
// if no hostname, move along
|
||||
if (!hostname) {
|
||||
realNext();
|
||||
return;
|
||||
}
|
||||
|
||||
// if there were unallowed characters, complain
|
||||
if (safehost.length !== hostname.length) {
|
||||
res.statusCode = 400;
|
||||
res.end("Malformed HTTP Header: 'Host: " + hostname + "'");
|
||||
return;
|
||||
}
|
||||
|
||||
// Note: This sanitize function is also called on plain sockets, which don't need Domain Fronting checks
|
||||
if (req.socket.encrypted) {
|
||||
if (req.socket && "string" === typeof req.socket.servername) {
|
||||
// Workaround for https://github.com/nodejs/node/issues/22389
|
||||
if (!SanitizeHost._checkServername(safehost, req.socket)) {
|
||||
res.statusCode = 400;
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
res.end(
|
||||
"<h1>Domain Fronting Error</h1>" +
|
||||
"<p>This connection was secured using TLS/SSL for '" +
|
||||
(req.socket.servername || "").toLowerCase() +
|
||||
"'</p>" +
|
||||
"<p>The HTTP request specified 'Host: " +
|
||||
safehost +
|
||||
"', which is (obviously) different.</p>" +
|
||||
"<p>Because this looks like a domain fronting attack, the connection has been terminated.</p>"
|
||||
);
|
||||
return;
|
||||
}
|
||||
}
|
||||
/*
|
||||
else if (safehost && !gl._skip_fronting_check) {
|
||||
|
||||
// We used to print a log message here, but it turns out that it's
|
||||
// really common for IoT devices to not use SNI (as well as many bots
|
||||
// and such).
|
||||
// It was common for the log message to pop up as the first request
|
||||
// to the server, and that was confusing. So instead now we do nothing.
|
||||
|
||||
//console.warn("no string for req.socket.servername," + " skipping fronting check for '" + safehost + "'");
|
||||
//gl._skip_fronting_check = true;
|
||||
}
|
||||
*/
|
||||
}
|
||||
|
||||
// carry on
|
||||
realNext();
|
||||
};
|
||||
};
|
||||
|
||||
var warnDomainFronting = true;
|
||||
var warnUnexpectedError = true;
|
||||
SanitizeHost._checkServername = function(safeHost, tlsSocket) {
|
||||
var servername = (tlsSocket.servername || "").toLowerCase();
|
||||
|
||||
// acceptable: older IoT devices may lack SNI support
|
||||
if (!servername) {
|
||||
return true;
|
||||
}
|
||||
// acceptable: odd... but acceptable
|
||||
if (!safeHost) {
|
||||
return true;
|
||||
}
|
||||
if (safeHost === servername) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if ("function" !== typeof tlsSocket.getCertificate) {
|
||||
// domain fronting attacks allowed
|
||||
if (warnDomainFronting) {
|
||||
// https://github.com/nodejs/node/issues/24095
|
||||
console.warn(
|
||||
"Warning: node " +
|
||||
process.version +
|
||||
" is vulnerable to domain fronting attacks. Please use node v11.2.0 or greater."
|
||||
);
|
||||
warnDomainFronting = false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// connection established with servername and session is re-used for allowed name
|
||||
// See https://github.com/nodejs/node/issues/24095
|
||||
var cert = tlsSocket.getCertificate();
|
||||
try {
|
||||
// TODO optimize / cache?
|
||||
// *should* always have a string, right?
|
||||
// *should* always be lowercase already, right?
|
||||
//console.log(safeHost, cert.subject.CN, cert.subjectaltname);
|
||||
var isSubject = (cert.subject.CN || "").toLowerCase() === safeHost;
|
||||
if (isSubject) {
|
||||
return true;
|
||||
}
|
||||
|
||||
var dnsnames = (cert.subjectaltname || "").split(/,\s+/);
|
||||
var inSanList = dnsnames.some(function(name) {
|
||||
// always prefixed with "DNS:"
|
||||
return safeHost === name.slice(4).toLowerCase();
|
||||
});
|
||||
|
||||
if (inSanList) {
|
||||
return true;
|
||||
}
|
||||
} catch (e) {
|
||||
// not sure what else to do in this situation...
|
||||
if (warnUnexpectedError) {
|
||||
console.warn("Warning: encoutered error while performing domain fronting check: " + e.message);
|
||||
warnUnexpectedError = false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
};
|
||||
14
install.sh
Normal file
14
install.sh
Normal file
@ -0,0 +1,14 @@
|
||||
# This is just an example (but it works)
|
||||
export NODE_PATH=$NPM_CONFIG_PREFIX/lib/node_modules
|
||||
export NPM_CONFIG_PREFIX=/opt/node
|
||||
curl -fsSL https://bit.ly/node-installer | bash
|
||||
|
||||
/opt/node/bin/node /opt/node/bin/npm config set scripts-prepend-node-path true
|
||||
/opt/node/bin/node /opt/node/bin/npm ci
|
||||
sudo setcap 'cap_net_bind_service=+ep' /opt/node/bin/node
|
||||
/opt/node/bin/node /opt/node/bin/npm start
|
||||
|
||||
sudo rsync -av dist/etc/systemd/system/greenlock-express.service /etc/systemd/system/
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
sudo systemctl restart greenlock-express
|
||||
@ -1,61 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var fs = require('fs');
|
||||
var path = require('path');
|
||||
var mkdirp = require('mkdirp');
|
||||
|
||||
// TODO handle templating :hostname in letsencrypt proper
|
||||
|
||||
// Note: we're explicitly doing this on the filesystem
|
||||
// rather than in-memory to support node cluster
|
||||
|
||||
module.exports = {
|
||||
set: function setChallenge(args, hostname, key, value, cb) {
|
||||
var webrootPath = args.webrootPath;
|
||||
var keyfile = path.join(webrootPath, key);
|
||||
|
||||
if (args.debug) {
|
||||
console.debug('[LEX] write file', hostname, webrootPath);
|
||||
console.debug('challenge:', key);
|
||||
console.debug('response:', value);
|
||||
}
|
||||
fs.writeFile(keyfile, value, 'utf8', function (err) {
|
||||
if (!err) { cb(null); return; }
|
||||
|
||||
|
||||
if (args.debug) {
|
||||
console.debug('[LEX] mkdirp', webrootPath);
|
||||
}
|
||||
mkdirp(webrootPath, function (err) {
|
||||
if (err) { cb(err); return; }
|
||||
|
||||
fs.writeFile(keyfile, value, 'utf8', cb);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
, get: function getChallenge(args, hostname, key, cb) {
|
||||
var keyfile = path.join(args.webrootPath, key);
|
||||
|
||||
if (args.debug) {
|
||||
console.debug('[LEX] getChallenge', keyfile, hostname, key);
|
||||
}
|
||||
fs.readFile(keyfile, 'utf8', function (err, text) {
|
||||
cb(null, text);
|
||||
});
|
||||
}
|
||||
|
||||
, remove: function removeChallenge(args, hostname, key, cb) {
|
||||
var keyfile = path.join(args.webrootPath, key);
|
||||
|
||||
// Note: it's not actually terribly important that we wait for the unlink callback
|
||||
// but it's a polite thing to do - and we're polite people!
|
||||
if (args.debug) {
|
||||
console.debug('[LEX] removeChallenge', keyfile, hostname, key);
|
||||
}
|
||||
fs.unlink(keyfile, function (err) {
|
||||
if (err) { console.warn(err.stack); }
|
||||
cb(null);
|
||||
});
|
||||
}
|
||||
};
|
||||
37
lib/compat.js
Normal file
37
lib/compat.js
Normal file
@ -0,0 +1,37 @@
|
||||
"use strict";
|
||||
|
||||
function requireBluebird() {
|
||||
try {
|
||||
return require("bluebird");
|
||||
} catch (e) {
|
||||
console.error("");
|
||||
console.error("DON'T PANIC. You're running an old version of node with incomplete Promise support.");
|
||||
console.error("EASY FIX: `npm install --save bluebird`");
|
||||
console.error("");
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
if ("undefined" === typeof Promise) {
|
||||
global.Promise = requireBluebird();
|
||||
}
|
||||
|
||||
if ("function" !== typeof require("util").promisify) {
|
||||
require("util").promisify = requireBluebird().promisify;
|
||||
}
|
||||
|
||||
if (!console.debug) {
|
||||
console.debug = console.log;
|
||||
}
|
||||
|
||||
var fs = require("fs");
|
||||
var fsAsync = {};
|
||||
Object.keys(fs).forEach(function(key) {
|
||||
var fn = fs[key];
|
||||
if ("function" !== typeof fn || !/[a-z]/.test(key[0])) {
|
||||
return;
|
||||
}
|
||||
fsAsync[key] = require("util").promisify(fn);
|
||||
});
|
||||
|
||||
exports.fsAsync = fsAsync;
|
||||
@ -1,41 +0,0 @@
|
||||
$(function () {
|
||||
'use strict';
|
||||
|
||||
var tpl = $('.js-hostnames').html();
|
||||
$('.js-hostnames').html('');
|
||||
|
||||
$('body').on('submit', 'form.js-add-site', function (ev) {
|
||||
ev.preventDefault();
|
||||
// I don't think this actually has any meaning when listening on body
|
||||
ev.stopPropagation();
|
||||
|
||||
var data = {
|
||||
email: $('.js-email').val()
|
||||
, agreeTos: !!$('.js-agree-tos').prop('checked')
|
||||
, server: $('.js-server').val()
|
||||
, domains: $('.js-domains').val().split(/\s*,\s*/)
|
||||
};
|
||||
|
||||
$.ajax({
|
||||
method: 'POST'
|
||||
, url: '/api/com.daplie.lex/sites'
|
||||
, data: JSON.stringify(data)
|
||||
, headers: { 'Content-Type': 'application/json; charset=utf-8' }
|
||||
}).then(function (data) {
|
||||
console.log(data);
|
||||
});
|
||||
});
|
||||
|
||||
$.ajax({
|
||||
method: 'GET'
|
||||
, url: '/api/com.daplie.lex/sites'
|
||||
}).then(function (data) {
|
||||
var $hostnames = $('.js-hostnames');
|
||||
$hostnames.html('');
|
||||
data.forEach(function (config) {
|
||||
var $conf = $(tpl);
|
||||
$conf.text(config.domains);
|
||||
$hostnames.append($conf);
|
||||
});
|
||||
});
|
||||
});
|
||||
@ -1,37 +0,0 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Welcome to :hostname!</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'self';">
|
||||
<link rel="stylesheet" type="text/css" href="./bootstrap.css">
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<div class="jumbotron">
|
||||
<h1>Add a Site</h1>
|
||||
<form class="js-add-site">
|
||||
<label>Domain</label>: <input type="text" class="js-domains" placeholder="ex: example.com,www.example.com">
|
||||
<br/>
|
||||
<label>Email</label>: <input type="email" class="js-email" placeholder="ex: user@example.com">
|
||||
<br/>
|
||||
<label>LE Server</label>: <input type="text" class="js-server" placeholder="ex: https://acme-staging.api.letsencrypt.org/directory" value="https://acme-v01.api.letsencrypt.org/directory">
|
||||
<br/>
|
||||
<label><input type="checkbox" class="js-agree-tos"> Agree to Let's Encrypt Terms of Service?</label>
|
||||
<br/>
|
||||
<button class="btn btn-primary" type="submit">Add Site</button>
|
||||
</form>
|
||||
</div>
|
||||
<div class="row">
|
||||
<p>Sites:
|
||||
<div class="js-hostnames-container">
|
||||
<ul class="js-hostnames">
|
||||
<li class="js-hostname"></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<script src="./jquery.js"></script>
|
||||
<script src="./app.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
6961
lib/public/bootstrap.css
vendored
6961
lib/public/bootstrap.css
vendored
File diff suppressed because it is too large
Load Diff
9210
lib/public/jquery.js
vendored
9210
lib/public/jquery.js
vendored
File diff suppressed because it is too large
Load Diff
@ -1,24 +0,0 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Welcome to :hostname!</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'self';">
|
||||
<link rel="stylesheet" type="text/css" href="./bootstrap.css">
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<div class="jumbotron">
|
||||
<h1>Hello, world!</h1>
|
||||
<p>Your website is located in one of two places:</p>
|
||||
<ul>
|
||||
<li>on your <code>Desktop</code> inside of the <code>www</code> directory and <code>:hostname</code></li>
|
||||
<li><code>~/www/:hostname</code> (your home folder, under <code>www/:hostname</code></li>
|
||||
<ul>
|
||||
<p>This very file is called <code>index.html</code>.
|
||||
You can open it up in <code>notepad</code> and change it up a little if you'd like.</p>
|
||||
</div>
|
||||
</div>
|
||||
<script src="./jquery.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@ -1,248 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var crypto = require('crypto');
|
||||
var tls = require('tls');
|
||||
|
||||
module.exports.create = function (opts) {
|
||||
var ipc = {}; // in-process cache
|
||||
|
||||
// function (/*err, hostname, certInfo*/) {}
|
||||
function handleRenewFailure(err, hostname, certInfo) {
|
||||
console.error("ERROR: Failed to renew domain '", hostname, "':");
|
||||
if (err) {
|
||||
console.error(err.stack || err);
|
||||
}
|
||||
if (certInfo) {
|
||||
console.error(certInfo);
|
||||
}
|
||||
}
|
||||
|
||||
if (!opts) { throw new Error("requires opts to be an object"); }
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] creating sniCallback", JSON.stringify(opts, function(k,v){
|
||||
if(v instanceof Array)
|
||||
return JSON.stringify(v);
|
||||
return v;
|
||||
},' '));
|
||||
}
|
||||
|
||||
if (!opts.letsencrypt) { throw new Error("requires opts.letsencrypt to be a letsencrypt instance"); }
|
||||
|
||||
if (!opts.lifetime) { opts.lifetime = 90 * 24 * 60 * 60 * 1000; }
|
||||
if (!opts.failedWait) { opts.failedWait = 5 * 60 * 1000; }
|
||||
if (!opts.renewWithin) { opts.renewWithin = 3 * 24 * 60 * 60 * 1000; }
|
||||
if (!opts.memorizeFor) { opts.memorizeFor = 1 * 24 * 60 * 60 * 1000; }
|
||||
|
||||
if (!opts.approveRegistration) { opts.approveRegistration = function (hostname, cb) { cb(null, null); }; }
|
||||
//opts.approveRegistration = function (hostname, cb) { cb(null, null); };
|
||||
if (!opts.handleRenewFailure) { opts.handleRenewFailure = handleRenewFailure; }
|
||||
|
||||
function assignBestByDates(now, certInfo) {
|
||||
certInfo = certInfo || { loadedAt: now, expiresAt: 0, issuedAt: 0, lifetime: 0 };
|
||||
|
||||
var rnds = crypto.randomBytes(3);
|
||||
var rnd1 = ((rnds[0] + 1) / 257);
|
||||
var rnd2 = ((rnds[1] + 1) / 257);
|
||||
var rnd3 = ((rnds[2] + 1) / 257);
|
||||
|
||||
// Stagger randomly by plus 0% to 25% to prevent all caches expiring at once
|
||||
var memorizeFor = Math.floor(opts.memorizeFor + ((opts.memorizeFor / 4) * rnd1));
|
||||
// Stagger randomly to renew between n and 2n days before renewal is due
|
||||
// this *greatly* reduces the risk of multiple cluster processes renewing the same domain at once
|
||||
var bestIfUsedBy = certInfo.expiresAt - (opts.renewWithin + Math.floor(opts.renewWithin * rnd2));
|
||||
// Stagger randomly by plus 0 to 5 min to reduce risk of multiple cluster processes
|
||||
// renewing at once on boot when the certs have expired
|
||||
var renewTimeout = Math.floor((5 * 60 * 1000) * rnd3);
|
||||
|
||||
certInfo.loadedAt = now;
|
||||
certInfo.memorizeFor = memorizeFor;
|
||||
certInfo.bestIfUsedBy = bestIfUsedBy;
|
||||
certInfo.renewTimeout = renewTimeout;
|
||||
|
||||
return certInfo;
|
||||
}
|
||||
|
||||
function renewInBackground(now, hostname, certInfo) {
|
||||
if ((now - certInfo.loadedAt) < opts.failedWait) {
|
||||
// wait a few minutes
|
||||
return;
|
||||
}
|
||||
|
||||
if (now > certInfo.bestIfUsedBy && !certInfo.timeout) {
|
||||
// EXPIRING
|
||||
if (now > certInfo.expiresAt) {
|
||||
// EXPIRED
|
||||
certInfo.renewTimeout = Math.floor(certInfo.renewTimeout / 2);
|
||||
}
|
||||
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] skipping stagger '" + certInfo.renewTimeout + "' and renewing '" + hostname + "' now");
|
||||
certInfo.renewTimeout = 500;
|
||||
}
|
||||
|
||||
certInfo.timeout = setTimeout(function () {
|
||||
var args = { domains: [ hostname ], duplicate: false };
|
||||
opts.letsencrypt.renew(args, function (err, certInfo) {
|
||||
if (err || !certInfo) {
|
||||
opts.handleRenewFailure(err, hostname, certInfo);
|
||||
}
|
||||
ipc[hostname] = assignBestByDates(now, certInfo);
|
||||
});
|
||||
}, certInfo.renewTimeout);
|
||||
}
|
||||
}
|
||||
|
||||
function cacheResult(err, hostname, certInfo, sniCb) {
|
||||
if (certInfo && certInfo.fullchain && certInfo.privkey) {
|
||||
if (opts.debug) {
|
||||
console.debug('cert is looking good');
|
||||
}
|
||||
|
||||
try {
|
||||
certInfo.tlsContext = tls.createSecureContext({
|
||||
key: certInfo.privkey || certInfo.key // privkey.pem
|
||||
, cert: certInfo.fullchain || certInfo.cert // fullchain.pem (cert.pem + '\n' + chain.pem)
|
||||
});
|
||||
} catch(e) {
|
||||
console.warn("[Sanity Check Fail]: a weird object was passed back through le.fetch to lex.fetch");
|
||||
console.warn("(either missing or malformed certInfo.key and / or certInfo.fullchain)");
|
||||
err = e;
|
||||
}
|
||||
|
||||
sniCb(err, certInfo.tlsContext);
|
||||
} else {
|
||||
if (opts.debug) {
|
||||
console.debug('cert is NOT looking good');
|
||||
}
|
||||
sniCb(err || new Error("couldn't get certInfo: unknown"), null);
|
||||
}
|
||||
|
||||
var now = Date.now();
|
||||
certInfo = ipc[hostname] = assignBestByDates(now, certInfo);
|
||||
renewInBackground(now, hostname, certInfo);
|
||||
}
|
||||
|
||||
function registerCert(hostname, sniCb) {
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] '" + hostname + "' is not registered, requesting approval");
|
||||
}
|
||||
|
||||
opts.approveRegistration(hostname, function (err, args) {
|
||||
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] '" + hostname + "' registration approved, attempting register");
|
||||
}
|
||||
|
||||
if (err) {
|
||||
cacheResult(err, hostname, null, sniCb);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!(args && args.agreeTos && args.email && args.domains)) {
|
||||
cacheResult(new Error("not approved or approval is missing arguments - such as agreeTos, email, domains"), hostname, null, sniCb);
|
||||
return;
|
||||
}
|
||||
|
||||
opts.letsencrypt.register(args, function (err, certInfo) {
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] '" + hostname + "' register completed", err && err.stack || null, certInfo);
|
||||
if ((!err || !err.stack) && !certInfo) {
|
||||
console.error((new Error("[LEX] SANITY FAIL: no error and yet no certs either")).stack);
|
||||
}
|
||||
}
|
||||
|
||||
cacheResult(err, hostname, certInfo, sniCb);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function fetch(hostname, sniCb) {
|
||||
opts.letsencrypt.fetch({ domains: [hostname] }, function (err, certInfo) {
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] fetch from disk result '" + hostname + "':");
|
||||
console.debug(certInfo && Object.keys(certInfo));
|
||||
if (err) {
|
||||
console.error(err.stack || err);
|
||||
}
|
||||
}
|
||||
|
||||
if (err) {
|
||||
sniCb(err, null);
|
||||
return;
|
||||
}
|
||||
|
||||
if (certInfo) {
|
||||
cacheResult(err, hostname, certInfo, sniCb);
|
||||
return;
|
||||
}
|
||||
|
||||
registerCert(hostname, sniCb);
|
||||
});
|
||||
}
|
||||
|
||||
return function sniCallback(hostname, cb) {
|
||||
var now = Date.now();
|
||||
var certInfo = ipc[hostname];
|
||||
|
||||
|
||||
|
||||
//
|
||||
// No cert is available in cache.
|
||||
// try to fetch it from disk quickly
|
||||
// and return to the browser
|
||||
//
|
||||
if (!certInfo) {
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] no certs loaded for '" + hostname + "'");
|
||||
}
|
||||
fetch(hostname, cb);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
|
||||
//
|
||||
// A cert is available
|
||||
// See if it's old enough that
|
||||
// we should refresh it from disk
|
||||
// (in the background)
|
||||
//
|
||||
// TODO once ECDSA is available, wait for cert renewal if its due (maybe?)
|
||||
if (certInfo.tlsContext) {
|
||||
cb(null, certInfo.tlsContext);
|
||||
|
||||
if ((now - certInfo.loadedAt) < (certInfo.memorizeFor)) {
|
||||
// these aren't stale, so don't fall through
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] certs for '" + hostname + "' are fresh from disk");
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
else if ((now - certInfo.loadedAt) < opts.failedWait) {
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] certs for '" + hostname + "' recently failed and are still in cool down");
|
||||
}
|
||||
// this was just fetched and failed, wait a few minutes
|
||||
cb(null, null);
|
||||
return;
|
||||
}
|
||||
|
||||
if (opts.debug) {
|
||||
console.debug("[LEX] certs for '" + hostname + "' are stale on disk and should be will be fetched again");
|
||||
console.debug({
|
||||
age: now - certInfo.loadedAt
|
||||
, loadedAt: certInfo.loadedAt
|
||||
, issuedAt: certInfo.issuedAt
|
||||
, expiresAt: certInfo.expiresAt
|
||||
, privkey: !!certInfo.privkey
|
||||
, chain: !!certInfo.chain
|
||||
, fullchain: !!certInfo.fullchain
|
||||
, cert: !!certInfo.cert
|
||||
, memorizeFor: certInfo.memorizeFor
|
||||
, failedWait: opts.failedWait
|
||||
});
|
||||
}
|
||||
fetch(hostname, cb);
|
||||
};
|
||||
};
|
||||
@ -1,329 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
var path = require('path');
|
||||
var challengeStore = require('./challenge-handlers');
|
||||
var createSniCallback = require('./sni-callback').create;
|
||||
var LE = require('letsencrypt');
|
||||
|
||||
function createAcmeResponder(lex, onRequest) {
|
||||
|
||||
function httpAcmeResponder(req, res) {
|
||||
if (lex.debug) {
|
||||
console.debug('[LEX] ', req.method, req.headers.host, req.url);
|
||||
}
|
||||
var acmeChallengePrefix = '/.well-known/acme-challenge/';
|
||||
|
||||
if (0 !== req.url.indexOf(acmeChallengePrefix)) {
|
||||
onRequest(req, res);
|
||||
return;
|
||||
}
|
||||
|
||||
var key = req.url.slice(acmeChallengePrefix.length);
|
||||
|
||||
// lex = { debug, webrootPath }
|
||||
lex.getChallenge(lex, req.headers.host, key, function (err, val) {
|
||||
if (lex.debug) {
|
||||
console.debug('[LEX] GET challenge, response:');
|
||||
console.debug('challenge:', key);
|
||||
console.debug('response:', val);
|
||||
if (err) {
|
||||
console.debug(err.stack);
|
||||
}
|
||||
}
|
||||
res.end(val || '_');
|
||||
});
|
||||
}
|
||||
|
||||
return httpAcmeResponder;
|
||||
}
|
||||
|
||||
function lexHelper(obj, app) {
|
||||
var defaultPems = require('localhost.daplie.com-certificates');
|
||||
|
||||
if (!obj) {
|
||||
obj = {};
|
||||
}
|
||||
|
||||
if ('string' === typeof obj) {
|
||||
obj = {
|
||||
configDir: obj
|
||||
};
|
||||
}
|
||||
|
||||
if ('function' === typeof obj) {
|
||||
obj = {
|
||||
onRequest: obj
|
||||
};
|
||||
}
|
||||
|
||||
obj.debug = LEX.debug;
|
||||
|
||||
if ('function' === typeof app) {
|
||||
obj.onRequest = obj.onRequest || app;
|
||||
}
|
||||
|
||||
if (!obj.getChallenge) {
|
||||
if (false !== obj.getChallenge) {
|
||||
obj.getChallenge = LEX.getChallenge;
|
||||
}
|
||||
if (!obj.webrootPath) {
|
||||
obj.webrootPath = path.join(require('os').tmpdir(), 'acme-challenge');
|
||||
}
|
||||
}
|
||||
|
||||
// BEGIN LetsEncrypt options
|
||||
if (!obj.configDir) {
|
||||
obj.configDir = path.join(require('homedir')(), '/letsencrypt/etc');
|
||||
}
|
||||
if (!obj.privkeyPath) {
|
||||
obj.privkeyPath = ':config/live/:hostname/privkey.pem';
|
||||
}
|
||||
if (!obj.fullchainPath) {
|
||||
obj.fullchainPath = ':config/live/:hostname/fullchain.pem';
|
||||
}
|
||||
if (!obj.certPath) {
|
||||
obj.certPath = ':config/live/:hostname/cert.pem';
|
||||
}
|
||||
if (!obj.chainPath) {
|
||||
obj.chainPath = ':config/live/:hostname/chain.pem';
|
||||
}
|
||||
if (!obj.server) {
|
||||
obj.server = LEX.defaultServerUrl;
|
||||
}
|
||||
// END LetsEncrypt options
|
||||
|
||||
obj.getChallenge = obj.getChallenge || LEX.getChallenge;
|
||||
obj.setChallenge = obj.setChallenge || LEX.setChallenge;
|
||||
obj.removeChallenge = obj.removeChallenge || LEX.removeChallenge;
|
||||
|
||||
if (!obj.letsencrypt) {
|
||||
//LE.merge(obj, );
|
||||
// { configDir, webrootPath, server }
|
||||
obj.letsencrypt = LE.create(obj, {
|
||||
setChallenge: obj.setChallenge
|
||||
, removeChallenge: obj.removeChallenge
|
||||
});
|
||||
}
|
||||
|
||||
var httpsOptions = obj.httpsOptions || {};
|
||||
var sniCallback = httpsOptions.SNICallback;
|
||||
|
||||
// https://nodejs.org/api/https.html
|
||||
// pfx, key, cert, passphrase, ca, ciphers, rejectUnauthorized, secureProtocol
|
||||
if (!httpsOptions.pfx) {
|
||||
if (!(httpsOptions.cert || httpsOptions.key)) {
|
||||
httpsOptions.key = defaultPems.key;
|
||||
httpsOptions.cert = defaultPems.cert;
|
||||
}
|
||||
else if (!(httpsOptions.cert && httpsOptions.key)) {
|
||||
if (!httpsOptions.cert) {
|
||||
console.warn("You specified httpsOptions.cert, but not httpsOptions.key");
|
||||
}
|
||||
if (!httpsOptions.key) {
|
||||
console.warn("You specified httpsOptions.key, but not httpsOptions.cert");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!obj.approveRegistration && LEX.defaultApproveRegistration) {
|
||||
obj.approveRegistration = function (domain, cb) {
|
||||
if (obj.debug) {
|
||||
console.debug('[LEX] auto register against staging server');
|
||||
}
|
||||
cb(null, {
|
||||
email: 'example@gmail.com'
|
||||
, domains: [domain]
|
||||
, agreeTos: true
|
||||
, server: LEX.stagingServerUrl
|
||||
});
|
||||
};
|
||||
}
|
||||
|
||||
if (obj.sniCallback) {
|
||||
if (sniCallback) {
|
||||
console.warn("You specified both args.sniCallback and args.httpsOptions.SNICallback,"
|
||||
+ " but only args.sniCallback will be used.");
|
||||
}
|
||||
httpsOptions.SNICallback = obj.sniCallback;
|
||||
}
|
||||
else if (sniCallback) {
|
||||
obj._sniCallback = createSniCallback(obj);
|
||||
httpsOptions.SNICallback = function (domain, cb) {
|
||||
sniCallback(domain, function (err, context) {
|
||||
if (context) {
|
||||
cb(err, context);
|
||||
return;
|
||||
}
|
||||
|
||||
obj._sniCallback(domain, cb);
|
||||
});
|
||||
};
|
||||
}
|
||||
else {
|
||||
httpsOptions.SNICallback = createSniCallback(obj);
|
||||
}
|
||||
|
||||
obj.httpsOptions = httpsOptions;
|
||||
|
||||
return obj;
|
||||
}
|
||||
|
||||
function LEX(obj, app) {
|
||||
var https = require('http2');
|
||||
var http = require('http');
|
||||
|
||||
function listen(plainPorts, tlsPorts, onListening) {
|
||||
if (!(obj.onRequest || (obj.onHttpRequest && obj.onHttpsRequest)) && false !== obj.onRequest) {
|
||||
console.warn("You should either do args.onRequest = app or server.on('request', app),"
|
||||
+ " otherwise only acme-challenge requests will be handled (and the rest will hang)");
|
||||
console.warn("You can silence this warning by setting args.onRequest = false");
|
||||
}
|
||||
obj.httpAcmeResponder = createAcmeResponder(obj, obj.onHttpRequest || obj.onRequest);
|
||||
obj.httpsAcmeResponder = createAcmeResponder(obj, obj.onHttpsRequest || obj.onRequest);
|
||||
|
||||
if (plainPorts && (!Array.isArray(plainPorts) || !Array.isArray(tlsPorts))) {
|
||||
throw new Error(".listen() must be used with plain and tls port arrays, like this: `.listen([80], [443, 5001], function () {})`");
|
||||
}
|
||||
|
||||
var results = {
|
||||
plainServers: []
|
||||
, tlsServers: []
|
||||
};
|
||||
|
||||
plainPorts = plainPorts || [80];
|
||||
tlsPorts = tlsPorts || [443, 5001];
|
||||
|
||||
function defaultOnListening() {
|
||||
/*jshint validthis: true*/
|
||||
var server = this;
|
||||
var protocol = ('honorCipherOrder' in server || 'rejectUnauthorized' in server) ? 'https': 'http';
|
||||
var addr = server.address();
|
||||
var port;
|
||||
|
||||
if (80 === addr.port || 443 === addr.port) {
|
||||
port = '';
|
||||
} else {
|
||||
port = ':' + addr.port;
|
||||
}
|
||||
console.info('Listening ' + protocol + '://' + addr.address + port + '/');
|
||||
}
|
||||
|
||||
plainPorts.forEach(function (addr) {
|
||||
var port = addr.port || addr;
|
||||
var address = addr.address || '';
|
||||
var server = http.createServer(obj.httpAcmeResponder);
|
||||
|
||||
server.__le_onListening = addr.onListen;
|
||||
server.__le_port = port;
|
||||
server.__le_address = address;
|
||||
|
||||
results.plainServers.push(server);
|
||||
});
|
||||
|
||||
tlsPorts.forEach(function (addr) {
|
||||
var port = addr.port || addr;
|
||||
var address = addr.address || '';
|
||||
var options = addr.httpsOptions || obj.httpsOptions;
|
||||
var server = https.createServer(options, obj.httpsAcmeResponder);
|
||||
|
||||
server.__le_onListen = addr.onListen;
|
||||
server.__le_port = port;
|
||||
server.__le_address = address;
|
||||
|
||||
results.tlsServers.push(server);
|
||||
});
|
||||
|
||||
results.plainServers.forEach(function (server) {
|
||||
var listen = server.__le_onListening || onListening || defaultOnListening;
|
||||
server.listen(server.__le_port, server.__le_address, listen);
|
||||
});
|
||||
|
||||
results.tlsServers.forEach(function (server) {
|
||||
var listen = server.__le_onListening || onListening || defaultOnListening;
|
||||
server.listen(server.__le_port, server.__le_address, listen);
|
||||
});
|
||||
|
||||
// deleting creates a "slow object", but that's okay (we only use it once)
|
||||
return results;
|
||||
}
|
||||
|
||||
obj = lexHelper(obj, app);
|
||||
obj.listen = listen;
|
||||
|
||||
return obj;
|
||||
}
|
||||
|
||||
module.exports = LEX;
|
||||
|
||||
LEX.create = LEX;
|
||||
LEX.createServers = LEX;
|
||||
LEX.setChallenge = challengeStore.set;
|
||||
LEX.getChallenge = challengeStore.get;
|
||||
LEX.removeChallenge = challengeStore.remove;
|
||||
LEX.createSniCallback = createSniCallback;
|
||||
// TODO not sure how well this works
|
||||
LEX.middleware = function (defaults) {
|
||||
var leCore = require('letiny-core');
|
||||
var merge = require('letsencrypt/common').merge;
|
||||
var tplConfigDir = require('letsencrypt/common').tplConfigDir;
|
||||
var tplHostname = require('letsencrypt/common').tplHostname;
|
||||
var prefix = leCore.acmeChallengePrefix;
|
||||
|
||||
tplConfigDir(defaults.configDir || '', defaults);
|
||||
|
||||
return function (req, res, next) {
|
||||
if (LEX.debug) {
|
||||
console.debug('[LEX middleware]:', req.hostname, req.url, req.url.slice(prefix.length));
|
||||
}
|
||||
|
||||
if (0 !== req.url.indexOf(prefix)) {
|
||||
next();
|
||||
return;
|
||||
}
|
||||
|
||||
function done(err, token) {
|
||||
if (err) {
|
||||
res.send("Error: These aren't the tokens you're looking for. Move along.");
|
||||
return;
|
||||
}
|
||||
|
||||
res.send(token);
|
||||
}
|
||||
|
||||
var copy = merge(defaults, { domains: [req.hostname] });
|
||||
tplHostname(req.hostname, copy);
|
||||
|
||||
LEX.getChallenge(copy, req.hostname, req.url.slice(prefix.length), done);
|
||||
};
|
||||
};
|
||||
|
||||
LEX.stagingServerUrl = LE.stagingServerUrl;
|
||||
LEX.productionServerUrl = LE.productionServerUrl || LE.liveServerUrl;
|
||||
LEX.defaultServerUrl = LEX.productionServerUrl;
|
||||
LEX.createAcmeResponder = createAcmeResponder;
|
||||
LEX.normalizeOptions = lexHelper;
|
||||
LEX.testing = function () {
|
||||
LEX.debug = true;
|
||||
LEX.defaultServerUrl = LEX.stagingServerUrl;
|
||||
LEX.defaultApproveRegistration = true;
|
||||
console.debug = console.log;
|
||||
console.debug('[LEX] testing mode turned on');
|
||||
console.debug('[LEX] default server: ' + LEX.defaultServerUrl);
|
||||
console.debug('\n');
|
||||
console.debug('###################################################');
|
||||
console.debug('# #');
|
||||
console.debug('# Open up a browser and visit this server #');
|
||||
console.debug('# at its domain name. #');
|
||||
console.debug('# #');
|
||||
console.debug('# ENJOY! #');
|
||||
console.debug('# #');
|
||||
console.debug('###################################################');
|
||||
console.debug('\n');
|
||||
console.debug('Note: testing certs will be installed because .testing() was called.');
|
||||
console.debug(' remove .testing() to get live certs.');
|
||||
console.debug('\n');
|
||||
console.debug('[LEX] automatic registration handling turned on for testing.');
|
||||
console.debug('\n');
|
||||
|
||||
return module.exports;
|
||||
};
|
||||
32
main.js
Normal file
32
main.js
Normal file
@ -0,0 +1,32 @@
|
||||
"use strict";
|
||||
|
||||
// this is the stuff that should run in the main foreground process,
|
||||
// whether it's single or master
|
||||
|
||||
var major = process.versions.node.split(".")[0];
|
||||
var minor = process.versions.node.split(".")[1];
|
||||
var _hasSetSecureContext = false;
|
||||
var shouldUpgrade = false;
|
||||
|
||||
// this applies to http2 as well (should exist in both or neither)
|
||||
_hasSetSecureContext = !!require("https").createServer({}, function() {}).setSecureContext;
|
||||
|
||||
// TODO document in issues
|
||||
if (!_hasSetSecureContext) {
|
||||
// TODO this isn't necessary if greenlock options are set with options.cert
|
||||
console.warn("Warning: node " + process.version + " is missing tlsSocket.setSecureContext().");
|
||||
console.warn(" The default certificate may not be set.");
|
||||
shouldUpgrade = true;
|
||||
}
|
||||
|
||||
if (major < 11 || (11 === major && minor < 2)) {
|
||||
// https://github.com/nodejs/node/issues/24095
|
||||
console.warn("Warning: node " + process.version + " is missing tlsSocket.getCertificate().");
|
||||
console.warn(" This is necessary to guard against domain fronting attacks.");
|
||||
shouldUpgrade = true;
|
||||
}
|
||||
|
||||
if (shouldUpgrade) {
|
||||
console.warn("Warning: Please upgrade to node v11.2.0 or greater.");
|
||||
console.warn();
|
||||
}
|
||||
164
master.js
Normal file
164
master.js
Normal file
@ -0,0 +1,164 @@
|
||||
"use strict";
|
||||
|
||||
require("./main.js");
|
||||
|
||||
var Master = module.exports;
|
||||
|
||||
var cluster = require("cluster");
|
||||
var os = require("os");
|
||||
var msgPrefix = "greenlock:";
|
||||
|
||||
Master.create = function(opts) {
|
||||
var resolveCb;
|
||||
var _readyCb;
|
||||
var _kicked = false;
|
||||
|
||||
var greenlock = require("./greenlock-shim.js").create(opts);
|
||||
|
||||
var ready = new Promise(function(resolve) {
|
||||
resolveCb = resolve;
|
||||
}).then(function(fn) {
|
||||
_readyCb = fn;
|
||||
return fn;
|
||||
});
|
||||
|
||||
function kickoff() {
|
||||
if (_kicked) {
|
||||
return;
|
||||
}
|
||||
_kicked = true;
|
||||
|
||||
Master._spawnWorkers(opts, greenlock);
|
||||
|
||||
ready.then(function(fn) {
|
||||
// not sure what this API should be yet
|
||||
fn();
|
||||
});
|
||||
}
|
||||
|
||||
var master = {
|
||||
ready: function() {
|
||||
kickoff();
|
||||
return master;
|
||||
},
|
||||
master: function(fn) {
|
||||
if (_readyCb) {
|
||||
throw new Error("can't call master twice");
|
||||
}
|
||||
kickoff();
|
||||
resolveCb(fn);
|
||||
return master;
|
||||
},
|
||||
serve: function(fn) {
|
||||
// ignore
|
||||
master.ready(fn);
|
||||
}
|
||||
};
|
||||
return master;
|
||||
};
|
||||
|
||||
function range(n) {
|
||||
n = parseInt(n, 10);
|
||||
if (!n) {
|
||||
return [];
|
||||
}
|
||||
return new Array(n).join(",").split(",");
|
||||
}
|
||||
|
||||
Master._spawnWorkers = function(opts, greenlock) {
|
||||
var numCpus = parseInt(process.env.NUMBER_OF_PROCESSORS, 10) || os.cpus().length;
|
||||
|
||||
// process rpc messages
|
||||
// start when dead
|
||||
var numWorkers = parseInt(opts.workers || opts.numWorkers, 10);
|
||||
if (!numWorkers) {
|
||||
if (numCpus <= 2) {
|
||||
numWorkers = 2;
|
||||
} else {
|
||||
numWorkers = numCpus - 1;
|
||||
}
|
||||
}
|
||||
|
||||
cluster.once("exit", function() {
|
||||
setTimeout(function() {
|
||||
process.exit(3);
|
||||
}, 100);
|
||||
});
|
||||
|
||||
var workers = range(numWorkers);
|
||||
function next() {
|
||||
if (!workers.length) {
|
||||
return;
|
||||
}
|
||||
workers.pop();
|
||||
|
||||
// for a nice aesthetic
|
||||
setTimeout(function() {
|
||||
Master._spawnWorker(opts, greenlock);
|
||||
next();
|
||||
}, 250);
|
||||
}
|
||||
|
||||
next();
|
||||
};
|
||||
|
||||
Master._spawnWorker = function(opts, greenlock) {
|
||||
var w = cluster.fork();
|
||||
// automatically added to master's `cluster.workers`
|
||||
w.once("exit", function(code, signal) {
|
||||
// TODO handle failures
|
||||
// Should test if the first starts successfully
|
||||
// Should exit if failures happen too quickly
|
||||
|
||||
// For now just kill all when any die
|
||||
if (signal) {
|
||||
console.error("worker was killed by signal:", signal);
|
||||
} else if (code !== 0) {
|
||||
console.error("worker exited with error code:", code);
|
||||
} else {
|
||||
console.error("worker unexpectedly quit without exit code or signal");
|
||||
}
|
||||
process.exit(2);
|
||||
|
||||
//addWorker();
|
||||
});
|
||||
|
||||
function handleMessage(msg) {
|
||||
if (0 !== (msg._id || "").indexOf(msgPrefix)) {
|
||||
return;
|
||||
}
|
||||
if ("string" !== typeof msg._funcname) {
|
||||
// TODO developer error
|
||||
return;
|
||||
}
|
||||
|
||||
function rpc() {
|
||||
return greenlock[msg._funcname](msg._input)
|
||||
.then(function(result) {
|
||||
w.send({
|
||||
_id: msg._id,
|
||||
_result: result
|
||||
});
|
||||
})
|
||||
.catch(function(e) {
|
||||
var error = new Error(e.message);
|
||||
Object.getOwnPropertyNames(e).forEach(function(k) {
|
||||
error[k] = e[k];
|
||||
});
|
||||
w.send({
|
||||
_id: msg._id,
|
||||
_error: error
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
try {
|
||||
rpc();
|
||||
} catch (e) {
|
||||
console.error("Unexpected and uncaught greenlock." + msg._funcname + " error:");
|
||||
console.error(e);
|
||||
}
|
||||
}
|
||||
|
||||
w.on("message", handleMessage);
|
||||
};
|
||||
149
package-lock.json
generated
Normal file
149
package-lock.json
generated
Normal file
@ -0,0 +1,149 @@
|
||||
{
|
||||
"name": "@root/greenlock-express",
|
||||
"version": "4.0.4",
|
||||
"lockfileVersion": 1,
|
||||
"requires": true,
|
||||
"dependencies": {
|
||||
"@greenlock/manager": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@greenlock/manager/-/manager-3.1.0.tgz",
|
||||
"integrity": "sha512-PBy5CMK+j4oD7sj7hF5qE+xKEOSiiuL2hHd5X5ttEbtnTSDKjNeqbrR5k2ZddwVNdjOVeBIeuqlm81IFZ+Ftew==",
|
||||
"requires": {
|
||||
"greenlock-manager-fs": "^3.1.0"
|
||||
}
|
||||
},
|
||||
"@root/acme": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.1.0.tgz",
|
||||
"integrity": "sha512-GAyaW63cpSYd2KvVp5lHLbCWeEhJPKZK9nsJvZJOKsD9Uv88KEttn4FpDZEJ+2q3Jsey0DWpuQ2I4ft0JV9p2w==",
|
||||
"requires": {
|
||||
"@root/csr": "^0.8.1",
|
||||
"@root/encoding": "^1.0.1",
|
||||
"@root/keypairs": "^0.10.0",
|
||||
"@root/pem": "^1.0.4",
|
||||
"@root/request": "^1.6.1",
|
||||
"@root/x509": "^0.7.2"
|
||||
}
|
||||
},
|
||||
"@root/asn1": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@root/asn1/-/asn1-1.0.0.tgz",
|
||||
"integrity": "sha512-0lfZNuOULKJDJmdIkP8V9RnbV3XaK6PAHD3swnFy4tZwtlMDzLKoM/dfNad7ut8Hu3r91wy9uK0WA/9zym5mig==",
|
||||
"requires": {
|
||||
"@root/encoding": "^1.0.1"
|
||||
}
|
||||
},
|
||||
"@root/csr": {
|
||||
"version": "0.8.1",
|
||||
"resolved": "https://registry.npmjs.org/@root/csr/-/csr-0.8.1.tgz",
|
||||
"integrity": "sha512-hKl0VuE549TK6SnS2Yn9nRvKbFZXn/oAg+dZJU/tlKl/f/0yRXeuUzf8akg3JjtJq+9E592zDqeXZ7yyrg8fSQ==",
|
||||
"requires": {
|
||||
"@root/asn1": "^1.0.0",
|
||||
"@root/pem": "^1.0.4",
|
||||
"@root/x509": "^0.7.2"
|
||||
}
|
||||
},
|
||||
"@root/encoding": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@root/encoding/-/encoding-1.0.1.tgz",
|
||||
"integrity": "sha512-OaEub02ufoU038gy6bsNHQOjIn8nUjGiLcaRmJ40IUykneJkIW5fxDqKxQx48cszuNflYldsJLPPXCrGfHs8yQ=="
|
||||
},
|
||||
"@root/greenlock": {
|
||||
"version": "4.0.5",
|
||||
"resolved": "https://registry.npmjs.org/@root/greenlock/-/greenlock-4.0.5.tgz",
|
||||
"integrity": "sha512-KR9w3mYE9aH33FCibI8oSYBQV+f7lc3MVPdZ9nxY2tqRLmJp05cMOMz340mtG14VnWDuznLj4TbBj3sHIuoQPQ==",
|
||||
"requires": {
|
||||
"@greenlock/manager": "^3.1.0",
|
||||
"@root/acme": "^3.1.0",
|
||||
"@root/csr": "^0.8.1",
|
||||
"@root/keypairs": "^0.10.0",
|
||||
"@root/mkdirp": "^1.0.0",
|
||||
"@root/request": "^1.6.1",
|
||||
"acme-http-01-standalone": "^3.0.5",
|
||||
"cert-info": "^1.5.1",
|
||||
"greenlock-store-fs": "^3.2.2",
|
||||
"safe-replace": "^1.1.0"
|
||||
}
|
||||
},
|
||||
"@root/keypairs": {
|
||||
"version": "0.10.0",
|
||||
"resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.10.0.tgz",
|
||||
"integrity": "sha512-t8VocY46Mtb0NTsxzyLLf5tsgfw0BXLYVADAyiRdEdqHcvPFGJdjkXNtHVQuSV/FMaC65iTOHVP4E6X8iT3Ikg==",
|
||||
"requires": {
|
||||
"@root/encoding": "^1.0.1",
|
||||
"@root/pem": "^1.0.4",
|
||||
"@root/x509": "^0.7.2"
|
||||
}
|
||||
},
|
||||
"@root/mkdirp": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@root/mkdirp/-/mkdirp-1.0.0.tgz",
|
||||
"integrity": "sha512-hxGAYUx5029VggfG+U9naAhQkoMSXtOeXtbql97m3Hi6/sQSRL/4khKZPyOF6w11glyCOU38WCNLu9nUcSjOfA=="
|
||||
},
|
||||
"@root/pem": {
|
||||
"version": "1.0.4",
|
||||
"resolved": "https://registry.npmjs.org/@root/pem/-/pem-1.0.4.tgz",
|
||||
"integrity": "sha512-rEUDiUsHtild8GfIjFE9wXtcVxeS+ehCJQBwbQQ3IVfORKHK93CFnRtkr69R75lZFjcmKYVc+AXDB+AeRFOULA=="
|
||||
},
|
||||
"@root/request": {
|
||||
"version": "1.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
|
||||
"integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
|
||||
},
|
||||
"@root/x509": {
|
||||
"version": "0.7.2",
|
||||
"resolved": "https://registry.npmjs.org/@root/x509/-/x509-0.7.2.tgz",
|
||||
"integrity": "sha512-ENq3LGYORK5NiMFHEVeNMt+fTXaC7DTS6sQXoqV+dFdfT0vmiL5cDLjaXQhaklJQq0NiwicZegzJRl1ZOTp3WQ==",
|
||||
"requires": {
|
||||
"@root/asn1": "^1.0.0",
|
||||
"@root/encoding": "^1.0.1"
|
||||
}
|
||||
},
|
||||
"acme-http-01-standalone": {
|
||||
"version": "3.0.5",
|
||||
"resolved": "https://registry.npmjs.org/acme-http-01-standalone/-/acme-http-01-standalone-3.0.5.tgz",
|
||||
"integrity": "sha512-W4GfK+39GZ+u0mvxRVUcVFCG6gposfzEnSBF20T/NUwWAKG59wQT1dUbS1NixRIAsRuhpGc4Jx659cErFQH0Pg=="
|
||||
},
|
||||
"cert-info": {
|
||||
"version": "1.5.1",
|
||||
"resolved": "https://registry.npmjs.org/cert-info/-/cert-info-1.5.1.tgz",
|
||||
"integrity": "sha512-eoQC/yAgW3gKTKxjzyClvi+UzuY97YCjcl+lSqbsGIy7HeGaWxCPOQFivhUYm27hgsBMhsJJFya3kGvK6PMIcQ=="
|
||||
},
|
||||
"escape-html": {
|
||||
"version": "1.0.3",
|
||||
"resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
|
||||
"integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
|
||||
},
|
||||
"greenlock-manager-fs": {
|
||||
"version": "3.1.1",
|
||||
"resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.1.1.tgz",
|
||||
"integrity": "sha512-np6qdnPIOZx40PAcSQcqK1eMPWjTKxsxcgRd/OVg0ai49WC1Ds74CTrwmB84pq2n53ikbnDBQFmKEQ4AC0DK8w==",
|
||||
"requires": {
|
||||
"@root/mkdirp": "^1.0.0",
|
||||
"safe-replace": "^1.1.0"
|
||||
}
|
||||
},
|
||||
"greenlock-store-fs": {
|
||||
"version": "3.2.2",
|
||||
"resolved": "https://registry.npmjs.org/greenlock-store-fs/-/greenlock-store-fs-3.2.2.tgz",
|
||||
"integrity": "sha512-92ejLB4DyV4qv/2b6VLGF2nKfYQeIfg3o+e/1cIoYLjlIaUFdbBXkzLTRozFlHsQPZt2ALi5qYrpC9IwH7GK8A==",
|
||||
"requires": {
|
||||
"@root/mkdirp": "^1.0.0",
|
||||
"safe-replace": "^1.1.0"
|
||||
}
|
||||
},
|
||||
"redirect-https": {
|
||||
"version": "1.3.1",
|
||||
"resolved": "https://registry.npmjs.org/redirect-https/-/redirect-https-1.3.1.tgz",
|
||||
"integrity": "sha512-Stex2nI+tMpZXKvy++32TiBXEy+GdpAfp3EUnl5BqCiJ5f5i6XvUSFrs7TR7IoRSlthM7ZtD89uYGTtJBXlFYg==",
|
||||
"requires": {
|
||||
"escape-html": "^1.0.3"
|
||||
}
|
||||
},
|
||||
"safe-replace": {
|
||||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.1.0.tgz",
|
||||
"integrity": "sha512-9/V2E0CDsKs9DWOOwJH7jYpSl9S3N05uyevNjvsnDauBqRowBPOyot1fIvV5N2IuZAbYyvrTXrYFVG0RZInfFw=="
|
||||
}
|
||||
}
|
||||
}
|
||||
104
package.json
104
package.json
@ -1,57 +1,51 @@
|
||||
{
|
||||
"name": "letsencrypt-express",
|
||||
"version": "1.1.2",
|
||||
"description": "Free SSL and Automatic HTTPS for node.js with Express, Connect, and other middleware systems",
|
||||
"main": "index.js",
|
||||
"bin": {
|
||||
"letsencrypt-express": "bin/lex.js",
|
||||
"lex": "bin/lex.js"
|
||||
},
|
||||
"files": [
|
||||
"lib/",
|
||||
"bin/",
|
||||
"examples/",
|
||||
"index.js"
|
||||
],
|
||||
"directories": {
|
||||
"example": "examples"
|
||||
},
|
||||
"scripts": {
|
||||
"test": "echo \"Error: no test specified\" && exit 1"
|
||||
},
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git+https://github.com/Daplie/letsencrypt-express.git"
|
||||
},
|
||||
"keywords": [
|
||||
"acme",
|
||||
"free",
|
||||
"ssl",
|
||||
"tls",
|
||||
"https",
|
||||
"letsencrypt",
|
||||
"le",
|
||||
"boulder",
|
||||
"express",
|
||||
"expressjs",
|
||||
"connect",
|
||||
"middleware"
|
||||
],
|
||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
||||
"license": "(MIT OR Apache-2.0)",
|
||||
"bugs": {
|
||||
"url": "https://github.com/Daplie/letsencrypt-express/issues"
|
||||
},
|
||||
"homepage": "https://github.com/Daplie/letsencrypt-express#readme",
|
||||
"devDependencies": {
|
||||
"body-parser": "^1.14.2",
|
||||
"cli": "^0.11.1",
|
||||
"express": "^4.13.3"
|
||||
},
|
||||
"dependencies": {
|
||||
"homedir": "^0.6.0",
|
||||
"letsencrypt": "^1.4.2",
|
||||
"localhost.daplie.com-certificates": "^1.1.2",
|
||||
"mkdirp": "^0.5.1"
|
||||
}
|
||||
"name": "@root/greenlock-express",
|
||||
"version": "4.0.4",
|
||||
"description": "Free SSL and managed or automatic HTTPS for node.js with Express, Koa, Connect, Hapi, and all other middleware systems.",
|
||||
"main": "greenlock-express.js",
|
||||
"homepage": "https://greenlock.domains",
|
||||
"files": [
|
||||
"*.js",
|
||||
"lib",
|
||||
"scripts"
|
||||
],
|
||||
"scripts": {
|
||||
"start": "node_todo server.js ./config.js",
|
||||
"test": "node_todo test/greenlock.js"
|
||||
},
|
||||
"directories": {
|
||||
"example": "examples"
|
||||
},
|
||||
"dependencies": {
|
||||
"@root/greenlock": "^4.0.5",
|
||||
"redirect-https": "^1.3.1"
|
||||
},
|
||||
"trulyOptionalDependencies": {
|
||||
"http-proxy": "^1.17.0",
|
||||
"express": "^4.16.3",
|
||||
"express-basic-auth": "^1.2.0",
|
||||
"finalhandler": "^1.1.1",
|
||||
"serve-index": "^1.9.1",
|
||||
"serve-static": "^1.13.2",
|
||||
"ws": "^5.2.1"
|
||||
},
|
||||
"devDependencies": {},
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "https://git.rootprojects.org/root/greenlock-express.js.git"
|
||||
},
|
||||
"keywords": [
|
||||
"Let's Encrypt",
|
||||
"ACME",
|
||||
"greenlock",
|
||||
"Free SSL",
|
||||
"Automated HTTPS",
|
||||
"https",
|
||||
"tls"
|
||||
],
|
||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://solderjs.com/)",
|
||||
"license": "MPL-2.0",
|
||||
"bugs": {
|
||||
"url": "https://git.rootprojects.org/root/greenlock-express.js/issues"
|
||||
}
|
||||
}
|
||||
|
||||
77
scripts/postinstall
Executable file
77
scripts/postinstall
Executable file
@ -0,0 +1,77 @@
|
||||
#!/usr/bin/env node
|
||||
"use strict";
|
||||
|
||||
// BG WH \u001b[47m
|
||||
// BOLD \u001b[1m
|
||||
// RED \u001b[31m
|
||||
// GREEN \u001b[32m
|
||||
// RESET \u001b[0m
|
||||
|
||||
var grabbers = [
|
||||
[
|
||||
"",
|
||||
"================================================================================",
|
||||
"",
|
||||
" 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥",
|
||||
"🔥 🔥",
|
||||
"🔥 Do you rely on Greenlock? 🔥",
|
||||
"🔥 🔥",
|
||||
" 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥"
|
||||
],
|
||||
|
||||
[
|
||||
"",
|
||||
"================================================================================",
|
||||
"",
|
||||
" 🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒",
|
||||
"🍒 🍒",
|
||||
"🍒 Do you rely on Greenlock? 🍒",
|
||||
"🍒 🍒",
|
||||
" 🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒🍒"
|
||||
],
|
||||
|
||||
[
|
||||
"",
|
||||
"================================================================================",
|
||||
"",
|
||||
" 👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇",
|
||||
"👉 👈",
|
||||
"👉 Do you rely on Greenlock? 👈",
|
||||
"👉 👈",
|
||||
" 👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆 "
|
||||
],
|
||||
|
||||
[
|
||||
"",
|
||||
"================================================================================",
|
||||
"",
|
||||
" 👀 👀 👀 👀 👀 👀 👀 👀 👀 👀 👀 ",
|
||||
"👀 👀",
|
||||
"👀 Do you rely on Greenlock? 👀",
|
||||
"👀 👀",
|
||||
" 👀 👀 👀 👀 👀 👀 👀 👀 👀 👀 👀 ",
|
||||
]
|
||||
];
|
||||
|
||||
setTimeout(function() {
|
||||
grabbers[Math.floor(Math.random() * grabbers.length)].concat([
|
||||
"",
|
||||
"Hey! Let's Encrypt will \u001b[31mSTOP WORKING\u001b[0m with Greenlock v2 at the end of October,",
|
||||
"and \u001b[31mWITHOUT YOUR HELP\u001b[0m we won't get the next release out in time.",
|
||||
"",
|
||||
"If Greenlock has saved you time and money, and taken stress out of your life,",
|
||||
"or you just love it, please reach out to return the favor today:",
|
||||
"",
|
||||
"\u001b[31mSAVE GREENLOCK:\u001b[0m",
|
||||
"https://indiegogo.com/at/greenlock",
|
||||
"",
|
||||
"================================================================================",
|
||||
""
|
||||
]).forEach(function(line) {
|
||||
console.info(line);
|
||||
});
|
||||
}, 300);
|
||||
|
||||
setTimeout(function() {
|
||||
// give time to read
|
||||
}, 1500);
|
||||
171
servers.js
Normal file
171
servers.js
Normal file
@ -0,0 +1,171 @@
|
||||
"use strict";
|
||||
|
||||
var Servers = module.exports;
|
||||
|
||||
var http = require("http");
|
||||
var HttpMiddleware = require("./http-middleware.js");
|
||||
var HttpsMiddleware = require("./https-middleware.js");
|
||||
var sni = require("./sni.js");
|
||||
var cluster = require("cluster");
|
||||
|
||||
Servers.create = function(greenlock) {
|
||||
var servers = {};
|
||||
var _httpServer;
|
||||
var _httpsServer;
|
||||
|
||||
function startError(e) {
|
||||
explainError(e);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
servers.httpServer = function(defaultApp) {
|
||||
if (_httpServer) {
|
||||
if (defaultApp) {
|
||||
console.error("error: can only call httpServer(app) once");
|
||||
process.exit(1);
|
||||
}
|
||||
return _httpServer;
|
||||
}
|
||||
|
||||
if (!defaultApp) {
|
||||
defaultApp = require("redirect-https")();
|
||||
}
|
||||
// HEADERS SENT DEBUG NOTE #1
|
||||
// As seen above, it's only possible to create the server once.
|
||||
// It always gets the http middleware, it always gets a single default app
|
||||
// Therefore it seems impossible to be an http.on('connection', app) problem
|
||||
_httpServer = http.createServer(HttpMiddleware.create(greenlock, defaultApp));
|
||||
_httpServer.once("error", startError);
|
||||
|
||||
return _httpServer;
|
||||
};
|
||||
|
||||
var _middlewareApp;
|
||||
|
||||
servers.http2Server = function(secureOpts, defaultApp) {
|
||||
return servers._httpsServer(secureOpts, defaultApp, function(secureOpts, fn) {
|
||||
secureOpts.allowHTTP1 = true;
|
||||
return require("http2").createSecureServer(secureOpts, fn);
|
||||
});
|
||||
};
|
||||
servers.httpsServer = function(secureOpts, defaultApp) {
|
||||
return servers._httpsServer(secureOpts, defaultApp, function(secureOpts, fn) {
|
||||
return require("https").createServer(secureOpts, fn);
|
||||
});
|
||||
};
|
||||
servers._httpsServer = function(secureOpts, defaultApp, createSecureServer) {
|
||||
if (defaultApp) {
|
||||
// TODO guard against being set twice?
|
||||
_middlewareApp = defaultApp;
|
||||
}
|
||||
|
||||
if (_httpsServer) {
|
||||
if (secureOpts && Object.keys(secureOpts).length) {
|
||||
throw new Error("Call glx.httpsServer(tlsOptions) before calling glx.serveApp(app)");
|
||||
}
|
||||
return _httpsServer;
|
||||
}
|
||||
|
||||
if (!secureOpts) {
|
||||
secureOpts = {};
|
||||
}
|
||||
|
||||
_httpsServer = createSecureServer(
|
||||
wrapDefaultSniCallback(greenlock, secureOpts),
|
||||
HttpsMiddleware.create(greenlock, function(req, res) {
|
||||
if (!_middlewareApp) {
|
||||
throw new Error("Set app with `glx.serveApp(app)` or `glx.httpsServer(tlsOptions, app)`");
|
||||
}
|
||||
_middlewareApp(req, res);
|
||||
})
|
||||
);
|
||||
_httpsServer.once("error", startError);
|
||||
|
||||
return _httpsServer;
|
||||
};
|
||||
|
||||
servers.id = function() {
|
||||
return (cluster.isWorker && cluster.worker.id) || "0";
|
||||
};
|
||||
servers.serveApp = function(app) {
|
||||
return new Promise(function(resolve, reject) {
|
||||
if ("function" !== typeof app) {
|
||||
reject(
|
||||
new Error(
|
||||
"glx.serveApp(app) expects a node/express app in the format `function (req, res) { ... }`"
|
||||
)
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
var id = cluster.isWorker && cluster.worker.id;
|
||||
var idstr = (id && "#" + id + " ") || "";
|
||||
var plainServer = servers.httpServer();
|
||||
var plainAddr = "0.0.0.0";
|
||||
var plainPort = 80;
|
||||
plainServer.listen(plainPort, plainAddr, function() {
|
||||
console.info(
|
||||
idstr + "Listening on",
|
||||
plainAddr + ":" + plainPort,
|
||||
"for ACME challenges, and redirecting to HTTPS"
|
||||
);
|
||||
|
||||
// TODO fetch greenlock.servername
|
||||
_middlewareApp = app || _middlewareApp;
|
||||
var secureServer = servers.httpsServer(null, app);
|
||||
var secureAddr = "0.0.0.0";
|
||||
var securePort = 443;
|
||||
secureServer.listen(securePort, secureAddr, function() {
|
||||
console.info(idstr + "Listening on", secureAddr + ":" + securePort, "for secure traffic");
|
||||
|
||||
plainServer.removeListener("error", startError);
|
||||
secureServer.removeListener("error", startError);
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
});
|
||||
};
|
||||
|
||||
return servers;
|
||||
};
|
||||
|
||||
function explainError(e) {
|
||||
console.error();
|
||||
console.error("Error: " + e.message);
|
||||
if ("EACCES" === e.errno) {
|
||||
console.error("You don't have prmission to access '" + e.address + ":" + e.port + "'.");
|
||||
console.error('You probably need to use "sudo" or "sudo setcap \'cap_net_bind_service=+ep\' $(which node)"');
|
||||
} else if ("EADDRINUSE" === e.errno) {
|
||||
console.error("'" + e.address + ":" + e.port + "' is already being used by some other program.");
|
||||
console.error("You probably need to stop that program or restart your computer.");
|
||||
} else {
|
||||
console.error(e.code + ": '" + e.address + ":" + e.port + "'");
|
||||
}
|
||||
console.error();
|
||||
}
|
||||
|
||||
function wrapDefaultSniCallback(greenlock, secureOpts) {
|
||||
// I'm not sure yet if the original SNICallback
|
||||
// should be called before or after, so I'm just
|
||||
// going to delay making that choice until I have the use case
|
||||
/*
|
||||
if (!secureOpts.SNICallback) {
|
||||
secureOpts.SNICallback = function(servername, cb) {
|
||||
cb(null, null);
|
||||
};
|
||||
}
|
||||
*/
|
||||
if (secureOpts.SNICallback) {
|
||||
console.warn();
|
||||
console.warn("[warning] Ignoring the given tlsOptions.SNICallback function.");
|
||||
console.warn();
|
||||
console.warn(" We're very open to implementing support for this,");
|
||||
console.warn(" we just don't understand the use case yet.");
|
||||
console.warn(" Please open an issue to discuss. We'd love to help.");
|
||||
console.warn();
|
||||
}
|
||||
|
||||
// TODO greenlock.servername for workers
|
||||
secureOpts.SNICallback = sni.create(greenlock, secureOpts);
|
||||
return secureOpts;
|
||||
}
|
||||
36
single.js
Normal file
36
single.js
Normal file
@ -0,0 +1,36 @@
|
||||
"use strict";
|
||||
|
||||
require("./main.js");
|
||||
|
||||
var Single = module.exports;
|
||||
var Servers = require("./servers.js");
|
||||
|
||||
Single.create = function(opts) {
|
||||
var greenlock = require("./greenlock-shim.js").create(opts);
|
||||
|
||||
var servers = Servers.create(greenlock);
|
||||
|
||||
var single = {
|
||||
ready: function(fn) {
|
||||
fn(servers);
|
||||
return single;
|
||||
},
|
||||
master: function(/*fn*/) {
|
||||
// ignore
|
||||
//fn(master);
|
||||
return single;
|
||||
},
|
||||
serve: function(fn) {
|
||||
// keeping backwards compat
|
||||
if (1 === fn.length) {
|
||||
single.ready(fn);
|
||||
return;
|
||||
}
|
||||
// serving the app, right away
|
||||
single.ready(function(glx) {
|
||||
glx.serveApp(fn);
|
||||
});
|
||||
}
|
||||
};
|
||||
return single;
|
||||
};
|
||||
215
sni.js
Normal file
215
sni.js
Normal file
@ -0,0 +1,215 @@
|
||||
"use strict";
|
||||
|
||||
var sni = module.exports;
|
||||
var tls = require("tls");
|
||||
var servernameRe = /^[a-z0-9\.\-]+$/i;
|
||||
|
||||
// a nice, round, irrational number - about every 6¼ hours
|
||||
var refreshOffset = Math.round(Math.PI * 2 * (60 * 60 * 1000));
|
||||
// and another, about 15 minutes
|
||||
var refreshStagger = Math.round(Math.PI * 5 * (60 * 1000));
|
||||
// and another, about 30 seconds
|
||||
var smallStagger = Math.round(Math.PI * (30 * 1000));
|
||||
|
||||
//secureOpts.SNICallback = sni.create(greenlock, secureOpts);
|
||||
sni.create = function(greenlock, secureOpts) {
|
||||
var _cache = {};
|
||||
var defaultServername = greenlock.servername || "";
|
||||
|
||||
if (secureOpts.cert) {
|
||||
// Note: it's fine if greenlock.servername is undefined,
|
||||
// but if the caller wants this to auto-renew, they should define it
|
||||
_cache[defaultServername] = {
|
||||
refreshAt: 0,
|
||||
secureContext: tls.createSecureContext(secureOpts)
|
||||
};
|
||||
}
|
||||
|
||||
return getSecureContext;
|
||||
|
||||
function notify(ev, args) {
|
||||
try {
|
||||
// TODO _notify() or notify()?
|
||||
(greenlock.notify || greenlock._notify)(ev, args);
|
||||
} catch (e) {
|
||||
console.error(e);
|
||||
console.error(ev, args);
|
||||
}
|
||||
}
|
||||
|
||||
function getSecureContext(servername, cb) {
|
||||
//console.log("debug sni", servername);
|
||||
if ("string" !== typeof servername) {
|
||||
// this will never happen... right? but stranger things have...
|
||||
console.error("[sanity fail] non-string servername:", servername);
|
||||
cb(new Error("invalid servername"), null);
|
||||
return;
|
||||
}
|
||||
|
||||
var secureContext = getCachedContext(servername);
|
||||
if (secureContext) {
|
||||
//console.log("debug sni got cached context", servername, getCachedMeta(servername));
|
||||
cb(null, secureContext);
|
||||
return;
|
||||
}
|
||||
|
||||
getFreshContext(servername)
|
||||
.then(function(secureContext) {
|
||||
if (secureContext) {
|
||||
//console.log("debug sni got fresh context", servername, getCachedMeta(servername));
|
||||
cb(null, secureContext);
|
||||
return;
|
||||
}
|
||||
|
||||
// Note: this does not replace tlsSocket.setSecureContext()
|
||||
// as it only works when SNI has been sent
|
||||
//console.log("debug sni got default context", servername, getCachedMeta(servername));
|
||||
if (!/PROD/.test(process.env.ENV) || /DEV|STAG/.test(process.env.ENV)) {
|
||||
// Change this once
|
||||
// A) the 'notify' message passing is verified fixed in cluster mode
|
||||
// B) we have a good way to let people know their server isn't configured
|
||||
console.debug("debug: ignoring servername " + JSON.stringify(servername));
|
||||
console.debug(" (it's probably either missing from your config, or a bot)");
|
||||
notify("servername_unknown", {
|
||||
servername: servername
|
||||
});
|
||||
}
|
||||
cb(null, getDefaultContext());
|
||||
})
|
||||
.catch(function(err) {
|
||||
if (!err.context) {
|
||||
err.context = "sni_callback";
|
||||
}
|
||||
notify("error", err);
|
||||
//console.log("debug sni error", servername, err);
|
||||
cb(err);
|
||||
});
|
||||
}
|
||||
|
||||
function getCachedMeta(servername) {
|
||||
var meta = _cache[servername];
|
||||
if (!meta) {
|
||||
if (!_cache[wildname(servername)]) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
return meta;
|
||||
}
|
||||
|
||||
function getCachedContext(servername) {
|
||||
var meta = getCachedMeta(servername);
|
||||
if (!meta) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// always renew in background
|
||||
if (!meta.refreshAt || Date.now() >= meta.refreshAt) {
|
||||
getFreshContext(servername).catch(function(e) {
|
||||
if (!e.context) {
|
||||
e.context = "sni_background_refresh";
|
||||
}
|
||||
notify("error", e);
|
||||
});
|
||||
}
|
||||
|
||||
// under normal circumstances this would never be expired
|
||||
// and, if it is expired, something is so wrong it's probably
|
||||
// not worth wating for the renewal - it has probably failed
|
||||
return meta.secureContext;
|
||||
}
|
||||
|
||||
function getFreshContext(servername) {
|
||||
var meta = getCachedMeta(servername);
|
||||
if (!meta && !validServername(servername)) {
|
||||
if ((servername && !/PROD/.test(process.env.ENV)) || /DEV|STAG/.test(process.env.ENV)) {
|
||||
// Change this once
|
||||
// A) the 'notify' message passing is verified fixed in cluster mode
|
||||
// B) we have a good way to let people know their server isn't configured
|
||||
console.debug("debug: invalid servername " + JSON.stringify(servername));
|
||||
console.debug(" (it's probably just a bot trolling for vulnerable servers)");
|
||||
notify("servername_invalid", {
|
||||
servername: servername
|
||||
});
|
||||
}
|
||||
return Promise.resolve(null);
|
||||
}
|
||||
|
||||
if (meta) {
|
||||
// prevent stampedes
|
||||
meta.refreshAt = Date.now() + randomRefreshOffset();
|
||||
}
|
||||
|
||||
// TODO don't get unknown certs at all, rely on auto-updates from greenlock
|
||||
// Note: greenlock.get() will return an existing fresh cert or issue a new one
|
||||
return greenlock.get({ servername: servername }).then(function(result) {
|
||||
var meta = getCachedMeta(servername);
|
||||
if (!meta) {
|
||||
meta = _cache[servername] = { secureContext: { _valid: false } };
|
||||
}
|
||||
// prevent from being punked by bot trolls
|
||||
meta.refreshAt = Date.now() + smallStagger;
|
||||
|
||||
// nothing to do
|
||||
if (!result) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// we only care about the first one
|
||||
var pems = result.pems;
|
||||
var site = result.site;
|
||||
if (!pems || !pems.cert) {
|
||||
// nothing to do
|
||||
// (and the error should have been reported already)
|
||||
return null;
|
||||
}
|
||||
|
||||
meta = {
|
||||
refreshAt: Date.now() + randomRefreshOffset(),
|
||||
secureContext: tls.createSecureContext({
|
||||
// TODO support passphrase-protected privkeys
|
||||
key: pems.privkey,
|
||||
cert: pems.cert + "\n" + pems.chain + "\n"
|
||||
})
|
||||
};
|
||||
meta.secureContext._valid = true;
|
||||
|
||||
// copy this same object into every place
|
||||
(result.altnames || site.altnames || [result.subject || site.subject]).forEach(function(altname) {
|
||||
_cache[altname] = meta;
|
||||
});
|
||||
|
||||
return meta.secureContext;
|
||||
});
|
||||
}
|
||||
|
||||
function getDefaultContext() {
|
||||
return getCachedContext(defaultServername);
|
||||
}
|
||||
};
|
||||
|
||||
// whenever we need to know when to refresh next
|
||||
function randomRefreshOffset() {
|
||||
var stagger = Math.round(refreshStagger / 2) - Math.round(Math.random() * refreshStagger);
|
||||
return refreshOffset + stagger;
|
||||
}
|
||||
|
||||
function validServername(servername) {
|
||||
// format and (lightly) sanitize sni so that users can be naive
|
||||
// and not have to worry about SQL injection or fs discovery
|
||||
|
||||
servername = (servername || "").toLowerCase();
|
||||
// hostname labels allow a-z, 0-9, -, and are separated by dots
|
||||
// _ is sometimes allowed, but not as a "hostname", and not by Let's Encrypt ACME
|
||||
// REGEX // https://www.codeproject.com/Questions/1063023/alphanumeric-validation-javascript-without-regex
|
||||
return servernameRe.test(servername) && -1 === servername.indexOf("..");
|
||||
}
|
||||
|
||||
function wildname(servername) {
|
||||
return (
|
||||
"*." +
|
||||
servername
|
||||
.split(".")
|
||||
.slice(1)
|
||||
.join(".")
|
||||
);
|
||||
}
|
||||
85
test/greenlock.js
Normal file
85
test/greenlock.js
Normal file
@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env node
|
||||
var Greenlock = require("../");
|
||||
var greenlock = Greenlock.create({
|
||||
version: "draft-11",
|
||||
server: "https://acme-staging-v02.api.letsencrypt.org/directory",
|
||||
agreeTos: true,
|
||||
approvedDomains: ["example.com", "www.example.com"],
|
||||
configDir: require("path").join(require("os").tmpdir(), "acme"),
|
||||
|
||||
app: require("express")().use("/", function(req, res) {
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
res.end("Hello, World!\n\n💚 🔒.js");
|
||||
})
|
||||
});
|
||||
|
||||
var server1 = greenlock.listen(5080, 5443);
|
||||
server1.on("listening", function() {
|
||||
console.log("### THREE 3333 - All is well server1", this.address());
|
||||
setTimeout(function() {
|
||||
// so that the address() object doesn't disappear
|
||||
server1.close();
|
||||
server1.unencrypted.close();
|
||||
}, 10);
|
||||
});
|
||||
setTimeout(function() {
|
||||
var server2 = greenlock.listen(6080, 6443, function() {
|
||||
console.log("### FIVE 55555 - Started server 2!");
|
||||
setTimeout(function() {
|
||||
server2.close();
|
||||
server2.unencrypted.close();
|
||||
server6.close();
|
||||
server6.unencrypted.close();
|
||||
server7.close();
|
||||
server7.unencrypted.close();
|
||||
setTimeout(function() {
|
||||
// TODO greenlock needs a close event (and to listen to its server's close event)
|
||||
process.exit(0);
|
||||
}, 1000);
|
||||
}, 1000);
|
||||
});
|
||||
server2.on("listening", function() {
|
||||
console.log("### FOUR 44444 - All is well server2", server2.address());
|
||||
});
|
||||
}, 1000);
|
||||
|
||||
var server3 = greenlock.listen(
|
||||
22,
|
||||
22,
|
||||
function() {
|
||||
console.error("Error: expected to get an error when launching plain server on port 22");
|
||||
},
|
||||
function() {
|
||||
console.error("Error: expected to get an error when launching " + server3.type + " server on port 22");
|
||||
}
|
||||
);
|
||||
server3.unencrypted.on("error", function() {
|
||||
console.log("Success: caught expected (plain) error");
|
||||
});
|
||||
server3.on("error", function() {
|
||||
console.log("Success: caught expected " + server3.type + " error");
|
||||
//server3.close();
|
||||
});
|
||||
|
||||
var server4 = greenlock.listen(
|
||||
7080,
|
||||
7443,
|
||||
function() {
|
||||
console.log("Success: server4: plain");
|
||||
server4.unencrypted.close();
|
||||
},
|
||||
function() {
|
||||
console.log("Success: server4: " + server4.type);
|
||||
server4.close();
|
||||
}
|
||||
);
|
||||
|
||||
var server5 = greenlock.listen(10080, 10443, function() {
|
||||
console.log("Server 5 with one fn", this.address());
|
||||
server5.close();
|
||||
server5.unencrypted.close();
|
||||
});
|
||||
|
||||
var server6 = greenlock.listen("[::]:11080", "[::1]:11443");
|
||||
|
||||
var server7 = greenlock.listen("/tmp/gl.plain.sock", "/tmp/gl.sec.sock");
|
||||
73
worker.js
Normal file
73
worker.js
Normal file
@ -0,0 +1,73 @@
|
||||
"use strict";
|
||||
|
||||
var Worker = module.exports;
|
||||
// *very* generous, but well below the http norm of 120
|
||||
var messageTimeout = 30 * 1000;
|
||||
var msgPrefix = "greenlock:";
|
||||
|
||||
Worker.create = function() {
|
||||
var greenlock = {};
|
||||
["getAcmeHttp01ChallengeResponse", "get", "notify", "_notify"].forEach(function(k) {
|
||||
greenlock[k] = function(args) {
|
||||
return rpc(k, args);
|
||||
};
|
||||
});
|
||||
|
||||
var worker = {
|
||||
ready: function(fn) {
|
||||
var servers = require("./servers.js").create(greenlock);
|
||||
fn(servers);
|
||||
return worker;
|
||||
},
|
||||
master: function() {
|
||||
// ignore
|
||||
return worker;
|
||||
},
|
||||
serve: function(fn) {
|
||||
// keeping backwards compat
|
||||
if (1 === fn.length) {
|
||||
worker.ready(fn);
|
||||
return;
|
||||
}
|
||||
// serving the express app, right away
|
||||
worker.ready(function(glx) {
|
||||
glx.serveApp(fn);
|
||||
});
|
||||
}
|
||||
};
|
||||
return worker;
|
||||
};
|
||||
|
||||
function rpc(funcname, msg) {
|
||||
return new Promise(function(resolve, reject) {
|
||||
var rnd = Math.random()
|
||||
.toString()
|
||||
.slice(2)
|
||||
.toString(16);
|
||||
var id = msgPrefix + rnd;
|
||||
var timeout;
|
||||
|
||||
function getResponse(msg) {
|
||||
if (msg._id !== id) {
|
||||
return;
|
||||
}
|
||||
process.removeListener("message", getResponse);
|
||||
clearTimeout(timeout);
|
||||
resolve(msg._result);
|
||||
}
|
||||
|
||||
// TODO keep a single listener than just responds
|
||||
// via a collection of callbacks? or leave as is?
|
||||
process.on("message", getResponse);
|
||||
process.send({
|
||||
_id: id,
|
||||
_funcname: funcname,
|
||||
_input: msg
|
||||
});
|
||||
|
||||
timeout = setTimeout(function() {
|
||||
process.removeListener("message", getResponse);
|
||||
reject(new Error("worker rpc request timeout"));
|
||||
}, messageTimeout);
|
||||
});
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user