pages-server/cmd/main.go

131 lines
4.7 KiB
Go
Raw Normal View History

2021-12-03 01:12:51 +00:00
package cmd
import (
"bytes"
"crypto/tls"
2021-12-03 02:34:50 +00:00
"errors"
2021-12-03 01:12:51 +00:00
"fmt"
"net"
"net/http"
2021-12-03 02:05:38 +00:00
"strings"
2021-12-03 01:12:51 +00:00
"time"
2021-12-03 02:05:38 +00:00
"github.com/rs/zerolog/log"
2021-12-03 01:12:51 +00:00
"github.com/urfave/cli/v2"
"github.com/valyala/fasthttp"
"codeberg.org/codeberg/pages/server"
2021-12-03 03:15:48 +00:00
"codeberg.org/codeberg/pages/server/cache"
"codeberg.org/codeberg/pages/server/database"
2021-12-03 02:44:21 +00:00
"codeberg.org/codeberg/pages/server/utils"
2021-12-03 01:12:51 +00:00
)
// AllowedCorsDomains lists the domains for which Cross-Origin Resource Sharing is allowed.
2021-12-03 02:05:38 +00:00
// TODO: make it a flag
2021-12-03 01:12:51 +00:00
var AllowedCorsDomains = [][]byte{
[]byte("fonts.codeberg.org"),
[]byte("design.codeberg.org"),
}
// BlacklistedPaths specifies forbidden path prefixes for all Codeberg Pages.
var BlacklistedPaths = [][]byte{
[]byte("/.well-known/acme-challenge/"),
}
// Serve sets up and starts the web server.
func Serve(ctx *cli.Context) error {
2021-12-03 02:05:38 +00:00
giteaRoot := strings.TrimSuffix(ctx.String("gitea-root"), "/")
giteaAPIToken := ctx.String("gitea-api-token")
rawDomain := ctx.String("raw-domain")
2021-12-03 01:12:51 +00:00
mainDomainSuffix := []byte(ctx.String("main-domain-suffix"))
2021-12-03 02:05:38 +00:00
rawInfoPage := ctx.String("raw-info-page")
listeningAddress := fmt.Sprintf("%s:%s", ctx.String("host"), ctx.String("port"))
2021-12-03 02:34:50 +00:00
enableHTTPServer := ctx.Bool("enable-http-server")
2021-12-03 02:05:38 +00:00
acmeAPI := ctx.String("acme-api")
acmeMail := ctx.String("acme-email")
2021-12-03 02:34:50 +00:00
acmeUseRateLimits := ctx.Bool("acme-use-rate-limits")
acmeAcceptTerms := ctx.Bool("acme-accept-terms")
acmeEabKID := ctx.String("acme-eab-kid")
acmeEabHmac := ctx.String("acme-eab-hmac")
dnsProvider := ctx.String("dns-provider")
if acmeAcceptTerms || (dnsProvider == "" && acmeAPI != "https://acme.mock.directory") {
return errors.New("you must set $ACME_ACCEPT_TERMS and $DNS_PROVIDER, unless $ACME_API is set to https://acme.mock.directory")
}
2021-12-03 02:05:38 +00:00
allowedCorsDomains := AllowedCorsDomains
if len(rawDomain) != 0 {
allowedCorsDomains = append(allowedCorsDomains, []byte(rawDomain))
}
2021-12-03 01:12:51 +00:00
// Make sure MainDomain has a trailing dot, and GiteaRoot has no trailing slash
if !bytes.HasPrefix(mainDomainSuffix, []byte{'.'}) {
mainDomainSuffix = append([]byte{'.'}, mainDomainSuffix...)
}
// Create handler based on settings
2021-12-03 02:05:38 +00:00
handler := server.Handler(mainDomainSuffix, []byte(rawDomain), giteaRoot, rawInfoPage, giteaAPIToken, BlacklistedPaths, allowedCorsDomains)
2021-12-03 01:12:51 +00:00
// Enable compression by wrapping the handler with the compression function provided by FastHTTP
compressedHandler := fasthttp.CompressHandlerBrotliLevel(handler, fasthttp.CompressBrotliBestSpeed, fasthttp.CompressBestSpeed)
fastServer := &fasthttp.Server{
Handler: compressedHandler,
DisablePreParseMultipartForm: true,
MaxRequestBodySize: 0,
NoDefaultServerHeader: true,
NoDefaultDate: true,
ReadTimeout: 30 * time.Second, // needs to be this high for ACME certificates with ZeroSSL & HTTP-01 challenge
Concurrency: 1024 * 32, // TODO: adjust bottlenecks for best performance with Gitea!
MaxConnsPerIP: 100,
}
// Setup listener and TLS
2021-12-03 02:05:38 +00:00
log.Info().Msgf("Listening on https://%s", listeningAddress)
listener, err := net.Listen("tcp", listeningAddress)
2021-12-03 01:12:51 +00:00
if err != nil {
2021-12-03 02:05:38 +00:00
return fmt.Errorf("couldn't create listener: %s", err)
2021-12-03 01:12:51 +00:00
}
2021-12-03 03:15:48 +00:00
// TODO: make "key-database.pogreb" set via flag
keyDatabase, err := database.New("key-database.pogreb")
if err != nil {
return fmt.Errorf("could not create database: %v", err)
}
2021-12-03 03:18:53 +00:00
defer keyDatabase.Sync() // database has no close ... sync behave like it
2021-12-03 03:15:48 +00:00
keyCache := cache.NewKeyValueCache()
2021-12-03 03:32:30 +00:00
challengeCache := cache.NewKeyValueCache()
listener = tls.NewListener(listener, server.TLSConfig(mainDomainSuffix, giteaRoot, giteaAPIToken, dnsProvider, acmeUseRateLimits, keyCache, challengeCache, keyDatabase))
2021-12-03 03:15:48 +00:00
2021-12-03 03:32:30 +00:00
server.SetupCertificates(mainDomainSuffix, acmeAPI, acmeMail, acmeEabHmac, acmeEabKID, dnsProvider, acmeUseRateLimits, acmeAcceptTerms, enableHTTPServer, challengeCache, keyDatabase)
2021-12-03 02:34:50 +00:00
if enableHTTPServer {
2021-12-03 01:12:51 +00:00
go (func() {
challengePath := []byte("/.well-known/acme-challenge/")
err := fasthttp.ListenAndServe("[::]:80", func(ctx *fasthttp.RequestCtx) {
if bytes.HasPrefix(ctx.Path(), challengePath) {
2021-12-03 03:32:30 +00:00
challenge, ok := challengeCache.Get(string(utils.TrimHostPort(ctx.Host())) + "/" + string(bytes.TrimPrefix(ctx.Path(), challengePath)))
2021-12-03 01:12:51 +00:00
if !ok || challenge == nil {
ctx.SetStatusCode(http.StatusNotFound)
ctx.SetBodyString("no challenge for this token")
}
ctx.SetBodyString(challenge.(string))
} else {
ctx.Redirect("https://"+string(ctx.Host())+string(ctx.RequestURI()), http.StatusMovedPermanently)
}
})
if err != nil {
2021-12-03 02:05:38 +00:00
log.Fatal().Err(err).Msg("Couldn't start HTTP fastServer")
2021-12-03 01:12:51 +00:00
}
})()
}
// Start the web fastServer
err = fastServer.Serve(listener)
if err != nil {
2021-12-03 02:05:38 +00:00
log.Fatal().Err(err).Msg("Couldn't start fastServer")
2021-12-03 01:12:51 +00:00
}
return nil
}