diff --git a/.foxguard.yml b/.foxguard.yml index 8a7a819..57ddfcb 100644 --- a/.foxguard.yml +++ b/.foxguard.yml @@ -1,5 +1,7 @@ scan: baseline: .foxguard/baseline.json + disable_rules: + - manifest/cargo-pq-vulnerable-dep secrets: baseline: .foxguard/secrets-baseline.json diff --git a/.foxguard/baseline.json b/.foxguard/baseline.json index 3083340..7f19696 100644 --- a/.foxguard/baseline.json +++ b/.foxguard/baseline.json @@ -1,4 +1,4 @@ { "version": 1, "entries": [] -} \ No newline at end of file +} diff --git a/.rustfmt.toml b/.rustfmt.toml index 750ac8a..d1afa00 100644 --- a/.rustfmt.toml +++ b/.rustfmt.toml @@ -6,3 +6,6 @@ reorder_modules = true match_block_trailing_comma = true use_field_init_shorthand = true use_small_heuristics = "Off" +# clean up multiple use crate:: that share the same root import +# run with cargo +nightly fmt +imports_granularity = "Crate" diff --git a/Cargo.lock b/Cargo.lock index c773153..7defbf5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2,15 +2,6 @@ # It is not intended for manual editing. version = 4 -[[package]] -name = "addr2line" -version = "0.25.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b" -dependencies = [ - "gimli", -] - [[package]] name = "adler2" version = "2.0.1" @@ -24,6 +15,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75" dependencies = [ "cfg-if", + "const-random", "getrandom 0.3.4", "once_cell", "version_check", @@ -121,9 +113,9 @@ dependencies = [ [[package]] name = "arc-swap" -version = "1.9.1" +version = "1.9.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207" +checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b" dependencies = [ "rustversion", ] @@ -146,7 +138,7 @@ dependencies = [ "nom", "num-traits", "rusticata-macros", - "thiserror 2.0.19", + "thiserror", "time", ] @@ -173,11 +165,23 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "async-channel" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2" +dependencies = [ + "concurrent-queue", + "event-listener-strategy", + "futures-core", + "pin-project-lite", +] + [[package]] name = "async-trait" -version = "0.1.91" +version = "0.1.92" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec" +checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", @@ -198,9 +202,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "untrusted 0.7.1", @@ -209,36 +213,28 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] -name = "backtrace" -version = "0.3.76" +name = "base64" +version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6" -dependencies = [ - "addr2line", - "cfg-if", - "libc", - "miniz_oxide", - "object", - "rustc-demangle", - "windows-link", -] +checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" [[package]] name = "base64" -version = "0.22.1" +version = "0.23.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5" [[package]] name = "bindgen" @@ -246,7 +242,7 @@ version = "0.72.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895" dependencies = [ - "bitflags 2.11.1", + "bitflags", "cexpr", "clang-sys", "itertools", @@ -267,12 +263,6 @@ dependencies = [ "serde", ] -[[package]] -name = "bitflags" -version = "1.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" - [[package]] name = "bitflags" version = "2.11.1" @@ -299,11 +289,11 @@ dependencies = [ [[package]] name = "boring" -version = "4.22.0" +version = "5.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b0e3bc837369e9e662d3845c374ac3771b054d4bc2dee5457591198d16d684c" +checksum = "47bf58283ad1560da95ab8dcbb6c71e18a89df30e6011e3582ddf755abe55c4a" dependencies = [ - "bitflags 2.11.1", + "bitflags", "boring-sys", "foreign-types", "libc", @@ -312,9 +302,9 @@ dependencies = [ [[package]] name = "boring-sys" -version = "4.22.0" +version = "5.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "15aad385759d3da2737772aefb391332227bef7cb71fb85c106cadd9d1e63a98" +checksum = "6993efa9d9f0ebf3b0c02c8e868cfe37d0854cd021d51204480a91ce23d6e444" dependencies = [ "bindgen", "cmake", @@ -360,12 +350,6 @@ version = "3.20.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" -[[package]] -name = "byteorder" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" - [[package]] name = "bytes" version = "1.11.1" @@ -394,38 +378,27 @@ dependencies = [ ] [[package]] -name = "cf-rustracing" -version = "1.2.1" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93f85c3824e4191621dec0551e3cef3d511f329da9a8990bf3e450a85651d97e" -dependencies = [ - "backtrace", - "rand 0.8.6", - "tokio", - "trackable", -] +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] -name = "cf-rustracing-jaeger" -version = "1.2.2" +name = "cfg_aliases" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6a5f80d44c257c3300a7f45ada676c211e64bbbac591bbec19344a8f61fbcab" -dependencies = [ - "cf-rustracing", - "hostname", - "local-ip-address", - "percent-encoding", - "rand 0.9.5", - "thrift_codec", - "tokio", - "trackable", -] +checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527" [[package]] -name = "cfg-if" -version = "1.0.4" +name = "chacha20" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures", + "rand_core 0.10.1", +] [[package]] name = "chrono" @@ -517,6 +490,45 @@ dependencies = [ "memchr", ] +[[package]] +name = "concurrent-queue" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973" +dependencies = [ + "crossbeam-utils", +] + +[[package]] +name = "const-random" +version = "0.1.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359" +dependencies = [ + "const-random-macro", +] + +[[package]] +name = "const-random-macro" +version = "0.1.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e" +dependencies = [ + "getrandom 0.2.17", + "once_cell", + "tiny-keccak", +] + +[[package]] +name = "core-foundation" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -533,6 +545,15 @@ version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" +[[package]] +name = "cpufeatures" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +dependencies = [ + "libc", +] + [[package]] name = "crc32fast" version = "1.5.0" @@ -542,6 +563,30 @@ dependencies = [ "cfg-if", ] +[[package]] +name = "critical-section" +version = "1.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" + +[[package]] +name = "crossbeam-channel" +version = "0.5.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1" +dependencies = [ + "crossbeam-utils", +] + +[[package]] +name = "crossbeam-epoch" +version = "0.9.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d" +dependencies = [ + "crossbeam-utils", +] + [[package]] name = "crossbeam-queue" version = "0.3.12" @@ -557,6 +602,12 @@ version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" +[[package]] +name = "crunchy" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" + [[package]] name = "crypto-common" version = "0.1.7" @@ -568,10 +619,10 @@ dependencies = [ ] [[package]] -name = "daemonize" -version = "0.5.0" +name = "daemonix" +version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ab8bfdaacb3c887a54d41bdf48d3af8873b3f5566469f8ba21b92057509f116e" +checksum = "f0b747381562a10fd2104e9333ad72fe5158d79de81b64426fc9e229c6d3fb38" dependencies = [ "libc", ] @@ -586,38 +637,16 @@ dependencies = [ ] [[package]] -name = "darling" -version = "0.20.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee" -dependencies = [ - "darling_core", - "darling_macro", -] - -[[package]] -name = "darling_core" -version = "0.20.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e" -dependencies = [ - "fnv", - "ident_case", - "proc-macro2", - "quote", - "strsim", - "syn 2.0.117", -] - -[[package]] -name = "darling_macro" -version = "0.20.11" +name = "dashmap" +version = "5.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead" +checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856" dependencies = [ - "darling_core", - "quote", - "syn 2.0.117", + "cfg-if", + "hashbrown 0.14.5", + "lock_api", + "once_cell", + "parking_lot_core", ] [[package]] @@ -660,37 +689,6 @@ dependencies = [ "syn 1.0.109", ] -[[package]] -name = "derive_builder" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947" -dependencies = [ - "derive_builder_macro", -] - -[[package]] -name = "derive_builder_core" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8" -dependencies = [ - "darling", - "proc-macro2", - "quote", - "syn 2.0.117", -] - -[[package]] -name = "derive_builder_macro" -version = "0.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c" -dependencies = [ - "derive_builder_core", - "syn 2.0.117", -] - [[package]] name = "digest" version = "0.10.7" @@ -725,6 +723,15 @@ version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" +[[package]] +name = "encoding_rs" +version = "0.8.35" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3" +dependencies = [ + "cfg-if", +] + [[package]] name = "equivalent" version = "1.0.2" @@ -741,6 +748,26 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "event-listener" +version = "5.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2" +dependencies = [ + "parking", + "pin-project-lite", +] + +[[package]] +name = "event-listener-strategy" +version = "0.5.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93" +dependencies = [ + "event-listener", + "pin-project-lite", +] + [[package]] name = "find-msvc-tools" version = "0.1.9" @@ -764,6 +791,18 @@ dependencies = [ "miniz_oxide", ] +[[package]] +name = "flurry" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cf5efcf77a4da27927d3ab0509dec5b0954bb3bc59da5a1de9e52642ebd4cdf9" +dependencies = [ + "ahash", + "num_cpus", + "parking_lot", + "seize", +] + [[package]] name = "fnv" version = "1.0.7" @@ -803,6 +842,15 @@ version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b" +[[package]] +name = "form_urlencoded" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf" +dependencies = [ + "percent-encoding", +] + [[package]] name = "fs_extra" version = "1.3.0" @@ -924,8 +972,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" dependencies = [ "cfg-if", + "js-sys", "libc", "wasi", + "wasm-bindgen", ] [[package]] @@ -936,28 +986,24 @@ checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", "libc", - "r-efi", + "r-efi 5.3.0", "wasip2", ] [[package]] -name = "getset" -version = "0.1.6" +name = "getrandom" +version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9cf0fc11e47561d47397154977bc219f4cf809b2974facc3ccb3b89e2436f912" +checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099" dependencies = [ - "proc-macro-error2", - "proc-macro2", - "quote", - "syn 2.0.117", + "cfg-if", + "js-sys", + "libc", + "r-efi 6.0.0", + "rand_core 0.10.1", + "wasm-bindgen", ] -[[package]] -name = "gimli" -version = "0.32.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7" - [[package]] name = "glob" version = "0.3.3" @@ -966,9 +1012,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" [[package]] name = "h2" -version = "0.4.14" +version = "0.4.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733" +checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16" dependencies = [ "atomic-waker", "bytes", @@ -991,14 +1037,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888" [[package]] name = "hashbrown" -version = "0.16.1" +version = "0.14.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" -dependencies = [ - "allocator-api2", - "equivalent", - "foldhash", -] +checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" [[package]] name = "hashbrown" @@ -1017,6 +1058,12 @@ version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" +[[package]] +name = "hermit-abi" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284" + [[package]] name = "hex" version = "0.4.3" @@ -1024,21 +1071,85 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" [[package]] -name = "hostname" -version = "0.4.2" +name = "hickory-net" +version = "0.26.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd" +checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d" dependencies = [ + "async-trait", + "bytes", "cfg-if", - "libc", - "windows-link", + "data-encoding", + "futures-channel", + "futures-io", + "futures-util", + "hickory-proto", + "idna", + "ipnet", + "jni", + "rand 0.10.2", + "rustls", + "thiserror", + "tinyvec", + "tokio", + "tokio-rustls", + "tracing", + "url", +] + +[[package]] +name = "hickory-proto" +version = "0.26.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d" +dependencies = [ + "data-encoding", + "idna", + "ipnet", + "jni", + "once_cell", + "prefix-trie", + "rand 0.10.2", + "ring", + "thiserror", + "tinyvec", + "tracing", + "url", +] + +[[package]] +name = "hickory-resolver" +version = "0.26.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981" +dependencies = [ + "cfg-if", + "futures-util", + "hickory-net", + "hickory-proto", + "ipconfig", + "ipnet", + "jni", + "moka", + "ndk-context", + "once_cell", + "parking_lot", + "rand 0.10.2", + "resolv-conf", + "rustls", + "smallvec", + "system-configuration", + "thiserror", + "tokio", + "tokio-rustls", + "tracing", ] [[package]] name = "http" -version = "1.4.2" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425" +checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0" dependencies = [ "bytes", "itoa", @@ -1123,18 +1234,23 @@ version = "0.1.20" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0" dependencies = [ + "base64 0.22.1", "bytes", "futures-channel", "futures-util", "http", "http-body", "hyper", + "ipnet", "libc", + "percent-encoding", "pin-project-lite", "socket2", + "system-configuration", "tokio", "tower-service", "tracing", + "windows-registry", ] [[package]] @@ -1162,10 +1278,107 @@ dependencies = [ ] [[package]] -name = "ident_case" -version = "1.0.1" +name = "icu_collections" +version = "2.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39" +checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c" +dependencies = [ + "displaydoc", + "potential_utf", + "utf8_iter", + "yoke", + "zerofrom", + "zerovec", +] + +[[package]] +name = "icu_locale_core" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29" +dependencies = [ + "displaydoc", + "litemap", + "tinystr", + "writeable", + "zerovec", +] + +[[package]] +name = "icu_normalizer" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4" +dependencies = [ + "icu_collections", + "icu_normalizer_data", + "icu_properties", + "icu_provider", + "smallvec", + "zerovec", +] + +[[package]] +name = "icu_normalizer_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38" + +[[package]] +name = "icu_properties" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de" +dependencies = [ + "icu_collections", + "icu_locale_core", + "icu_properties_data", + "icu_provider", + "zerotrie", + "zerovec", +] + +[[package]] +name = "icu_properties_data" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14" + +[[package]] +name = "icu_provider" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421" +dependencies = [ + "displaydoc", + "icu_locale_core", + "writeable", + "yoke", + "zerofrom", + "zerotrie", + "zerovec", +] + +[[package]] +name = "idna" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de" +dependencies = [ + "idna_adapter", + "smallvec", + "utf8_iter", +] + +[[package]] +name = "idna_adapter" +version = "1.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714" +dependencies = [ + "icu_normalizer", + "icu_properties", +] [[package]] name = "indexmap" @@ -1195,7 +1408,7 @@ checksum = "9f05ad37c421b962354c358d347d4a6130151df9407978372d3ad7f0c8f71a64" dependencies = [ "async-trait", "aws-lc-rs", - "base64", + "base64 0.22.1", "bytes", "http", "http-body", @@ -1209,10 +1422,32 @@ dependencies = [ "rustls-pki-types", "serde", "serde_json", - "thiserror 2.0.19", + "thiserror", "tokio", ] +[[package]] +name = "ipconfig" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222" +dependencies = [ + "socket2", + "widestring", + "windows-registry", + "windows-result", + "windows-sys 0.61.2", +] + +[[package]] +name = "ipnet" +version = "2.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78" +dependencies = [ + "serde", +] + [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -1246,7 +1481,7 @@ dependencies = [ "jni-sys", "log", "simd_cesu8", - "thiserror 2.0.19", + "thiserror", "walkdir", "windows-link", ] @@ -1338,15 +1573,10 @@ dependencies = [ ] [[package]] -name = "local-ip-address" -version = "0.6.12" +name = "litemap" +version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7b0187df4e614e42405b49511b82ff7a1774fbd9a816060ee465067847cac22" -dependencies = [ - "libc", - "neli", - "windows-sys 0.61.2", -] +checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0" [[package]] name = "lock_api" @@ -1365,13 +1595,19 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" [[package]] name = "lru" -version = "0.16.4" +version = "0.18.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39" +checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25" dependencies = [ - "hashbrown 0.16.1", + "hashbrown 0.17.0", ] +[[package]] +name = "lru-slab" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" + [[package]] name = "memchr" version = "2.8.0" @@ -1380,13 +1616,19 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" [[package]] name = "memoffset" -version = "0.6.5" +version = "0.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce" +checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" dependencies = [ "autocfg", ] +[[package]] +name = "mime" +version = "0.3.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" + [[package]] name = "minimal-lexical" version = "0.2.1" @@ -1415,42 +1657,37 @@ dependencies = [ ] [[package]] -name = "neli" -version = "0.7.4" +name = "moka" +version = "0.12.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22f9786d56d972959e1408b6a93be6af13b9c1392036c5c1fafa08a1b0c6ee87" +checksum = "4293f18e7567a1caf3c584855554377025c65e0aa445344d04171f5ad63d19b9" dependencies = [ - "bitflags 2.11.1", - "byteorder", - "derive_builder", - "getset", - "libc", - "log", - "neli-proc-macros", + "crossbeam-channel", + "crossbeam-epoch", + "crossbeam-utils", + "equivalent", "parking_lot", + "portable-atomic", + "smallvec", + "tagptr", + "uuid", ] [[package]] -name = "neli-proc-macros" -version = "0.2.2" +name = "ndk-context" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "05d8d08c6e98f20a62417478ebf7be8e1425ec9acecc6f63e22da633f6b71609" -dependencies = [ - "either", - "proc-macro2", - "quote", - "serde", - "syn 2.0.117", -] +checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" [[package]] name = "nix" -version = "0.24.3" +version = "0.31.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fa52e972a9a719cecb6864fb88568781eb706bac2cd1d4f04a648542dbf78069" +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" dependencies = [ - "bitflags 1.3.2", + "bitflags", "cfg-if", + "cfg_aliases", "libc", "memoffset", ] @@ -1500,12 +1737,13 @@ dependencies = [ ] [[package]] -name = "object" -version = "0.37.3" +name = "num_cpus" +version = "1.17.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe" +checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b" dependencies = [ - "memchr", + "hermit-abi", + "libc", ] [[package]] @@ -1522,6 +1760,10 @@ name = "once_cell" version = "1.21.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" +dependencies = [ + "critical-section", + "portable-atomic", +] [[package]] name = "once_cell_polyfill" @@ -1552,6 +1794,12 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" +[[package]] +name = "parking" +version = "2.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba" + [[package]] name = "parking_lot" version = "0.12.5" @@ -1577,11 +1825,11 @@ dependencies = [ [[package]] name = "pem" -version = "3.0.6" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be" +checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120" dependencies = [ - "base64", + "base64 0.23.1", "serde_core", ] @@ -1609,9 +1857,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" [[package]] name = "pingora" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "54a75f2ff8e122aa80ab202dc865294fe59cd856c2a5dab2d3df6e122c93b941" +checksum = "fc02712a3847828d6b798ecf31f0ac64e138df26b9513e20d52319cf3cecd11e" dependencies = [ "pingora-cache", "pingora-core", @@ -1623,9 +1871,9 @@ dependencies = [ [[package]] name = "pingora-boringssl" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d63a2d970f4c6ed9bd91025d89d8756a3ce1bb17969f4c83928445210cbf4940" +checksum = "1003c703c50e869a8e7c9ba2e232f8caf457e06531b66029d7a929342a67a7ae" dependencies = [ "boring", "boring-sys", @@ -1637,17 +1885,16 @@ dependencies = [ [[package]] name = "pingora-cache" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "527735ac204efb9fa3884bfd9224d016c5735fabe1d394ebed145b40e7545b99" +checksum = "8d2b5ad1877a7e0656d1fbcca0375aae46a7b17b71efe1956203c81f3ad4f013" dependencies = [ "ahash", + "arrayvec", "async-trait", "blake2", "bstr", "bytes", - "cf-rustracing", - "cf-rustracing-jaeger", "hex", "http", "httparse", @@ -1674,9 +1921,9 @@ dependencies = [ [[package]] name = "pingora-core" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a7ffe2f5acf9f94fd255cfd1438866bc9124f8f0c7d42562bd3f853df2094b7" +checksum = "7fd4d1ddc6d6dbc1a97164ce13c301980c25c35422aab87b512c4c8b5123729b" dependencies = [ "ahash", "async-trait", @@ -1685,10 +1932,11 @@ dependencies = [ "bytes", "chrono", "clap", - "daemonize", + "daemonix", "daggy", "derivative", "flate2", + "flurry", "futures", "h2", "http", @@ -1707,7 +1955,6 @@ dependencies = [ "pingora-pool", "pingora-runtime", "pingora-timeout", - "prometheus", "rand 0.8.6", "regex", "serde", @@ -1726,15 +1973,15 @@ dependencies = [ [[package]] name = "pingora-error" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b23f7bc013de67e44ed902a82843f6157460b89d11da882bcc6f09f8ae380af1" +checksum = "b6399da6e698035093d6b458707df5f3ea5292858816b99d4b2624d96b4f567f" [[package]] name = "pingora-header-serde" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "828c0e53e74160cbfe8e67dd3a811eb6a253c36acbaf7a39a01d9aacfb9ac139" +checksum = "e2e824dac9612e4b807e55981c2d6b665b6f936a8b4b75ee0ce1922373e93243" dependencies = [ "bytes", "http", @@ -1748,9 +1995,9 @@ dependencies = [ [[package]] name = "pingora-http" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d553d310a15ec88107b9388a02885f798efc57764d8e9bdaaf32a76722927a10" +checksum = "ac9876e8775ebeb5d91262be4daaaf26d21a8932f53402106ed280867fe4c4f4" dependencies = [ "bytes", "http", @@ -1759,18 +2006,18 @@ dependencies = [ [[package]] name = "pingora-ketama" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e2a2e43a14f1d291fba7905542c7c1d1f89528f470b3cd48b6806e702ea772f" +checksum = "21e1baa2fffc859944e0c42d1955412858ac80f1e6ad175c6c3d93693c990d60" dependencies = [ "crc32fast", ] [[package]] name = "pingora-load-balancing" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "361b69af0234d2e4d10234e2efd106bb3b8147c575d52f45604a46aaf26def7a" +checksum = "377e653ba80b73c1f35c16ade085eb5bc5a58cdd92f8e4ff1f967750f6faa654" dependencies = [ "arc-swap", "async-trait", @@ -1790,36 +2037,42 @@ dependencies = [ [[package]] name = "pingora-lru" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6705a26ad89d241a989a5395641931ba37076f5ab5fbd19ee92402414a43af32" +checksum = "aff106b6d8a53a746a23a6304e25709b3f2e580841ffe3176acc1979095b3806" dependencies = [ + "ahash", "arrayvec", + "async-channel", + "flurry", "hashbrown 0.17.0", + "log", "parking_lot", "rand 0.8.6", + "tokio", ] [[package]] name = "pingora-pool" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "feb1237893b15a9cf6b371bee8d7e2e1c10742e4be6eb00ed38cfe87fd1363f8" +checksum = "0f9276b751bf2f908d24c73b8f23fcf05c2102fe373513457deb8868e17ef238" dependencies = [ "crossbeam-queue", + "dashmap", + "futures", "log", "lru", "parking_lot", "pingora-timeout", - "thread_local", "tokio", ] [[package]] name = "pingora-proxy" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a92ee756ecf6ecb6419864da651cad6cecd933b6d420a26877031efa16bef57" +checksum = "2467265ad39b56230b56149f1c03ca510f46c4bf4a25d6d4b7345e0f06cc46e7" dependencies = [ "async-trait", "bytes", @@ -1840,21 +2093,23 @@ dependencies = [ [[package]] name = "pingora-runtime" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41815a13691a3e7d9ad0e34767d4140284132e31b95a4481f5e73ab6f407f834" +checksum = "89aed2e58b34196682bdc2370c4293f908dece5741c56f5f5ba1018f55de68f2" dependencies = [ + "log", "once_cell", "rand 0.8.6", + "serde", "thread_local", "tokio", ] [[package]] name = "pingora-timeout" -version = "0.8.1" +version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e3e321452eaa461e0b6c5aaa35b7e42527ee89df33710279f37fae7f066b68e" +checksum = "8a1dac05d3ebf3ec1be4748d7ef391c48baa886181ce0f1b564ef8fa569243e3" dependencies = [ "once_cell", "parking_lot", @@ -1869,6 +2124,21 @@ version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" +[[package]] +name = "portable-atomic" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85" + +[[package]] +name = "potential_utf" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564" +dependencies = [ + "zerovec", +] + [[package]] name = "powerfmt" version = "0.2.0" @@ -1885,25 +2155,14 @@ dependencies = [ ] [[package]] -name = "proc-macro-error-attr2" -version = "2.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5" -dependencies = [ - "proc-macro2", - "quote", -] - -[[package]] -name = "proc-macro-error2" -version = "2.0.1" +name = "prefix-trie" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802" +checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7" dependencies = [ - "proc-macro-error-attr2", - "proc-macro2", - "quote", - "syn 2.0.117", + "either", + "ipnet", + "num-traits", ] [[package]] @@ -1915,43 +2174,85 @@ dependencies = [ "unicode-ident", ] -[[package]] -name = "prometheus" -version = "0.13.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1" -dependencies = [ - "cfg-if", - "fnv", - "lazy_static", - "memchr", - "parking_lot", - "protobuf", - "thiserror 1.0.69", -] - -[[package]] -name = "protobuf" -version = "2.28.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94" - [[package]] name = "proxy" -version = "0.2.3" +version = "0.3.0" dependencies = [ + "arc-swap", "async-trait", + "boring", "chrono", + "hickory-resolver", "http", "instant-acme", "pingora", "rcgen", + "reqwest", + "rustls", "serde", - "thiserror 2.0.19", + "serde_json", + "thiserror", "tokio", "toml", ] +[[package]] +name = "quinn" +version = "0.11.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8" +dependencies = [ + "bytes", + "cfg_aliases", + "pin-project-lite", + "quinn-proto", + "quinn-udp", + "rustc-hash", + "rustls", + "socket2", + "thiserror", + "tokio", + "tracing", + "web-time", +] + +[[package]] +name = "quinn-proto" +version = "0.11.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" +dependencies = [ + "aws-lc-rs", + "bytes", + "getrandom 0.4.3", + "lru-slab", + "rand 0.10.2", + "rand_pcg", + "ring", + "rustc-hash", + "rustls", + "rustls-pki-types", + "slab", + "thiserror", + "tinyvec", + "tracing", + "web-time", +] + +[[package]] +name = "quinn-udp" +version = "0.5.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694" +dependencies = [ + "cfg_aliases", + "libc", + "once_cell", + "socket2", + "tracing", + "windows-sys 0.61.2", +] + [[package]] name = "quote" version = "1.0.45" @@ -1967,6 +2268,12 @@ version = "5.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" +[[package]] +name = "r-efi" +version = "6.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" + [[package]] name = "rand" version = "0.8.6" @@ -1974,18 +2281,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" dependencies = [ "libc", - "rand_chacha 0.3.1", + "rand_chacha", "rand_core 0.6.4", ] [[package]] name = "rand" -version = "0.9.5" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "rand_chacha 0.9.0", - "rand_core 0.9.5", + "chacha20", + "getrandom 0.4.3", + "rand_core 0.10.1", ] [[package]] @@ -1998,16 +2306,6 @@ dependencies = [ "rand_core 0.6.4", ] -[[package]] -name = "rand_chacha" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", - "rand_core 0.9.5", -] - [[package]] name = "rand_core" version = "0.6.4" @@ -2019,22 +2317,27 @@ dependencies = [ [[package]] name = "rand_core" -version = "0.9.5" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + +[[package]] +name = "rand_pcg" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" dependencies = [ - "getrandom 0.3.4", + "rand_core 0.10.1", ] [[package]] name = "rcgen" -version = "0.14.8" +version = "0.14.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055" +checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8" dependencies = [ "aws-lc-rs", "pem", - "ring", "rustls-pki-types", "time", "x509-parser", @@ -2047,7 +2350,7 @@ version = "0.5.18" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d" dependencies = [ - "bitflags 2.11.1", + "bitflags", ] [[package]] @@ -2079,6 +2382,52 @@ version = "0.8.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a" +[[package]] +name = "reqwest" +version = "0.13.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029" +dependencies = [ + "base64 0.23.1", + "bytes", + "encoding_rs", + "futures-core", + "h2", + "http", + "http-body", + "http-body-util", + "hyper", + "hyper-rustls", + "hyper-util", + "js-sys", + "log", + "mime", + "percent-encoding", + "pin-project-lite", + "quinn", + "rustls", + "rustls-pki-types", + "rustls-platform-verifier", + "serde", + "serde_json", + "sync_wrapper", + "tokio", + "tokio-rustls", + "tower", + "tower-http", + "tower-service", + "url", + "wasm-bindgen", + "wasm-bindgen-futures", + "web-sys", +] + +[[package]] +name = "resolv-conf" +version = "0.7.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7" + [[package]] name = "ring" version = "0.17.14" @@ -2122,12 +2471,6 @@ dependencies = [ "num-traits", ] -[[package]] -name = "rustc-demangle" -version = "0.1.27" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d" - [[package]] name = "rustc-hash" version = "2.1.2" @@ -2154,11 +2497,12 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", + "log", "once_cell", "rustls-pki-types", "rustls-webpki", @@ -2184,6 +2528,7 @@ version = "1.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9" dependencies = [ + "web-time", "zeroize", ] @@ -2193,7 +2538,7 @@ version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" dependencies = [ - "core-foundation", + "core-foundation 0.10.1", "core-foundation-sys", "jni", "log", @@ -2216,9 +2561,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", @@ -2268,8 +2613,8 @@ version = "3.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ - "bitflags 2.11.1", - "core-foundation", + "bitflags", + "core-foundation 0.10.1", "core-foundation-sys", "libc", "security-framework-sys", @@ -2285,6 +2630,12 @@ dependencies = [ "libc", ] +[[package]] +name = "seize" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "689224d06523904ebcc9b482c6a3f4f7fb396096645c4cd10c0d2ff7371a34d3" + [[package]] name = "semver" version = "1.0.28" @@ -2323,9 +2674,9 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.149" +version = "1.0.151" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86" +checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14" dependencies = [ "itoa", "memchr", @@ -2362,7 +2713,7 @@ version = "0.10.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3fa1f336066b758b7c9df34ed049c0e693a426afe2b27ff7d5b14f410ab1a132" dependencies = [ - "base64", + "base64 0.22.1", "indexmap 2.14.0", "rust_decimal", ] @@ -2427,6 +2778,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "stable_deref_trait" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" + [[package]] name = "strsim" version = "0.11.1" @@ -2494,6 +2851,15 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "sync_wrapper" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263" +dependencies = [ + "futures-core", +] + [[package]] name = "synstructure" version = "0.13.2" @@ -2506,39 +2872,46 @@ dependencies = [ ] [[package]] -name = "thiserror" -version = "1.0.69" +name = "system-configuration" +version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52" +checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b" dependencies = [ - "thiserror-impl 1.0.69", + "bitflags", + "core-foundation 0.9.4", + "system-configuration-sys", ] [[package]] -name = "thiserror" -version = "2.0.19" +name = "system-configuration-sys" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9" +checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4" dependencies = [ - "thiserror-impl 2.0.19", + "core-foundation-sys", + "libc", ] [[package]] -name = "thiserror-impl" -version = "1.0.69" +name = "tagptr" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417" + +[[package]] +name = "thiserror" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" +checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e" dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", + "thiserror-impl", ] [[package]] name = "thiserror-impl" -version = "2.0.19" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd" +checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", @@ -2554,16 +2927,6 @@ dependencies = [ "cfg-if", ] -[[package]] -name = "thrift_codec" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83d957f535b242b91aa9f47bde08080f9a6fef276477e55b0079979d002759d5" -dependencies = [ - "byteorder", - "trackable", -] - [[package]] name = "time" version = "0.3.47" @@ -2595,11 +2958,45 @@ dependencies = [ "time-core", ] +[[package]] +name = "tiny-keccak" +version = "2.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237" +dependencies = [ + "crunchy", +] + +[[package]] +name = "tinystr" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d" +dependencies = [ + "displaydoc", + "zerovec", +] + +[[package]] +name = "tinyvec" +version = "1.12.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f" +dependencies = [ + "tinyvec_macros", +] + +[[package]] +name = "tinyvec_macros" +version = "0.1.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" + [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" dependencies = [ "bytes", "libc", @@ -2670,9 +3067,9 @@ dependencies = [ [[package]] name = "toml" -version = "1.1.3+spec-1.1.0" +version = "1.1.6+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c" +checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a" dependencies = [ "indexmap 2.14.0", "serde_core", @@ -2694,9 +3091,9 @@ dependencies = [ [[package]] name = "toml_parser" -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526" +checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56" dependencies = [ "winnow", ] @@ -2707,6 +3104,45 @@ version = "1.1.2+spec-1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2" +[[package]] +name = "tower" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4" +dependencies = [ + "futures-core", + "futures-util", + "pin-project-lite", + "sync_wrapper", + "tokio", + "tower-layer", + "tower-service", +] + +[[package]] +name = "tower-http" +version = "0.6.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840" +dependencies = [ + "bitflags", + "bytes", + "futures-util", + "http", + "http-body", + "pin-project-lite", + "tower", + "tower-layer", + "tower-service", + "url", +] + +[[package]] +name = "tower-layer" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e" + [[package]] name = "tower-service" version = "0.3.3" @@ -2732,25 +3168,6 @@ dependencies = [ "once_cell", ] -[[package]] -name = "trackable" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b15bd114abb99ef8cee977e517c8f37aee63f184f2d08e3e6ceca092373369ae" -dependencies = [ - "trackable_derive", -] - -[[package]] -name = "trackable_derive" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebeb235c5847e2f82cfe0f07eb971d1e5f6804b18dac2ae16349cc604380f82f" -dependencies = [ - "quote", - "syn 1.0.109", -] - [[package]] name = "try-lock" version = "0.2.5" @@ -2793,12 +3210,41 @@ version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" +[[package]] +name = "url" +version = "2.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed" +dependencies = [ + "form_urlencoded", + "idna", + "percent-encoding", + "serde", +] + +[[package]] +name = "utf8_iter" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" + [[package]] name = "utf8parse" version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.26.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce" +dependencies = [ + "getrandom 0.4.3", + "js-sys", + "wasm-bindgen", +] + [[package]] name = "version_check" version = "0.9.5" @@ -2852,6 +3298,16 @@ dependencies = [ "wasm-bindgen-shared", ] +[[package]] +name = "wasm-bindgen-futures" +version = "0.4.71" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "96492d0d3ffba25305a7dc88720d250b1401d7edca02cc3bcd50633b424673b8" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "wasm-bindgen-macro" version = "0.2.121" @@ -2884,6 +3340,26 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "web-sys" +version = "0.3.98" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4b572dff8bcf38bad0fa19729c89bb5748b2b9b1d8be70cf90df697e3a8f32aa" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + +[[package]] +name = "web-time" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "webpki-root-certs" version = "1.0.7" @@ -2893,6 +3369,12 @@ dependencies = [ "rustls-pki-types", ] +[[package]] +name = "widestring" +version = "1.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471" + [[package]] name = "winapi" version = "0.3.9" @@ -2965,6 +3447,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" +[[package]] +name = "windows-registry" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720" +dependencies = [ + "windows-link", + "windows-result", + "windows-strings", +] + [[package]] name = "windows-result" version = "0.4.1" @@ -3086,6 +3579,12 @@ version = "0.57.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" +[[package]] +name = "writeable" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4" + [[package]] name = "x509-parser" version = "0.18.1" @@ -3099,9 +3598,8 @@ dependencies = [ "lazy_static", "nom", "oid-registry", - "ring", "rusticata-macros", - "thiserror 2.0.19", + "thiserror", "time", ] @@ -3115,6 +3613,29 @@ dependencies = [ "time", ] +[[package]] +name = "yoke" +version = "0.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" +dependencies = [ + "stable_deref_trait", + "yoke-derive", + "zerofrom", +] + +[[package]] +name = "yoke-derive" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.117", + "synstructure", +] + [[package]] name = "zerocopy" version = "0.8.48" @@ -3135,12 +3656,66 @@ dependencies = [ "syn 2.0.117", ] +[[package]] +name = "zerofrom" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272" +dependencies = [ + "zerofrom-derive", +] + +[[package]] +name = "zerofrom-derive" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.117", + "synstructure", +] + [[package]] name = "zeroize" version = "1.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" +[[package]] +name = "zerotrie" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf" +dependencies = [ + "displaydoc", + "yoke", + "zerofrom", +] + +[[package]] +name = "zerovec" +version = "0.11.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +dependencies = [ + "yoke", + "zerofrom", + "zerovec-derive", +] + +[[package]] +name = "zerovec-derive" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.117", +] + [[package]] name = "zmij" version = "1.0.21" diff --git a/Cargo.toml b/Cargo.toml index adfe95c..6c84a45 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "proxy" -version = "0.2.3" +version = "0.3.0" edition = "2024" [profile.dev] @@ -14,30 +14,51 @@ panic = "abort" [lints.rust] unsafe_code = "forbid" # while developing, allow dead code and unused imports/variables -dead_code = { level = "allow", priority = -1 } -unused = { level = "allow", priority = -1 } +# dead_code = { level = "allow", priority = -1 } +# unused = { level = "allow", priority = -1 } [dependencies] # Async -async-trait = "0.1.91" -tokio = { version = "1.53.1", features = ["full"] } +async-trait = "0.1.92" +tokio = { version = "1.53.2", features = ["full"] } + +# Arc +arc-swap = "1.9.2" # Certs -# used Ring as backend for default -rcgen = { version = "0.14.8", features = ["default"] } -# match the backed from rcgen -instant-acme = { version = "0.8.5", features = ["rcgen"] } +# aws-lc-rs backend: post-quantum key exchange in rustls +rcgen = { version = "0.14.10", default-features = false, features = [ + "aws_lc_rs", + "pem", +] } +# match the backend from rcgen +instant-acme = { version = "0.8.5", default-features = false, features = [ + "aws-lc-rs", + "rcgen", + "hyper-rustls", +] } +rustls = "0.23.45" + +# DNS resolver +hickory-resolver = { version = "0.26.3", features = ["tls-aws-lc-rs"] } # TOML -toml = "1.1.3" +toml = "1.1.6" # Json serde = { version = "1.0.229", features = ["derive"] } +serde_json = "1.0.151" # Others -thiserror = "2.0.19" +thiserror = "2.0.21" chrono = { version = "0.4.45", features = ["serde"] } # HTTP -http = "1.4.2" -pingora = { version = "0.8.1", features = ["proxy", "boringssl"] } +http = "1.5.0" +pingora = { version = "0.9.0", features = ["proxy", "boringssl"] } +# https://github.com/cloudflare/pingora/blob/0.9.0/pingora-boringssl/Cargo.toml +# keep it in-sync with the pingora-boringssl crate +boring = { version = "5.2.0", features = ["pq-experimental"] } + +# HTTP Client +reqwest = { version = "0.13.5", features = ["json"] } diff --git a/README.md b/README.md index 7029610..f007e93 100644 --- a/README.md +++ b/README.md @@ -1,43 +1,32 @@ -# Reverse Proxy +# reverse-proxy -> A small, fast, single-binary reverse proxy with TLS termination and per-host routing. Drop in a TOML file, point DNS at it, done. +A single-binary reverse proxy for self-hosting. One TOML file declares your routes; it handles TLS termination and forwarding from there. Built on [Pingora](https://github.com/cloudflare/pingora) + BoringSSL, ships as a hardened container image (non-root, read-only rootfs, no shell). -

Architecture diagram

- -Built in Rust on top of Cloudflare's [Pingora](https://github.com/cloudflare/pingora), shipped as a hardened container (~few MB, non-root, read-only rootfs). Designed for self-hosting: one process in front of all your services, configured from a single file. +

A request flowing through the proxy

## Why -I normally use `nginxproxy/nginx-proxy` for my self-hosted projects. It works, but every container has to live on the same Docker network with a `VIRTUAL_HOST` label. That couples the proxy to the apps in a way I don't love. +`nginxproxy/nginx-proxy` was my go-to for a while, and it does the job. What I never liked is that every container needs a `VIRTUAL_HOST` label and has to share a network with the proxy. That always felt a bit wrong to me. -So I wrote my own (by hand, old-school, no AI writing the code) to learn the internals and end up with something that: +A lot has changed since then. Building your own proxy is doable now, though it comes with its own challenges, so I built this one on a proven stack. The core idea: keep it simple for self-hosted projects, and still get a legit Let's Encrypt certificate for a box the internet can't reach. Point `vault.example.com` at a LAN IP in your own DNS, and you get proper HTTPS on your home network. -- Has **one place** to declare what gets proxied (a TOML file). -- Doesn't care how upstreams are deployed: containers, host processes, anywhere reachable. -- Boots fast, binds two ports, terminates TLS, forwards. That's it. +The code is written by hand, no AI. I want to keep my Rust skills sharp, and I still enjoy writing code. ## Features -| Status | Feature | -| ------ | -------------------------------------------------------- | -| done | HTTP & HTTPS listeners (Pingora + BoringSSL) | -| done | Per-host routing from a single `config.toml` | -| done | Self-signed certificate generation (`rcgen`) on boot | -| done | Per-route TLS mode: `self_signed`, `acme`, `none` | -| done | HTTP → HTTPS redirect (301) for routes with a cert | -| done | Hardened container: non-root, read-only fs, dropped caps | -| done | Reach apps on the host via `host.docker.internal` | -| wip | Let's Encrypt / ACME issuance (`rustls-acme`) | -| todo | Structured logs (errors today, access logs next) | -| todo | Full test coverage for behavioural guarantees | -| todo | Performance benchmarks | +- HTTP and HTTPS listeners, both always on +- Routing by `Host` header from a single TOML file +- Self-signed certs generated on boot for `self_signed` routes +- 301 redirect from HTTP → HTTPS for any route that has a cert +- Full ACME / Let's Encrypt: a renewal loop (hourly, every 2 minutes while an order is pending) that orders a cert, writes the DNS TXT record via Cloudflare API, and hot-swaps it in without a restart +- Hardened container image: non-root, read-only rootfs, all capabilities dropped, no shell +- Multi-arch images (amd64, arm64) on Docker Hub and GHCR per release ## Quick start -The image is published to Docker Hub as `maxvanderschee/reverse-proxy` (also available on GHCR as `ghcr.io/mvdschee/reverse-proxy`). Two things to provide: +Two things: a `config.toml` and a compose file. -1. A `config.toml` describing your routes. -2. A `docker-compose.yml` that mounts it. +The image is `maxvanderschee/reverse-proxy` on Docker Hub, `ghcr.io/mvdschee/reverse-proxy` on GHCR. Multi-arch per release tag, plus `latest`. **`config.toml`** @@ -54,6 +43,19 @@ cert_type = "none" host = "api.example.com" upstream = "host.docker.internal:8000" cert_type = "self_signed" + +# real cert: the renewal loop orders from Let's Encrypt, writes the DNS +# TXT record via Cloudflare, swaps the new cert in. no restart. +[[routes]] +host = "blog.example.com" +upstream = "host.docker.internal:2000" +cert_type = "acme" + +# DNS challenge. acme routes without a provider are skipped. +# challenge prefix is always _acme-challenge., not configurable. +[routes.dns_provider.cloudflare] +zone_id = "your-cloudflare-zone-id" +api_token = "your-cloudflare-api-token" ``` **`docker-compose.yml`** @@ -61,8 +63,9 @@ cert_type = "self_signed" ```yaml services: proxy: - image: maxvanderschee/reverse-proxy:latest # or ghcr.io/mvdschee/reverse-proxy:latest + image: maxvanderschee/reverse-proxy:latest restart: unless-stopped + # runs as nonroot (uid 65532), can't bind below 1024, so 8080/8443 ports: - "80:8080" - "443:8443" @@ -76,93 +79,117 @@ services: - no-new-privileges:true cap_drop: - ALL - tmpfs: - - /tmp + healthcheck: + test: ["CMD", "nc", "-z", "127.0.0.1", "8080"] + interval: 30s + timeout: 3s + retries: 3 + start_period: 5s volumes: proxy-certs: ``` -Then: +`docker compose up -d`, point DNS at the box, done. Configured hosts get proxied; everything else gets a `421 Misdirected Request`. -```sh -docker compose up -d -``` +## Config -Point DNS at the host, and traffic on `:80`/`:443` for the configured hosts will be terminated and proxied to the upstreams. +An `[acme]` table and a list of `[[routes]]`. Full annotated schema: [`example/example.toml`](example/example.toml). -## Configuration +| Field | Required | What it does | +| ----------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `acme.email` | yes | Contact email for Let's Encrypt. Parser requires it even if every route is `none`. Use a real one!!! | +| `routes[].host` | yes | The `Host` header to match, e.g. `app.example.com`. | +| `routes[].upstream` | yes | `host:port` to forward to, over plain HTTP. `host.docker.internal:` reaches apps on the Docker host. | +| `routes[].cert_type` | no | `none` (HTTP only), `self_signed`, or `acme`. Defaults to `none`. | +| `routes[].dns_provider` | no | Only for `acme` routes. Cloudflare only for now (`zone_id` + `api_token`, see [Cloudflare setup](#cloudflare-setup)). Routes without one are skipped by the renewal loop. | -The full schema lives in [`example/example.toml`](example/example.toml). The fields: +A couple of sharp edges: -| Field | Required | Description | -| -------------------- | -------- | ----------------------------------------------------------------------------------------------------- | -| `acme.email` | yes | Contact email for Let's Encrypt (used once ACME lands; required today even if every route is `none`). | -| `routes[].host` | yes | The `Host` header to match (e.g. `app.example.com`). | -| `routes[].upstream` | yes | `host:port` to forward to. Use `host.docker.internal:` to reach the host machine from Docker. | -| `routes[].cert_type` | no | `self_signed` (default works on boot), `acme` (WIP), or `none` (HTTP only). Defaults to `acme`. | +- `host` is an exact match. A request for `app.example.com:443` will not match a route for `app.example.com`. +- "TLS route" means `cert_type` ≠ `none`. Those get the 301 on the HTTP listener and are served on 443 with whatever's in `CERT_DIR` (`..pem` / `..key`, e.g. `app.example.com.acme.pem`). Each cert type has its own files, so switching a route's `cert_type` never reuses the other type's cert. Self-signed certs are regenerated on every boot; ACME certs come from the renewal loop (renews within 30 days of expiry). +- The proxy boots even when cert files are missing. It logs a warning and serves what it can. +- The cert is picked by SNI. The TLS handshake only succeeds when the client sends SNI and a cert for that host exists. +- The first ACME cert takes a few minutes. Boot tick writes the TXT record, then a tick every 2 minutes finalizes once the record resolves. Until it lands the host is unreachable: HTTP still 301s to HTTPS, and HTTPS has nothing to serve yet. +- It talks to Let's Encrypt production by default and agrees to their terms for you. Set `ACME_ENV=staging` while testing to stay clear of the production rate limits. +- The ACME account is tied to the environment it was created in. Once `acme_account` exists, `ACME_ENV` is ignored. Delete `acme_account` to switch between staging and production. +- No `X-Forwarded-For` / `X-Forwarded-Proto` headers are added. The upstream sees the proxy as the client. -## How it works +## Environment variables -``` - ┌──────────────────────────────────────────┐ - │ Pingora process │ -client │ ┌────────────────┐ ┌──────────────┐ │ HTTP - ───► │ │ TLS termination│ ──►│ Host router │ ─┼──────► upstream - │ └────────────────┘ └──────────────┘ │ - │ (BoringSSL) (config.toml) │ - └──────────────────────────────────────────┘ -``` +| Variable | Binary default | In the image | Notes | +| ------------- | -------------- | ------------------------ | ------------------------------------------------------------ | +| `CONFIG_PATH` | _none, exits_ | `/etc/proxy/config.toml` | Path to the TOML config. | +| `CERT_DIR` | `.certs/` | `/var/lib/proxy/certs` | Where certs and the ACME account file (`acme_account`) live. | +| `HTTP_PORT` | `80` | `8080` | Port for the HTTP listener. | +| `HTTPS_PORT` | `443` | `8443` | Port for the HTTPS listener. | +| `ACME_ENV` | `production` | `production` | `production` or `staging`. Other values get rejected | + +The image bakes in the right-hand column (Dockerfile sets all four), so the compose file above doesn't repeat them. Listeners always bind `0.0.0.0`. -On startup the binary: +## Container image -1. Reads `config.toml` from `CONFIG_PATH`. -2. Ensures `CERT_DIR` exists and is writable. -3. Generates self-signed certs via `rcgen` for any route configured as `self_signed`. -4. Boots Pingora with one HTTPS listener (SNI-routed) and one HTTP listener, both reading the same per-host route table. The HTTP listener 301-redirects to HTTPS for any route that has a cert. +Both stages build on [Docker Hardened Images](https://hub.docker.com/hardened-images/catalog) alpine. The runtime image has the binary, `libgcc_s.so.1`, musl, busybox (for the `nc` healthcheck), and CA certs. No shell, no package manager. -Routing is purely `Host`-based: incoming `Host` header → route entry → forward to upstream over plain HTTP. +One build quirk: we cross-compile to `*-unknown-linux-musl` with `-crt-static` off. Fully static musl binaries can't `dlopen`, which breaks bindgen's libclang loader at build time. The runtime image ships musl, so the resulting mostly-dynamic binary runs fine. -## Under the hood +Since this sits on the public internet: -A few decisions worth knowing about if you want to dig in or contribute. +- **`read_only: true`** — the only writes are certs, and those go to the named volume. A compromised process can't touch its own binary or config. +- **`cap_drop: ALL`** + **`no-new-privileges`** — no capabilities, no setuid escalation. If it gets owned, the blast radius is the process. -**Pingora + BoringSSL.** The proxy is built on Pingora (the engine behind a chunk of Cloudflare's edge), with the `boringssl` feature instead of the OpenSSL default. That keeps the binary self-contained and avoids dragging system OpenSSL in. +## How it works -**Why `8080`/`8443` inside the container.** The image runs as user `nonroot` (uid `65532`) with `cap_drop: ALL` and `no-new-privileges`. A process without `CAP_NET_BIND_SERVICE` can't bind to ports below 1024, so the binary listens on `8080`/`8443` and the compose file maps the standard ports onto them. The defaults of the binary itself (`HTTP_PORT`/`HTTPS_PORT` env vars) are `80`/`443`; the Dockerfile overrides them. +Implementation notes, for the curious: -**Hardened base image.** Built and runtime images are both [Docker Hardened Images](https://hub.docker.com/hardened-images/catalog) (alpine-base). Runtime image ships only the binary, `musl`, `ca-certs`, and `libgcc_s.so.1` (needed by the dynamically-linked binary's unwinder). No shell, no package manager, no extras. +- `main()` is synchronous. Pingora has its own Tokio runtime; the binary loads config, sorts out certs, hands over to the server loop. +- The cert store is a `HashMap` behind an `ArcSwap`. The renewal loop swaps new certs in atomically, no restart. +- ACME account credentials persist in `CERT_DIR/acme_account`. A restart reuses the account, doesn't re-register. +- The renewal loop runs in two stages per host: first tick creates the order and writes the DNS-01 TXT record; later ticks (every 2 minutes while pending) wait until the TXT record resolves, then mark the challenge ready, finalize, swap the cert in. Dead orders get dropped and retried later. Pending orders live in memory, so a restart before it finalizes just starts a fresh order. -**Static-ish musl build.** Cross-compiled to `*-unknown-linux-musl`, but with `-crt-static` disabled so that build-script artifacts (notably `bindgen`'s `dlopen` of `libclang`) work. The runtime image ships `musl`, so the binary still runs cleanly. +## Roadmap -**No async runtime juggling.** `main()` is synchronous. Pingora owns its own Tokio runtime, so the binary just initializes config, certs, and hands control to Pingora's server loop. +Roughly in the order I'm doing them: -**Per-route TLS modes.** Each route picks its own cert strategy. `none` skips TLS entirely (handy for an internal-only host). `self_signed` writes a fresh cert on every restart. `rcgen`'s defaults give it a ~2000-year validity, so there's no in-process renewal loop; the restart is the rotation. `acme` is wired into the type system but not yet issuing. +1. Access logs and a proper logging story. Errors go to stdout for now. +2. A test suite for the behavioural bits. Routing, redirects, cert handling, error paths. +3. Benchmarks. Baseline numbers against nginx so I can judge changes by measurement instead of vibes. +4. Idiomatic Rust. V1 was correctness-first; the internals get tidied up once the shape is stable. -## Environment variables +## A note on AI -| Var | Default | Purpose | -| ------------- | ------------------------- | ------------------------------------------- | -| `CONFIG_PATH` | _required_ | Path to `config.toml`. | -| `CERT_DIR` | `.certs/` | Where generated/issued certs are persisted. | -| `HTTP_PORT` | `80` (image sets `8080`) | Port the HTTP listener binds to. | -| `HTTPS_PORT` | `443` (image sets `8443`) | Port the HTTPS listener binds to. | +I'm upfront about where I use AI. This one, the Rust is hand-written. What AI helped with: -## Roadmap +- Researching trade-offs (Pingora vs. the alternatives, BoringSSL vs. rustls, musl vs. glibc) +- Drafting and polishing text. +- The Dockerfile. I have written enough of those. Didn't feel like doing it by hand again. + +The code is mine. If you find a bug, that's on me. + +## Contributing + +- **Open an issue first.** I'd rather talk through what you want and how before reviewing a PR that already fixes a problem. +- **No AI-written code.** The Rust here is hand-written and I'd like it to stay that way. You can use AI to help you understand a change or clean up but I will be a bit sceptical if you have no Rust experience on your profile. + +## Cloudflare setup + +`acme` routes need two things from Cloudflare: the zone ID and an API token that can edit DNS in that zone. -In rough priority order: +**Zone ID.** Domains → pick your domain → Overview. It's in the API section towards the bottom. The Account ID sits right next to it and looks the same, don't mix them up. -1. **ACME issuance.** Wire up `rustls-acme` so the `acme` cert_type flips from "wired" to "working". -2. **Structured logging.** Error logs are in place; access logs and a sane structured format come next. -3. **Full test coverage.** Behavioural guarantees (routing, TLS modes, redirect, error paths) backed by tests, not just manual checks. -4. **Performance benchmarks.** Measure baseline throughput/latency vs. nginx, so future changes can be judged against numbers instead of vibes. -5. **Make each module idiomatic.** V1 is correctness-first; polish the internals once the surface is stable. +**API token.** -## AI disclaimer +1. My Profile → API Tokens → Create Token. +2. Use the "Edit zone DNS" template. +3. Permissions: `Zone` → `DNS` → `Edit`. That's the only one needed: the proxy creates and updates records, and it calls `/zones//dns_records` directly, so it needs `Edit` but not `Zone` → `Read`. +4. Zone Resources: `Include` → `Specific zone` → your domain. Don't hand it all zones. +5. Optional: Client IP Address Filtering to the box's public IP. If you set a TTL, renewals stop when it expires. +6. Create, copy the token (you only see it once), put it in `api_token`. -I'll be upfront on every public project about what was done with AI. For this one, I wanted to write the Rust myself to keep the skills sharp and have 100% understanding of every bit of code. AI was used for: +What the proxy does with it: -- Research and tradeoff discussions -- Cleanup of the README and other prose -- Talking through code-level solutions -- Generating the Docker image scaffolding from a spec +- Writes one TXT record, `_acme-challenge.`, TTL auto, not proxied, with a comment so you can spot it. +- Keeps the record around. The next renewal updates it in place. Leave it alone. +- The host has to live in that zone: `blog.example.com` → the `example.com` zone. No wildcards, one cert per host. +- The token is plain text in `config.toml`. Keep that in mind. +- DNS-01 means Let's Encrypt never connects to the box. The A record can point at a LAN IP, that's the whole point. diff --git a/docker-compose.yml b/docker-compose.yml index dec2d7b..469c2b5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,11 +1,12 @@ services: proxy: # Replace with the actual image - # image: ghcr.io/mvdschee/proxy:latest + # image: ghcr.io/mvdschee/reverse-proxy:latest build: context: . dockerfile: .docker/Dockerfile ports: + # nonroot user can't bind to ports < 1024, so map to 8080/8443 - "80:8080" - "443:8443" # Lets upstream = "host.docker.internal:" reach apps running @@ -23,8 +24,6 @@ services: - no-new-privileges:true cap_drop: - ALL - tmpfs: - - /tmp healthcheck: # Busybox `nc -z` confirms the HTTP listener is bound. It does # not exercise the proxy path; the listener simply has to accept. diff --git a/example/example.toml b/example/example.toml index 69e6f8a..6066324 100644 --- a/example/example.toml +++ b/example/example.toml @@ -1,12 +1,28 @@ [acme] -email = "max@example.com" +email = "max@example.com" # use a real one, Let's Encrypt rejects example.com, even for local testing [[routes]] host = "git.example.com" upstream = "127.0.0.1:3000" # use "host.docker.internal:3000" when using docker -cert_type = "self_signed" # default is "acme" +cert_type = "self_signed" # default is "none" [[routes]] host = "test.example.com" upstream = "127.0.0.1:3000" # use "host.docker.internal:3000" when using docker -cert_type = "none" # default is "acme" +cert_type = "none" # default is "none" + +# acme gets a legit Let's Encrypt cert through the DNS-01 challenge, so the box +# can stay off the internet: point blog.example.com at a LAN IP and it still works. +# the renewal loop only picks up acme routes with a dns provider. it orders the +# cert, writes the TXT record, and swaps the cert in once the record resolves. +# no restart needed. +[[routes]] +host = "blog.example.com" +upstream = "127.0.0.1:3000" # use "host.docker.internal:3000" when using docker +cert_type = "acme" + +# the dns provider for the DNS-01 challenge. cloudflare is the only one for now. +# the challenge record is always _acme-challenge.. +[routes.dns_provider.cloudflare] +zone_id = "your-cloudflare-zone-id" +api_token = "your-cloudflare-api-token" diff --git a/makefile b/makefile index 3cd59f6..0f06349 100644 --- a/makefile +++ b/makefile @@ -1,5 +1,5 @@ dev: - CONFIG_PATH=./example/example.toml watchexec -q -c -w src --exts rs --restart "cargo run" + CONFIG_PATH=./example/local.toml ACME_ENV=staging HTTP_PORT=880 HTTPS_PORT=8443 watchexec -q -c -w src --exts rs --restart "cargo run" scan: foxguard --config .foxguard.yml diff --git a/src/config.rs b/src/config.rs index 6a6ddde..10f72e9 100644 --- a/src/config.rs +++ b/src/config.rs @@ -1,49 +1,35 @@ use crate::{ Error, Result, core::models::{ - certs::{CertDir, Email}, + certs::{CertAccountPath, CertDir}, + config::{AcmeEnv, Config, ConfigTomlFile}, proxy::{ProxyInputAddress, ProxyPort}, - routes::Route, tasks::TaskInterval, }, }; -use serde::Deserialize; use std::{env, fs}; const CONFIG_PATH_ENV: &str = "CONFIG_PATH"; const CERT_DIR_ENV: &str = "CERT_DIR"; const HTTP_PORT_ENV: &str = "HTTP_PORT"; const HTTPS_PORT_ENV: &str = "HTTPS_PORT"; +const ACME_ENV: &str = "ACME_ENV"; +pub const ACME_CHALLENGE_PREFIX: &str = "_acme-challenge."; const CERT_DIR_DEFAULT: &str = ".certs/"; +// this will be stored in the .certs/ or depending on where the user wants to store it +const CERT_CREDENTIAL_FILE: &str = "acme_account"; +// set +const ACME_ENV_DEFAULT: &str = "production"; const HTTP_PORT_DEFAULT: u16 = 80; const HTTPS_PORT_DEFAULT: u16 = 443; const INPUT_ADDRESS: &str = "0.0.0.0"; -// in seconds -const CERT_BACKGROUND_TASK_INTERVAL: u64 = 120; - -#[derive(Debug, Clone)] -pub struct Config { - pub email: Email, - pub cert_dir: CertDir, - pub routes: Vec, - pub task_interval: TaskInterval, - pub http_port: ProxyPort, - pub https_port: ProxyPort, - pub input_address: ProxyInputAddress, -} - -#[derive(Debug, Clone, Deserialize)] -pub struct ConfigTomlFile { - pub acme: Acme, - pub routes: Vec, -} - -#[derive(Debug, Clone, Deserialize)] -pub struct Acme { - pub email: Email, -} +/// in seconds +const CERT_BACKGROUND_TASK_INTERVAL_DEFAULT: u64 = 3600; // 1 hour +const CERT_BACKGROUND_TASK_INTERVAL_PENDING: u64 = 120; // 2 minutes +pub const CERT_RENEWAL_TRESHOLD_DAYS: u32 = 30; +pub const FILE_PERMISSION: u32 = 0o600; impl Config { pub fn init() -> Result { @@ -51,6 +37,8 @@ impl Config { let config_file = parse_toml_config(config_path)?; let cert_dir = load_env(CERT_DIR_ENV).unwrap_or_else(|_| CERT_DIR_DEFAULT.to_string()); + let cert_account_path = format!("{}/{}", cert_dir, CERT_CREDENTIAL_FILE); + let http_port = load_env(HTTP_PORT_ENV).ok().and_then(|v| v.parse().ok()).unwrap_or(HTTP_PORT_DEFAULT); let https_port = load_env(HTTPS_PORT_ENV) @@ -58,11 +46,23 @@ impl Config { .and_then(|v| v.parse().ok()) .unwrap_or(HTTPS_PORT_DEFAULT); + let acme_env = load_env(ACME_ENV).unwrap_or_else(|_| ACME_ENV_DEFAULT.to_string()); + // a typo would silently fall back to staging and issue untrusted certs + if acme_env != "production" && acme_env != "staging" { + return Err(Error::Config(format!( + "{} must be \"production\" or \"staging\", got \"{}\"", + ACME_ENV, acme_env + ))); + } + Ok(Config { email: config_file.acme.email.clone(), + acme_env: AcmeEnv::from(acme_env), cert_dir: CertDir::from(cert_dir), + cert_account_path: CertAccountPath::from(cert_account_path), routes: config_file.routes.clone(), - task_interval: TaskInterval::from(CERT_BACKGROUND_TASK_INTERVAL), + task_interval_default: TaskInterval::from(CERT_BACKGROUND_TASK_INTERVAL_DEFAULT), + task_interval_pending: TaskInterval::from(CERT_BACKGROUND_TASK_INTERVAL_PENDING), http_port: ProxyPort::from(http_port), https_port: ProxyPort::from(https_port), input_address: ProxyInputAddress::from(INPUT_ADDRESS.to_string()), diff --git a/src/core/handlers/certs.rs b/src/core/handlers/certs.rs index f9d088d..c7361be 100644 --- a/src/core/handlers/certs.rs +++ b/src/core/handlers/certs.rs @@ -1,73 +1,592 @@ use crate::{ Error, Result, + config::CERT_RENEWAL_TRESHOLD_DAYS, core::{ - handlers::filesystem::{safe_path, write_file}, + handlers::filesystem::{check_file_exists, read_file, safe_path, write_file}, models::{ - certs::{CertificateConfig, CertificateType}, + certs::{ + CertAccountPath, CertPath, CertificateConfig, CertificateType, Email, KeyPath, + OrderOutcome, TlsMaterial, TlsStore, + }, + config::AcmeEnv, + dns::{ + Cloudflare, CloudflareProvider, DnsProvider, ProviderCredentail, + default_challenge_prefix, + }, + routes::Host, tasks::TaskInterval, }, }, - info, + error, info, + services::{ + certs::{ + acme::{create_account, create_order, init_account, load_account}, + self_signed::create_self_signed_certificate_files, + }, + dns::resolver::DnsResolver, + http::create_client, + }, + warn, +}; +use arc_swap::ArcSwap; +use async_trait::async_trait; +use boring::asn1::Asn1Time; +use instant_acme::{ + Account, AccountCredentials, AuthorizationStatus, ChallengeType, Order, OrderStatus, + RetryPolicy, }; -use rcgen::{CertifiedKey, generate_simple_self_signed}; -use std::time::Duration; -use tokio::time; - -pub fn generate_certs(certificate_configs: Vec) -> Result<()> { - for config in &certificate_configs { - // self signed certificates are good until the year 4096 - // this will be replace every restart so it's safe to keep using the default setting - match config.cert_type { - CertificateType::SelfSigned => { - info!("generating self-signed certificate for {}", config.host); - - let subject_alt_names = vec![config.host.to_string()]; - let pem_filename = format!("{}.pem", config.host); - let key_filename = format!("{}.key", config.host); - - let key_path = safe_path(&config.cert_dir, &key_filename)?; - let pem_path = safe_path(&config.cert_dir, &pem_filename)?; - - let CertifiedKey { - cert, - signing_key, - } = generate_simple_self_signed(subject_alt_names) - .map_err(|e| Error::Certificate(e.to_string()))?; - - let pem_serialized = cert.pem(); - let key_serialized = signing_key.serialize_pem(); - - write_file(pem_path, pem_serialized.as_bytes())?; - write_file(key_path, key_serialized.as_bytes())?; +use pingora::{server::ShutdownWatch, services::background::BackgroundService, tls}; +use reqwest::Client; +use std::{collections::HashMap, sync::Arc, time::Duration}; + +/// ------------------------------ +/// Main background cert loop +/// ------------------------------ +pub struct CertBackgroundRenewal { + pub certificate_configs: Vec, + pub cert_account_path: CertAccountPath, + pub task_interval_default: TaskInterval, + pub task_interval_pending: TaskInterval, + pub tls_store: TlsStore, + pub email: Email, + pub acme_env: AcmeEnv, +} + +impl CertBackgroundRenewal { + pub fn new( + certificate_configs: Vec, + cert_account_path: CertAccountPath, + task_interval_default: TaskInterval, + task_interval_pending: TaskInterval, + tls_store: TlsStore, + email: Email, + acme_env: AcmeEnv, + ) -> Self { + Self { + certificate_configs, + cert_account_path, + task_interval_default, + task_interval_pending, + tls_store, + acme_env, + email, + } + } +} + +#[async_trait] +impl BackgroundService for CertBackgroundRenewal { + // start should never return this will stop the background task, + // this means we have to be a little more verbose with our error handeling. + // TLDR; just continue on any error :D, problem for the next loop :') + async fn start(&self, mut shutdown: ShutdownWatch) { + let configs: Vec = self + .certificate_configs + .iter() + .filter(|c| c.cert_type == CertificateType::Acme) + .cloned() + .collect(); + + if configs.iter().all(|config| config.provider_config.is_none()) { + warn!("No ACME certificates configured, skipping ACME renewal loop"); + return; + } + + let http_client = match create_client() { + Ok(client) => client, + Err(e) => { + error!("Can't start cert renewal loop: {}", e); + return; + }, + }; + + let dns_resolver = match DnsResolver::new(default_challenge_prefix()) { + Ok(resolver) => resolver, + Err(err) => { + error!("Failed to create DNS resolver: {err:?}"); + return; }, - CertificateType::Acme => { - info!("generating acme certificate for {}", config.host); + }; + + // mutated in the renew_host to keep track of the order state + let mut pending_order_urls: HashMap = HashMap::new(); + // store account outside of loop + let mut account: Option = None; + + loop { + info!("renewal loop: {} ACME hosts", configs.len()); + + if account.is_none() { + match resolve_acme_account(&self.cert_account_path, &self.email, &self.acme_env) + .await + { + Ok(acc) => account = Some(acc), + Err(err) => { + error!("Failed to resolve ACME account: {err:?}"); + }, + }; + } + + if let Some(account) = &account { + for config in &configs { + if let Err(err) = renew_host( + &self.tls_store, + &dns_resolver, + account, + &mut pending_order_urls, + &http_client, + config.clone(), + ) + .await + { + error!("renewal failed for {}: {err:?}", config.host); + } + } + } + + let interval = if account.is_some() && pending_order_urls.is_empty() { + *self.task_interval_default + } else { + *self.task_interval_pending + }; + + info!("background renewal loop sleeping for {} seconds...", interval); + + tokio::select! { + _ = tokio::time::sleep(Duration::from_secs(interval)) => {} + _ = shutdown.changed() => break, + } + } + } +} + +// ------------------------------ +// Cert functions used in our +// background cert loop +// ------------------------------ + +pub fn swap_store(store: &TlsStore, host: Host, key_bytes: &[u8], cert_bytes: &[u8]) -> Result<()> { + let tls = parse_certificates(cert_bytes, key_bytes)?; + + let mut new_certs = HashMap::clone(&store.load()); + + new_certs.insert(host, tls); + store.store(Arc::new(new_certs)); + + Ok(()) +} + +pub fn parse_certificates(cert_bytes: &[u8], key_bytes: &[u8]) -> Result { + // the PEM can be a full chain, the first cert is for the domain the rest are intermediates + let mut certs = tls::x509::X509::stack_from_pem(cert_bytes) + .map_err(|e| Error::Certificate(format!("Failed to parse certificate: {}", e)))? + .into_iter(); + + let cert = certs + .next() + .ok_or_else(|| Error::Certificate("No certificate found in PEM".to_string()))?; + let chain = certs.collect(); + + let key = tls::pkey::PKey::private_key_from_pem(key_bytes) + .map_err(|e| Error::Certificate(format!("Failed to parse private key: {}", e)))?; + + let pub_key = cert + .public_key() + .map_err(|e| Error::Certificate(format!("Failed to get public key: {}", e)))?; + + if !pub_key.public_eq(&key) { + return Err(Error::Certificate("Public key does not match private key".to_string())); + } + + Ok(TlsMaterial { + cert, + chain, + key, + }) +} + +// each cert get a suffix to prevent you from never getting a new certificate when switching +// between self-signed and acme +pub fn certificate_paths(config: &CertificateConfig) -> Result<(KeyPath, CertPath)> { + let suffix = match config.cert_type { + CertificateType::SelfSigned => "self_signed", + CertificateType::Acme => "acme", + CertificateType::None => { + return Err(Error::Certificate(format!("No certificate files for {}", config.host))); + }, + }; + + let cert_filename = format!("{}.{}.pem", config.host, suffix); + let key_filename = format!("{}.{}.key", config.host, suffix); + + let key_path = safe_path(&config.cert_dir, &key_filename)?; + let cert_path = safe_path(&config.cert_dir, &cert_filename)?; + + Ok((key_path, cert_path)) +} + +async fn renew_host( + tls_store: &TlsStore, + dns_resolver: &DnsResolver, + account: &Account, + pending_order_urls: &mut HashMap, + http_client: &Client, + config: CertificateConfig, +) -> Result<()> { + // -------------- + // CHECK STAGE + // -------------- + info!("[{}] checking", config.host); + + // check if dns provider is configured + let dns_service_config = match config.provider_config.clone() { + Some(config) => config, + None => { + warn!("Skipping Cert..."); + warn!("No DNS credentials provided for {}", config.host); + return Ok(()); + }, + }; + // check if existing cert needs renewal + let certs = tls_store.load(); + + if let Some(TlsMaterial { + cert, + .. + }) = certs.get(config.host.as_str()) + { + let threshold = Asn1Time::days_from_now(CERT_RENEWAL_TRESHOLD_DAYS) + .map_err(|e| Error::Certificate(format!("Failed to create threshold time: {}", e)))?; + + let needs_renewal = cert.not_after() < threshold; + + if !needs_renewal { + info!( + "[{}] skip: cert valid until {}, threshold {} days", + config.host, + cert.not_after(), + CERT_RENEWAL_TRESHOLD_DAYS + ); + return Ok(()); + } + }; + + // -------------- + // CHOOSE STAGE + // -------------- + let order_url = pending_order_urls.get(&config.host); + let mut order = create_order(account, &config.host, order_url).await?; + + let ready_to_validate = order_url.is_some(); + + if ready_to_validate { + info!("[{}] stage 2: resuming order", config.host); + } else { + info!("[{}] stage 1: new order", config.host); + } + + // -------------- + // ACTION STAGE + // -------------- + let order_status = order.state().status; + info!("[{}] order status {:?}", config.host, order_status); + + let dns_service = + get_dns_services(dns_service_config, http_client.clone(), config.host.clone()); + + let outcome = match (order_status, ready_to_validate) { + (OrderStatus::Pending, false) => { + authorizations_dns(&mut order, &dns_service, &config.host).await?; + OrderOutcome::Waiting + }, + (OrderStatus::Pending, true) => { + authorizations_ready(&mut order, &config.host, dns_resolver).await?; + finish_order(&mut order, tls_store, &config).await? + }, + (OrderStatus::Ready, _) => finish_order(&mut order, tls_store, &config).await?, + (OrderStatus::Valid, _) => OrderOutcome::Dead, + (OrderStatus::Processing, _) => OrderOutcome::Dead, + (OrderStatus::Invalid, _) => OrderOutcome::Dead, + }; + + match outcome { + OrderOutcome::Issued => { + info!("[{}] renewed", config.host); + pending_order_urls.remove(&config.host) + }, + OrderOutcome::Dead => { + warn!("[{}] order dropped ({:?}), new order next tick", config.host, order_status); + pending_order_urls.remove(&config.host) + }, + OrderOutcome::Waiting => { + info!("[{}] holding order for next tick", config.host); + pending_order_urls.insert(config.host.clone(), order.url().to_string()) + }, + }; + + Ok(()) +} + +async fn finish_order( + order: &mut Order, + tls_store: &TlsStore, + config: &CertificateConfig, +) -> Result { + // Exponentially back off until the order becomes ready or invalid. + let status = order + .poll_ready(&RetryPolicy::default()) + .await + .map_err(|e| Error::Certificate(format!("Polling order failed: {}", e)))?; + + if status != OrderStatus::Ready { + return Err(Error::Certificate(format!("Order is not ready: {:?}", status))); + } + + info!("[{}] order ready, finalizing", config.host); + + let private_key_pem = order + .finalize() + .await + .map_err(|e| Error::Certificate(format!("Finalizing order failed: {}", e)))?; + + let cert_chain_pem = order + .poll_certificate(&RetryPolicy::default()) + .await + .map_err(|e| Error::Certificate(format!("Polling certificate failed: {}", e)))?; + + info!("[{}] certificate issued", config.host); + + let (key_path, cert_path) = certificate_paths(config)?; + + write_file(key_path, private_key_pem.as_bytes())?; + write_file(cert_path, cert_chain_pem.as_bytes())?; + + info!("[{}] cert and key written to {}", config.host, config.cert_dir); + + swap_store( + tls_store, + config.host.clone(), + private_key_pem.as_bytes(), + cert_chain_pem.as_bytes(), + )?; + + info!("[{}] tls store updated", config.host); + + Ok(OrderOutcome::Issued) +} + +async fn authorizations_dns( + order: &mut Order, + dns_service: &impl DnsProvider, + host: &Host, +) -> Result<()> { + info!("[{}] writing dns-01 challenge records", host); + + let mut authorizations = order.authorizations(); + + while let Some(result) = authorizations.next().await { + let mut authz = result + .map_err(|e| Error::Certificate(format!("authorizations for this order: {}", e)))?; + + match authz.status { + // all status should continue here, we are create a new entry + AuthorizationStatus::Pending + | AuthorizationStatus::Invalid + | AuthorizationStatus::Revoked + | AuthorizationStatus::Expired + | AuthorizationStatus::Deactivated => {}, + AuthorizationStatus::Valid => { + info!("[{}] authorization already valid, no record needed", host); + continue; }, - CertificateType::None => {}, + // no catch all to prevent introducing new status } + + let challenge = match authz.challenge(ChallengeType::Dns01) { + Some(challenge) => challenge, + None => { + return Err(Error::Certificate("no dns01 challenge found".to_string())); + }, + }; + + let dns_value = challenge.key_authorization().dns_value(); + let record = dns_service.upsert_challenge_record(dns_value).await?; + + info!("[{}] txt record {} = {}", host, record.name, record.value); } Ok(()) } -pub async fn background_certs_task( - certificates: Vec, - task_interval: TaskInterval, +async fn authorizations_ready( + order: &mut Order, + host: &Host, + dns_resolver: &DnsResolver, ) -> Result<()> { - // only acme certificates need to be renewed - let certificates = certificates - .into_iter() - .filter(|cert| cert.cert_type == CertificateType::Acme) - .collect::>(); + info!("[{}] marking dns-01 challenges ready", host); + + let mut authorizations = order.authorizations(); + + while let Some(result) = authorizations.next().await { + let mut authz = result + .map_err(|e| Error::Certificate(format!("authorizations for this order: {}", e)))?; + + match authz.status { + // this one should continue + AuthorizationStatus::Pending => {}, + // others need to just skip and log + AuthorizationStatus::Valid + | AuthorizationStatus::Expired + | AuthorizationStatus::Invalid + | AuthorizationStatus::Revoked + | AuthorizationStatus::Deactivated => { + info!("[{}] authorization {:?}", host, authz.status); + continue; + }, + // no catch all to prevent introducing new status + } + + let records = dns_resolver.lookup_text(host).await?; + + let mut challenge = match authz.challenge(ChallengeType::Dns01) { + Some(challenge) => challenge, + None => { + return Err(Error::Certificate("no dns01 challenge found".to_string())); + }, + }; + + let dns_value = challenge.key_authorization().dns_value(); + + // check if dns_value is in records if so we are allowed to continue otherwise skip + if records.contains(&dns_value) { + info!("[{}] dns value present", host); + challenge + .set_ready() + .await + .map_err(|e| Error::Certificate(format!("set challenge ready: {}", e)))?; - loop { - info!("certificates: {}", certificates.len()); + info!("[{}] challenge marked ready, polling", host); - // for certificate in &certificates { - // } + continue; + } - time::sleep(Duration::from_secs(*task_interval)).await; + return Err(Error::Certificate("dns value not present".to_string())); } Ok(()) } + +fn get_dns_services(config: ProviderCredentail, client: Client, host: Host) -> impl DnsProvider { + match config { + ProviderCredentail::Cloudflare(config) => Cloudflare { + client, + host, + config: CloudflareProvider { + zone_id: config.zone_id, + api_token: config.api_token, + }, + challenge_prefix: default_challenge_prefix(), + }, + } +} + +async fn resolve_acme_account( + cert_account_path: &CertAccountPath, + email: &Email, + acme_env: &AcmeEnv, +) -> Result { + // set crypto lib to load/create the account + init_account(); + + if check_file_exists(cert_account_path) { + let credentials = get_acme_account(cert_account_path)?; + warn!("loading the previouse account, this skip the ACME_ENV value"); + warn!("remove acme_account in your cert folder if this is not what you want"); + return load_account(credentials).await; + } + + let (account, credentials) = create_account(email, acme_env).await?; + let content = serde_json::to_vec(&credentials) + .map_err(|e| Error::Acme(format!("Failed to serialize ACME account: {}", e)))?; + write_file(cert_account_path.clone(), &content)?; + + Ok(account) +} + +fn get_acme_account(cert_account_path: &CertAccountPath) -> Result { + let raw_content = read_file(cert_account_path)?; + + serde_json::from_slice(&raw_content).map_err(|e| { + Error::Acme(format!( + "Failed to parse ACME account: {}, delete {} to register a new one", + e, cert_account_path + )) + }) +} + +// ------------------------------ +// Self-signed cert functions +// those are used in the setup stage +// ------------------------------ + +pub fn create_self_signed_certs(certificate_configs: &Vec) -> Result<()> { + for config in certificate_configs { + if config.cert_type == CertificateType::SelfSigned { + // self signed certificates are good until the year 4096 + // this will be replace every restart so it's safe to keep using the default setting + // for selfsigned we will create the certs here right away + create_self_signed_certificate_files(config)?; + } + } + + Ok(()) +} + +pub fn load_tls_store(certificate_configs: &Vec) -> Result { + let mut tls_certs = HashMap::new(); + + for config in certificate_configs { + if config.cert_type != CertificateType::None { + let (key_path, cert_path) = certificate_paths(config)?; + + let has_tls_files = check_file_exists(&key_path) && check_file_exists(&cert_path); + + // We only show a warning so its easier to debug once its running, + // but we are not stopping any traffic. + if !has_tls_files { + warn!("Certificate files not found for host '{}' but is expected", &config.host); + continue; + } + + let cert_bytes = match read_file(&cert_path) { + Ok(cert_bytes) => cert_bytes, + Err(e) => { + error!("failed to read cert file for {}: {}", &config.host, e); + continue; + }, + }; + + let key_bytes = match read_file(&key_path) { + Ok(key_bytes) => key_bytes, + Err(e) => { + error!("failed to read key file for {}: {}", &config.host, e); + continue; + }, + }; + + let tls = match parse_certificates(&cert_bytes, &key_bytes) { + Ok(tls) => tls, + Err(e) => { + error!("failed to parse certs for {}: {}", &config.host, e); + continue; + }, + }; + + tls_certs.insert(config.host.clone(), tls); + } + } + + let tls_store: TlsStore = Arc::new(ArcSwap::from_pointee(tls_certs)); + + Ok(tls_store) +} diff --git a/src/core/handlers/filesystem.rs b/src/core/handlers/filesystem.rs index f4648d8..f1398b8 100644 --- a/src/core/handlers/filesystem.rs +++ b/src/core/handlers/filesystem.rs @@ -1,6 +1,8 @@ -use crate::{Error, Result, core::models::filesystem::SafePath}; +use crate::{Error, Result, config::FILE_PERMISSION, core::models::filesystem::SafePath}; use std::{ fs, + io::Write, + os::unix::fs::{OpenOptionsExt, PermissionsExt}, path::{Component, Path, PathBuf}, }; @@ -14,7 +16,21 @@ pub fn write_file(file_path: SafePath, content: &[u8]) -> Result<()> { return Err(Error::FileSystem(format!("Parent directory {:?} does not exist", parent))); } - fs::write(file_path.as_str(), content) + // written files are certificates and accounts in the certs directory + // for safty we use 0600 (owner only read/write) as read/write permission + let mut file = fs::OpenOptions::new() + .write(true) + .create(true) + .truncate(true) + .mode(FILE_PERMISSION) + .open(file_path.as_str()) + .map_err(|e| Error::FileSystem(format!("Failed to open {}: {}", file_path, e)))?; + + file.set_permissions(fs::Permissions::from_mode(FILE_PERMISSION)).map_err(|e| { + Error::FileSystem(format!("Failed to set permissions {}: {}", file_path, e)) + })?; + + file.write_all(content) .map_err(|e| Error::FileSystem(format!("Failed to write {}: {}", file_path, e)))?; Ok(()) diff --git a/src/core/handlers/proxy.rs b/src/core/handlers/proxy.rs index 62693f4..943e946 100644 --- a/src/core/handlers/proxy.rs +++ b/src/core/handlers/proxy.rs @@ -1,9 +1,9 @@ use crate::{ Error, Result, core::{ - handlers::filesystem::read_file, + handlers::certs::CertBackgroundRenewal, models::{ - certs::{TlsCerts, TlsMaterial}, + certs::{TlsMaterial, TlsStore}, proxy::{ProxyConfig, ProxyRoute, ProxyRouteMap}, }, }, @@ -15,7 +15,7 @@ use pingora::{ ErrorType, http::ResponseHeader, listeners::{TlsAccept, tls::TlsSettings}, - prelude::{Error as PingoraError, HttpPeer, Result as PingoraResult}, + prelude::{Error as PingoraError, HttpPeer, Result as PingoraResult, background_service}, proxy::{ProxyHttp, Session, http_proxy_service}, server::{Server, configuration::ServerConf}, services::Service, @@ -23,7 +23,12 @@ use pingora::{ }; use std::{collections::HashMap, sync::Arc}; -pub fn run_proxy(proxy_config: ProxyConfig, routes: Vec) -> Result<()> { +pub fn run_proxy( + proxy_config: ProxyConfig, + routes: Vec, + tls_store: TlsStore, + renewal: CertBackgroundRenewal, +) -> Result<()> { let mut server = Server::new(None).map_err(|e| Error::Proxy(e.to_string()))?; server.bootstrap(); @@ -31,34 +36,13 @@ pub fn run_proxy(proxy_config: ProxyConfig, routes: Vec) -> Result<( let server_conf = server.configuration.clone(); let http_addr = format!("{}:{}", proxy_config.input_address, *proxy_config.http_port); let https_addr = format!("{}:{}", proxy_config.input_address, *proxy_config.https_port); - let mut routes_map = HashMap::new(); - let mut tls_certs = HashMap::new(); for route in routes { - if *route.tls { - let cert_bytes = read_file(&route.cert_path)?; - let cert = tls::x509::X509::from_pem(&cert_bytes) - .map_err(|e| Error::Certificate(format!("Failed to parse certificate: {}", e)))?; - - let key_bytes = read_file(&route.key_path)?; - let key = tls::pkey::PKey::private_key_from_pem(&key_bytes) - .map_err(|e| Error::Certificate(format!("Failed to parse private key: {}", e)))?; - - tls_certs.insert( - route.host.clone(), - TlsMaterial { - cert, - key, - }, - ); - } - routes_map.insert(route.host.clone(), route); } let routes_map = Arc::new(routes_map); - let tls_certs = Arc::new(tls_certs); // plain proxies with redirect let plain_service = @@ -66,10 +50,12 @@ pub fn run_proxy(proxy_config: ProxyConfig, routes: Vec) -> Result<( server.add_service(plain_service); // tls proxies - let tls_service = - tls_routes_service(server_conf, https_addr.clone(), routes_map.clone(), tls_certs)?; + let tls_service = tls_routes_service(server_conf, https_addr, routes_map, tls_store)?; server.add_service(tls_service); + // background cert services + server.add_service(background_service("cert-renewal", renewal)); + server.run_forever(); } @@ -77,14 +63,14 @@ pub fn tls_routes_service( server_conf: Arc, listen_addr: String, routes_map: ProxyRouteMap, - tls_certs: TlsCerts, + tls_store: TlsStore, ) -> Result { let proxy_app = ProxyToUpstream::new(routes_map.clone(), false); let mut service = http_proxy_service(&server_conf, proxy_app); - let sni_resolver = SniResolver::new(tls_certs); - let callback = Box::new(sni_resolver); + let cert_resolver = CertResolver::new(tls_store); + let callback = Box::new(cert_resolver); let tls_settings = TlsSettings::with_callbacks(callback).map_err(|e| Error::Proxy(e.to_string()))?; service.add_tls_with_settings(&listen_addr, None, tls_settings); @@ -186,20 +172,20 @@ fn host_from_session(session: &Session) -> Option<&str> { session.get_header(header::HOST).and_then(|h| h.to_str().ok()) } -struct SniResolver { - certs: TlsCerts, +struct CertResolver { + tls_store: TlsStore, } -impl SniResolver { - fn new(tls_certs: TlsCerts) -> Self { +impl CertResolver { + fn new(tls_store: TlsStore) -> Self { Self { - certs: tls_certs, + tls_store, } } } #[async_trait] -impl TlsAccept for SniResolver { +impl TlsAccept for CertResolver { async fn certificate_callback(&self, ssl: &mut ssl::SslRef) -> () { let sni_provided = ssl.servername(ssl::NameType::HOST_NAME).map(str::to_owned); @@ -208,10 +194,13 @@ impl TlsAccept for SniResolver { return; }; + let certs = self.tls_store.load(); + let Some(TlsMaterial { cert, + chain, key, - }) = self.certs.get(sni_provided.as_str()) + }) = certs.get(sni_provided.as_str()) else { error!("No certificate found for SNI: {}", sni_provided); return; @@ -221,6 +210,14 @@ impl TlsAccept for SniResolver { error!("Failed to use certificate for SNI {}: {}", sni_provided, e); return; } + + for intermediate in chain { + if let Err(e) = tls::ext::ssl_add_chain_cert(ssl, intermediate) { + error!("Failed to add chain certificate for SNI {}: {}", sni_provided, e); + return; + } + } + if let Err(e) = tls::ext::ssl_use_private_key(ssl, key) { error!("Failed to use private key for SNI {}: {}", sni_provided, e); return; diff --git a/src/core/models/certs.rs b/src/core/models/certs.rs index 818149a..c3063cd 100644 --- a/src/core/models/certs.rs +++ b/src/core/models/certs.rs @@ -1,20 +1,21 @@ -use crate::core::models::routes::Host; +use crate::{ + core::models::{dns::ProviderCredentail, filesystem::SafePath, routes::Host}, + string_newtype, +}; +use arc_swap::ArcSwap; use pingora::tls::{ pkey::{PKey, Private}, x509::X509, }; use serde::Deserialize; -use std::collections::HashMap; -use std::fmt; -use std::ops::Deref; -use std::sync::Arc; +use std::{collections::HashMap, sync::Arc}; #[derive(Debug, Clone, Deserialize, Default, PartialEq)] #[serde(rename_all = "snake_case")] pub enum CertificateType { SelfSigned, - #[default] Acme, + #[default] None, } @@ -22,61 +23,43 @@ pub enum CertificateType { pub struct CertificateConfig { pub host: Host, pub cert_dir: CertDir, - pub email: Email, pub cert_type: CertificateType, + pub provider_config: Option, +} + +pub enum OrderOutcome { + Issued, // clear pending + Waiting, // keep pending, try next loop + Dead, // clear pending, new order next loop } pub struct TlsMaterial { pub cert: X509, + // intermediates certs for non browser based clients + pub chain: Vec, pub key: PKey, } -pub type TlsCerts = Arc>; - -// --- EMAIL --- -#[derive(Debug, Clone, Deserialize)] -pub struct Email(String); - -impl Deref for Email { - type Target = String; - - fn deref(&self) -> &String { - &self.0 - } -} - -impl fmt::Display for Email { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) +impl Clone for TlsMaterial { + fn clone(&self) -> Self { + Self { + cert: self.cert.to_owned(), + chain: self.chain.to_owned(), + key: self.key.to_owned(), + } } } -impl From for Email { - fn from(s: String) -> Self { - Email(s) - } -} - -// --- CERT_DIR --- -#[derive(Debug, Clone, Deserialize)] -pub struct CertDir(String); +pub type KeyPath = SafePath; +pub type CertPath = SafePath; -impl Deref for CertDir { - type Target = String; +pub type TlsStore = Arc>>; - fn deref(&self) -> &String { - &self.0 - } -} +// --- EMAIL --- +string_newtype!(Email, derive(Deserialize)); -impl fmt::Display for CertDir { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) - } -} +// --- CERT_DIR --- +string_newtype!(CertDir, derive(Deserialize)); -impl From for CertDir { - fn from(s: String) -> Self { - CertDir(s) - } -} +// --- CERT_ACCOUNT_PATH --- +pub type CertAccountPath = SafePath; diff --git a/src/core/models/config.rs b/src/core/models/config.rs new file mode 100644 index 0000000..f092327 --- /dev/null +++ b/src/core/models/config.rs @@ -0,0 +1,39 @@ +use crate::{ + core::models::{ + certs::{CertAccountPath, CertDir, Email}, + proxy::{ProxyInputAddress, ProxyPort}, + routes::Route, + tasks::TaskInterval, + }, + string_newtype, +}; +use serde::Deserialize; + +#[derive(Debug, Clone)] +pub struct Config { + pub email: Email, + pub cert_dir: CertDir, + pub acme_env: AcmeEnv, + // opague string type as it can't be cloned when its in AccountCredentials type + pub cert_account_path: CertAccountPath, + pub routes: Vec, + pub task_interval_default: TaskInterval, + pub task_interval_pending: TaskInterval, + pub http_port: ProxyPort, + pub https_port: ProxyPort, + pub input_address: ProxyInputAddress, +} + +#[derive(Debug, Clone, Deserialize)] +pub struct ConfigTomlFile { + pub acme: Acme, + pub routes: Vec, +} + +#[derive(Debug, Clone, Deserialize)] +pub struct Acme { + pub email: Email, +} + +// --- CERT_DIR --- +string_newtype!(AcmeEnv); diff --git a/src/core/models/dns.rs b/src/core/models/dns.rs new file mode 100644 index 0000000..52784a4 --- /dev/null +++ b/src/core/models/dns.rs @@ -0,0 +1,66 @@ +use crate::{Result, config::ACME_CHALLENGE_PREFIX, core::models::routes::Host, string_newtype}; +use async_trait::async_trait; +use reqwest::Client; +use serde::Deserialize; + +#[async_trait] +pub trait DnsProvider { + /// Single fuction to set and update + /// will return the set record (if returned otherwise fake it) + async fn upsert_challenge_record(&self, dns_value: String) -> Result; +} + +pub fn default_challenge_prefix() -> ChallengePrefix { + ChallengePrefix::from(ACME_CHALLENGE_PREFIX.to_string()) +} + +// --- DNS Record --- +pub struct Record { + #[expect(dead_code, reason = "used later to update/delete the record")] + pub provider_id: RecordId, + pub name: String, + pub value: String, +} + +// --- Challenge Prefix (ex: _acme-challenge.) --- +string_newtype!(ChallengePrefix, derive(Deserialize)); + +// API token can be for any provider. +// we can safely asume that this will always be a string +string_newtype!(ApiToken, derive(Deserialize)); + +// DNS Record ID, meant for any provider +// the dns provider required to update a record +string_newtype!(RecordId, derive(Deserialize)); + +// --- DNS Provider credentials --- + +#[derive(Debug, Clone, Deserialize)] +#[serde(rename_all = "snake_case")] +pub enum ProviderCredentail { + Cloudflare(CloudflareProvider), +} + +// --- add here any other providers credentials or needed structs --- + +// --- CloudFlare --- +// ASSIGNED TYPE PREFIX: CF + +// config struct, define here your values that is needed, +// for the runtime struct +#[derive(Debug, Clone, Deserialize)] +pub struct CloudflareProvider { + pub api_token: ApiToken, + pub zone_id: CFZoneId, +} + +// runtime struct that will actually do the DNS updating +pub struct Cloudflare { + pub client: Client, + pub host: Host, + pub config: CloudflareProvider, + pub challenge_prefix: ChallengePrefix, +} + +// Zone ID +string_newtype!(CFZoneId, derive(Deserialize)); diff --git a/src/core/models/filesystem.rs b/src/core/models/filesystem.rs index 53c4570..3a70b54 100644 --- a/src/core/models/filesystem.rs +++ b/src/core/models/filesystem.rs @@ -1,25 +1,4 @@ -use std::{fmt, ops::Deref}; +use crate::string_newtype; // --- SAFEPATH --- -#[derive(Debug, Clone)] -pub struct SafePath(String); - -impl Deref for SafePath { - type Target = String; - - fn deref(&self) -> &String { - &self.0 - } -} - -impl fmt::Display for SafePath { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) - } -} - -impl From for SafePath { - fn from(s: String) -> Self { - SafePath(s) - } -} +string_newtype!(SafePath); diff --git a/src/core/models/mod.rs b/src/core/models/mod.rs index 1cf9ecb..d53125f 100644 --- a/src/core/models/mod.rs +++ b/src/core/models/mod.rs @@ -1,4 +1,6 @@ pub mod certs; +pub mod config; +pub mod dns; pub mod filesystem; pub mod proxy; pub mod routes; diff --git a/src/core/models/proxy.rs b/src/core/models/proxy.rs index dab8d40..678e682 100644 --- a/src/core/models/proxy.rs +++ b/src/core/models/proxy.rs @@ -1,10 +1,8 @@ -use crate::core::models::{ - certs::CertDir, - filesystem::SafePath, - routes::{Host, Upstream}, +use crate::{ + core::models::routes::{Host, Upstream}, + string_newtype, }; -use http::{Response, StatusCode, header}; -use std::{collections::HashMap, fmt, ops::Deref, sync::Arc}; +use std::{collections::HashMap, ops::Deref, sync::Arc}; pub type ProxyRouteMap = Arc>; @@ -13,13 +11,10 @@ pub struct ProxyRoute { pub host: Host, pub upstream: Upstream, pub tls: ProxyTls, - pub cert_path: SafePath, - pub key_path: SafePath, } #[derive(Debug, Clone)] pub struct ProxyConfig { - pub cert_dir: CertDir, pub http_port: ProxyPort, pub https_port: ProxyPort, pub input_address: ProxyInputAddress, @@ -62,25 +57,4 @@ impl From for ProxyPort { } // --- PROXY INPUT ADDRESS --- -#[derive(Debug, Clone)] -pub struct ProxyInputAddress(String); - -impl Deref for ProxyInputAddress { - type Target = String; - - fn deref(&self) -> &String { - &self.0 - } -} - -impl fmt::Display for ProxyInputAddress { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) - } -} - -impl From for ProxyInputAddress { - fn from(s: String) -> Self { - ProxyInputAddress(s) - } -} +string_newtype!(ProxyInputAddress); diff --git a/src/core/models/routes.rs b/src/core/models/routes.rs index 17649ec..b44a2e3 100644 --- a/src/core/models/routes.rs +++ b/src/core/models/routes.rs @@ -1,6 +1,8 @@ -use crate::core::models::certs::CertificateType; +use crate::{ + core::models::{certs::CertificateType, dns::ProviderCredentail}, + string_newtype, +}; use serde::Deserialize; -use std::{fmt, ops::Deref}; #[derive(Debug, Clone, Deserialize)] pub struct Route { @@ -8,19 +10,11 @@ pub struct Route { pub upstream: Upstream, #[serde(default)] pub cert_type: CertificateType, + pub dns_provider: Option, } // --- HOST --- -#[derive(Debug, Clone, Deserialize, Hash, Eq, PartialEq)] -pub struct Host(String); - -impl Deref for Host { - type Target = String; - - fn deref(&self) -> &String { - &self.0 - } -} +string_newtype!(Host, derive(Deserialize, Hash, Eq, PartialEq)); impl std::borrow::Borrow for Host { fn borrow(&self) -> &str { @@ -28,38 +22,5 @@ impl std::borrow::Borrow for Host { } } -impl fmt::Display for Host { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) - } -} - -impl From for Host { - fn from(s: String) -> Self { - Host(s) - } -} - // --- UPSTREAM --- -#[derive(Debug, Clone, Deserialize)] -pub struct Upstream(String); - -impl Deref for Upstream { - type Target = String; - - fn deref(&self) -> &String { - &self.0 - } -} - -impl fmt::Display for Upstream { - fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { - write!(f, "{}", self.0) - } -} - -impl From for Upstream { - fn from(s: String) -> Self { - Upstream(s) - } -} +string_newtype!(Upstream, derive(Deserialize)); diff --git a/src/core/models/tasks.rs b/src/core/models/tasks.rs index 1cc2b46..8722ed1 100644 --- a/src/core/models/tasks.rs +++ b/src/core/models/tasks.rs @@ -2,6 +2,7 @@ use serde::Deserialize; use std::ops::Deref; // --- TASK INTERVAL --- +/// Interval for a task in seconds. #[derive(Debug, Clone, Deserialize)] pub struct TaskInterval(u64); diff --git a/src/core/setup.rs b/src/core/setup.rs index b133345..22c551b 100644 --- a/src/core/setup.rs +++ b/src/core/setup.rs @@ -2,18 +2,20 @@ use crate::{ Error, Result, core::{ handlers::{ - certs::generate_certs, - filesystem::{check_file_exists, safe_path}, + certs::{CertBackgroundRenewal, create_self_signed_certs, load_tls_store}, proxy::run_proxy, }, models::{ - certs::{CertDir, CertificateConfig, CertificateType, Email}, + certs::{ + CertAccountPath, CertDir, CertificateConfig, CertificateType, Email, TlsStore, + }, + config::AcmeEnv, proxy::{ProxyConfig, ProxyRoute, ProxyTls}, routes::Route, tasks::TaskInterval, }, }, - error, info, warn, + info, }; use std::path::Path; @@ -46,87 +48,95 @@ impl HandleFileSystem { pub struct HandleCertificates { certificate_configs: Vec, - task_interval: TaskInterval, + cert_account_path: CertAccountPath, + task_interval_default: TaskInterval, + task_interval_pending: TaskInterval, + email: Email, + acme_env: AcmeEnv, } impl HandleCertificates { pub fn new( cert_dir: CertDir, + cert_account_path: CertAccountPath, email: Email, + acme_env: AcmeEnv, routes: Vec, - task_interval: TaskInterval, + task_interval_default: TaskInterval, + task_interval_pending: TaskInterval, ) -> Self { let certificate_configs = routes .into_iter() .map(|route| CertificateConfig { host: route.host.clone(), cert_dir: cert_dir.clone(), - email: email.clone(), cert_type: route.cert_type.clone(), + provider_config: route.dns_provider.clone(), }) .collect::>(); Self { certificate_configs, - task_interval, + cert_account_path, + task_interval_default, + task_interval_pending, + email, + acme_env, } } - pub fn run(self) -> Result<()> { - generate_certs(self.certificate_configs.clone())?; - - // spawn(async move { - // info!("starting certificates tasks..."); - // background_certs_task(self.certificates, self.task_interval).await; - // }); - - Ok(()) + pub fn run(self) -> Result<(TlsStore, CertBackgroundRenewal)> { + create_self_signed_certs(&self.certificate_configs)?; + + let store = load_tls_store(&self.certificate_configs)?; + let renewal = CertBackgroundRenewal::new( + self.certificate_configs.clone(), + self.cert_account_path.clone(), + self.task_interval_default.clone(), + self.task_interval_pending.clone(), + store.clone(), + self.email.clone(), + self.acme_env.clone(), + ); + + Ok((store, renewal)) } } pub struct HandleProxy { proxy_config: ProxyConfig, proxy_routes: Vec, + tls_store: TlsStore, } impl HandleProxy { - pub fn new(proxy_config: ProxyConfig, routes: Vec) -> Result { + pub fn new(proxy_config: ProxyConfig, routes: Vec, tls_store: TlsStore) -> Result { let mut proxy_routes = Vec::new(); for route in routes { - let cert_filename = format!("{}.pem", route.host); - let key_filename = format!("{}.key", route.host); - - let key_path = safe_path(&proxy_config.cert_dir, &key_filename)?; - let cert_path = safe_path(&proxy_config.cert_dir, &cert_filename)?; - - let has_tls_files = check_file_exists(&key_path) && check_file_exists(&cert_path); - - // We only show a warning so its easier to debug once its running, - // but we are not stopping any traffic. - if !has_tls_files && route.cert_type != CertificateType::None { - warn!("Certificate files not found for host `{}` but is expected", route.host); - } - proxy_routes.push(ProxyRoute { host: route.host.clone(), upstream: route.upstream.clone(), tls: ProxyTls::from(route.cert_type != CertificateType::None), - cert_path, - key_path, }); } Ok(Self { proxy_config, proxy_routes, + tls_store, }) } - pub fn run(&self) -> Result<()> { + pub fn run(&self, renewal: CertBackgroundRenewal) -> Result<()> { info!("proxy running..."); - run_proxy(self.proxy_config.clone(), self.proxy_routes.clone())?; + run_proxy( + self.proxy_config.clone(), + self.proxy_routes.clone(), + self.tls_store.clone(), + renewal, + )?; Err(Error::Proxy("proxy exited".to_string())) } diff --git a/src/error.rs b/src/error.rs index a9f79ac..10da973 100644 --- a/src/error.rs +++ b/src/error.rs @@ -13,18 +13,33 @@ pub enum Error { #[error("IO error: {0}")] Io(#[from] std::io::Error), + #[error("request error: {0}")] + Request(reqwest::Error), + #[error("file system error: {0}")] FileSystem(String), #[error("certificate error: {0}")] Certificate(String), + #[error("Acme error: {0}")] + Acme(String), + #[error("proxy error: {0}")] Proxy(String), + #[error("dns error: {0}")] + Dns(String), + #[error("config error: {0}")] Config(String), #[error("unknown error")] Unknown, } + +impl From for Error { + fn from(err: reqwest::Error) -> Self { + Error::Request(err) + } +} diff --git a/src/main.rs b/src/main.rs index ad61be0..314deb4 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,15 +1,13 @@ -use crate::{ - config::Config, - core::{ - models::proxy::ProxyConfig, - setup::{HandleCertificates, HandleFileSystem, HandleProxy}, - }, +use crate::core::{ + models::{config::Config, proxy::ProxyConfig}, + setup::{HandleCertificates, HandleFileSystem, HandleProxy}, }; pub use error::{Error, Result}; mod config; mod core; pub mod error; +mod services; mod utils; // entry needs to be synchronous as pingora has there own @@ -25,21 +23,23 @@ fn main() -> Result<()> { // and spin up background tasks to refresh certificates let cert_handler = HandleCertificates::new( config.cert_dir.clone(), + config.cert_account_path.clone(), config.email, + config.acme_env, config.routes.clone(), - config.task_interval, + config.task_interval_default, + config.task_interval_pending, ); - cert_handler.run()?; + let (store, renewal) = cert_handler.run()?; // start the proxy let proxy_config = ProxyConfig { - cert_dir: config.cert_dir.clone(), http_port: config.http_port, https_port: config.https_port, input_address: config.input_address, }; - let proxy_handler = HandleProxy::new(proxy_config, config.routes)?; - proxy_handler.run()?; + let proxy_handler = HandleProxy::new(proxy_config, config.routes, store)?; + proxy_handler.run(renewal)?; Err(Error::MainLoopClosed) } diff --git a/src/services/certs/acme.rs b/src/services/certs/acme.rs new file mode 100644 index 0000000..451296e --- /dev/null +++ b/src/services/certs/acme.rs @@ -0,0 +1,82 @@ +use crate::{ + Error, Result, + core::models::{certs::Email, config::AcmeEnv, routes::Host}, + info, +}; +use instant_acme::{ + Account, AccountCredentials, Identifier, LetsEncrypt, NewAccount, NewOrder, Order, +}; +use rustls::crypto::CryptoProvider; + +pub fn init_account() { + let _ = CryptoProvider::install_default(rustls::crypto::aws_lc_rs::default_provider()); +} + +pub async fn load_account(credentials: AccountCredentials) -> Result { + let account = Account::builder() + .map_err(|e| Error::Acme(e.to_string()))? + .from_credentials(credentials) + .await + .map_err(|e| Error::Acme(e.to_string()))?; + + info!("Reusing ACME account"); + + Ok(account) +} + +// this one returns credentials, because we are going to save it to the file +// for later usage to start the process with the same credentials +pub async fn create_account( + email: &Email, + acme_env: &AcmeEnv, +) -> Result<(Account, AccountCredentials)> { + let url = if acme_env.as_str() == "production" { + info!("Using production ACME server"); + LetsEncrypt::Production.url().to_owned() + } else { + info!("Using staging ACME server"); + LetsEncrypt::Staging.url().to_owned() + }; + + let (account, credentials) = Account::builder() + .map_err(|e| Error::Acme(e.to_string()))? + .create( + &NewAccount { + contact: &[&format!("mailto:{}", email.as_str())], + terms_of_service_agreed: true, + only_return_existing: false, + }, + url, + None, + ) + .await + .map_err(|e| Error::Acme(e.to_string()))?; + + info!("Created new ACME account"); + + Ok((account, credentials)) +} + +pub async fn create_order( + account: &Account, + host: &Host, + order_url: Option<&String>, +) -> Result { + let identifier = Identifier::Dns(host.to_string()); + // instant_acme support multiple host per order, + // but we need to know which dns needs to be updated + // which is why we split them up, this is maybe something we can refine in V2 + let identifiers = vec![identifier]; + + if let Some(order_url) = order_url { + account + .order(order_url.to_owned()) + .await + .map_err(|e| Error::Acme(format!("Failed with order_from_url: {}", e))) + } else { + account + .new_order(&NewOrder::new(&identifiers)) + .await + .map_err(|e| Error::Acme(format!("Failed with new_order: {}", e))) + } +} diff --git a/src/services/certs/mod.rs b/src/services/certs/mod.rs new file mode 100644 index 0000000..7c4495a --- /dev/null +++ b/src/services/certs/mod.rs @@ -0,0 +1,2 @@ +pub mod acme; +pub mod self_signed; diff --git a/src/services/certs/self_signed.rs b/src/services/certs/self_signed.rs new file mode 100644 index 0000000..a7c44a9 --- /dev/null +++ b/src/services/certs/self_signed.rs @@ -0,0 +1,31 @@ +use crate::{ + Error, Result, + core::{ + handlers::{certs::certificate_paths, filesystem::write_file}, + models::certs::CertificateConfig, + }, + info, +}; +use rcgen::{CertifiedKey, generate_simple_self_signed}; + +pub fn create_self_signed_certificate_files(config: &CertificateConfig) -> Result<()> { + info!("generating self-signed certificate for {}", config.host); + + let subject_alt_names = vec![config.host.to_string()]; + + let (key_path, cert_path) = certificate_paths(config)?; + + let CertifiedKey { + cert, + signing_key, + } = generate_simple_self_signed(subject_alt_names) + .map_err(|e| Error::Certificate(e.to_string()))?; + + let cert_serialized = cert.pem(); + let key_serialized = signing_key.serialize_pem(); + + write_file(cert_path, cert_serialized.as_bytes())?; + write_file(key_path, key_serialized.as_bytes())?; + + Ok(()) +} diff --git a/src/services/dns/cloudflare.rs b/src/services/dns/cloudflare.rs new file mode 100644 index 0000000..d224b6d --- /dev/null +++ b/src/services/dns/cloudflare.rs @@ -0,0 +1,215 @@ +use crate::{ + Error, Result, + core::models::dns::{Cloudflare, DnsProvider, Record, RecordId}, + info, + services::dns::utils::create_txt_key, +}; +use async_trait::async_trait; +use http::HeaderValue; +use serde::Deserialize; + +const API_BASE: &str = "https://api.cloudflare.com/client/v4"; +const RECORD_COMMENT: &str = "managed by reverse-proxy (acme dns-01), do not edit"; + +/// CloudflareResponse can be used for both Vec or DnsRecord +#[derive(Debug, Deserialize)] +pub struct CloudflareResponse { + // #[serde(default)] + // pub errors: Vec, + // #[serde(default)] + // pub messages: Vec, + // pub success: bool, + pub result: T, +} + +// some fields are skipped that provides nothing +// #[derive(Debug, Deserialize)] +// pub struct CloudflareMessage { +// pub code: u32, +// pub message: String, +// pub documentation_url: Option, +// } + +// some fields are skipped that provides nothing +#[derive(Debug, Deserialize)] +pub struct DnsRecord { + pub id: String, + pub name: String, + // #[serde(rename = "type")] + // pub record_type: String, + pub content: String, + // pub ttl: u32, + // pub proxied: bool, + pub comment: Option, + // pub created_on: DateTime, + // pub modified_on: DateTime, +} + +#[async_trait] +impl DnsProvider for Cloudflare { + async fn upsert_challenge_record(&self, dns_value: String) -> Result { + // return on error so we are not + let record_id = self.get_record_id().await?; + + let Some(record_id) = record_id else { + // add record + return self.create_record(dns_value).await; + }; + + // update record + return self.update_record(record_id, dns_value).await; + } +} + +impl Cloudflare { + async fn get_record_id(self: &Cloudflare) -> Result> { + info!("get records for: {}", &self.host); + + let mut headers = reqwest::header::HeaderMap::new(); + headers.insert( + "Authorization", + HeaderValue::from_str(&format!("Bearer {}", self.config.api_token)) + .map_err(|e| Error::Dns(e.to_string()))?, + ); + headers.insert( + "Content-Type", + HeaderValue::from_str("application/json").map_err(|e| Error::Dns(e.to_string()))?, + ); + + let url = format!( + "{}/zones/{}/dns_records?type=TXT&name={}{}", + API_BASE, self.config.zone_id, self.challenge_prefix, self.host + ); + + let response = match self.client.get(&url).headers(headers).send().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Request {}", e))), + }; + + let status = response.status(); + if !status.is_success() { + return Err(Error::Dns(format!("Status {}", status))); + } + + let response = match response.text().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Parse {}", e))), + }; + + let result: CloudflareResponse> = + serde_json::from_str(&response).map_err(|e| Error::Dns(format!("serde_json {}", e)))?; + + // extra filter on comment + // this should prevent an issue with multiple acme records + let record_id = result + .result + .iter() + .find(|record| record.comment.as_deref() == Some(RECORD_COMMENT)) + .map(|record| RecordId::from(record.id.clone())); + + Ok(record_id) + } + + async fn create_record(&self, dns_value: String) -> Result { + info!("create record for: {}", &self.host); + + let mut headers = reqwest::header::HeaderMap::new(); + headers.insert( + "Authorization", + HeaderValue::from_str(&format!("Bearer {}", self.config.api_token)) + .map_err(|e| Error::Dns(e.to_string()))?, + ); + headers.insert( + "Content-Type", + HeaderValue::from_str("application/json").map_err(|e| Error::Dns(e.to_string()))?, + ); + + let challenge_prefix = create_txt_key(&self.host, &self.challenge_prefix); + + let json = &serde_json::json!({ + "type": "TXT", + "name": challenge_prefix, + "content": dns_value, + "ttl": 1, + "proxied": false, + "comment": RECORD_COMMENT + }); + + let url = format!("{}/zones/{}/dns_records", API_BASE, self.config.zone_id); + + let response = match self.client.post(&url).headers(headers).json(json).send().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Request {}", e))), + }; + + let response = match response.text().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Parse {}", e))), + }; + + let result: CloudflareResponse = + serde_json::from_str(&response).map_err(|e| Error::Dns(format!("serde_json {}", e)))?; + + let record = Record { + provider_id: RecordId::from(result.result.id), + name: result.result.name, + value: result.result.content, + }; + + Ok(record) + } + + async fn update_record(&self, record_id: RecordId, dns_value: String) -> Result { + info!("update record for: {}", &self.host); + + let mut headers = reqwest::header::HeaderMap::new(); + headers.insert( + "Authorization", + HeaderValue::from_str(&format!("Bearer {}", self.config.api_token)) + .map_err(|e| Error::Dns(e.to_string()))?, + ); + headers.insert( + "Content-Type", + HeaderValue::from_str("application/json").map_err(|e| Error::Dns(e.to_string()))?, + ); + + let challenge_prefix = create_txt_key(&self.host, &self.challenge_prefix); + + let json = &serde_json::json!({ + "type": "TXT", + "name": challenge_prefix, + "content": dns_value, + "ttl": 1, + "proxied": false, + "comment": RECORD_COMMENT + }); + + let url = format!("{}/zones/{}/dns_records/{}", API_BASE, self.config.zone_id, record_id); + + let response = match self.client.patch(&url).headers(headers).json(json).send().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Request {}", e))), + }; + + let status = response.status(); + if !status.is_success() { + return Err(Error::Dns(format!("Status {}", status))); + } + + let response = match response.text().await { + Ok(response) => response, + Err(e) => return Err(Error::Dns(format!("Parse {}", e))), + }; + + let result: CloudflareResponse = + serde_json::from_str(&response).map_err(|e| Error::Dns(format!("serde_json {}", e)))?; + + let record = Record { + provider_id: RecordId::from(result.result.id), + name: result.result.name, + value: result.result.content, + }; + + Ok(record) + } +} diff --git a/src/services/dns/mod.rs b/src/services/dns/mod.rs new file mode 100644 index 0000000..a420f64 --- /dev/null +++ b/src/services/dns/mod.rs @@ -0,0 +1,3 @@ +mod cloudflare; +pub mod resolver; +mod utils; diff --git a/src/services/dns/resolver.rs b/src/services/dns/resolver.rs new file mode 100644 index 0000000..ec005a3 --- /dev/null +++ b/src/services/dns/resolver.rs @@ -0,0 +1,43 @@ +use crate::{ + Error, Result, + core::models::{dns::ChallengePrefix, routes::Host}, + services::dns::utils::create_txt_key, +}; +use hickory_resolver::{Resolver, config::*, net::runtime::TokioRuntimeProvider}; + +pub struct DnsResolver { + pub resolver: Resolver, + pub challenge_prefix: ChallengePrefix, +} + +impl DnsResolver { + pub fn new(challenge_prefix: ChallengePrefix) -> Result { + // Construct a new Resolver with default configuration options + let resolver = Resolver::builder_with_config( + ResolverConfig::udp_and_tcp(&CLOUDFLARE), + TokioRuntimeProvider::default(), + ) + .build() + .map_err(|e| Error::Dns(e.to_string()))?; + + Ok(Self { + resolver, + challenge_prefix, + }) + } + + pub async fn lookup_text(&self, host: &Host) -> Result> { + let record_key = create_txt_key(host, &self.challenge_prefix); + + let response = + self.resolver.txt_lookup(record_key).await.map_err(|e| Error::Dns(e.to_string()))?; + + let mut records = vec![]; + + for record in response.message().answers.iter() { + records.push(record.data.to_string()); + } + + Ok(records) + } +} diff --git a/src/services/dns/utils.rs b/src/services/dns/utils.rs new file mode 100644 index 0000000..891b938 --- /dev/null +++ b/src/services/dns/utils.rs @@ -0,0 +1,8 @@ +use crate::core::models::{dns::ChallengePrefix, routes::Host}; + +// create a dns record for the challenge +pub fn create_txt_key(host: &Host, challenge_prefix: &ChallengePrefix) -> String { + let challenge = format!("{}{}", challenge_prefix, host); + + challenge +} diff --git a/src/services/http/mod.rs b/src/services/http/mod.rs new file mode 100644 index 0000000..731029c --- /dev/null +++ b/src/services/http/mod.rs @@ -0,0 +1,15 @@ +use crate::Result; +use reqwest::Client; +use std::time::Duration; + +// simply return client no need for struct, +// or extras +pub fn create_client() -> Result { + let client = Client::builder() + .timeout(Duration::from_secs(30)) + .pool_idle_timeout(Duration::from_secs(90)) + .pool_max_idle_per_host(10) + .build()?; + + Ok(client) +} diff --git a/src/services/mod.rs b/src/services/mod.rs new file mode 100644 index 0000000..cc7959b --- /dev/null +++ b/src/services/mod.rs @@ -0,0 +1,3 @@ +pub mod certs; +pub mod dns; +pub mod http; diff --git a/src/utils.rs b/src/utils.rs index b253deb..4225ce5 100644 --- a/src/utils.rs +++ b/src/utils.rs @@ -18,3 +18,30 @@ macro_rules! error { println!("\x1b[90m{} \x1b[31m{} \x1b[0m{}", chrono::Local::now().format("%H:%M:%S%.3f %d-%m-%y"), "[ERROR]", format_args!($($arg)*)) }; } + +#[macro_export] +macro_rules! string_newtype { + ($name:ident $(, derive($($extra:path),+ $(,)?))?) => { + #[derive(Debug, Clone $(, $($extra),+)?)] + pub struct $name(String); + + impl ::std::ops::Deref for $name { + type Target = String; + fn deref(&self) -> &String { + &self.0 + } + } + + impl ::std::fmt::Display for $name { + fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result { + write!(f, "{}", self.0) + } + } + + impl From for $name { + fn from(s: String) -> Self { + $name(s) + } + } + }; +}