proksi 0.9.0

A batteries-included reverse proxy with automatic HTTPS using Cloudflare Pingora and Let's Encrypt.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

use std::fmt;

use serde::{
    de::{self, MapAccess, Visitor},
    Deserialize, Deserializer, Serialize,
};

use crate::config::{host::HostTls, RouteSslPath};

/// `tls { ... }` in a host
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct TlsBlock {
    /// Certificate files, used instead of Let's Encrypt
    pub certificate: Option<RouteSslPath>,
    /// Use a self-signed certificate if no other certificate can be obtained
    #[serde(default)]
    pub self_signed_on_failure: bool,
}

/// `tls = false` / `tls = true`, or `tls { ... }`
#[derive(Debug, Clone, PartialEq, Serialize)]
#[serde(untagged)]
pub enum TlsSetting {
    Enabled(bool),
    Settings(TlsBlock),
}

impl TlsSetting {
    pub fn to_host_tls(&self) -> HostTls {
        match self {
            TlsSetting::Enabled(enabled) => HostTls {
                enabled: *enabled,
                ..HostTls::default()
            },
            TlsSetting::Settings(block) => HostTls {
                enabled: true,
                certificate: block.certificate.clone(),
                self_signed_on_failure: block.self_signed_on_failure,
            },
        }
    }
}

/// Written by hand (rather than `#[serde(untagged)]`) so that errors inside `tls { ... }`,
/// such as unknown attributes, are reported as they are
impl<'de> Deserialize<'de> for TlsSetting {
    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        struct TlsVisitor;

        impl<'de> Visitor<'de> for TlsVisitor {
            type Value = TlsSetting;

            fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
                f.write_str("a boolean or a tls block")
            }

            fn visit_bool<E: de::Error>(self, enabled: bool) -> Result<TlsSetting, E> {
                Ok(TlsSetting::Enabled(enabled))
            }

            fn visit_map<A: MapAccess<'de>>(self, map: A) -> Result<TlsSetting, A::Error> {
                TlsBlock::deserialize(de::value::MapAccessDeserializer::new(map))
                    .map(TlsSetting::Settings)
            }
        }

        deserializer.deserialize_any(TlsVisitor)
    }
}

#[cfg(test)]
mod tests {
    use figment::providers::{Format, Yaml};
    use serde::Deserialize;

    use crate::config::hcl::HclFormat;

    use super::{TlsBlock, TlsSetting};

    #[derive(Deserialize)]
    struct Doc {
        tls: TlsSetting,
    }

    fn hcl(src: &str) -> Result<TlsSetting, String> {
        HclFormat::from_str::<Doc>(src)
            .map(|doc| doc.tls)
            .map_err(|err| err.to_string())
    }

    #[test]
    fn test_tls_can_be_disabled() {
        assert_eq!(hcl("tls = false\n"), Ok(TlsSetting::Enabled(false)));
        assert_eq!(hcl("tls = true\n"), Ok(TlsSetting::Enabled(true)));
        assert_eq!(
            Yaml::from_str::<Doc>("tls: false\n")
                .map(|doc| doc.tls)
                .ok(),
            Some(TlsSetting::Enabled(false))
        );
    }

    #[test]
    fn test_tls_block() {
        assert_eq!(
            hcl("tls {\n  self_signed_on_failure = true\n}\n"),
            Ok(TlsSetting::Settings(TlsBlock {
                certificate: None,
                self_signed_on_failure: true,
            }))
        );
    }

    #[test]
    fn test_tls_block_with_unknown_attribute() {
        let err = hcl("tls {\n  self_signed = true\n}\n").unwrap_err();
        assert!(err.contains("unknown field `self_signed`"), "{err}");
    }

    #[test]
    fn test_tls_setting_to_host_tls() {
        let disabled = TlsSetting::Enabled(false).to_host_tls();
        assert!(!disabled.enabled);
        assert!(disabled.certificate.is_none());

        let settings = TlsSetting::Settings(TlsBlock {
            certificate: None,
            self_signed_on_failure: true,
        })
        .to_host_tls();
        assert!(settings.enabled);
        assert!(settings.self_signed_on_failure);
    }
}