rust_web_server/config_check/
mod.rs

1//! `rws --check`: validate `rws.config.toml` without starting the server —
2//! the counterpart of `nginx -t` / `caddy validate`.
3//!
4//! Reports unknown keys (in settings and in proxy sections), values of the
5//! wrong type, TLS files that can't be loaded, proxy routes pointing at
6//! undeclared upstreams, auth secrets that aren't set, and similar mistakes
7//! that would otherwise surface as a warning in the startup log or as a 503
8//! at request time. Nothing is bound and the environment is not modified.
9//!
10//! ```bash
11//! rws --check                      # the file rws would load (RWS_CONFIG_FILE or ./rws.config.toml)
12//! rws --check=/etc/rws/site.toml   # a specific file
13//! ```
14
15#[cfg(test)]
16mod tests;
17
18use std::io::Cursor;
19use std::path::Path;
20
21use crate::entry_point::config_file::collect_settings;
22use crate::entry_point::Config;
23
24/// Errors and warnings found in a configuration file.
25#[derive(Debug, Default, Clone, PartialEq)]
26pub struct ConfigReport {
27    /// Mistakes: the configuration does not do what it says.
28    pub errors: Vec<String>,
29    /// Likely mistakes that don't stop the server working.
30    pub warnings: Vec<String>,
31}
32
33impl ConfigReport {
34    pub fn error(&mut self, message: impl Into<String>) {
35        self.errors.push(message.into());
36    }
37
38    pub fn warn(&mut self, message: impl Into<String>) {
39        self.warnings.push(message.into());
40    }
41
42    /// `true` when there are no errors (warnings are allowed).
43    pub fn is_ok(&self) -> bool {
44        self.errors.is_empty()
45    }
46
47    /// One JSON object: `{"path":…,"ok":…,"errors":[…],"warnings":[…]}`.
48    /// Strings are escaped; exit codes stay with the caller.
49    pub fn render_json(&self, path: &str) -> String {
50        fn escaped(s: &str) -> String {
51            let mut out = String::with_capacity(s.len() + 2);
52            for c in s.chars() {
53                match c {
54                    '"' => out.push_str("\\\""),
55                    '\\' => out.push_str("\\\\"),
56                    '\n' => out.push_str("\\n"),
57                    '\r' => out.push_str("\\r"),
58                    '\t' => out.push_str("\\t"),
59                    c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
60                    c => out.push(c),
61                }
62            }
63            out
64        }
65        let list = |items: &[String]| {
66            let inner: Vec<String> = items.iter().map(|i| format!("\"{}\"", escaped(i))).collect();
67            format!("[{}]", inner.join(","))
68        };
69        format!(
70            "{{\"path\":\"{}\",\"ok\":{},\"errors\":{},\"warnings\":{}}}",
71            escaped(path),
72            self.is_ok(),
73            list(&self.errors),
74            list(&self.warnings),
75        )
76    }
77
78    /// Human-readable report, one finding per line, ending in a verdict.
79    pub fn render(&self, path: &str) -> String {
80        let mut out = String::new();
81        for e in &self.errors {
82            out.push_str(&format!("error: {e}\n"));
83        }
84        for w in &self.warnings {
85            out.push_str(&format!("warning: {w}\n"));
86        }
87        if self.is_ok() {
88            out.push_str(&format!("{path}: configuration OK"));
89            if !self.warnings.is_empty() {
90                out.push_str(&format!(" ({} warning{})", self.warnings.len(), plural(self.warnings.len())));
91            }
92        } else {
93            out.push_str(&format!(
94                "{path}: {} error{}, {} warning{}",
95                self.errors.len(), plural(self.errors.len()),
96                self.warnings.len(), plural(self.warnings.len()),
97            ));
98        }
99        out.push('\n');
100        out
101    }
102}
103
104fn plural(n: usize) -> &'static str {
105    if n == 1 { "" } else { "s" }
106}
107
108/// The path `--check` targets in `args` (the process arguments), or `None`
109/// when `--check` is absent. `--check=<path>` and `--check <path>` name a
110/// file; a bare `--check` checks the file the server would load.
111pub fn check_target_from_args(args: &[String]) -> Option<String> {
112    let mut iter = args.iter().skip(1).peekable();
113    while let Some(arg) = iter.next() {
114        if let Some(path) = arg.strip_prefix("--check=") {
115            return Some(path.to_string());
116        }
117        if arg == "--check" {
118            return Some(match iter.peek() {
119                Some(next) if !next.starts_with('-') => next.to_string(),
120                _ => default_config_path(),
121            });
122        }
123    }
124    None
125}
126
127/// Whether the arguments ask for machine-readable output (`--format=json`).
128pub fn wants_json_output(args: &[String]) -> bool {
129    args.iter().any(|a| a == "--format=json")
130}
131
132/// `RWS_CONFIG_FILE` if set, else `rws.config.toml` in the working directory.
133pub fn default_config_path() -> String {
134    std::env::var("RWS_CONFIG_FILE")
135        .ok()
136        .filter(|p| !p.trim().is_empty())
137        .unwrap_or_else(|| "rws.config.toml".to_string())
138}
139
140/// Check the configuration file at `path`.
141pub fn check_file(path: &str) -> ConfigReport {
142    match std::fs::read_to_string(path) {
143        Ok(content) => check_str(&content),
144        Err(e) => {
145            let mut report = ConfigReport::default();
146            report.error(format!("cannot read {path}: {e}"));
147            report
148        }
149    }
150}
151
152/// Check configuration text. Relative file paths in it (certificates,
153/// htpasswd files, static roots) are resolved against the working directory,
154/// as the server resolves them.
155pub fn check_str(content: &str) -> ConfigReport {
156    let mut report = ConfigReport::default();
157    if content.contains('\0') {
158        report.error("the file contains a NUL byte");
159        return report;
160    }
161
162    match collect_settings(Cursor::new(content.as_bytes()), String::new()) {
163        Ok(resolved) => {
164            for key in &resolved.unknown {
165                report.error(format!("unknown setting '{key}' — ignored"));
166            }
167            check_settings(&resolved.settings, &mut report);
168        }
169        Err(e) => report.error(format!("unable to parse: {e}")),
170    }
171
172    #[cfg(not(target_arch = "wasm32"))]
173    if content.contains("[[route]]") || content.contains("[[upstream]]")
174        || content.contains("[[tcp_proxy]]") || content.contains("[[udp_proxy]]") || content.contains("[[ws_proxy]]")
175    {
176        crate::proxy_config::validate::check_unknown_keys(content, &mut report);
177        crate::proxy_config::ProxyConfig::from_str(content).validate(&mut report);
178    } else if content.lines().any(|l| l.trim().starts_with("[middleware")) {
179        report.warn("[middleware] only applies in proxy mode (a file with [[route]] or [[upstream]] sections)");
180    }
181
182    report
183}
184
185/// Type and consistency checks for the `RWS_CONFIG_*` settings in the file.
186fn check_settings(settings: &[(String, String)], report: &mut ConfigReport) {
187    let get = |name: &str| settings.iter().rev().find(|(n, _)| n == name).map(|(_, v)| v.trim());
188
189    for (name, value) in settings {
190        let value = value.trim();
191        let key = setting_key(name);
192        match name.as_str() {
193            Config::RWS_CONFIG_PORT | Config::RWS_CONFIG_HTTP_REDIRECT_PORT | Config::RWS_CONFIG_ACME_CHALLENGE_PORT => {
194                if !(name == Config::RWS_CONFIG_HTTP_REDIRECT_PORT && value.is_empty())
195                    && !value.parse::<u16>().is_ok_and(|p| p > 0)
196                {
197                    report.error(format!("{key} = {value:?}: not a port number (1-65535)"));
198                }
199            }
200            Config::RWS_CONFIG_IP => {
201                if value.parse::<std::net::IpAddr>().is_err() {
202                    report.error(format!("{key} = {value:?}: not an IP address (use 0.0.0.0 or :: for all interfaces)"));
203                }
204            }
205            Config::RWS_CONFIG_THREAD_COUNT => {
206                if !value.parse::<usize>().is_ok_and(|n| n > 0) {
207                    report.error(format!("{key} = {value:?}: not a positive number"));
208                }
209            }
210            Config::RWS_CONFIG_REQUEST_ALLOCATION_SIZE_IN_BYTES => {
211                if !value.parse::<u64>().is_ok_and(|n| n > 0) {
212                    report.error(format!("{key} = {value:?}: not a positive number"));
213                }
214            }
215            "RWS_CONFIG_MAX_BODY_SIZE_IN_BYTES" | "RWS_CONFIG_OPEN_FILE_CACHE_SECS" | "RWS_CONFIG_RATE_LIMIT_MAX_REQUESTS" | "RWS_CONFIG_RATE_LIMIT_WINDOW_SECS"
216            | "RWS_CONFIG_ACME_RENEW_BEFORE_DAYS" | "RWS_CONFIG_ACME_RENEW_CHECK_INTERVAL_SECS"
217            | "RWS_CONFIG_CIRCUIT_BREAKER_FAILURE_THRESHOLD" | "RWS_CONFIG_CIRCUIT_BREAKER_MAX_HALF_OPEN_PROBES"
218            | "RWS_CONFIG_CIRCUIT_BREAKER_RECOVERY_SECS" | Config::RWS_CONFIG_CORS_MAX_AGE => {
219                if value.parse::<u64>().is_err() {
220                    report.error(format!("{key} = {value:?}: not a whole number"));
221                }
222            }
223            Config::RWS_CONFIG_CORS_ALLOW_ALL | Config::RWS_CONFIG_CORS_ALLOW_CREDENTIALS | Config::RWS_CONFIG_ACME_STAGING
224            | "RWS_CONFIG_CLIENT_HINTS" | "RWS_CONFIG_OPEN_FILE_CACHE_STRICT"
225            | "RWS_CONFIG_SECURITY_HEADERS" | "RWS_CONFIG_NANOS_HEADERS" | "RWS_CONFIG_SERVE_DOTFILES" | "RWS_CONFIG_WATCH"
226            | "RWS_CONFIG_PROXY_PROTOCOL" | "RWS_CONFIG_GATEWAY_API_ENABLED" => {
227                if !matches!(value.to_ascii_lowercase().as_str(), "true" | "false") {
228                    report.error(format!("{key} = {value:?}: expected true or false"));
229                }
230            }
231            "RWS_CONFIG_GATEWAY_API_MODE" => {
232                if !matches!(value.to_ascii_lowercase().as_str(), "shared" | "provisioned") {
233                    report.error(format!("{key} = {value:?}: expected shared or provisioned"));
234                }
235            }
236            "RWS_CONFIG_ACCESS_LOG_MAX_SIZE" | "RWS_CONFIG_ACCESS_LOG_KEEP" => {
237                if crate::log::access_sink::parse_size(value).is_none() {
238                    report.error(format!("{key} = {value:?}: expected a number of bytes or files (e.g. 104857600 or 100M)"));
239                }
240            }
241            "RWS_CONFIG_RUNTIME" => {
242                if !matches!(value.to_ascii_lowercase().as_str(), "shared" | "per-core") {
243                    report.error(format!("{key} = {value:?}: expected \"shared\" or \"per-core\""));
244                }
245            }
246            "RWS_CONFIG_LOG_FORMAT" => {
247                if !matches!(value.to_ascii_lowercase().as_str(), "combined" | "json" | "off" | "none") {
248                    report.error(format!("{key} = {value:?}: expected \"combined\", \"json\" or \"off\""));
249                }
250            }
251            "RWS_CONFIG_TLS_CLIENT_CA_FILE" | Config::RWS_CONFIG_ACME_CA_FILE => {
252                if !value.is_empty() && !Path::new(value).is_file() {
253                    report.error(format!("{key} = {value:?}: file not found"));
254                }
255            }
256            "RWS_CONFIG_TEMPLATE_DIR" => {
257                if !value.is_empty() && !Path::new(value).is_dir() {
258                    report.warn(format!("{key} = {value:?}: directory not found"));
259                }
260            }
261            _ => {}
262        }
263    }
264
265    // TLS: both files or neither; loadable unless ACME will create them.
266    let acme_domains = get(Config::RWS_CONFIG_ACME_DOMAINS).unwrap_or("");
267    let acme = !acme_domains.is_empty();
268    let cert = get(Config::RWS_CONFIG_TLS_CERT_FILE).unwrap_or("");
269    let key = get(Config::RWS_CONFIG_TLS_KEY_FILE).unwrap_or("");
270    match (cert.is_empty(), key.is_empty()) {
271        (false, true) => report.error("tls_cert_file is set but tls_key_file is not"),
272        (true, false) => report.error("tls_key_file is set but tls_cert_file is not"),
273        (false, false) if !acme => check_tls_pair("tls_cert_file / tls_key_file", cert, key, report),
274        _ => {}
275    }
276    // spa_fallback names a file relative to the working directory; if it is
277    // missing, every client-side route except / 404s.
278    if let Some(fallback) = get(Config::RWS_CONFIG_SPA_FALLBACK).filter(|v| !v.is_empty()) {
279        if !std::path::Path::new(fallback).is_file() {
280            report.warn(format!(
281                "spa_fallback = {fallback:?}: the file does not exist in the working directory, so every client-side route would 404"
282            ));
283        }
284    }
285
286    // [cors] allow_origins must match what the browser sends in Origin:
287    // scheme://host[:port], no trailing slash, no path.
288    if let Some(origins) = get(Config::RWS_CONFIG_CORS_ALLOW_ORIGINS) {
289        for origin in origins.split(',').map(str::trim).filter(|o| !o.is_empty()) {
290            if origin != "*" && !origin.starts_with("http://") && !origin.starts_with("https://") {
291                report.warn(format!(
292                    "[cors] allow_origins: '{origin}' does not look like scheme://host[:port]; a browser's Origin header never matches it"
293                ));
294            } else if origin != "*" && (origin.ends_with('/') || origin.rsplit_once("://").is_some_and(|(_, rest)| rest.contains('/'))) {
295                report.warn(format!(
296                    "[cors] allow_origins: '{origin}' has a path or trailing slash; Origin headers carry none, so it never matches"
297                ));
298            }
299        }
300    }
301
302    let mut seen_domains: Vec<&str> = Vec::new();
303    for i in 0.. {
304        let domain = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_DOMAIN"));
305        let cert = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_CERT_FILE"));
306        let key = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_KEY_FILE"));
307        if domain.is_none() && cert.is_none() && key.is_none() {
308            break;
309        }
310        let label = format!("[[virtual_host]] {}", domain.unwrap_or("(no domain)"));
311        match (domain, cert, key) {
312            (Some(d), Some(c), Some(k)) if !d.is_empty() => {
313                // Two entries with the same domain: only one certificate can
314                // win, so the loser is a silent misconfiguration.
315                if seen_domains.contains(&d) {
316                    report.error(format!(
317                        "{label}: a second [[virtual_host]] with the same domain; only one certificate can win"
318                    ));
319                } else {
320                    seen_domains.push(d);
321                }
322                check_tls_pair(&label, c, k, report)
323            }
324            _ => report.error(format!("{label}: needs domain, cert_file and key_file")),
325        }
326    }
327
328    if acme {
329        #[cfg(not(feature = "acme"))]
330        report.error("[acme] is configured, but this rws binary was built without the `acme` feature — no certificate would be requested");
331        if get(Config::RWS_CONFIG_ACME_EMAIL).unwrap_or("").is_empty() {
332            report.warn("[acme] has no email: the CA can't warn you about expiring or revoked certificates");
333        }
334        let challenge = get(Config::RWS_CONFIG_ACME_CHALLENGE).map(str::trim).filter(|v| !v.is_empty()).unwrap_or("http-01").to_ascii_lowercase();
335        if !matches!(challenge.as_str(), "http-01" | "tls-alpn-01" | "dns-01" | "dns-persist-01") {
336            report.error(format!("[acme] challenge = {challenge:?}: expected http-01, tls-alpn-01, dns-01 or dns-persist-01"));
337        }
338        for domain in acme_domains.split(',').map(str::trim) {
339            // A wildcard is one leading "*." label (RFC 8555 §7.1.3).
340            let (wildcard, name) = match domain.strip_prefix("*.") {
341                Some(rest) => (true, rest),
342                None => (false, domain),
343            };
344            if name.is_empty() || name.contains('*') || name.contains('/') || name.contains(':') || !name.contains('.') {
345                report.error(format!("[acme] domains: '{domain}' is not a domain name"));
346            } else if wildcard && !challenge.starts_with("dns-") {
347                report.error(format!("[acme] domains: the wildcard '{domain}' needs challenge = \"dns-01\" or \"dns-persist-01\""));
348            }
349        }
350        let port = get(Config::RWS_CONFIG_PORT).unwrap_or("7878");
351        let challenge_port = get(Config::RWS_CONFIG_ACME_CHALLENGE_PORT).unwrap_or("80");
352        let redirect_port = get(Config::RWS_CONFIG_HTTP_REDIRECT_PORT).unwrap_or("");
353        if challenge == "http-01" && redirect_port.is_empty() {
354            report.warn(format!(
355                "[acme] without http_redirect_port: nothing answers the HTTP-01 challenge on port {challenge_port}; set http_redirect_port = {challenge_port}"
356            ));
357        }
358        if challenge == "dns-01" {
359            check_acme_dns(&get, report);
360        }
361        if challenge == "dns-persist-01" && get(Config::RWS_CONFIG_ACME_DNS_PROVIDER).is_some_and(|p| !p.trim().is_empty()) {
362            report.warn("[acme] dns_provider is ignored with dns-persist-01: you publish its record once yourself (rws prints it)");
363        }
364        let on_demand = get(Config::RWS_CONFIG_ACME_ON_DEMAND).unwrap_or("").trim().to_ascii_lowercase();
365        if !matches!(on_demand.as_str(), "" | "true" | "false") {
366            report.error(format!("[acme] on_demand = {on_demand:?}: expected true or false"));
367        } else if on_demand == "true" {
368            match get(Config::RWS_CONFIG_ACME_ON_DEMAND_ASK).map(str::trim).filter(|v| !v.is_empty()) {
369                None => report.error("[acme] on_demand needs on_demand_ask: without it anyone could make rws order certificates for any name pointed at it"),
370                Some(ask) if !(ask.starts_with("http://") || ask.starts_with("https://")) => {
371                    report.error(format!("[acme] on_demand_ask = {ask:?}: expected an http:// or https:// URL"))
372                }
373                Some(_) => {}
374            }
375            if challenge.starts_with("dns-") {
376                report.error(format!("[acme] on_demand works with http-01 and tls-alpn-01, not {challenge} (it would need every customer's DNS zone)"));
377            }
378        }
379        if port != "443" {
380            report.warn(format!("[acme] with port = {port}: browsers expect HTTPS on 443 (fine if a port mapping forwards 443 here)"));
381        }
382    }
383}
384
385/// `dns_api_url`, when set: an http(s) URL.
386fn check_api_url(url: Option<&str>, report: &mut ConfigReport) {
387    if let Some(url) = url.filter(|u| !(u.starts_with("https://") || u.starts_with("http://"))) {
388        report.error(format!("[acme] dns_api_url = {url:?}: expected an http:// or https:// URL"));
389    }
390}
391
392/// `[acme] challenge = "dns-01"`: a provider and what it needs.
393fn check_acme_dns<'a>(get: &dyn Fn(&str) -> Option<&'a str>, report: &mut ConfigReport) {
394    let set = |name: &str| get(name).map(str::trim).filter(|v| !v.is_empty());
395    match set(Config::RWS_CONFIG_ACME_DNS_PROVIDER).map(str::to_ascii_lowercase).as_deref() {
396        Some("rfc2136") => {
397            match set(Config::RWS_CONFIG_ACME_DNS_SERVER) {
398                None => report.error("[acme] dns_provider = \"rfc2136\" needs dns_server (the primary DNS server, host[:port])"),
399                Some(server) if server.contains('/') || server.is_empty() => report.error(format!("[acme] dns_server = {server:?}: expected host[:port]")),
400                Some(_) => {}
401            }
402            match (set(Config::RWS_CONFIG_ACME_DNS_TSIG_KEY), set(Config::RWS_CONFIG_ACME_DNS_TSIG_SECRET)) {
403                (Some(_), None) | (None, Some(_)) => report.error("[acme] dns_tsig_key and dns_tsig_secret go together"),
404                (None, None) => report.warn("[acme] rfc2136 without a TSIG key: the server must accept unsigned updates from this host"),
405                (Some(_), Some(secret)) => {
406                    #[cfg(feature = "acme")]
407                    if crate::acme::base64_secret(secret).is_none() {
408                        report.error("[acme] dns_tsig_secret is not base64");
409                    }
410                    #[cfg(not(feature = "acme"))]
411                    let _ = secret;
412                }
413            }
414            if let Some(algorithm) = set(Config::RWS_CONFIG_ACME_DNS_TSIG_ALGORITHM) {
415                if !matches!(algorithm.to_ascii_lowercase().as_str(), "hmac-sha256" | "hmac-sha512") {
416                    report.error(format!("[acme] dns_tsig_algorithm = {algorithm:?}: expected hmac-sha256 or hmac-sha512"));
417                }
418            }
419        }
420        Some("exec") => match set(Config::RWS_CONFIG_ACME_DNS_EXEC) {
421            None => report.error("[acme] dns_provider = \"exec\" needs dns_exec (the program)"),
422            Some(program) if !Path::new(program).is_file() => report.error(format!("[acme] dns_exec = {program:?}: file not found")),
423            Some(_) => {}
424        },
425        Some("cloudflare") => {
426            // Usually kept out of the file, in the environment.
427            let in_env = std::env::var(Config::RWS_CONFIG_ACME_DNS_API_TOKEN).is_ok_and(|v| !v.trim().is_empty());
428            if set(Config::RWS_CONFIG_ACME_DNS_API_TOKEN).is_none() && !in_env {
429                report.error("[acme] dns_provider = \"cloudflare\" needs dns_api_token (an API token with DNS edit permission; or RWS_CONFIG_ACME_DNS_API_TOKEN)");
430            }
431            check_api_url(set(Config::RWS_CONFIG_ACME_DNS_API_URL), report);
432        }
433        Some("route53") => {
434            let aws = |name: &str| std::env::var(name).is_ok_and(|v| !v.trim().is_empty());
435            if !(aws("AWS_ACCESS_KEY_ID") && aws("AWS_SECRET_ACCESS_KEY")) {
436                report.warn("[acme] dns_provider = \"route53\" reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from the environment, and they aren't set here");
437            }
438            check_api_url(set(Config::RWS_CONFIG_ACME_DNS_API_URL), report);
439        }
440        Some(other) => report.error(format!("[acme] dns_provider = {other:?}: expected rfc2136, cloudflare, route53 or exec")),
441        None => report.error("[acme] challenge = \"dns-01\" needs dns_provider (rfc2136, cloudflare, route53 or exec)"),
442    }
443    if let Some(secs) = set(Config::RWS_CONFIG_ACME_DNS_PROPAGATION_SECS) {
444        if secs.parse::<u64>().is_err() {
445            report.error(format!("[acme] dns_propagation_secs = {secs:?}: not a whole number"));
446        }
447    }
448}
449
450/// `RWS_CONFIG_CORS_ALLOW_ALL` → `cors_allow_all`, for messages.
451fn setting_key(env_name: &str) -> String {
452    env_name.trim_start_matches("RWS_CONFIG_").to_ascii_lowercase()
453}
454
455fn check_tls_pair(label: &str, cert: &str, key: &str, report: &mut ConfigReport) {
456    let mut missing = false;
457    for (what, path) in [("certificate", cert), ("key", key)] {
458        if !Path::new(path).is_file() {
459            report.error(format!("{label}: {what} file '{path}' not found"));
460            missing = true;
461        }
462    }
463    if missing {
464        return;
465    }
466    #[cfg(all(feature = "http2", not(target_arch = "wasm32")))]
467    if let Err(e) = crate::tls::create_tls_acceptor(cert, key) {
468        report.error(format!("{label}: {e}"));
469    }
470    #[cfg(not(feature = "http2"))]
471    report.warn(format!("{label}: this build has no TLS support (`http1` only), so the certificate is not used"));
472}
rust_web_server/config_check/mod.rs

rust_web_server/config_check/
mod.rs
