fix tunnel embed, acme renew

Author: gosunuts

cmd/relay-server/tunnel.go

@@ -5,8 +5,6 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net/http"
-	"os"
-	"path/filepath"
 	"strings"
 )
 
@@ -199,46 +197,36 @@ func serveTunnelBinary(w http.ResponseWriter, r *http.Request) {
 		slug = strings.TrimSuffix(slug, ".sha256")
 	}
 
-	path, ok := tunnelBinaryPathBySlug(slug)
+	data, filename, ok := tunnelBinaryBySlug(slug)
 	if !ok {
 		http.NotFound(w, r)
 		return
 	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		http.NotFound(w, r)
-		return
-	}
 	sum := sha256.Sum256(data)
 	checksumHex := hex.EncodeToString(sum[:])
 
 	if checksumRequest {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		if r.Method == http.MethodGet {
-			_, _ = fmt.Fprintf(w, "%s  portal-tunnel-%s\n", checksumHex, slug)
+			_, _ = fmt.Fprintf(w, "%s  %s\n", checksumHex, filename)
 		}
 		return
 	}
 
 	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
 	w.Header().Set("X-Checksum-Sha256", checksumHex)
 	if r.Method == http.MethodGet {
 		_, _ = w.Write(data)
 	}
 }
 
-func tunnelBinaryPathBySlug(slug string) (string, bool) {
-	candidates := []string{
-		filepath.Join("dist", "tunnel", tunnelBinaryName(slug)),
-		filepath.Join("bin", tunnelBinaryName(slug)),
-	}
-	for _, candidate := range candidates {
-		if _, err := os.Stat(candidate); err == nil {
-			return candidate, true
-		}
+func tunnelBinaryBySlug(slug string) ([]byte, string, bool) {
+	filename := tunnelBinaryName(slug)
+	if data, err := embeddedDistFS.ReadFile("dist/tunnel/" + filename); err == nil {
+		return data, filename, true
 	}
-	return "", false
+	return nil, "", false
 }
 
 func tunnelBinaryName(slug string) string {

portal/acme/acme.go

@@ -24,6 +24,7 @@ import (
 	lego "github.com/go-acme/lego/v4/lego"
 	"github.com/go-acme/lego/v4/providers/dns/cloudflare"
 	"github.com/go-acme/lego/v4/registration"
+	"github.com/rs/zerolog/log"
 )
 
 const (
@@ -32,6 +33,9 @@ const (
 	accountKeyFileName     = "acme-account.key"
 	registrationFileName   = "acme-registration.json"
 	defaultACMEEmailPrefix = "acme@"
+	defaultRenewInterval   = 24 * time.Hour
+	defaultDNSSyncInterval = 10 * time.Minute
+	defaultSyncTimeout     = 2 * time.Minute
 )
 
 type Config struct {
@@ -99,7 +103,7 @@ func (m *Manager) EnsureCertificate(ctx context.Context) (string, string, error)
 		return "", "", errors.New("cloudflare token is required for non-local relay certificates")
 	}
 
-	if err := EnsureDNSRecords(ctx, m.cfg.BaseDomain, m.cfg.CloudflareToken); err != nil {
+	if err := m.syncDNS(ctx); err != nil {
 		return "", "", fmt.Errorf("ensure dns records: %w", err)
 	}
 
@@ -124,7 +128,7 @@ func (m *Manager) Start(ctx context.Context) {
 
 	m.startOnce.Do(func() {
 		m.wg.Add(1)
-		go m.renewalLoop(ctx)
+		go m.maintenanceLoop(ctx)
 	})
 }
 
@@ -195,29 +199,48 @@ func (m *Manager) provision(ctx context.Context) error {
 	return nil
 }
 
-func (m *Manager) renewalLoop(ctx context.Context) {
+func (m *Manager) maintenanceLoop(ctx context.Context) {
 	defer m.wg.Done()
 
-	ticker := time.NewTicker(24 * time.Hour)
-	defer ticker.Stop()
+	renewTicker := time.NewTicker(defaultRenewInterval)
+	dnsTicker := time.NewTicker(defaultDNSSyncInterval)
+	defer renewTicker.Stop()
+	defer dnsTicker.Stop()
 
 	for {
 		select {
 		case <-ctx.Done():
 			return
 		case <-m.stopCh:
 			return
-		case <-ticker.C:
+		case <-dnsTicker.C:
+			syncCtx, cancel := context.WithTimeout(ctx, defaultSyncTimeout)
+			err := m.syncDNS(syncCtx)
+			cancel()
+			if err != nil {
+				log.Warn().Err(err).Str("base_domain", m.cfg.BaseDomain).Msg("sync dns records")
+			}
+		case <-renewTicker.C:
 			if !m.shouldRenew() {
 				continue
 			}
-			renewCtx, cancel := context.WithTimeout(ctx, 2*time.Minute)
-			_ = m.provision(renewCtx)
+			renewCtx, cancel := context.WithTimeout(ctx, defaultSyncTimeout)
+			err := m.provision(renewCtx)
 			cancel()
+			if err != nil {
+				log.Warn().Err(err).Str("base_domain", m.cfg.BaseDomain).Msg("renew acme certificate")
+			}
 		}
 	}
 }
 
+func (m *Manager) syncDNS(ctx context.Context) error {
+	if m == nil || isLocalhost(m.cfg.BaseDomain) || m.cfg.CloudflareToken == "" {
+		return nil
+	}
+	return EnsureDNSRecords(ctx, m.cfg.BaseDomain, m.cfg.CloudflareToken)
+}
+
 func (m *Manager) shouldRenew() bool {
 	m.mu.RLock()
 	defer m.mu.RUnlock()