fix: 修复 TLS ConnectionState、SPA 回退、健康检查与监听小问题

cmd/nixmsg/healthcheck.go

@@ -30,8 +30,9 @@ func cmdHealthcheck(_ []string) error {
 	scheme := "http"
 	if healthcheckUseHTTPS(cfg) {
 		scheme = "https"
+		// 本机 HEALTHCHECK 只连 127.0.0.1，自签证书可接受。
 		client.Transport = &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // 本机 HEALTHCHECK，自签证书可接受
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
 		}
 	}
 	url := scheme + "://" + addr + "/healthz"

cmd/nixmsg/healthcheck_test.go

@@ -1,11 +1,24 @@
 package main
 
 import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
+
+	"git.asio.asia/nixevol/NixMsg/internal/config"
 )
 
 func TestResolveHealthAddrFromListenAddrFile(t *testing.T) {
@@ -40,7 +53,6 @@ func TestCmdHealthcheckOK(t *testing.T) {
 	t.Cleanup(srv.Close)
 
 	dir := t.TempDir()
-	// httptest URL is like http://127.0.0.1:port — write host:port into listen.addr
 	hostPort := srv.Listener.Addr().String()
 	if err := os.WriteFile(filepath.Join(dir, "listen.addr"), []byte(hostPort+"\n"), 0o644); err != nil {
 		t.Fatal(err)
@@ -85,3 +97,91 @@ func TestCmdHealthcheckHTTPS(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestCmdHealthcheckWithTLS(t *testing.T) {
+	dataDir := t.TempDir()
+	certPath, keyPath := writeServeTestCert(t, dataDir, "hc")
+	initAdminForTest(t, dataDir)
+	cfgYAML := "listen: \"127.0.0.1:0\"\ndata_dir: \"" + filepath.ToSlash(dataDir) + "\"\n" +
+		"tls:\n  cert_file: \"" + filepath.ToSlash(certPath) + "\"\n" +
+		"  key_file: \"" + filepath.ToSlash(keyPath) + "\"\n" +
+		"  allow_plaintext: false\nlog:\n  level: error\n"
+	cfgPath := filepath.Join(dataDir, "config.yaml")
+	if err := os.WriteFile(cfgPath, []byte(cfgYAML), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := config.Load(cfgPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cfg.Validate(); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	errCh := make(chan error, 1)
+	go func() { errCh <- runServe(ctx, cfg) }()
+
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) {
+		b, readErr := os.ReadFile(filepath.Join(dataDir, "listen.addr"))
+		if readErr == nil && strings.TrimSpace(string(b)) != "" {
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Setenv("NIXMSG_CONFIG", cfgPath)
+	if err := cmdHealthcheck(nil); err != nil {
+		t.Fatal(err)
+	}
+	cancel()
+	select {
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("serve exit: %v", err)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("serve did not stop")
+	}
+}
+
+func writeServeTestCert(t *testing.T, dir, cn string) (certPath, keyPath string) {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: cn},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPath = filepath.Join(dir, cn+".crt")
+	keyPath = filepath.Join(dir, cn+".key")
+	certOut, err := os.Create(certPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der})
+	_ = certOut.Close()
+	keyOut, err := os.Create(keyPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: b})
+	_ = keyOut.Close()
+	return certPath, keyPath
+}

cmd/nixmsg/serve.go

@@ -249,7 +249,11 @@ func runServe(ctx context.Context, cfg config.Config) error {
 		}
 	}
 
-	handlers := buildHandlers(nil)
+	proxies, err := listener.ParseTrustedProxies(cfg.TrustedProxies)
+	if err != nil {
+		return fmt.Errorf("trusted_proxies: %w", err)
+	}
+	handlers := buildHandlers(proxies)
 	shared := cfg.AdminListen == ""
 	var clientHandler, adminHTTP http.Handler
 	if shared {
@@ -278,17 +282,6 @@ func runServe(ctx context.Context, cfg config.Config) error {
 	if err != nil {
 		return fmt.Errorf("listener: %w", err)
 	}
-	handlers = buildHandlers(lnSrv.Proxies())
-	if shared {
-		lnOpts.ClientHandler = listener.NewMux(listener.RoleShared, handlers)
-	} else {
-		lnOpts.ClientHandler = listener.NewMux(listener.RoleClient, handlers)
-		lnOpts.AdminHandler = listener.NewMux(listener.RoleAdmin, handlers)
-	}
-	lnSrv, err = listener.New(lnOpts)
-	if err != nil {
-		return fmt.Errorf("listener: %w", err)
-	}
 
 	if err := lnSrv.Start(ctx); err != nil {
 		return err
@@ -360,10 +353,10 @@ func staticFileHandler() http.Handler {
 		}
 		if f, err := sub.Open("index.html"); err == nil {
 			_ = f.Close()
-			return http.FileServer(http.FS(sub))
+			return httpx.SPA(sub)
 		}
 	}
-	return http.FileServer(http.FS(root))
+	return httpx.SPA(root)
 }
 
 func writeListenAddr(dataDir, addr string) error {

cmd/nixmsg/serve_test.go

@@ -102,6 +102,20 @@ func TestServeHealthzAndListenAddr(t *testing.T) {
 		t.Fatalf("readyz status=%d", ready.StatusCode)
 	}
 
+	spa, err := http.Get("http://" + addr + "/endpoints")
+	if err != nil {
+		t.Fatalf("spa: %v", err)
+	}
+	defer func() { _ = spa.Body.Close() }()
+	spaBody, _ := io.ReadAll(spa.Body)
+	if spa.StatusCode != http.StatusOK {
+		t.Fatalf("spa status=%d body=%s", spa.StatusCode, spaBody)
+	}
+	ct := spa.Header.Get("Content-Type")
+	if !strings.Contains(ct, "text/html") {
+		t.Fatalf("spa content-type=%q", ct)
+	}
+
 	if _, err := os.Stat(filepath.Join(dataDir, "nixmsg.db")); err != nil {
 		t.Fatalf("db missing: %v", err)
 	}