nixevol/NixMsg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge: listener l01-l07

Browse Source
This commit is contained in:
Nixevol
2026-09-30 16:01:26 +08:00
parent a4e51ec5cd 9e3769f740
commit 8e1d022ee8
19 changed files with 1068 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/nixmsg/healthcheck.go
+4 -9
View File
@@ -26,12 +26,13 @@ func cmdHealthcheck(_ []string) error {
if err != nil {
return err
}
client := &http.Client{Timeout: 3 * time.Second}
scheme := "http"
if healthcheckUseHTTPS(cfg) {
client := &http.Client{Timeout: 3 * time.Second}
if strings.TrimSpace(cfg.TLS.CertFile) != "" && !cfg.TLS.AllowPlaintext {
scheme = "https"
// 只连 127.0.0.1 做存活探测，不涉及证书身份校验。
client.Transport = &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // 本机 HEALTHCHECK，自签证书可接受
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
}
}
url := scheme + "://" + addr + "/healthz"
@@ -47,12 +48,6 @@ func cmdHealthcheck(_ []string) error {
return nil
}
func healthcheckUseHTTPS(cfg config.Config) bool {
cert := strings.TrimSpace(cfg.TLS.CertFile)
key := strings.TrimSpace(cfg.TLS.KeyFile)
return cert != "" && key != "" && !cfg.TLS.AllowPlaintext
}
func resolveHealthAddr(dataDir, listen string) (string, error) {
path := filepath.Join(dataDir, "listen.addr")
if b, err := os.ReadFile(path); err == nil {
cmd/nixmsg/healthcheck_test.go
+93 -24
View File
@@ -1,11 +1,24 @@
package main
import (
"context"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"net"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"strings"
"testing"
"time"
"git.asio.asia/nixevol/NixMsg/internal/config"
)
func TestResolveHealthAddrFromListenAddrFile(t *testing.T) {
@@ -40,7 +53,6 @@ func TestCmdHealthcheckOK(t *testing.T) {
t.Cleanup(srv.Close)
dir := t.TempDir()
// httptest URL is like http://127.0.0.1:port — write host:port into listen.addr
hostPort := srv.Listener.Addr().String()
if err := os.WriteFile(filepath.Join(dir, "listen.addr"), []byte(hostPort+"\n"), 0o644); err != nil {
t.Fatal(err)
@@ -55,33 +67,90 @@ func TestCmdHealthcheckOK(t *testing.T) {
}
}
func TestCmdHealthcheckHTTPS(t *testing.T) {
srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte("ok"))
}))
t.Cleanup(srv.Close)
func TestCmdHealthcheckWithTLS(t *testing.T) {
dataDir := t.TempDir()
certPath, keyPath := writeServeTestCert(t, dataDir, "hc")
initAdminForTest(t, dataDir)
cfgYAML := "listen: \"127.0.0.1:0\"\ndata_dir: \"" + filepath.ToSlash(dataDir) + "\"\n" +
"tls:\n cert_file: \"" + filepath.ToSlash(certPath) + "\"\n" +
" key_file: \"" + filepath.ToSlash(keyPath) + "\"\n" +
" allow_plaintext: false\nlog:\n level: error\n"
cfgPath := filepath.Join(dataDir, "config.yaml")
if err := os.WriteFile(cfgPath, []byte(cfgYAML), 0o644); err != nil {
t.Fatal(err)
}
cfg, err := config.Load(cfgPath)
if err != nil {
t.Fatal(err)
}
if err := cfg.Validate(); err != nil {
t.Fatal(err)
}
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
errCh := make(chan error, 1)
go func() { errCh <- runServe(ctx, cfg) }()
dir := t.TempDir()
hostPort := srv.Listener.Addr().String()
if err := os.WriteFile(filepath.Join(dir, "listen.addr"), []byte(hostPort+"\n"), 0o644); err != nil {
t.Fatal(err)
}
cert := filepath.Join(dir, "cert.pem")
key := filepath.Join(dir, "key.pem")
if err := os.WriteFile(cert, []byte("dummy"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(key, []byte("dummy"), 0o644); err != nil {
t.Fatal(err)
}
cfgPath := filepath.Join(dir, "config.yaml")
body := "listen: \":0\"\ndata_dir: \"" + filepath.ToSlash(dir) + "\"\ntls:\n cert_file: \"" + filepath.ToSlash(cert) + "\"\n key_file: \"" + filepath.ToSlash(key) + "\"\n allow_plaintext: false\n"
if err := os.WriteFile(cfgPath, []byte(body), 0o644); err != nil {
t.Fatal(err)
deadline := time.Now().Add(10 * time.Second)
for time.Now().Before(deadline) {
b, readErr := os.ReadFile(filepath.Join(dataDir, "listen.addr"))
if readErr == nil && strings.TrimSpace(string(b)) != "" {
break
}
time.Sleep(20 * time.Millisecond)
}
t.Setenv("NIXMSG_CONFIG", cfgPath)
if err := cmdHealthcheck(nil); err != nil {
t.Fatal(err)
}
cancel()
select {
case err := <-errCh:
if err != nil {
t.Fatalf("serve exit: %v", err)
}
case <-time.After(10 * time.Second):
t.Fatal("serve did not stop")
}
}
func writeServeTestCert(t *testing.T, dir, cn string) (certPath, keyPath string) {
t.Helper()
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
t.Fatal(err)
}
tmpl := &x509.Certificate{
SerialNumber: big.NewInt(time.Now().UnixNano()),
Subject: pkix.Name{CommonName: cn},
NotBefore: time.Now().Add(-time.Hour),
NotAfter: time.Now().Add(24 * time.Hour),
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
DNSNames: []string{"localhost"},
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
}
der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
if err != nil {
t.Fatal(err)
}
certPath = filepath.Join(dir, cn+".crt")
keyPath = filepath.Join(dir, cn+".key")
certOut, err := os.Create(certPath)
if err != nil {
t.Fatal(err)
}
_ = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der})
_ = certOut.Close()
keyOut, err := os.Create(keyPath)
if err != nil {
t.Fatal(err)
}
b, err := x509.MarshalECPrivateKey(key)
if err != nil {
t.Fatal(err)
}
_ = pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: b})
_ = keyOut.Close()
return certPath, keyPath
}
cmd/nixmsg/serve.go
+7 -14
View File
@@ -249,7 +249,11 @@ func runServe(ctx context.Context, cfg config.Config) error {
}
}
handlers := buildHandlers(nil)
proxies, err := listener.ParseTrustedProxies(cfg.TrustedProxies)
if err != nil {
return fmt.Errorf("trusted_proxies: %w", err)
}
handlers := buildHandlers(proxies)
shared := cfg.AdminListen == ""
var clientHandler, adminHTTP http.Handler
if shared {
@@ -278,17 +282,6 @@ func runServe(ctx context.Context, cfg config.Config) error {
if err != nil {
return fmt.Errorf("listener: %w", err)
}
handlers = buildHandlers(lnSrv.Proxies())
if shared {
lnOpts.ClientHandler = listener.NewMux(listener.RoleShared, handlers)
} else {
lnOpts.ClientHandler = listener.NewMux(listener.RoleClient, handlers)
lnOpts.AdminHandler = listener.NewMux(listener.RoleAdmin, handlers)
}
lnSrv, err = listener.New(lnOpts)
if err != nil {
return fmt.Errorf("listener: %w", err)
}
if err := lnSrv.Start(ctx); err != nil {
return err
@@ -355,10 +348,10 @@ func staticFileHandler() http.Handler {
}
if f, err := sub.Open("index.html"); err == nil {
_ = f.Close()
return http.FileServer(http.FS(sub))
return httpx.SPA(sub)
}
}
return http.FileServer(http.FS(root))
return httpx.SPA(root)
}
func writeListenAddr(dataDir, addr string) error {
cmd/nixmsg/serve_test.go
+14
View File
@@ -102,6 +102,20 @@ func TestServeHealthzAndListenAddr(t *testing.T) {
t.Fatalf("readyz status=%d", ready.StatusCode)
}
spa, err := http.Get("http://" + addr + "/endpoints")
if err != nil {
t.Fatalf("spa: %v", err)
}
defer func() { _ = spa.Body.Close() }()
spaBody, _ := io.ReadAll(spa.Body)
if spa.StatusCode != http.StatusOK {
t.Fatalf("spa status=%d body=%s", spa.StatusCode, spaBody)
}
ct := spa.Header.Get("Content-Type")
if !strings.Contains(ct, "text/html") {
t.Fatalf("spa content-type=%q", ct)
}
if _, err := os.Stat(filepath.Join(dataDir, "nixmsg.db")); err != nil {
t.Fatalf("db missing: %v", err)
}