about summary refs log tree commit diff stats
path: root/internal/server
diff options
context:
space:
mode:
Diffstat (limited to 'internal/server')
-rw-r--r--internal/server/dev.go74
-rw-r--r--internal/server/logging.go16
-rw-r--r--internal/server/mime.go9
-rw-r--r--internal/server/server.go234
-rw-r--r--internal/server/tcp.go14
-rw-r--r--internal/server/tls.go185
6 files changed, 423 insertions, 109 deletions
diff --git a/internal/server/dev.go b/internal/server/dev.go
index f7ebb82..6fcc93e 100644
--- a/internal/server/dev.go
+++ b/internal/server/dev.go
@@ -3,37 +3,64 @@ package server
 import (
 	"fmt"
 	"io/fs"
-	"log/slog"
 	"os"
+	"path"
 	"path/filepath"
+	"slices"
 	"time"
-	"website/internal/log"
+
+	"go.alanpearce.eu/x/log"
 
 	"github.com/fsnotify/fsnotify"
-	"github.com/pkg/errors"
+	"gitlab.com/tozd/go/errors"
 )
 
 type FileWatcher struct {
 	*fsnotify.Watcher
 }
 
-func NewFileWatcher() (*FileWatcher, error) {
+var (
+	l       *log.Logger
+	ignores = []string{
+		"*.templ",
+		"*.go",
+	}
+	checkSettleInterval = 200 * time.Millisecond
+)
+
+func matches(name string) func(string) bool {
+	return func(pattern string) bool {
+		matched, err := path.Match(pattern, name)
+		if err != nil {
+			l.Warn("error checking watcher ignores", "error", err)
+		}
+
+		return matched
+	}
+}
+
+func ignored(pathname string) bool {
+	return slices.ContainsFunc(ignores, matches(path.Base(pathname)))
+}
+
+func NewFileWatcher(log *log.Logger) (*FileWatcher, error) {
 	watcher, err := fsnotify.NewWatcher()
 	if err != nil {
 		return nil, errors.WithMessage(err, "could not create watcher")
 	}
+	l = log
 
 	return &FileWatcher{watcher}, nil
 }
 
 func (watcher FileWatcher) AddRecursive(from string) error {
-	log.Debug("walking directory tree", "root", from)
+	l.Debug("walking directory tree", "root", from)
 	err := filepath.WalkDir(from, func(path string, entry fs.DirEntry, err error) error {
 		if err != nil {
 			return errors.WithMessagef(err, "could not walk directory %s", path)
 		}
 		if entry.IsDir() {
-			log.Debug("adding directory to watcher", "path", path)
+			l.Debug("adding directory to watcher", "path", path)
 			if err = watcher.Add(path); err != nil {
 				return errors.WithMessagef(err, "could not add directory %s to watcher", path)
 			}
@@ -46,26 +73,37 @@ func (watcher FileWatcher) AddRecursive(from string) error {
 }
 
 func (watcher FileWatcher) Start(callback func(string)) {
+	var timer *time.Timer
 	for {
 		select {
 		case event := <-watcher.Events:
-			if event.Has(fsnotify.Create) || event.Has(fsnotify.Rename) {
-				f, err := os.Stat(event.Name)
-				if err != nil {
-					slog.Error(fmt.Sprintf("error handling %s event: %v", event.Op.String(), err))
-				} else if f.IsDir() {
-					err = watcher.Add(event.Name)
+			if !ignored(event.Name) {
+				l.Debug("watcher event", "name", event.Name, "op", event.Op.String())
+				if event.Has(fsnotify.Create) || event.Has(fsnotify.Rename) {
+					f, err := os.Stat(event.Name)
 					if err != nil {
-						slog.Error(fmt.Sprintf("error adding new folder to watcher: %v", err))
+						l.Error(
+							fmt.Sprintf("error handling %s event: %v", event.Op.String(), err),
+						)
+					} else if f.IsDir() {
+						err = watcher.Add(event.Name)
+						if err != nil {
+							l.Error(fmt.Sprintf("error adding new folder to watcher: %v", err))
+						}
 					}
 				}
-			}
-			if event.Has(fsnotify.Rename) || event.Has(fsnotify.Write) {
-				callback(event.Name)
-				time.Sleep(500 * time.Millisecond)
+				if event.Has(fsnotify.Rename) || event.Has(fsnotify.Write) ||
+					event.Has(fsnotify.Create) || event.Has(fsnotify.Chmod) {
+					if timer == nil {
+						timer = time.AfterFunc(checkSettleInterval, func() {
+							callback(event.Name)
+						})
+					}
+					timer.Reset(checkSettleInterval)
+				}
 			}
 		case err := <-watcher.Errors:
-			slog.Error(fmt.Sprintf("error in watcher: %v", err))
+			l.Error("error in watcher", "error", err)
 		}
 	}
 }
diff --git a/internal/server/logging.go b/internal/server/logging.go
index a574bcb..f744931 100644
--- a/internal/server/logging.go
+++ b/internal/server/logging.go
@@ -2,7 +2,8 @@ package server
 
 import (
 	"net/http"
-	"website/internal/log"
+
+	"go.alanpearce.eu/x/log"
 )
 
 type LoggingResponseWriter struct {
@@ -22,25 +23,18 @@ func NewLoggingResponseWriter(w http.ResponseWriter) *LoggingResponseWriter {
 	return &LoggingResponseWriter{w, http.StatusOK}
 }
 
-func wrapHandlerWithLogging(wrappedHandler http.Handler) http.Handler {
+func wrapHandlerWithLogging(wrappedHandler http.Handler, log *log.Logger) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		scheme := r.Header.Get("X-Forwarded-Proto")
-		if scheme == "" {
-			scheme = "http"
-		}
-		host := r.Host
 		lw := NewLoggingResponseWriter(w)
 		wrappedHandler.ServeHTTP(lw, r)
 		if r.URL.Path == "/health" {
 			return
 		}
-		statusCode := lw.statusCode
 		log.Info(
 			"http request",
-			"scheme", scheme,
 			"method", r.Method,
-			"status", statusCode,
-			"host", host,
+			"status", lw.statusCode,
+			"host", r.Host,
 			"path", r.URL.Path,
 			"location", lw.Header().Get("Location"),
 		)
diff --git a/internal/server/mime.go b/internal/server/mime.go
index 696a0ad..cb1b1cf 100644
--- a/internal/server/mime.go
+++ b/internal/server/mime.go
@@ -2,21 +2,18 @@ package server
 
 import (
 	"mime"
-	"website/internal/log"
+
+	"go.alanpearce.eu/x/log"
 )
 
 var newMIMEs = map[string]string{
 	".xsl": "text/xsl",
 }
 
-func fixupMIMETypes() {
+func fixupMIMETypes(log *log.Logger) {
 	for ext, newType := range newMIMEs {
 		if err := mime.AddExtensionType(ext, newType); err != nil {
 			log.Error("could not update mime type", "ext", ext, "mime", newType)
 		}
 	}
 }
-
-func init() {
-	fixupMIMETypes()
-}
diff --git a/internal/server/server.go b/internal/server/server.go
index 77905f8..269ed9e 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -7,18 +7,22 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
+	"regexp"
 	"slices"
+	"strconv"
+	"strings"
 	"time"
 
-	"website/internal/builder"
-	cfg "website/internal/config"
-	"website/internal/log"
-	"website/internal/website"
+	"go.alanpearce.eu/website/internal/builder"
+	cfg "go.alanpearce.eu/website/internal/config"
+	"go.alanpearce.eu/website/internal/vcs"
+	"go.alanpearce.eu/website/internal/website"
+	"go.alanpearce.eu/x/log"
 
+	"github.com/ardanlabs/conf/v3"
 	"github.com/osdevisnot/sorvor/pkg/livereload"
-	"github.com/pkg/errors"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
+	"gitlab.com/tozd/go/errors"
 )
 
 var (
@@ -28,69 +32,129 @@ var (
 )
 
 type Config struct {
-	Development   bool   `conf:"default:false,flag:dev"`
-	Root          string `conf:"default:website"`
+	Root          string `conf:"default:public"`
+	Redirect      bool   `conf:"default:true"`
 	ListenAddress string `conf:"default:localhost"`
-	Port          string `conf:"default:3000,short:p"`
+	Port          int    `conf:"default:8080,short:p"`
+	TLSPort       int    `conf:"default:8443"`
+	TLS           bool   `conf:"default:false"`
+
+	Development bool   `conf:"default:false,flag:dev"`
+	ACMECA      string `conf:"env:ACME_CA"`
+	ACMECACert  string `conf:"env:ACME_CA_CERT"`
+	Domains     string
 }
 
 type Server struct {
 	*http.Server
+	runtimeConfig *Config
+	config        *cfg.Config
+	log           *log.Logger
 }
 
-func applyDevModeOverrides(config *cfg.Config, listenAddress string) {
-	config.CSP.StyleSrc = slices.Insert(config.CSP.StyleSrc, 0, "'unsafe-inline'")
+func applyDevModeOverrides(config *cfg.Config, runtimeConfig *Config) {
 	config.CSP.ScriptSrc = slices.Insert(config.CSP.ScriptSrc, 0, "'unsafe-inline'")
 	config.CSP.ConnectSrc = slices.Insert(config.CSP.ConnectSrc, 0, "'self'")
+	if runtimeConfig.Domains != "" {
+		config.Domains = strings.Split(runtimeConfig.Domains, ",")
+	} else {
+		config.Domains = []string{runtimeConfig.ListenAddress}
+	}
+	scheme := "http"
+	port := runtimeConfig.Port
+	if runtimeConfig.TLS {
+		scheme = "https"
+		port = runtimeConfig.TLSPort
+	}
 	config.BaseURL = cfg.URL{
 		URL: &url.URL{
-			Scheme: "http",
-			Host:   listenAddress,
+			Scheme: scheme,
+			Host:   net.JoinHostPort(config.Domains[0], strconv.Itoa(port)),
 		},
 	}
 }
 
+func updateCSPHashes(config *cfg.Config, r *builder.Result) {
+	for i, h := range r.Hashes {
+		config.CSP.StyleSrc[i] = fmt.Sprintf("'%s'", h)
+	}
+}
+
 func serverHeaderHandler(wrappedHandler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.ProtoMajor >= 2 && r.Header.Get("Host") != "" {
-			// net/http does this for HTTP/1.1, but not h2c
-			// TODO: check with HTTP/2.0 (i.e. with TLS)
-			r.Host = r.Header.Get("Host")
-			r.Header.Del("Host")
-		}
 		w.Header().Set("Server", serverHeader)
 		wrappedHandler.ServeHTTP(w, r)
 	})
 }
 
-func New(runtimeConfig *Config) (*Server, error) {
-	var err error
-	config, err := cfg.GetConfig()
+func rebuild(builderConfig *builder.IOConfig, config *cfg.Config, log *log.Logger) error {
+	r, err := builder.BuildSite(builderConfig, config, log.Named("builder"))
+	if err != nil {
+		return errors.WithMessage(err, "could not build site")
+	}
+	updateCSPHashes(config, r)
+
+	return nil
+}
+
+func New(runtimeConfig *Config, log *log.Logger) (*Server, error) {
+	builderConfig := &builder.IOConfig{
+		Destination: runtimeConfig.Root,
+		Development: runtimeConfig.Development,
+	}
+
+	if !runtimeConfig.Development {
+		vcsConfig := &vcs.Config{}
+		_, err := conf.Parse("VCS", vcsConfig)
+		if err != nil {
+			return nil, err
+		}
+		if vcsConfig.LocalPath != "" {
+			_, err = vcs.CloneOrUpdate(vcsConfig, log.Named("vcs"))
+			if err != nil {
+				return nil, err
+			}
+			err = os.Chdir(runtimeConfig.Root)
+			if err != nil {
+				return nil, err
+			}
+
+			builderConfig.Source = vcsConfig.LocalPath
+
+			publicDir := filepath.Join(runtimeConfig.Root, "public")
+			builderConfig.Destination = publicDir
+			runtimeConfig.Root = publicDir
+		} else {
+			log.Warn("in production mode without VCS configuration")
+		}
+	}
+
+	config, err := cfg.GetConfig(builderConfig.Source, log.Named("config"))
 	if err != nil {
 		return nil, errors.WithMessage(err, "error parsing configuration file")
 	}
+	if runtimeConfig.Development {
+		applyDevModeOverrides(config, runtimeConfig)
+	}
 
-	listenAddress := net.JoinHostPort(runtimeConfig.ListenAddress, runtimeConfig.Port)
 	top := http.NewServeMux()
 
-	if runtimeConfig.Development {
-		applyDevModeOverrides(config, listenAddress)
-		builderConfig := builder.IOConfig{
-			Source:      "content",
-			Destination: runtimeConfig.Root,
-			BaseURL:     config.BaseURL,
-			Development: true,
-		}
-		builder.BuildSite(builderConfig)
+	err = rebuild(builderConfig, config, log)
+	if err != nil {
+		return nil, err
+	}
+
+	fixupMIMETypes(log)
 
+	if runtimeConfig.Development {
 		liveReload := livereload.New()
 		top.Handle("/_/reload", liveReload)
 		liveReload.Start()
-		fw, err := NewFileWatcher()
+		fw, err := NewFileWatcher(log.Named("watcher"))
 		if err != nil {
 			return nil, errors.WithMessage(err, "could not create file watcher")
 		}
-		for _, dir := range []string{"content", "static", "templates"} {
+		for _, dir := range []string{"content", "static", "templates", "internal/builder"} {
 			err := fw.AddRecursive(dir)
 			if err != nil {
 				return nil, errors.WithMessagef(
@@ -100,62 +164,84 @@ func New(runtimeConfig *Config) (*Server, error) {
 				)
 			}
 		}
+		err = fw.Add(".")
+		if err != nil {
+			return nil, errors.WithMessage(err, "could not add directory to file watcher")
+		}
 		go fw.Start(func(filename string) {
-			log.Debug("file updated", "filename", filename)
-			builder.BuildSite(builderConfig)
-			liveReload.Reload()
+			log.Info("rebuilding site", "changed_file", filename)
+			err := rebuild(builderConfig, config, log)
+			if err != nil {
+				log.Error("error rebuilding site", "error", err)
+			}
 		})
 	}
 
 	loggingMux := http.NewServeMux()
-	mux, err := website.NewMux(config, runtimeConfig.Root)
+	mux, err := website.NewMux(config, runtimeConfig.Root, log.Named("website"))
 	if err != nil {
 		return nil, errors.Wrap(err, "could not create website mux")
 	}
-	log.Debug("binding main handler to", "host", listenAddress)
-	hostname := config.BaseURL.Hostname()
-
-	loggingMux.Handle(hostname+"/", mux)
 
-	loggingMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		newURL := config.BaseURL.JoinPath(r.URL.String())
-		http.Redirect(w, r, newURL.String(), 301)
-	})
+	if runtimeConfig.Redirect {
+		re := regexp.MustCompile(
+			"^(.*)\\." + strings.ReplaceAll(config.WildcardDomain, ".", `\.`) + "$",
+		)
+		replace := "${1}." + config.Domains[0]
+		loggingMux.Handle(config.BaseURL.Hostname()+"/", mux)
+		loggingMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			if slices.Contains(config.Domains, r.Host) {
+				path, _ := website.CanonicalisePath(r.URL.Path)
+				newURL := config.BaseURL.JoinPath(path)
+				http.Redirect(w, r, newURL.String(), http.StatusMovedPermanently)
+			} else {
+				url := config.BaseURL
+				url.Host = re.ReplaceAllString(r.Host, replace)
+				http.Redirect(w, r, url.String(), http.StatusTemporaryRedirect)
+			}
+		})
+	} else {
+		loggingMux.Handle("/", mux)
+	}
 
-	top.Handle("/",
-		serverHeaderHandler(
-			wrapHandlerWithLogging(loggingMux),
-		),
-	)
+	if runtimeConfig.Development {
+		top.Handle("/",
+			serverHeaderHandler(
+				wrapHandlerWithLogging(loggingMux, log),
+			),
+		)
+	} else {
+		top.Handle("/", serverHeaderHandler(loggingMux))
+	}
 
 	top.HandleFunc("/health", func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	})
 
 	return &Server{
-		&http.Server{
-			Addr:              listenAddress,
-			ReadHeaderTimeout: 1 * time.Minute,
-			Handler: http.MaxBytesHandler(h2c.NewHandler(
-				top,
-				&http2.Server{
-					IdleTimeout: 15 * time.Minute,
-				},
-			), 0),
+		Server: &http.Server{
+			ReadHeaderTimeout: 10 * time.Second,
+			ReadTimeout:       1 * time.Minute,
+			WriteTimeout:      2 * time.Minute,
+			IdleTimeout:       10 * time.Minute,
+			Handler:           top,
 		},
+		log:           log,
+		config:        config,
+		runtimeConfig: runtimeConfig,
 	}, nil
 }
 
-func (s *Server) Start() error {
-	f := os.NewFile(uintptr(3), "")
-	l, err := net.FileListener(f)
-	if err != nil {
-		l, err = net.Listen("tcp", s.Addr)
-		if err != nil {
-			return errors.Wrap(err, "could not create listener")
-		}
+func (s *Server) serve(tls bool) error {
+	if tls {
+		return s.serveTLS()
 	}
-	if err := http.Serve(l, s.Handler); err != http.ErrServerClosed {
+
+	return s.serveTCP()
+}
+
+func (s *Server) Start() error {
+	if err := s.serve(s.runtimeConfig.TLS); err != http.ErrServerClosed {
 		return errors.Wrap(err, "error creating/closing server")
 	}
 
@@ -163,19 +249,19 @@ func (s *Server) Start() error {
 }
 
 func (s *Server) Stop() chan struct{} {
-	log.Debug("stop called")
+	s.log.Debug("stop called")
 
 	idleConnsClosed := make(chan struct{})
 
 	go func() {
-		log.Debug("shutting down server")
+		s.log.Debug("shutting down server")
 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 		defer cancel()
 		err := s.Server.Shutdown(ctx)
-		log.Debug("server shut down")
+		s.log.Debug("server shut down")
 		if err != nil {
 			// Error from closing listeners, or context timeout:
-			log.Warn("HTTP server Shutdown", "error", err)
+			s.log.Warn("HTTP server Shutdown", "error", err)
 		}
 		close(idleConnsClosed)
 	}()
diff --git a/internal/server/tcp.go b/internal/server/tcp.go
new file mode 100644
index 0000000..1627854
--- /dev/null
+++ b/internal/server/tcp.go
@@ -0,0 +1,14 @@
+package server
+
+import (
+	"go.alanpearce.eu/x/listenfd"
+)
+
+func (s *Server) serveTCP() error {
+	l, err := listenfd.GetListener(0, s.Addr, s.log.Named("tcp.listenfd"))
+	if err != nil {
+		return err
+	}
+
+	return s.Serve(l)
+}
diff --git a/internal/server/tls.go b/internal/server/tls.go
new file mode 100644
index 0000000..4d52b8d
--- /dev/null
+++ b/internal/server/tls.go
@@ -0,0 +1,185 @@
+package server
+
+import (
+	"context"
+	"crypto/x509"
+	"net"
+	"net/http"
+	"strconv"
+
+	"go.alanpearce.eu/x/listenfd"
+
+	"github.com/ardanlabs/conf/v3"
+	"github.com/caddyserver/caddy/v2"
+	"github.com/caddyserver/certmagic"
+	"github.com/libdns/acmedns"
+	certmagic_redis "github.com/pberkel/caddy-storage-redis"
+	"gitlab.com/tozd/go/errors"
+)
+
+type redisConfig struct {
+	Address       string `conf:"required"`
+	Username      string `conf:"default:default"`
+	Password      string `conf:"required"`
+	EncryptionKey string `conf:"required"`
+	KeyPrefix     string `conf:"default:certmagic"`
+}
+
+type acmeConfig struct {
+	Username  string `conf:"required"`
+	Password  string `conf:"required"`
+	Subdomain string `conf:"required"`
+	ServerURL string `conf:"env:SERVER_URL,default:https://acme.alanpearce.eu"`
+}
+
+func (s *Server) serveTLS() (err error) {
+	log := s.log.Named("tls")
+
+	// setting cfg.Logger is too late somehow
+	certmagic.Default.Logger = log.GetLogger().Named("certmagic")
+	cfg := certmagic.NewDefault()
+	cfg.DefaultServerName = s.config.Domains[0]
+
+	var issuer *certmagic.ACMEIssuer
+
+	if s.runtimeConfig.Development {
+		ca := s.runtimeConfig.ACMECA
+		if ca == "" {
+			return errors.New("can't enable tls in development without an ACME_CA")
+		}
+
+		cp, err := x509.SystemCertPool()
+		if err != nil {
+			log.Warn("could not get system certificate pool", "error", err)
+			cp = x509.NewCertPool()
+		}
+
+		if cacert := s.runtimeConfig.ACMECACert; cacert != "" {
+			cp.AppendCertsFromPEM([]byte(cacert))
+		}
+
+		// caddy's ACME server (step-ca) doesn't specify an OCSP server
+		cfg.OCSP.DisableStapling = true
+
+		issuer = certmagic.NewACMEIssuer(cfg, certmagic.ACMEIssuer{
+			CA:                      s.runtimeConfig.ACMECA,
+			TrustedRoots:            cp,
+			DisableTLSALPNChallenge: true,
+			ListenHost:              s.runtimeConfig.ListenAddress,
+			AltHTTPPort:             s.runtimeConfig.Port,
+			AltTLSALPNPort:          s.runtimeConfig.TLSPort,
+			Logger:                  certmagic.Default.Logger,
+		})
+	} else {
+		rc := &redisConfig{}
+		_, err = conf.Parse("REDIS", rc)
+		if err != nil {
+			return errors.Wrap(err, "could not parse redis config")
+		}
+
+		acme := &acmedns.Provider{}
+		_, err = conf.Parse("ACME", acme)
+		if err != nil {
+			return errors.Wrap(err, "could not parse ACME config")
+		}
+
+		issuer = certmagic.NewACMEIssuer(cfg, certmagic.ACMEIssuer{
+			CA:     certmagic.LetsEncryptProductionCA,
+			Email:  s.config.Email,
+			Agreed: true,
+			Logger: certmagic.Default.Logger,
+			DNS01Solver: &certmagic.DNS01Solver{
+				DNSManager: certmagic.DNSManager{
+					DNSProvider: acme,
+					Logger:      certmagic.Default.Logger,
+				},
+			},
+		})
+
+		log.Info("acme", "username", acme.Username, "subdomain", acme.Subdomain, "server_url", acme.ServerURL)
+
+		rs := certmagic_redis.New()
+		rs.Address = []string{rc.Address}
+		rs.Username = rc.Username
+		rs.Password = rc.Password
+		rs.EncryptionKey = rc.EncryptionKey
+		rs.KeyPrefix = rc.KeyPrefix
+
+		cfg.Storage = rs
+		err = rs.Provision(caddy.Context{
+			Context: context.Background(),
+		})
+		if err != nil {
+			return errors.Wrap(err, "could not provision redis storage")
+		}
+	}
+	cfg.Issuers[0] = issuer
+
+	ln, err := listenfd.GetListener(
+		1,
+		net.JoinHostPort(s.runtimeConfig.ListenAddress, strconv.Itoa(s.runtimeConfig.Port)),
+		log.Named("listenfd"),
+	)
+	if err != nil {
+		return errors.Wrap(err, "could not bind plain socket")
+	}
+
+	go func(ln net.Listener, srv *http.Server) {
+		httpMux := http.NewServeMux()
+		httpMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			if certmagic.LooksLikeHTTPChallenge(r) && issuer.HandleHTTPChallenge(w, r) {
+				return
+			}
+			url := r.URL
+			url.Scheme = "https"
+			port := s.config.BaseURL.Port()
+			if port == "" {
+				url.Host = r.Host
+			} else {
+				host, _, err := net.SplitHostPort(r.Host)
+				if err != nil {
+					log.Warn("error splitting host and port", "error", err)
+					host = r.Host
+				}
+				url.Host = net.JoinHostPort(host, s.config.BaseURL.Port())
+			}
+			http.Redirect(w, r, url.String(), http.StatusMovedPermanently)
+		})
+		srv.Handler = httpMux
+
+		if err := srv.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Error("error in http handler", "error", err)
+		}
+	}(ln, &http.Server{
+		ReadHeaderTimeout: s.ReadHeaderTimeout,
+		ReadTimeout:       s.ReadTimeout,
+		WriteTimeout:      s.WriteTimeout,
+		IdleTimeout:       s.IdleTimeout,
+	})
+
+	log.Debug(
+		"starting certmagic",
+		"http_port",
+		s.runtimeConfig.Port,
+		"https_port",
+		s.runtimeConfig.TLSPort,
+	)
+	err = cfg.ManageAsync(context.TODO(), s.config.Domains)
+	if err != nil {
+		return errors.Wrap(err, "could not enable TLS")
+	}
+	tlsConfig := cfg.TLSConfig()
+	tlsConfig.NextProtos = append([]string{"h2", "http/1.1"}, tlsConfig.NextProtos...)
+
+	sln, err := listenfd.GetListenerTLS(
+		0,
+		net.JoinHostPort(s.runtimeConfig.ListenAddress, strconv.Itoa(s.runtimeConfig.TLSPort)),
+		tlsConfig,
+		log.Named("listenfd"),
+	)
+	if err != nil {
+		return errors.Wrap(err, "could not bind tls socket")
+	}
+
+	return s.Serve(sln)
+}
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-09-28 02:20:38 +0000