Function ensureNginxBootstrap

src/cli/commands/start.ts:15–69

()

  /^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/

const ensureNginxBootstrap = async (): Promise<void> => {
  const relayDomain = process.env.RELAY_DOMAIN?.trim()
  if (!relayDomain) {
    throw new Error(
      'RELAY_DOMAIN environment variable is required when using --nginx (example: RELAY_DOMAIN=relay.example.com).',
    )
  }

  if (!FQDN_REGEX.test(relayDomain)) {
    throw new Error('RELAY_DOMAIN must be a valid fully-qualified domain name when using --nginx.')
  }

  const certbotEmail = process.env.CERTBOT_EMAIL?.trim()
  if (!certbotEmail) {
    throw new Error(
      'CERTBOT_EMAIL environment variable is required when using --nginx (example: CERTBOT_EMAIL=you@example.com).',
    )
  }

  const nginxConfDir = getProjectPath('nginx', 'conf.d')
  const nginxTemplate = join(nginxConfDir, 'nostream.conf.template')
  const nginxConf = join(nginxConfDir, 'nostream.conf')

  const templateContent = fs.readFileSync(nginxTemplate, 'utf-8')
  const rendered = templateContent.replaceAll('${RELAY_DOMAIN}', relayDomain)
  fs.writeFileSync(nginxConf, rendered, { encoding: 'utf-8' })

  const sslCertDir = getProjectPath('nginx', 'ssl', 'live', relayDomain)
  const fullchainPath = join(sslCertDir, 'fullchain.pem')
  const privkeyPath = join(sslCertDir, 'privkey.pem')

  if (!fs.existsSync(fullchainPath) || !fs.existsSync(privkeyPath)) {
    fs.mkdirSync(sslCertDir, { recursive: true })

    const code = await runCommand('openssl', [
      'req',
      '-x509',
      '-nodes',
      '-newkey',
      'rsa:2048',
      '-days',
      '1',
      '-keyout',
      privkeyPath,
      '-out',
      fullchainPath,
      '-subj',
      `/CN=${relayDomain}`,
    ])

    if (code !== 0) {
      throw new Error('Failed to generate self-signed SSL certificate. Ensure openssl is installed and retry.')
    }
  }
}

export const runStart = async (options: StartOptions, passthrough: string[]): Promise<number> => {
  ensureNotRoot()