From 2665e7d466a13bd5f3046e97dd195d8b9c8ec711 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Fri, 3 Jul 2026 01:29:43 -0400 Subject: [PATCH] Fix cert deletion key and harden nginx SSL/redis handling - host.remove() now deletes the cert under the host key instead of the Domain relation object, so certs are actually removed from redis - targetinfo.lua returns the redis connection to the pool via set_keepalive instead of leaking one connection per request - autossl.conf drops TLSv1/1.1 and 3DES, adds TLSv1.3 Co-Authored-By: Claude Opus 4.8 --- nodejs/models/host.js | 8 ++++++-- ops/nginx_conf/autossl.conf | 4 ++-- ops/nginx_conf/targetinfo.lua | 8 ++++++++ 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/nodejs/models/host.js b/nodejs/models/host.js index 0b98457..ed1fc1e 100755 --- a/nodejs/models/host.js +++ b/nodejs/models/host.js @@ -22,14 +22,18 @@ class Host extends Table{ 'created_on': {default: function(){return (new Date).getTime()}}, 'updated_by': {default:"__NONE__", isRequired: false, type: 'string',}, 'updated_on': {default: function(){return (new Date).getTime()}, always: true}, + 'host': {isRequired: true, type: 'string', min: 3, max: 500}, 'ip': {isRequired: true, type: 'string', min: 3, max: 500}, 'targetPort': {isRequired: true, type: 'number', min:0, max:65535}, 'forcessl': {isRequired: false, default: true, type: 'boolean'}, 'targetssl': {isRequired: false, default: false, type: 'boolean'}, + 'is_cache': {default: false, isRequired: false, type: 'boolean',}, + 'is_wildcard': {default: false, isRequired: false, type: 'boolean',}, 'wildcard_status': {isRequired: false, type: 'string', min: 3, max: 500}, + 'wildcard_matchAny': {default: false, isRequired: false, type: 'boolean',}, 'wildcard_parent': {isRequired: false, type: 'string', min: 3, max: 500}, 'wildcard_expires': {isRequired: false, type: 'number'}, 'domain': {model: 'Domain', rel: 'one'}, @@ -85,9 +89,9 @@ class Host extends Table{ try{ // Validate requested host is valid host and domain if(data.challengeType === 'DNS-01-wildcard'){ + await this.validateWildcardCreate(data, args); data.is_wildcard = true; data.wildcard_status = "Starting" - await this.validateWildcardCreate(data, args); } // Validate requested host has a valid wildcard parent @@ -272,7 +276,7 @@ class Host extends Table{ let out = await super.remove(...args); await Host.buildLookUpObj(); await this.bustCache(this.host); - await deleteCert(this.domain); + await deleteCert(this.host); return out; } catch(error){ diff --git a/ops/nginx_conf/autossl.conf b/ops/nginx_conf/autossl.conf index a7ae8b7..2598c80 100644 --- a/ops/nginx_conf/autossl.conf +++ b/ops/nginx_conf/autossl.conf @@ -1,9 +1,9 @@ listen 443 ssl http2; listen 4443 ssl; -ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; -ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; +ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!3DES:!MD5; ssl_certificate_by_lua_block { auto_ssl:ssl_certificate() diff --git a/ops/nginx_conf/targetinfo.lua b/ops/nginx_conf/targetinfo.lua index f71dc1f..67c2702 100644 --- a/ops/nginx_conf/targetinfo.lua +++ b/ops/nginx_conf/targetinfo.lua @@ -37,6 +37,14 @@ function M.get(ngx, domain, targetInfo) local res, err = red:hgetall("proxy_Host_"..domain) res = red:array_to_hash(res) + -- Return the connection to the pool instead of closing it, so it can be + -- reused by later requests. Without this a new connection is opened per + -- request and never released, exhausting sockets under load. + local ok, err = red:set_keepalive(10000, 100) + if not ok then + ngx.log(ngx.ERR, "failed to set redis keepalive: ", err) + end + if not res["ip"] then if connect("/var/run/proxy_lookup.socket") then local socket = require("socket.unix")()