From 37b6193616dbbd826a53113cc82257393053268a Mon Sep 17 00:00:00 2001 From: Abraham Ingersoll <586805+aberoham@users.noreply.github.com> Date: Thu, 9 Apr 2026 01:26:31 +0100 Subject: [PATCH 1/2] wip: docker support + NICTOOL_BIND_HOST override Dockerfile and entrypoint in docker/ for container deployments. The entrypoint generates nictool.toml from env vars (remote API mode) and lets the server auto-generate self-signed TLS on first start. NICTOOL_BIND_HOST env var overrides the listen address so the server can bind 0.0.0.0 inside a container while keeping the TLS cert hostname for display. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker/Dockerfile | 10 ++++++++++ docker/entrypoint.sh | 27 +++++++++++++++++++++++++++ index.js | 2 +- 3 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 docker/Dockerfile create mode 100644 docker/entrypoint.sh diff --git a/docker/Dockerfile b/docker/Dockerfile new file mode 100644 index 0000000..07cb773 --- /dev/null +++ b/docker/Dockerfile @@ -0,0 +1,10 @@ +FROM node:22-trixie-slim +RUN apt-get update && apt-get install -y --no-install-recommends openssl && rm -rf /var/lib/apt/lists/* +WORKDIR /app +COPY package*.json . +RUN npm install --omit=dev +COPY . . +RUN chmod +x docker/entrypoint.sh \ + && ln -s node_modules/@nictool/api/conf.d conf.d +EXPOSE 8443 +ENTRYPOINT ["./docker/entrypoint.sh"] diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh new file mode 100644 index 0000000..5e74057 --- /dev/null +++ b/docker/entrypoint.sh @@ -0,0 +1,27 @@ +#!/bin/sh +set -e + +TOML="/data/etc/nictool.toml" +mkdir -p /data/etc + +if [ ! -f "$TOML" ]; then + cat > "$TOML" < { server.once('error', reject) - server.listen(port, host, resolve) + server.listen(port, process.env.NICTOOL_BIND_HOST || host, resolve) }) const url = `https://${host}${port === 443 ? '' : `:${port}`}` From f2be8084cbea5843b24ff9e696d7cdff1dc5265b Mon Sep 17 00:00:00 2001 From: Abraham Ingersoll <586805+aberoham@users.noreply.github.com> Date: Thu, 9 Apr 2026 22:39:26 +0100 Subject: [PATCH 2/2] feat: HTTP dev mode, Groups tab, fix proxy crashes NICTOOL_TLS=false gives you plain HTTP on 8080 -- no more self-signed cert dance in local dev. Left "auto" as the default for production (discovers or generates certs as before). Added a Groups tab to the web UI: list, create, edit, delete, restore, and you can click a group name to navigate into it. Follows the same patterns as the Users/Nameservers tabs. Fixed a few things that were crashing the server: - buildRemoteUrl assumed non-localhost meant https, which blew up with EPROTO when proxying to the plain-HTTP API container. Defaults to http now, configurable via scheme. - forwardToRemote was missing an await so proxy errors bypassed the try/catch entirely - added clientError/tlsClientError/connection handlers plus process-level uncaughtException/unhandledRejection for EPROTO so a stray bad request can't take down the server Dockerfile now exposes both 8080 and 8443. Co-Authored-By: Claude Opus 4.6 (1M context) --- bin/start.js | 62 ++++++++++---- docker/Dockerfile | 2 +- html/index.html | 81 ++++++++++++++++++ html/js/main.js | 205 ++++++++++++++++++++++++++++++++++++++++++++++ index.js | 22 +++-- 5 files changed, 350 insertions(+), 22 deletions(-) diff --git a/bin/start.js b/bin/start.js index 2a5d969..0768ef4 100644 --- a/bin/start.js +++ b/bin/start.js @@ -15,6 +15,28 @@ import { init as initAPI } from '@nictool/api/routes/index.js' const execFileAsync = promisify(execFile) +// --------------------------------------------------------------------------- +// Prevent stray TLS errors (e.g. plain HTTP hitting the HTTPS port) from +// crashing the process. Only EPROTO is swallowed; everything else exits. +// --------------------------------------------------------------------------- +process.on('uncaughtException', (err) => { + if (err.code === 'EPROTO') { + console.error(`[uncaughtException] TLS error (ignored): ${err.message}`) + return + } + console.error('[uncaughtException] Fatal:', err) + process.exit(1) +}) + +process.on('unhandledRejection', (reason) => { + if (reason?.code === 'EPROTO') { + console.error(`[unhandledRejection] TLS error (ignored): ${reason.message}`) + return + } + console.error('[unhandledRejection] Fatal:', reason) + process.exit(1) +}) + // --------------------------------------------------------------------------- // CLI arguments // --------------------------------------------------------------------------- @@ -55,23 +77,29 @@ try { } // --------------------------------------------------------------------------- -// TLS – discover existing certs or generate a self-signed one +// TLS – skip entirely in development mode, otherwise discover or generate // --------------------------------------------------------------------------- +const useTLS = (process.env.NICTOOL_TLS ?? 'auto') !== 'false' const osHostname = os.hostname() -const tlsDir = path.join(configDir, 'etc', 'tls') - -const discovered = await discoverTLS(tlsDir, osHostname) -let tls, host +let tls = null +let host = osHostname -if (discovered) { - const { hostname: certHost, ...pemMaterial } = discovered - tls = pemMaterial - host = certHost +if (!useTLS) { + console.log('TLS disabled (NICTOOL_TLS=false) — running plain HTTP') + host = 'localhost' } else { - console.log(`Generating self-signed cert for ${osHostname}`) - tls = await generateTLS(tlsDir, osHostname) - host = osHostname + const tlsDir = path.join(configDir, 'etc', 'tls') + const discovered = await discoverTLS(tlsDir, osHostname) + + if (discovered) { + const { hostname: certHost, ...pemMaterial } = discovered + tls = pemMaterial + host = certHost + } else { + console.log(`Generating self-signed cert for ${osHostname}`) + tls = await generateTLS(tlsDir, osHostname) + } } // --------------------------------------------------------------------------- @@ -82,10 +110,12 @@ const tomlPath = path.join(configDir, 'etc', 'nictool.toml') const nicConfig = await readNicToolToml(tomlPath) // --------------------------------------------------------------------------- -// Port selection – prefer 443, fall back to 8443 +// Port selection – HTTP prefers 8080, HTTPS prefers 443/8443 // --------------------------------------------------------------------------- -const port = (await resolvePort(host, 443)) ?? (await resolvePort(host, 8443)) ?? (await randomAvailablePort(host)) +const port = useTLS + ? ((await resolvePort(host, 443)) ?? (await resolvePort(host, 8443)) ?? (await randomAvailablePort(host))) + : ((await resolvePort(host, 8080)) ?? (await resolvePort(host, 80)) ?? (await randomAvailablePort(host))) // --------------------------------------------------------------------------- // If already configured, skip the configurator and go straight to services @@ -237,9 +267,9 @@ function storeTypeToEnv(type) { */ function buildRemoteUrl(config) { if (!config?.api || config.api.mode !== 'remote') return null - const { host, port } = config.api + const { host, port, scheme: configScheme } = config.api if (!host || !port) return null - const scheme = /^(localhost|127\.|::1)/.test(host) ? 'http' : 'https' + const scheme = configScheme ?? 'http' return `${scheme}://${host}:${port}` } diff --git a/docker/Dockerfile b/docker/Dockerfile index 07cb773..7f23ed6 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -6,5 +6,5 @@ RUN npm install --omit=dev COPY . . RUN chmod +x docker/entrypoint.sh \ && ln -s node_modules/@nictool/api/conf.d conf.d -EXPOSE 8443 +EXPOSE 8080 8443 ENTRYPOINT ["./docker/entrypoint.sh"] diff --git a/html/index.html b/html/index.html index ac7dab9..a182ef5 100644 --- a/html/index.html +++ b/html/index.html @@ -84,6 +84,18 @@ aria-selected="false" >Users +
    @@ -292,6 +304,45 @@

    Login

    + +
    +
    + +
    + + + + + + + + + +
    NameParentActions
    +
    +
    + + +
    +
    + + +
    +
    +
    @@ -673,5 +724,35 @@
    Nameserver
    + +
    +
    +
    Group
    + +
    +
    +
    + + +
    +
    + + +
    +
    + + +
    +
    +
    + diff --git a/html/js/main.js b/html/js/main.js index a79a8af..c2c7c39 100644 --- a/html/js/main.js +++ b/html/js/main.js @@ -4,6 +4,7 @@ const API_URI = "/api"; let nsDataTable; let zoneDataTable; let userDataTable; +let groupDataTable; const zoneRecordDataTables = new Map(); const zoneColumnSearchTimers = new Map(); const RR_DATA_PREVIEW_CHARS = 50; @@ -278,6 +279,7 @@ function onLoad() { initDangerousModeToggle(); initNsControls(); initUserControls(); + initGroupControls(); if (!Cookie.get("nt-token")) { console.log(`Cookie/token not found`); @@ -388,6 +390,7 @@ function switchGroup(gid, name) { } showNameservers(); showUsers(); + showGroups(); } function onLoggedIn(response) { @@ -421,6 +424,7 @@ function onLoggedIn(response) { if (zoneDataTable) zoneDataTable.ajax.reload(null, true); else showZones(); showNameservers(); showUsers(); + showGroups(); return; } @@ -455,6 +459,7 @@ function onLoggedIn(response) { showNameservers(); showZones(); showUsers(); + showGroups(); } function onLoggedOut() { @@ -928,6 +933,206 @@ function initUserControls() { } } +// --------------------------------------------------------------------------- +// Groups tab +// --------------------------------------------------------------------------- + +let allGroupsCache = []; + +async function showGroups() { + // Fetch all groups for parent name lookup + const allRes = await ajax({ method: "GET", url: `${API_URI}/group?include_subgroups=true` }); + const groupNameMap = new Map(); + for (const g of allRes.group ?? []) groupNameMap.set(g.id, g.name); + + const params = new URLSearchParams(); + if (document.getElementById("groupShowDeleted")?.checked) params.set("deleted", "true"); + if (document.getElementById("groupShowSubgroups")?.checked) params.set("include_subgroups", "true"); + if (currentGroupId) params.set("parent_gid", `${currentGroupId}`); + + ajax({ + method: "GET", + url: `${API_URI}/group${params.toString() ? "?" + params.toString() : ""}`, + }).then((response) => { + const table = document.getElementById("group_table"); + const tableHead = table.querySelector("thead"); + + while (tableHead.rows.length > 1) tableHead.deleteRow(1); + + if (groupDataTable) { + groupDataTable.destroy(); + groupDataTable = undefined; + } + + const body = table.querySelector("tbody"); + body.innerHTML = ""; + + const groups = (response.group ?? []).slice().sort((a, b) => Number(a.id) - Number(b.id)); + + for (const g of groups) { + const row = document.createElement("tr"); + row.id = `group_${g.id}_tr`; + if (g.deleted) row.classList.add("text-body-secondary"); + + const parentName = g.parent_gid === 0 ? "(root)" : (groupNameMap.get(g.parent_gid) ?? `#${g.parent_gid}`); + const actionButtons = g.deleted + ? `` + : `
    `; + row.innerHTML = ` + ${escapeHtml(g.name ?? "")} + ${escapeHtml(parentName)} + ${actionButtons} + `; + row.querySelector(".group-nav-link")?.addEventListener("click", (e) => { + e.preventDefault(); + groupHistory.push({ id: currentGroupId, name: document.getElementById("group_dropdown_label")?.textContent ?? "Group" }); + switchGroup(g.id, g.name); + }); + row.querySelector(".group-edit-btn")?.addEventListener("click", () => openGroupPane(g)); + row.querySelector(".group-delete-btn")?.addEventListener("click", () => { + if (isConfirmDeletesEnabled()) { + const confirmed = window.confirm(`Delete group "${g.name}"?`); + if (!confirmed) return; + } + ajax({ method: "DELETE", url: `${API_URI}/group/${g.id}` }).then((r) => { + if (r?.error) { console.error("Delete group failed:", r); return; } + showGroups(); + loadGroupMenu(currentGroupId, document.getElementById("group_dropdown_label")?.textContent ?? "Group"); + }); + }); + row.querySelector(".group-restore-btn")?.addEventListener("click", () => { + ajax({ method: "PUT", url: `${API_URI}/group/${g.id}`, payload: { deleted: false } }).then((r) => { + if (r?.error) { console.error("Restore group failed:", r); return; } + showGroups(); + }); + }); + body.appendChild(row); + } + + const hasSearch = groups.length > 10; + let filterRow; + if (hasSearch) { + filterRow = tableHead.rows[0].cloneNode(true); + filterRow.classList.add("group-filter-row"); + for (let i = 0; i < filterRow.cells.length; i++) { + const cell = filterRow.cells[i]; + if (i === filterRow.cells.length - 1) { cell.innerHTML = ""; continue; } + const title = tableHead.rows[0].cells[i].textContent.trim(); + cell.innerHTML = ``; + } + tableHead.appendChild(filterRow); + } + + groupDataTable = new DataTable(table, { + orderCellsTop: true, + pageLength: 25, + lengthMenu: [10, 25, 50, 100], + layout: { topStart: 'info', bottomStart: 'pageLength', topEnd: null }, + columnDefs: [ + { orderable: false, searchable: false, targets: [2] }, + ], + initComplete() { + if (!hasSearch) return; + const api = this.api(); + api.columns().every(function (index) { + const input = filterRow.cells[index].querySelector("input"); + if (!input) return; + input.addEventListener("input", () => { + if (this.search() !== input.value) this.search(input.value).draw(); + }); + }); + }, + }); + }); +} + +let activeGroupContext = null; + +async function openGroupPane(group) { + activeGroupContext = group ? { mode: "edit", group } : { mode: "create" }; + const isCreate = !group; + document.getElementById("groupEditPaneLabel").textContent = isCreate ? "Create Group" : "Edit Group"; + document.getElementById("groupEditName").value = group?.name ?? ""; + document.getElementById("groupEditSaveBtn").textContent = isCreate ? "Create" : "Save"; + + // Populate parent dropdown with all groups + const parentSelect = document.getElementById("groupEditParent"); + parentSelect.innerHTML = ''; + try { + const res = await ajax({ method: "GET", url: `${API_URI}/group?include_subgroups=true` }); + for (const g of res.group ?? []) { + if (group && g.id === group.id) continue; // can't be your own parent + const opt = document.createElement("option"); + opt.value = g.id; + opt.textContent = g.name; + parentSelect.appendChild(opt); + } + } catch (e) { /* best effort */ } + + parentSelect.value = group?.parent_gid ?? currentGroupId ?? ""; + + bootstrap.Offcanvas.getOrCreateInstance(document.getElementById("groupEditPane")).show(); +} + +function initGroupControls() { + const deletedToggle = document.getElementById("groupShowDeleted"); + if (deletedToggle && !deletedToggle.dataset.initialized) { + deletedToggle.dataset.initialized = "true"; + deletedToggle.addEventListener("change", () => showGroups()); + } + + const subgroupToggle = document.getElementById("groupShowSubgroups"); + if (subgroupToggle && !subgroupToggle.dataset.initialized) { + subgroupToggle.dataset.initialized = "true"; + subgroupToggle.addEventListener("change", () => showGroups()); + } + + const createBtn = document.getElementById("groupCreateBtn"); + if (createBtn && !createBtn.dataset.initialized) { + createBtn.dataset.initialized = "true"; + createBtn.addEventListener("click", () => openGroupPane(null)); + } + + const saveBtn = document.getElementById("groupEditSaveBtn"); + if (saveBtn && !saveBtn.dataset.initialized) { + saveBtn.dataset.initialized = "true"; + saveBtn.addEventListener("click", async () => { + const ctx = activeGroupContext; + if (!ctx) return; + + const name = document.getElementById("groupEditName").value.trim(); + if (!name) { alert("Group name is required."); return; } + + const parentVal = document.getElementById("groupEditParent").value; + const payload = { name }; + if (parentVal) payload.parent_gid = parseInt(parentVal, 10); + else if (ctx.mode === "create") payload.parent_gid = currentGroupId ?? 0; + + const method = ctx.mode === "create" ? "POST" : "PUT"; + const url = ctx.mode === "create" + ? `${API_URI}/group` + : `${API_URI}/group/${ctx.group.id}`; + + saveBtn.disabled = true; + try { + const response = await ajax({ method, url, payload }); + if (!response || response?.error) { + alert(response?.message ?? "Save failed. See console for details."); + return; + } + bootstrap.Offcanvas.getOrCreateInstance(document.getElementById("groupEditPane")).hide(); + showGroups(); + loadGroupMenu(currentGroupId, document.getElementById("group_dropdown_label")?.textContent ?? "Group"); + } catch (err) { + console.error("Group save failed:", err); + alert("Save failed due to a network error."); + } finally { + saveBtn.disabled = false; + } + }); + } +} + function showZones() { const ztbody = document.getElementById("zone_tbody"); if (!ztbody) return; diff --git a/index.js b/index.js index 22c3be3..b3ee7ae 100644 --- a/index.js +++ b/index.js @@ -52,16 +52,28 @@ export async function startServer({ // ctx is mutated as services start/stop const ctx = { configDir, tomlPath, nicConfig, apiServer, apiRemoteUrl, suggestedPorts, host, onSaved } - const server = https.createServer({ cert: tls.cert, key: tls.key }, (req, res) => - handleRequest(req, res, ctx), - ) + const useTLS = tls?.cert && tls?.key + const handler = (req, res) => handleRequest(req, res, ctx) + const server = useTLS + ? https.createServer({ cert: tls.cert, key: tls.key }, handler) + : http.createServer(handler) + + if (useTLS) { + server.on('clientError', (_err, socket) => socket.destroy()) + server.on('tlsClientError', (_err, socket) => socket.destroy()) + } + server.on('connection', (socket) => { + socket.on('error', () => socket.destroy()) + }) await new Promise((resolve, reject) => { server.once('error', reject) server.listen(port, process.env.NICTOOL_BIND_HOST || host, resolve) }) - const url = `https://${host}${port === 443 ? '' : `:${port}`}` + const scheme = useTLS ? 'https' : 'http' + const defaultPort = useTLS ? 443 : 80 + const url = `${scheme}://${host}${port === defaultPort ? '' : `:${port}`}` console.log(`Configurator: ${url}`) return server @@ -88,7 +100,7 @@ async function handleRequest(req, res, ctx) { if (url?.startsWith('/api/') || url?.startsWith('/doc')) { if (ctx.apiServer) return await forwardToAPI(req, res, ctx.apiServer) - if (ctx.apiRemoteUrl) return forwardToRemote(req, res, ctx.apiRemoteUrl) + if (ctx.apiRemoteUrl) return await forwardToRemote(req, res, ctx.apiRemoteUrl) } if (method === 'GET' && url?.startsWith('/nictool/')) return await serveStatic(req, res, path.join(__dirname, 'node_modules', '@nictool'), '/nictool/')