built-in https

.gitignore

@@ -1,3 +1,5 @@
 /target
 cert.pem
 key.pem
+bundle
+config.toml

Cargo.toml

@@ -8,9 +8,14 @@ edition = "2021"
 [dependencies]
 anyhow = "1.0.86"
 axum = "0.7.7"
+axum-server = { version = "0.7.1", features = ["tls-rustls"] }
 lazy_static = "1.4.0"
+rustls-pemfile = "2.2.0"
+serde = { version = "1.0.214", features = ["derive"] }
+serde_json = "1.0.132"
 tokio = { version = "1.37.0", features = ["full"] }
 tokio-rustls = "0.26.0"
+toml = "0.8.19"
 tower = "0.5.1"
 tower-http = { version = "0.6.1", features = ["fs"] }
 tracing = { version = "0.1.40", features = ["async-await"] }

bundle.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+cargo build --release
+
+rm -rf mumble-web2
+git clone https://git.ohea.xyz/mumble/mumble-web2
+cd mumble-web2
+echo "[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]" >server_hash.txt
+dx build --release
+cd ..
+
+rm -rf bundle
+mkdir bundle
+cp target/release/mumble-webtransport-proxy bundle
+cp -r mumble-web2/dist bundle/gui

config.toml.example

@@ -0,0 +1,11 @@
+proxy_listen_address = "127.0.0.1:4433"
+http_listen_address = "127.0.0.1:4434"
+cert_path = "./cert.pem"
+key_path = "./key.pem"
+mumble_server_url = "voip.ohea.xyz:64738"
+gui_path = "../mumble-web2/dist"
+serve_https = true
+
+[gui]
+proxy_url = "https://voip2.ohea.xyz"
+# cert_hash = [...]

src/main.rs

@@ -1,8 +1,13 @@
-use anyhow::{Context, Result};
-use std::env;
+use anyhow::{anyhow, Context, Result};
+use axum::extract::State;
+use axum::http::{Response, StatusCode};
+use axum::response::IntoResponse;
+use serde::{Deserialize, Serialize};
 use std::future::IntoFuture;
 use std::net::{SocketAddr, ToSocketAddrs};
+use std::path::PathBuf;
 use std::time::Duration;
+use tokio::fs::read_to_string;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
 use tokio::net::TcpStream;
 use tokio::pin;
@@ -83,63 +88,133 @@ impl ServerCertVerifier for NoCertificateVerification {
     }
 }
 
+#[derive(Clone, Deserialize, Serialize)]
+struct GuiConfig {
+    proxy_url: Option<String>,
+    cert_hash: Option<Vec<u8>>,
+}
+
+#[derive(Clone, Deserialize)]
 struct Config {
-    proxy_listen_address: String,
-    http_listen_address: String,
+    proxy_listen_address: SocketAddr,
+    http_listen_address: SocketAddr,
     cert_path: String,
     key_path: String,
-    mumble_server_address: SocketAddr,
-    gui_path: String,
+    #[serde(default)]
+    serve_https: bool,
+    mumble_server_url: String,
+    gui_path: PathBuf,
+    gui: GuiConfig,
 }
 
-impl Config {
-    fn get() -> Result<Config> {
-        Ok(Config {
-            proxy_listen_address: env::var("MUMBLE_WEBTRANSPORT_PROXY_LISTEN_ADDRESS")
-                .unwrap_or("127.0.0.1:4433".to_string()),
-            http_listen_address: env::var("MUMBLE_WEBTRANSPORT_HTTP_LISTEN_ADDRESS")
-                .unwrap_or("127.0.0.1:4434".to_string()),
-            cert_path: env::var("MUMBLE_WEBTRANSPORT_CERT_PATH").unwrap_or("cert.pem".to_string()),
-            key_path: env::var("MUMBLE_WEBTRANSPORT_KEY_PATH").unwrap_or("key.pem".to_string()),
-            mumble_server_address: env::var("MUMBLE_WEBTRANSPORT_MUMBLE_SERVER_ADDRESS")
-                .with_context(|| "Please set MUMBLE_WEBTRANSPORT_MUMBLE_SERVER_ADDRESS")?
-                .to_socket_addrs()?
-                .next()
-                .ok_or(anyhow::anyhow!("Invalid mumble server address"))?,
-            gui_path: env::var("MUMBLE_WEBTRANSPORT_GUI_PATH").unwrap_or("gui".to_string()),
-        })
-    }
+//async fn serve_index_html_with_config(State(config): State<Config>) -> impl IntoResponse {
+async fn serve_index_html_with_config(State(config): State<Config>) -> impl IntoResponse {
+    // Load the HTML file
+    let html = match read_to_string(config.gui_path.join("index.html")).await {
+        Ok(content) => content,
+        Err(_) => return (StatusCode::NOT_FOUND, "File not found").into_response(),
+    };
+
+    // Insert the script tag with configuration
+    let modified_html = html.replace(
+        "</head>",
+        &format!(
+            "<script>window.config = {}</script>\n</head>",
+            serde_json::to_string(&config.gui).unwrap(),
+        ),
+    );
+
+    // Create a response with the modified HTML
+    Response::builder()
+        .status(StatusCode::OK)
+        .header("Content-Type", "text/html")
+        .body(modified_html)
+        .unwrap()
+        .into_response()
 }
 
-async fn redirect() -> axum::response::Redirect {
-    axum::response::Redirect::to("/static/index.html")
+fn configure_tls(config: &Config) -> Result<rustls::ServerConfig, anyhow::Error> {
+    // Thanks perplexity!
+    use rustls_pemfile::{certs, pkcs8_private_keys};
+    use std::fs::File;
+    use std::io::BufReader;
+
+    // Create a new ServerConfig with no client authentication
+    //(rustls::server::NoClientAuth::new());
+
+    // Read the certificate file
+    let cert_file = File::open(&config.cert_path)?;
+    let mut cert_reader = BufReader::new(cert_file);
+    let cert_chain = certs(&mut cert_reader).collect::<Result<_, _>>()?;
+
+    // Read the private key file
+    let key_file = File::open(&config.key_path)?;
+    let mut key_reader = BufReader::new(key_file);
+    let key = pkcs8_private_keys(&mut key_reader)
+        .next()
+        .ok_or(anyhow!("no keys in key.pem"))??;
+
+    // Set the certificate chain and private key
+    let config = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(cert_chain, key.into())?;
+
+    Ok(config)
 }
 
 #[tokio::main]
 async fn main() -> Result<()> {
     init_logging();
 
-    let proxy_config = Config::get()?;
+    let proxy_config: Config = toml::from_str(
+        &read_to_string("./config.toml")
+            .await
+            .context("reading config.toml (try making a copy of config.toml.example)")?,
+    )?;
+
+    let mumble_server_addr = proxy_config
+        .mumble_server_url
+        .to_socket_addrs()
+        .context(format!(
+            "parsing mumble_server_url={}",
+            proxy_config.mumble_server_url
+        ))?
+        .next()
+        .ok_or(anyhow!(
+            "no socket addrs in mumble_server_url={}",
+            proxy_config.mumble_server_url
+        ))?;
 
     // Setup HTTP Server
     //let http = axum::Router::new().route("/", axum::routing::get(serve_gui));
     let app = axum::Router::new()
-        .nest_service(
-            "/gui",
-            tower_http::services::ServeDir::new(proxy_config.gui_path),
-        )
-        .route("/", axum::routing::get(redirect));
-    let listener = tokio::net::TcpListener::bind(proxy_config.http_listen_address)
-        .await
-        .unwrap();
-    tokio::spawn(axum::serve(listener, app).into_future());
+        .route("/", axum::routing::get(serve_index_html_with_config))
+        .fallback_service(tower_http::services::ServeDir::new(&proxy_config.gui_path))
+        .with_state(proxy_config.clone());
+    if proxy_config.serve_https {
+        tokio::spawn(
+            axum_server::bind_rustls(
+                proxy_config.http_listen_address,
+                axum_server::tls_rustls::RustlsConfig::from_config(Arc::new(configure_tls(
+                    &proxy_config,
+                )?)),
+            )
+            .serve(app.into_make_service())
+            .into_future(),
+        );
+    } else {
+        tokio::spawn(
+            axum_server::bind(proxy_config.http_listen_address)
+                .serve(app.into_make_service())
+                .into_future(),
+        );
+    }
 
     // Setup WebTransport proxy listener
+    let identity = Identity::load_pemfiles(proxy_config.cert_path, proxy_config.key_path).await?;
     let config = ServerConfig::builder()
-        .with_bind_address(proxy_config.proxy_listen_address.parse()?)
-        .with_identity(
-            &Identity::load_pemfiles(proxy_config.cert_path, proxy_config.key_path).await?,
-        )
+        .with_bind_address(proxy_config.proxy_listen_address)
+        .with_identity(&identity)
         .keep_alive_interval(Some(Duration::from_secs(20)))
         .build();
 
@@ -150,7 +225,7 @@ async fn main() -> Result<()> {
     for id in 0.. {
         let incoming_session = server.accept().await;
         tokio::spawn(
-            handle_connection(incoming_session, id, proxy_config.mumble_server_address)
+            handle_connection(incoming_session, id, mumble_server_addr)
                 .instrument(info_span!("Connection", id)),
         );
     }