agentbox/https-bridge/https-proxy.js at main · DreamLab-AI/agentbox · GitHub

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

#!/usr/bin/env node

/**

* HTTPS to HTTP Bridge Proxy

* Bridges https://localhost:<HTTPS_PORT> -> http://<HOST_IP>:<TARGET_PORT>

* Solves cross-origin security issues for local development

* Environment Variables:

* HOST_IP - Target host IP (default: gateway IP or 192.168.0.51)

* HTTPS_PORT - Local HTTPS port to listen on (default: 3001)

* TARGET_PORT - Remote HTTP port to proxy to (default: 3001)

* CERT_DIR - Directory containing server.key and server.crt

const https = require('https');

const http = require('http');

const fs = require('fs');

const path = require('path');

const { execSync } = require('child_process');

// Try to detect gateway IP if HOST_IP not set

function detectGatewayIP() {

try {

const result = execSync("ip route | grep default | awk '{print $3}'", { encoding: 'utf8' });

return result.trim() || '192.168.0.51';

} catch {

return '192.168.0.51';

}

const HOST_IP = process.env.HOST_IP || detectGatewayIP();

// R-003: listen bind defaults to 0.0.0.0 because Docker port publishing requires

// the in-container listener to accept the bridge interface. It is exposed only on

// host-loopback via the compose `127.0.0.1:` publish mapping.

const HTTPS_HOST = process.env.HTTPS_BRIDGE_HOST || '0.0.0.0';

const HTTPS_PORT = parseInt(process.env.HTTPS_PORT || '3001', 10);

const TARGET_PORT = parseInt(process.env.TARGET_PORT || '3001', 10);

const CERT_DIR = process.env.CERT_DIR || __dirname;

const keyPath = path.join(CERT_DIR, 'server.key');

const certPath = path.join(CERT_DIR, 'server.crt');

// Generate self-signed certificate via Node's built-in crypto.

// Previously this shelled out to `openssl req -x509 ...`, but devuser's

// PATH inside the agentbox container does not include openssl by default

// (it's only available at the absolute Nix store path the bootstrap uses

// for pre-generation). Node 19+ has all the primitives we need natively,

// so we drop the external dependency entirely.

function ensureCertificates() {

if (fs.existsSync(keyPath) && fs.existsSync(certPath)) return;

console.log('Generating self-signed certificate via node:crypto...');

try {

const crypto = require('crypto');

// RSA-2048 keypair, PEM encoded.

const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {

modulusLength: 2048,

publicKeyEncoding: { type: 'spki', format: 'pem' },

privateKeyEncoding: { type: 'pkcs8', format: 'pem' },

});

// Build a minimal X.509v1 self-signed cert. CN=localhost; valid 365d.

// We use the DER-encoded subject + signature ourselves rather than

// pulling in `selfsigned` or `node-forge` so the dependency surface

// stays at zero. Node has no high-level cert builder, so this is the

// smallest correct implementation.

const cert = buildSelfSignedX509(privateKey, publicKey, 'localhost', 365);

fs.writeFileSync(keyPath, privateKey, { mode: 0o600 });

fs.writeFileSync(certPath, cert, { mode: 0o644 });

console.log('Certificate generated successfully');

} catch (err) {

console.error('Failed to generate certificate:', err.message);

process.exit(1);

}

// Minimal X.509v1 self-signed cert builder. Returns a PEM string.

function buildSelfSignedX509(privateKeyPem, publicKeyPem, commonName, validDays) {

const crypto = require('crypto');

// Helpers for ASN.1 DER encoding.

const der = (() => {

function len(n) {

if (n < 0x80) return Buffer.from([n]);

const b = []; let v = n;

while (v) { b.unshift(v & 0xff); v >>= 8; }

return Buffer.concat([Buffer.from([0x80 | b.length]), Buffer.from(b)]);

}

function tlv(tag, value) {

return Buffer.concat([Buffer.from([tag]), len(value.length), value]);

}

return {

seq: (parts) => tlv(0x30, Buffer.concat(parts)),

set: (parts) => tlv(0x31, Buffer.concat(parts)),

int: (n) => {

// Positive integer; pad if high bit is set.

const bytes = [];

do { bytes.unshift(n & 0xff); n >>= 8; } while (n);

if (bytes[0] & 0x80) bytes.unshift(0x00);

return tlv(0x02, Buffer.from(bytes));

bigInt: (buf) => {

if (buf[0] & 0x80) return tlv(0x02, Buffer.concat([Buffer.from([0]), buf]));

return tlv(0x02, buf);

oid: (parts) => {

const out = [parts[0] * 40 + parts[1]];

for (let i = 2; i < parts.length; i++) {

const p = parts[i]; const stack = [];

let v = p; do { stack.unshift(v & 0x7f); v >>= 7; } while (v);

for (let j = 0; j < stack.length - 1; j++) stack[j] |= 0x80;

out.push(...stack);

}

return tlv(0x06, Buffer.from(out));

utf8: (s) => tlv(0x0c, Buffer.from(s, 'utf8')),

utc: (d) => {

// YYMMDDHHMMSSZ

const yy = String(d.getUTCFullYear() % 100).padStart(2, '0');

const mm = String(d.getUTCMonth() + 1).padStart(2, '0');

const dd = String(d.getUTCDate()).padStart(2, '0');

const hh = String(d.getUTCHours()).padStart(2, '0');

const mi = String(d.getUTCMinutes()).padStart(2, '0');

const ss = String(d.getUTCSeconds()).padStart(2, '0');

return tlv(0x17, Buffer.from(yy + mm + dd + hh + mi + ss + 'Z'));

null: () => Buffer.from([0x05, 0x00]),

bitstring: (buf) => tlv(0x03, Buffer.concat([Buffer.from([0]), buf])),

};

})();

// OIDs we need.

const OID_RSA = der.oid([1, 2, 840, 113549, 1, 1, 1]);

const OID_SHA256_RSA = der.oid([1, 2, 840, 113549, 1, 1, 11]);

const OID_CN = der.oid([2, 5, 4, 3]);

// Extract SPKI bytes from PEM-encoded public key.

const publicKeyDer = pemToDer(publicKeyPem);

const subject = der.seq([

der.set([

der.seq([OID_CN, der.utf8(commonName)]),

]),

]);

const now = new Date();

const notAfter = new Date(now.getTime() + validDays * 86400 * 1000);

const tbs = der.seq([

der.int(1), // serialNumber

der.seq([OID_SHA256_RSA, der.null()]), // signature alg

subject, // issuer (= subject; self-signed)

der.seq([der.utc(now), der.utc(notAfter)]), // validity

subject, // subject

publicKeyDer, // SPKI

]);

const sig = crypto.createSign('sha256').update(tbs).sign(privateKeyPem);

const cert = der.seq([

tbs,

der.seq([OID_SHA256_RSA, der.null()]), // signature alg

der.bitstring(sig), // signature

]);

return derToPem(cert, 'CERTIFICATE');

}

function pemToDer(pem) {

const m = pem.match(/-----BEGIN [^-]+-----([\s\S]+?)-----END [^-]+-----/);

if (!m) throw new Error('pemToDer: not a PEM block');

return Buffer.from(m[1].replace(/\s+/g, ''), 'base64');

}

function derToPem(der, label) {

const b64 = der.toString('base64');

const lines = [];

for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));

return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;

}

ensureCertificates();

const options = {

key: fs.readFileSync(keyPath),

cert: fs.readFileSync(certPath)

};

const server = https.createServer(options, (req, res) => {

const startTime = Date.now();

const proxyOptions = {

hostname: HOST_IP,

port: TARGET_PORT,

path: req.url,

method: req.method,

headers: {

...req.headers,

host: `${HOST_IP}:${TARGET_PORT}`,

'x-forwarded-proto': 'https',

'x-forwarded-host': `localhost:${HTTPS_PORT}`

}

};

const proxyReq = http.request(proxyOptions, (proxyRes) => {

// Add CORS headers for browser compatibility

res.setHeader('Access-Control-Allow-Origin', '*');

res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');

res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With');

res.setHeader('Access-Control-Allow-Credentials', 'true');

// Copy response headers (except CORS-related which we override)

Object.keys(proxyRes.headers).forEach(key => {

if (!key.toLowerCase().startsWith('access-control-')) {

res.setHeader(key, proxyRes.headers[key]);

}

});

res.writeHead(proxyRes.statusCode);

proxyRes.pipe(res);

proxyRes.on('end', () => {

const duration = Date.now() - startTime;

console.log(`${req.method} ${req.url} -> ${proxyRes.statusCode} (${duration}ms)`);

});

proxyReq.on('error', (err) => {

console.error(`Proxy error for ${req.url}: ${err.message}`);

res.writeHead(502, { 'Content-Type': 'application/json' });

res.end(JSON.stringify({

error: 'Bad Gateway',

message: err.message,

target: `http://${HOST_IP}:${TARGET_PORT}`

}));

});

// Handle preflight OPTIONS requests

if (req.method === 'OPTIONS') {

res.writeHead(204, {

'Access-Control-Allow-Origin': '*',

'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',

'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',

'Access-Control-Max-Age': '86400'

});

res.end();

return;

}

req.pipe(proxyReq);

});

server.on('error', (err) => {

if (err.code === 'EADDRINUSE') {

console.error(`Port ${HTTPS_PORT} is already in use`);

process.exit(1);

}

console.error('Server error:', err);

});

server.listen(HTTPS_PORT, HTTPS_HOST, () => {

console.log('='.repeat(60));

console.log('HTTPS Bridge Proxy Started');

console.log('='.repeat(60));

console.log(` Local: https://localhost:${HTTPS_PORT}`);

console.log(` Target: http://${HOST_IP}:${TARGET_PORT}`);

console.log('='.repeat(60));

});

// Graceful shutdown

process.on('SIGTERM', () => {

console.log('Shutting down HTTPS bridge...');

server.close(() => process.exit(0));

});

process.on('SIGINT', () => {

console.log('\nShutting down HTTPS bridge...');

server.close(() => process.exit(0));

});

agentbox/https-bridge/https-proxy.js at main · DreamLab-AI/agentbox · GitHub

Repository navigation

Expand file tree

Breadcrumbs

https-proxy.js

Latest commit

History

Breadcrumbs

https-proxy.js

File metadata and controls