mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-02-01 03:53:33 +00:00
cc1920749e
Your redbean can now interoperate with clients that require TLS crypto. This is accomplished using a protocol polyglot that lets us distinguish between HTTP and HTTPS regardless of the port number. Certificates will be generated automatically, if none are supplied by the user. Footprint increases by only a few hundred kb so redbean in MODY=tiny is now 1.0mb - Add lseek() polyfills for ZIP executable - Automatically polyfill /tmp/FOO paths on NT - Fix readdir() / ftw() / nftw() bugs on Windows - Introduce -B flag for slower SSL that's stronger - Remove mbedtls features Cosmopolitan doesn't need - Have base64 decoder support the uri-safe alternative - Remove Truncated HMAC because it's forbidden by the IETF - Add all the mbedtls test suites and make them go 3x faster - Support opendir() / readdir() / closedir() on ZIP executable - Use Everest for ECDHE-ECDSA because it's so good it's so good - Add tinier implementation of sha1 since it's not worth the rom - Add chi-square monte-carlo mean correlation tests for getrandom() - Source entropy on Windows from the proper interface everyone uses We're continuing to outperform NGINX and other servers on raw message throughput. Using SSL means that instead of 1,000,000 qps you can get around 300,000 qps. However redbean isn't as fast as NGINX yet at SSL handshakes, since redbean can do 2,627 per second and NGINX does 4.3k Right now, the SSL UX story works best if you give your redbean a key signing key since that can be easily generated by openssl using a one liner then redbean will do all the things that are impossibly hard to do like signing ecdsa and rsa certificates that'll work in chrome. We should integrate the let's encrypt acme protocol in the future. Live Demo: https://redbean.justine.lol/ Root Cert: https://redbean.justine.lol/redbean1.crt
205 lines
7.7 KiB
Text
205 lines
7.7 KiB
Text
SYNOPSIS
|
|
|
|
redbean.com [-hvduzmbagf] [-p PORT] [-- SCRIPTARGS...]
|
|
|
|
DESCRIPTION
|
|
|
|
redbean - single-file distributable web server
|
|
|
|
OVERVIEW
|
|
|
|
redbean makes it possible to share web applications that run offline
|
|
as a single-file Actually Portable Executable PKZIP archive which
|
|
contains your assets. All you need to do is download the redbean.com
|
|
program below, change the filename to .zip, add your content in a zip
|
|
editing tool, and then change the extension back to .com.
|
|
|
|
redbean can serve 1 million+ gzip encoded responses per second on a
|
|
cheap personal computer. That performance is thanks to zip and gzip
|
|
using the same compression format, which enables kernelspace copies.
|
|
Another reason redbean goes fast is that it's a tiny static binary,
|
|
which makes fork memory paging nearly free.
|
|
|
|
redbean is also easy to modify to suit your own needs. The program
|
|
itself is written as a single .c file. It embeds the Lua programming
|
|
language and SQLite which let you write dynamic pages.
|
|
|
|
FLAGS
|
|
|
|
-h help
|
|
-d daemonize
|
|
-u uniprocess
|
|
-z print port
|
|
-m log messages
|
|
-b log message bodies
|
|
-a log resource usage
|
|
-g log handler latency
|
|
-f log worker function calls
|
|
-B use stronger cryptography
|
|
-s increase silence [repeatable]
|
|
-v increase verbosity [repeatable]
|
|
-V increase ssl verbosity [repeatable]
|
|
-H K:V sets http header globally [repeatable]
|
|
-D DIR overlay assets in local directory [repeatable]
|
|
-r /X=/Y redirect X to Y [repeatable]
|
|
-R /X=/Y rewrites X to Y [repeatable]
|
|
-K PATH tls private key path [repeatable]
|
|
-C PATH tls certificate(s) path [repeatable]
|
|
-t MS tunes read and write timeouts [def. 60000]
|
|
-M INT tunes max message payload size [def. 65536]
|
|
-p PORT listen port [def. 8080; repeatable]
|
|
-l ADDR listen addr [def. 0.0.0.0; repeatable]
|
|
-c SEC configures static cache-control
|
|
-L PATH log file location
|
|
-P PATH pid file location
|
|
-U INT daemon set user id
|
|
-G INT daemon set group id
|
|
|
|
FEATURES
|
|
|
|
- Lua v5.4
|
|
- SQLite 3.35.5
|
|
- TLS v1.2 / v1.1 / v1.0
|
|
- HTTP v1.1 / v1.0 / v0.9
|
|
- Chromium-Zlib Compression
|
|
- Statusz Monitoring Statistics
|
|
- Self-Modifying PKZIP Object Store
|
|
- Linux + Windows + Mac + FreeBSD + OpenBSD + NetBSD
|
|
|
|
USAGE
|
|
|
|
This executable is also a ZIP file that contains static assets.
|
|
You can run redbean interactively in your terminal as follows:
|
|
|
|
./redbean.com -vvvmbag # starts server verbosely
|
|
open http://127.0.0.1:8080/ # shows zip listing page
|
|
CTRL-C # 1x: graceful shutdown
|
|
CTRL-C # 2x: forceful shutdown
|
|
|
|
You can override the default listing page by adding:
|
|
|
|
zip redbean.com index.lua # lua server pages take priority
|
|
zip redbean.com index.html # default page for directory
|
|
|
|
The listing page only applies to the root directory. However the
|
|
default index page applies to subdirectories too. In order for it
|
|
to work, there needs to be an empty directory entry in the zip.
|
|
That should already be the default practice of your zip editor.
|
|
|
|
wget \
|
|
--mirror \
|
|
--convert-links \
|
|
--adjust-extension \
|
|
--page-requisites \
|
|
--no-parent \
|
|
--no-if-modified-since \
|
|
http://a.example/index.html
|
|
zip -r redbean.com a.example/ # default page for directory
|
|
|
|
redbean normalizes the trailing slash for you automatically:
|
|
|
|
$ printf 'GET /a.example HTTP/1.0\n\n' | nc 127.0.0.1 8080
|
|
HTTP/1.0 307 Temporary Redirect
|
|
Location: /a.example/
|
|
|
|
Virtual hosting is accomplished this way too. The Host is simply
|
|
prepended to the path, and if it doesn't exist, it gets removed.
|
|
|
|
$ printf 'GET / HTTP/1.1\nHost:a.example\n\n' | nc 127.0.0.1 8080
|
|
HTTP/1.1 200 OK
|
|
Link: <http://127.0.0.1/a.example/index.html>; rel="canonical"
|
|
|
|
If you mirror a lot of websites within your redbean then you can
|
|
actually tell your browser that redbean is your proxy server, in
|
|
which redbean will act as your private version of the Internet.
|
|
|
|
$ printf 'GET http://a.example HTTP/1.0\n\n' | nc 127.0.0.1 8080
|
|
HTTP/1.0 200 OK
|
|
Link: <http://127.0.0.1/a.example/index.html>; rel="canonical"
|
|
|
|
If you use a reverse proxy, then redbean recognizes the following
|
|
provided that the proxy forwards requests over the local network:
|
|
|
|
X-Forwarded-For: 203.0.113.42:31337
|
|
X-Forwarded-Host: foo.example:80
|
|
|
|
There's a text/plain statistics page called /statusz that makes
|
|
it easy to track and monitor the health of your redbean:
|
|
|
|
printf 'GET /statusz\n\n' | nc 127.0.0.1 8080
|
|
|
|
redbean will display an error page using the /redbean.png logo
|
|
by default, embedded as a bas64 data uri. You can override the
|
|
custom page for various errors by adding files to the zip root.
|
|
|
|
zip redbean.com 404.html # custom not found page
|
|
|
|
Audio video content should not be compressed in your ZIP files.
|
|
Uncompressed assets enable browsers to send Range HTTP request.
|
|
On the other hand compressed assets are best for gzip encoding.
|
|
|
|
zip redbean.com index.html # adds file
|
|
zip -0 redbean.com video.mp4 # adds without compression
|
|
|
|
You can have redbean run as a daemon by doing the following:
|
|
|
|
sudo ./redbean.com -vvdp80 -p443 -L redbean.log -P redbean.pid
|
|
kill -TERM $(cat redbean.pid) # 1x: graceful shutdown
|
|
kill -TERM $(cat redbean.pid) # 2x: forceful shutdown
|
|
|
|
redbean currently has a 32kb limit on request messages and 64kb
|
|
including the payload. redbean will grow to whatever the system
|
|
limits allow. Should fork() or accept() fail redbean will react
|
|
by going into "meltdown mode" which closes lingering workers.
|
|
You can trigger this at any time using:
|
|
|
|
kill -USR2 $(cat redbean.pid)
|
|
|
|
Another failure condition is running out of disk space in which
|
|
case redbean reacts by truncating the log file. Lastly, redbean
|
|
does the best job possible reporting on resource usage when the
|
|
logger is in debug mode noting that NetBSD is the best at this.
|
|
|
|
Your redbean is an actually portable executable, that's able to
|
|
run on six different operating systems. To do that, it needs to
|
|
overwrite its own MZ header at startup, with ELF or Mach-O, and
|
|
then puts the original back once the program loads. If you want
|
|
your redbean to follow the platform-local executable convention
|
|
then delete the /.ape file from zip.
|
|
|
|
redbean contains software licensed ISC, MIT, BSD-2, BSD-3, zlib
|
|
which makes it a permissively licensed gift to anyone who might
|
|
find it useful. The transitive closure of legalese can be found
|
|
inside the binary. redbean also respects your privacy and won't
|
|
phone home because your computer is its home.
|
|
|
|
SECURITY
|
|
|
|
redbean uses a protocol polyglot for serving HTTP and HTTPS on
|
|
the same port numbers. For example, both of these are valid:
|
|
|
|
http://127.0.0.1:8080/
|
|
https://127.0.0.1:8080/
|
|
|
|
The easiest way to use a self-signed certificate is to provide
|
|
redbean with a key-signing key:
|
|
|
|
openssl req -x509 -newkey rsa:2048 \
|
|
-keyout .ca.key -out .ca.crt -days 6570 -nodes \
|
|
-subj '/C=US/ST=CA/O=Jane Doe/CN=My Root CA 1' \
|
|
-addext 'keyUsage = critical,cRLSign,keyCertSign'
|
|
sudo ./redbean.com -C ca.crt -K .ca.key -p 80 -p 443
|
|
|
|
SSL verbosity is controlled as follows for troubleshooting:
|
|
|
|
-V log ssl errors
|
|
-VV log ssl state changes too
|
|
-VVV log ssl informational messages too
|
|
-VVVV log ssl verbose details too
|
|
|
|
That's in addition to existing flags like -vvvm.
|
|
|
|
SEE ALSO
|
|
|
|
https://justine.lol/redbean/index.html
|
|
https://news.ycombinator.com/item?id=26271117
|