Answer domain redirects from the edge, with or without Traefik

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -13,6 +13,12 @@ BLACKTIP_TOKEN=
 # Serve http/https with Traefik (path to a Traefik v3 binary), and optionally
 # use DNS challenge for wildcard certificates. The provider's credentials go here
 # too, named exactly as Traefik documents for that provider.
-#BLACKTIP_TRAEFIK=/usr/local/bin/traefik
+# Releases bundle a tested Traefik: /usr/local/lib/blacktip/traefik (systemd install),
+# /traefik (Docker image, already set; set it empty to use the built-in proxy).
+#BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 #BLACKTIP_ACME_DNS=cloudflare
 #CF_DNS_API_TOKEN=
+
+# Check for new releases every few hours and update and restart by itself (Linux and macOS).
+# setup.sh turns this on; remove it to update by hand.
+#BLACKTIP_AUTO_UPDATE=1

.gitea/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       # Catches platform-specific breakage before a release is tagged.
       - name: Every release platform compiles
         run: |
-          for t in linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64; do
+          for t in linux/amd64 windows/amd64; do
             echo "building for $t"
             GOOS=${t%/*} GOARCH=${t#*/} GOARM=7 CGO_ENABLED=0 go build -o /dev/null ./cmd/blacktip
           done

.gitea/workflows/release.yml

@@ -59,4 +59,4 @@ jobs:
             *-*) ;;                       # pre-releases (v1.0.0-rc1) don't move :latest
             *) tags="$tags -t $image:latest" ;;
           esac
-          docker buildx build --platform linux/amd64,linux/arm64 $tags --push .
+          docker buildx build --platform linux/amd64 $tags --push .

Dockerfile

@@ -18,7 +18,9 @@ LABEL org.opencontainers.image.title="Blacktip" \
 COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=prep /data /data
 COPY dist/bin/linux_${TARGETARCH}/blacktip /blacktip
-ENV BLACKTIP_DATA=/data
+COPY dist/bin/linux_${TARGETARCH}/traefik /traefik
+# Traefik serves http/https; set BLACKTIP_TRAEFIK= (empty) in .env to use the built-in proxy instead
+ENV BLACKTIP_DATA=/data BLACKTIP_TRAEFIK=/traefik
 VOLUME ["/data"]
 EXPOSE 51820/udp
 ENTRYPOINT ["/blacktip"]

README.md

@@ -21,7 +21,7 @@ Open the WireGuard UDP port (default 51820) and any ports you open from the dash
 | `-tunnel` | `BLACKTIP_TUNNEL` | UDP listen address for WireGuard (default `:51820`) |
 | `-data` | `BLACKTIP_DATA` | folder for the WireGuard key and certificates |
 | `-docker` | `BLACKTIP_DOCKER=1` | report local Docker containers so they can be picked as targets |
-| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik |
+| `-traefik` | `BLACKTIP_TRAEFIK` | path to a Traefik v3 binary, to serve http/https with Traefik. Release archives and the Docker image include a tested one |
 | `-acme-dns` | `BLACKTIP_ACME_DNS` | with Traefik: DNS-challenge provider for wildcard certificates |
 | `-no-acme` | | with Traefik: serve its self-signed certificate instead of Let's Encrypt |
 | `-env` | | `.env` file to read (default `./.env`) |
@@ -38,7 +38,7 @@ Settings and secrets can live in a `.env` file instead of the command line; see
 
 ## Deploying
 
-Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Blacktip for Linux (amd64, arm64, armv7), Windows (amd64) and macOS (amd64, arm64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a multi-architecture container image to this server's registry (`git.veillax.com/veillax/blacktip`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
+Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Blacktip for Linux (amd64) and Windows (amd64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a container image (linux/amd64) to this server's registry (`git.veillax.com/veillax/blacktip`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
 
 **On a Linux server (systemd)**
 
@@ -52,7 +52,11 @@ sudoedit /etc/blacktip/blacktip.env   # your settings and secrets
 sudo systemctl start blacktip
 ```
 
-Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running.
+Releases are published for x86-64 only; for ARM machines build it yourself (`TARGETS=linux/arm64 sh deploy/build.sh`). To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/blacktip` and `/var/lib/blacktip` alone. `blacktip -version` tells you which build is running.
+
+**Updates**
+
+Set `BLACKTIP_AUTO_UPDATE=1` (or pass `-auto-update`) and Blacktip checks this server for a newer release every few hours, verifies it against `SHA256SUMS`, checks that the new binary runs, swaps it in and restarts itself. It only follows full releases (never pre-releases), never downgrades, and keeps the old binary if anything looks wrong. `setup.sh` turns it on. It is not available on Windows, and it is for the systemd and plain-binary installs: with Docker, pull a new image instead.
 
 **With Docker**
 

blacktip.go

@@ -38,6 +38,13 @@ type Config struct {
 	DataDir    string
 	Docker     bool // report local Docker containers for discovery
 
+	// Version is the release this binary was built from, reported to Hammerhead. AutoUpdate says
+	// whether the program may update itself; only then does it act on an update request from
+	// Hammerhead, by calling UpdateNow (which normally restarts the process into the new binary).
+	Version    string
+	AutoUpdate bool
+	UpdateNow  func(ctx context.Context, progress func(stage string, pct int, line string)) (newVersion string, err error)
+
 	// Traefik, when its Path is set, serves http/https resources instead of the built-in proxy.
 	Traefik TraefikConfig
 
@@ -106,6 +113,14 @@ type Blacktip struct {
 
 	logq       chan model.LogEntry
 	reportMu   sync.Mutex
+	updating   atomic.Bool
+	addrSig    string // machine addresses a wildcard website was spread across, "" when none was
+	updateMsg  string // outcome of the update Hammerhead asked for, reported back
+	updateID   string // the request that updateMsg answers
+	updStage   string // progress of the running update, reported to Hammerhead
+	updPct     int
+	updLog     []string
+	updSent    time.Time
 	dockerMu   sync.Mutex
 	dockerAt   time.Time
 	dockerList []model.Container
@@ -233,6 +248,50 @@ func (b *Blacktip) fetchConfig(ctx context.Context) (*model.EdgeConfig, error) {
 	return &cfg, json.NewDecoder(resp.Body).Decode(&cfg)
 }
 
+// hostIPv4 lists every IPv4 address on this machine, loopback included: what a wildcard bind covers.
+func hostIPv4() []string {
+	var ips []string
+	addrs, _ := net.InterfaceAddrs()
+	for _, a := range addrs {
+		if ipn, ok := a.(*net.IPNet); ok && ipn.IP.To4() != nil {
+			ips = append(ips, ipn.IP.String())
+		}
+	}
+	sort.Strings(ips)
+	return ips
+}
+
+// bindIPs says which addresses a mapping listens on. Normally that is its own BindIP. A website on
+// 0.0.0.0 steps aside for websites of the same kind that name an address on the same port: it then
+// listens on the machine's other addresses only, so a wildcard never takes a port from a specific IP.
+func bindIPs(m model.Mapping, all []model.Mapping) []string {
+	if !model.Web(m.Proto) {
+		return []string{m.BindIP}
+	}
+	if ip := net.ParseIP(m.BindIP); ip == nil || !ip.IsUnspecified() {
+		return []string{m.BindIP}
+	}
+	named := map[string]bool{}
+	for _, o := range all {
+		if o.ID == m.ID || o.Proto != m.Proto || o.Port != m.Port {
+			continue
+		}
+		if ip := net.ParseIP(o.BindIP); ip != nil && !ip.IsUnspecified() {
+			named[ip.String()] = true
+		}
+	}
+	if len(named) == 0 {
+		return []string{m.BindIP}
+	}
+	var out []string
+	for _, ip := range hostIPv4() {
+		if !named[ip] {
+			out = append(out, ip)
+		}
+	}
+	return out
+}
+
 func listenKey(m model.Mapping) string {
 	n := "tcp"
 	if m.Proto == model.ProtoUDP {
@@ -252,6 +311,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 	if b.dashboard == "" {
 		b.dashboard = b.cfg.Hammerhead
 	}
+	if cfg.UpdateID != "" {
+		b.requestUpdate(cfg.UpdateID)
+	}
 	b.local = map[string]bool{}
 	for _, id := range cfg.Local {
 		b.local[id] = true
@@ -294,9 +356,10 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			continue
 		}
 		// a range opens one listener per port; each shifts the target port by its offset
+		for _, ip := range bindIPs(m, cfg.Mappings) {
 			for p := m.Port; p <= m.LastPort(); p++ {
 				mm := m
-			mm.Port = p
+				mm.BindIP, mm.Port = ip, p
 				k := listenKey(mm)
 				if want[k] == nil {
 					want[k] = &bindSet{off: p - m.Port}
@@ -304,16 +367,19 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 				want[k].ms = append(want[k].ms, b.maps[m.ID])
 			}
 		}
+	}
 	// https ports can also answer on :80 with a redirect, unless something else owns that port
 	redirects := map[string][]*mapState{}
 	for _, m := range cfg.Mappings {
 		if b.tr == nil && m.Proto == model.ProtoHTTPS && m.RedirectHTTP {
-			k := "tcp|" + net.JoinHostPort(m.BindIP, "80")
+			for _, ip := range bindIPs(m, cfg.Mappings) {
+				k := "tcp|" + net.JoinHostPort(ip, "80")
 				if _, taken := want[k]; !taken {
 					redirects[k] = append(redirects[k], b.maps[m.ID])
 				}
 			}
 		}
+	}
 
 	for k, l := range b.listeners {
 		_, w := want[k]
@@ -323,6 +389,13 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			delete(b.listeners, k)
 		}
 	}
+	b.addrSig = ""
+	for _, m := range cfg.Mappings {
+		if ips := bindIPs(m, cfg.Mappings); len(ips) != 1 || ips[0] != m.BindIP {
+			b.addrSig = strings.Join(hostIPv4(), ",")
+			break
+		}
+	}
 	b.status = map[string]string{}
 	bring := func(k string, ms []*mapState, off int, redirect bool) {
 		if l, ok := b.listeners[k]; ok {
@@ -332,7 +405,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 			l.close()
 			delete(b.listeners, k)
 		}
-		l, err := b.open(ms, off, redirect)
+		_, addr, _ := strings.Cut(k, "|")
+		host, _, _ := net.SplitHostPort(addr)
+		l, err := b.open(host, ms, off, redirect)
 		if err != nil {
 			log.Printf("open %s: %v", k, err)
 			if !redirect {
@@ -359,7 +434,11 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) {
 		bring(k, ms, 0, true)
 	}
 	if b.tr != nil {
-		b.tr.sync(b.ctx, webMaps, cfg.AcmeEmail, cfg.AcmeStages)
+		binds := map[string][]string{}
+		for _, ms := range webMaps {
+			binds[ms.m.ID] = bindIPs(ms.m, cfg.Mappings)
+		}
+		b.tr.sync(b.ctx, webMaps, binds, cfg.AcmeEmail, cfg.AcmeStages)
 		if e := b.tr.err(); e != "" {
 			for _, ms := range webMaps {
 				b.status[ms.m.ID] = e
@@ -426,14 +505,14 @@ func (b *Blacktip) newMapState(m model.Mapping, sig string) *mapState {
 	for i := range ms.health {
 		ms.health[i] = model.TargetHealth{Healthy: true, Detail: "not checked yet"}
 	}
-	if model.Web(m.Proto) {
+	if model.Web(m.Proto) && !m.IsRedirect() { // a redirect has nothing behind it to relay to or check
 		if b.tr != nil {
 			ms.startRelay()
 		} else {
 			ms.initProxy()
 		}
 	}
-	if m.Proto != model.ProtoUDP && m.HealthSeconds != -1 {
+	if m.Proto != model.ProtoUDP && m.HealthSeconds != -1 && !m.IsRedirect() {
 		go b.healthLoop(ctx, ms)
 	}
 	return ms
@@ -517,8 +596,11 @@ func (b *Blacktip) report() {
 		IPs: localIPs(), PublicKey: b.wgPub,
 		Status: map[string]model.MappingStatus{}, Stats: map[string]model.Stat{},
 		Containers: b.containers(), MailChecks: map[string]model.MailCheck{},
+		Version: b.cfg.Version, AutoUpdate: b.cfg.AutoUpdate,
 	}
 	b.mu.Lock()
+	rep.UpdateMsg, rep.UpdateID = b.updateMsg, b.updateID
+	rep.UpdateStage, rep.UpdatePct, rep.UpdateLog = b.updStage, b.updPct, append([]string(nil), b.updLog...)
 	for id, chk := range b.mailChecks {
 		rep.MailChecks[id] = chk
 	}
@@ -565,10 +647,25 @@ func (b *Blacktip) reportLoop(ctx context.Context) {
 			return
 		case <-t.C:
 			b.report()
+			b.recheckAddresses()
 		}
 	}
 }
 
+// recheckAddresses re-applies the config when this machine gains or loses an address that a wildcard
+// website is spread across, so the listeners follow the machine.
+func (b *Blacktip) recheckAddresses() {
+	b.mu.Lock()
+	last, sig := b.last, b.addrSig
+	b.mu.Unlock()
+	if last == nil || sig == "" {
+		return
+	}
+	if strings.Join(hostIPv4(), ",") != sig {
+		b.apply(last)
+	}
+}
+
 // ---------- access logs ----------
 
 func (b *Blacktip) logAccess(e model.LogEntry) {
@@ -736,3 +833,73 @@ func (ms *mapState) dialOff(proto string, prefer, off int) (net.Conn, bool, erro
 	}
 	return nil, false, last
 }
+
+// requestUpdate acts on "update now" from Hammerhead (id identifies the request). It only ever installs
+// what this machine's own auto-update would (the newest release from its configured server), and only
+// when auto-update is on. Caller holds b.mu.
+func (b *Blacktip) requestUpdate(id string) {
+	if id == b.updateID {
+		return // already handled, or in progress
+	}
+	b.updateID, b.updateMsg = id, ""
+	b.updStage, b.updPct, b.updLog = "starting", 0, nil
+	b.updNote("Update requested from the dashboard")
+	if !b.cfg.AutoUpdate || b.cfg.UpdateNow == nil {
+		b.updateMsg = "auto-update is off on this machine (set BLACKTIP_AUTO_UPDATE=1 and restart it)"
+		b.updStage = "failed"
+		b.updNote("Refused: " + b.updateMsg)
+		go b.report()
+		return
+	}
+	if !b.updating.CompareAndSwap(false, true) {
+		b.updateMsg = "another update is already running"
+		b.updStage = "failed"
+		b.updNote("Refused: " + b.updateMsg)
+		go b.report()
+		return
+	}
+	go func() {
+		defer b.updating.Store(false)
+		tag, err := b.cfg.UpdateNow(b.ctx, b.updProgress) // on success this restarts the process and does not return
+		b.mu.Lock()
+		switch {
+		case err != nil:
+			b.updateMsg = "update failed: " + err.Error()
+		case tag == "":
+			b.updateMsg = "already on the newest release"
+		default:
+			b.updateMsg = "updated to " + tag + ", restarting"
+		}
+		b.mu.Unlock()
+		b.report()
+	}()
+}
+
+// updNote adds a timestamped line to the update log. Caller holds b.mu.
+func (b *Blacktip) updNote(line string) {
+	b.updLog = append(b.updLog, time.Now().Format("15:04:05")+" "+line)
+	if len(b.updLog) > 200 {
+		b.updLog = b.updLog[len(b.updLog)-200:]
+	}
+}
+
+// updProgress is called by the updater as it works; Hammerhead gets a fresh report at most once a
+// second (and straight away for every new log line), so its progress bar follows along.
+func (b *Blacktip) updProgress(stage string, pct int, line string) {
+	b.mu.Lock()
+	b.updStage = stage
+	if pct >= 0 {
+		b.updPct = pct
+	}
+	if line != "" {
+		b.updNote(line)
+	}
+	send := line != "" || time.Since(b.updSent) > time.Second
+	if send {
+		b.updSent = time.Now()
+	}
+	b.mu.Unlock()
+	if send {
+		go b.report()
+	}
+}

cmd/blacktip/main.go

@@ -11,6 +11,7 @@ import (
 
 	"git.veillax.com/Veillax/blacktip"
 	"git.veillax.com/Veillax/reef/dotenv"
+	"git.veillax.com/Veillax/reef/selfupdate"
 )
 
 // version is set at build time (deploy/build.sh).
@@ -38,6 +39,7 @@ func main() {
 	acmeDNS := flag.String("acme-dns", os.Getenv("BLACKTIP_ACME_DNS"), "with -traefik: DNS-challenge provider (e.g. cloudflare) for wildcard certificates; its credentials go in this process's environment")
 	noACME := flag.Bool("no-acme", false, "with -traefik: serve Traefik's self-signed certificate instead of requesting Let's Encrypt ones")
 	flag.String("env", ".env", "file to read secrets and settings from")
+	autoUpdate := flag.Bool("auto-update", os.Getenv("BLACKTIP_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	flag.Parse()
 	if *showVersion {
@@ -48,9 +50,16 @@ func main() {
 		flag.Usage()
 		os.Exit(2)
 	}
+	upd := selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/blacktip", App: "blacktip", Current: version, Logf: log.Printf}
 	b, err := blacktip.New(blacktip.Config{
 		Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, TunnelAddr: *tun, DataDir: *data, Docker: *dockerOn,
 		Traefik: blacktip.TraefikConfig{Path: *traefikPath, ACMEDNS: *acmeDNS, NoACME: *noACME},
+		Version: version, AutoUpdate: *autoUpdate,
+		UpdateNow: func(ctx context.Context, progress func(string, int, string)) (string, error) {
+			c := upd
+			c.Progress = func(e selfupdate.Event) { progress(e.Stage, e.Pct, e.Line) }
+			return selfupdate.CheckOnce(ctx, c)
+		},
 	})
 	if err != nil {
 		log.Fatal(err)
@@ -58,6 +67,9 @@ func main() {
 	log.Printf("blacktip %s starting", version)
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
 	defer stop()
+	if *autoUpdate {
+		go selfupdate.Run(ctx, upd)
+	}
 	if err := b.Run(ctx); err != nil {
 		log.Fatal(err)
 	}

deploy/blacktip.service

@@ -7,8 +7,10 @@ Wants=network-online.target
 [Service]
 User=blacktip
 Group=blacktip
+# The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
+Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
-ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
+ExecStart=/usr/local/lib/blacktip/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip
 Restart=on-failure
 RestartSec=3
@@ -20,7 +22,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/blacktip
+ReadWritePaths=/var/lib/blacktip /usr/local/lib/blacktip
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true

deploy/build.sh

@@ -4,16 +4,17 @@
 #   deploy/build.sh [version]      version defaults to `git describe`
 #
 # Output:
-#   dist/bin/<os>_<arch>/blacktip             the raw binaries (the Docker image uses the linux ones)
+#   dist/bin/<os>_<arch>/blacktip and traefik             the raw binaries (the Docker image uses the linux ones)
 #   dist/blacktip_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
-# Set TARGETS="linux/amd64 linux/arm64" to build fewer platforms.
+# Releases are published for linux/amd64 and windows/amd64 only. Set TARGETS="linux/arm64 darwin/arm64"
+# (any GOOS/GOARCH pair Go supports) to build something else by hand.
 set -eu
 NAME=blacktip
 cd "$(dirname "$0")/.."
 VERSION=${1:-$(git describe --tags --always 2>/dev/null || echo dev)}
-TARGETS=${TARGETS:-"linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64"}
+TARGETS=${TARGETS:-"linux/amd64 windows/amd64"}
 
 rm -rf dist
 mkdir -p dist/bin dist/stage
@@ -28,10 +29,13 @@ for t in $TARGETS; do
 	CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=7 \
 		go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o "$out/$NAME$ext" "./cmd/$NAME"
 
+	# the Traefik that Blacktip drives for http/https (see BLACKTIP_TRAEFIK)
+	sh deploy/fetch-traefik.sh "$os" "$arch" "$out"
+
 	pkg="${NAME}_${VERSION}_${os}_${arch}"
 	stage="dist/stage/$pkg"
 	mkdir -p "$stage"
-	cp "$out/$NAME$ext" "$stage/"
+	cp "$out/$NAME$ext" "$out/traefik$ext" "$stage/"
 	for f in LICENSE README.md .env.example; do
 		[ -f "$f" ] && cp "$f" "$stage/"
 	done

deploy/docker-compose.yml

@@ -15,8 +15,6 @@ services:
       - blacktip-data:/data
       # To list this machine's Docker containers as targets (BLACKTIP_DOCKER=1):
       # - /var/run/docker.sock:/var/run/docker.sock:ro
-      # To serve websites with Traefik (BLACKTIP_TRAEFIK=/traefik): mount a Traefik v3 binary
-      # - /usr/local/bin/traefik:/traefik:ro
 
 volumes:
   blacktip-data:

deploy/fetch-traefik.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Downloads the official Traefik release for one platform and checks its checksum.
+#
+#   deploy/fetch-traefik.sh <os> <arch> <destination-dir>
+#
+# Blacktip ships this exact Traefik version, which is the one it was tested with.
+# Set TRAEFIK_VERSION to try another.
+set -eu
+OS=${1:?os} ARCH=${2:?arch} DEST=${3:?destination}
+VERSION=${TRAEFIK_VERSION:-3.7.16}
+case "$ARCH" in arm) ARCH=armv7 ;; esac
+EXT=tar.gz
+[ "$OS" = windows ] && EXT=zip
+BASE="https://github.com/traefik/traefik/releases/download/v$VERSION"
+FILE="traefik_v${VERSION}_${OS}_${ARCH}.$EXT"
+CACHE=${TRAEFIK_CACHE:-${TMPDIR:-/tmp}/traefik-cache}
+mkdir -p "$CACHE" "$DEST"
+[ -f "$CACHE/$FILE" ] || curl -fsSL -o "$CACHE/$FILE" "$BASE/$FILE"
+[ -f "$CACHE/checksums-$VERSION.txt" ] || curl -fsSL -o "$CACHE/checksums-$VERSION.txt" "$BASE/traefik_v${VERSION}_checksums.txt"
+want=$(grep " $FILE\$" "$CACHE/checksums-$VERSION.txt" | cut -d' ' -f1)
+[ -n "$want" ] || { echo "no checksum listed for $FILE" >&2; exit 1; }
+got=$(sha256sum "$CACHE/$FILE" | cut -d' ' -f1)
+[ "$want" = "$got" ] || { echo "checksum mismatch for $FILE" >&2; rm -f "$CACHE/$FILE"; exit 1; }
+if [ "$EXT" = zip ]; then
+	unzip -qo "$CACHE/$FILE" traefik.exe -d "$DEST"
+else
+	tar -xzf "$CACHE/$FILE" -C "$DEST" traefik
+fi
+echo "traefik $VERSION for $OS/$ARCH ready"

deploy/install.sh

@@ -5,7 +5,7 @@
 #   sudo ./install.sh --start      the same, then start (or restart) the service
 #   sudo ./install.sh --uninstall  remove the service and binary (keeps the settings and data)
 #
-# Files: /usr/local/bin/blacktip, /etc/systemd/system/blacktip.service,
+# Files: /usr/local/lib/blacktip/blacktip (linked from /usr/local/bin/blacktip), /etc/systemd/system/blacktip.service,
 #        /etc/blacktip/blacktip.env (your settings and secrets), /var/lib/blacktip (data).
 # Set DESTDIR=/some/dir to stage everything there without touching the system.
 set -eu
@@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service
 CONF=$ROOT/etc/$NAME
 ENVFILE=$CONF/$NAME.env
 DATA=$ROOT/var/lib/$NAME
+LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it
 
 say() { printf '%s\n' "$*"; }
 real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system?
@@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$LIB/$NAME" "$ROOT/usr/local/lib/$NAME/traefik"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -45,16 +46,25 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 	say "Created the system user '$NAME'."
 fi
 
-mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
+mkdir -p "$ROOT/usr/local/lib/$NAME" "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
-install -m 0755 "$HERE/$NAME" "$BIN.new"
+mkdir -p "$LIB"
-mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new"
+mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe
+rm -f "$BIN"
+LINK=/usr/local/lib/$NAME/$NAME
+[ -z "${DESTDIR:-}" ] || LINK=$LIB/$NAME # staging: point inside the staging folder
+ln -s "$LINK" "$BIN"
+if [ -f "$HERE/traefik" ]; then
+	install -m 0755 "$HERE/traefik" "$ROOT/usr/local/lib/$NAME/traefik.new"
+	mv -f "$ROOT/usr/local/lib/$NAME/traefik.new" "$ROOT/usr/local/lib/$NAME/traefik"
+fi
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"
 	say "Created $ENVFILE. Edit it before starting."
 fi
 if real; then
-	chown -R "$NAME:$NAME" "$DATA"
+	chown -R "$NAME:$NAME" "$DATA" "$LIB"
 fi
 
 if real; then
@@ -66,7 +76,7 @@ if real; then
 	fi
 fi
 
-say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")."
+say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")."
 say "Next:"
 say "  1. edit $ENVFILE"
 say "  2. systemctl start $NAME      (or run this again with --start)"

deploy/publish-release.sh

@@ -42,19 +42,30 @@ else
 	echo "release $TAG already exists (id $id): replacing its files"
 fi
 
-existing=$(curl -fsS -H "$AUTH" "$API/releases/$id/assets" | json 'import sys, json
+# the ids of the release's assets with a given name (a failed upload can leave a partial one behind)
+asset_ids() {
+	curl -fsS -H "$AUTH" "$API/releases/$id/assets" | "$PY" -c 'import sys, json
 for a in json.load(sys.stdin):
-    print(a["id"], a["name"])')
+    if a["name"] == sys.argv[1]:
+        print(a["id"])' "$1"
+}
 
 for f in dist/*.tar.gz dist/*.zip dist/SHA256SUMS; do
 	[ -f "$f" ] || continue
 	name=$(basename "$f")
-	echo "$existing" | while read -r aid aname; do
+	n=1
-		if [ "$aname" = "$name" ]; then
+	while :; do
+		for aid in $(asset_ids "$name"); do
 			curl -fsS -X DELETE -H "$AUTH" "$API/releases/$id/assets/$aid" > /dev/null
-		fi
 		done
-	echo "uploading $name"
+		echo "uploading $name (attempt $n)"
-	curl -fsS -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null
+		if curl -fsS --max-time 1200 -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null; then
+			break
+		fi
+		# large uploads can hit a proxy timeout (HTTP 502); try again
+		[ "$n" -lt 5 ] || { echo "giving up on $name after $n attempts" >&2; exit 1; }
+		n=$((n + 1))
+		sleep $((n * 10))
+	done
 done
 echo "published $SERVER/$REPO/releases/tag/$TAG"

go.mod

@@ -3,7 +3,7 @@ module git.veillax.com/Veillax/blacktip
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/reef v0.1.0
+	git.veillax.com/Veillax/reef v0.1.10
 	github.com/emersion/go-msgauth v0.7.0
 	golang.org/x/crypto v0.58.0
 )

go.sum

@@ -1,5 +1,5 @@
-git.veillax.com/Veillax/reef v0.1.0 h1:O0OhEKFx2CsvACJ20sfzJNjGsngomtfDdKdxu4ROpCs=
+git.veillax.com/Veillax/reef v0.1.10 h1:b15oD1vyrGOriCHhipQtJ3j7Cy5ForYWvfJkqifLQPg=
-git.veillax.com/Veillax/reef v0.1.0/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.10/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
 github.com/emersion/go-msgauth v0.7.0 h1:vj2hMn6KhFtW41kshIBTXvp6KgYSqpA/ZN9Pv4g1INc=

listener.go

@@ -35,12 +35,12 @@ type listener struct {
 	sessions map[string]*udpSession
 }
 
-func (b *Blacktip) open(ms []*mapState, off int, redirect bool) (*listener, error) {
+func (b *Blacktip) open(ip string, ms []*mapState, off int, redirect bool) (*listener, error) {
 	m := ms[0].m
-	addr := net.JoinHostPort(m.BindIP, strconv.Itoa(m.Port+off))
+	addr := net.JoinHostPort(ip, strconv.Itoa(m.Port+off))
 	l := &listener{b: b, kind: m.Proto, redirect: redirect, maps: ms, off: off, done: make(chan struct{}), sessions: map[string]*udpSession{}}
 	if redirect {
-		addr = net.JoinHostPort(m.BindIP, "80")
+		addr = net.JoinHostPort(ip, "80")
 		l.kind = model.ProtoHTTP
 	}
 	if m.Proto == model.ProtoUDP {

redirect_test.go

@@ -0,0 +1,44 @@
+package blacktip
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+// A redirect mapping answers from the edge itself: no proxy, relay or target is needed.
+func TestRedirectMappingAnswersWithoutATarget(t *testing.T) {
+	b := &Blacktip{logq: make(chan model.LogEntry, 8)}
+	mk := func(m model.Mapping) *listener {
+		return &listener{b: b, kind: model.ProtoHTTP, maps: []*mapState{{b: b, m: m}}}
+	}
+	cases := []struct {
+		name string
+		m    model.Mapping
+		uri  string
+		code int
+		loc  string
+	}{
+		{"temporary, no path", model.Mapping{Hostname: "old.test", RedirectTo: "https://new.test/home"}, "/a?b=1", http.StatusFound, "https://new.test/home"},
+		{"permanent keeps path and query", model.Mapping{Hostname: "old.test", RedirectTo: "https://new.test", RedirectPermanent: true, RedirectKeepPath: true}, "/a/b?c=d", http.StatusMovedPermanently, "https://new.test/a/b?c=d"},
+	}
+	for _, c := range cases {
+		r := httptest.NewRequest("GET", "http://old.test"+c.uri, nil)
+		w := httptest.NewRecorder()
+		mk(c.m).ServeHTTP(w, r)
+		if w.Code != c.code || w.Header().Get("Location") != c.loc {
+			t.Errorf("%s: got %d %q, want %d %q", c.name, w.Code, w.Header().Get("Location"), c.code, c.loc)
+		}
+	}
+	// a hostname nobody serves is still a 404
+	w := httptest.NewRecorder()
+	mk(cases[0].m).ServeHTTP(w, httptest.NewRequest("GET", "http://other.test/", nil))
+	if w.Code != http.StatusNotFound {
+		t.Errorf("unknown host: got %d", w.Code)
+	}
+	if e := <-b.logq; e.Result != "redirect" || e.Status != http.StatusFound {
+		t.Errorf("access log entry: %+v", e)
+	}
+}

traefik.go

@@ -49,6 +49,7 @@ type traefikMgr struct {
 	stop      context.CancelFunc // stops the current traefik process
 	lastErr   string
 	maps      map[string]*mapState
+	binds     map[string][]string // mapping ID -> the addresses it listens on (a wildcard steps aside for named ones)
 	ports     map[string]int      // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes
 	dynBytes  []byte
 }
@@ -217,20 +218,23 @@ func hostRule(host string) (string, bool) {
 
 // sync rewrites Traefik's configuration for the given web mappings and
 // (re)starts the process if its static part changed. Called with b.mu held.
-func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail string, staging bool) {
+func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, binds map[string][]string, acmeEmail string, staging bool) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
+	t.binds = binds
 	t.maps = map[string]*mapState{}
 	eps := map[string]string{} // name -> address
 	needACME := false
 	for _, ms := range maps {
 		t.maps[ms.m.ID] = ms
-		eps[epName(ms.m.BindIP, ms.m.Port)] = net.JoinHostPort(ms.m.BindIP, strconv.Itoa(ms.m.Port))
+		for _, ip := range t.bindsOf(ms.m) {
+			eps[epName(ip, ms.m.Port)] = net.JoinHostPort(ip, strconv.Itoa(ms.m.Port))
+			if ms.m.Proto == model.ProtoHTTPS && ms.m.RedirectHTTP {
+				eps[epName(ip, 80)] = net.JoinHostPort(ip, "80")
+			}
+		}
 		if ms.m.Proto == model.ProtoHTTPS {
 			needACME = true
-			if ms.m.RedirectHTTP {
-				eps[epName(ms.m.BindIP, 80)] = net.JoinHostPort(ms.m.BindIP, "80")
-			}
 		}
 	}
 	routers := map[string]any{}
@@ -240,11 +244,45 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 	}
 	for _, ms := range maps {
 		m := ms.m
+		if m.IsRedirect() { // answered by Traefik itself: no relay, login or target
+			rule, wildcard := hostRule(m.Hostname)
+			var eps []string
+			for _, ip := range t.bindsOf(m) {
+				eps = append(eps, epName(ip, m.Port))
+			}
+			prio := 5000
+			if wildcard {
+				prio = 2000
+			}
+			to := strings.ReplaceAll(m.RedirectTo, "$", "$$") // "$" would otherwise start a group reference
+			regex, repl := "^.*", to
+			if m.RedirectKeepPath {
+				regex, repl = "^https?://[^/]+(.*)", strings.TrimRight(to, "/")+"${1}"
+			}
+			mws["rd-"+m.ID] = map[string]any{"redirectRegex": map[string]any{"regex": regex, "replacement": repl, "permanent": m.RedirectPermanent}}
+			router := map[string]any{"rule": rule, "entryPoints": eps, "service": "noop@internal", "middlewares": []string{"rd-" + m.ID}, "priority": prio}
+			if m.Proto == model.ProtoHTTPS {
+				tlsCfg := map[string]any{}
+				if !t.cfg.NoACME {
+					tlsCfg["certResolver"] = "le"
+					if wildcard {
+						tlsCfg["domains"] = []map[string]any{{"main": m.Hostname}}
+					}
+				}
+				router["tls"] = tlsCfg
+			}
+			routers["m-"+m.ID] = router
+			continue
+		}
 		if ms.relayPort == 0 {
 			continue
 		}
 		rule, wildcard := hostRule(m.Hostname)
-		ep := epName(m.BindIP, m.Port)
+		var mainEPs, redirEPs []string
+		for _, ip := range t.bindsOf(m) {
+			mainEPs = append(mainEPs, epName(ip, m.Port))
+			redirEPs = append(redirEPs, epName(ip, 80))
+		}
 		prio := 5000
 		if wildcard {
 			prio = 2000
@@ -274,7 +312,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			mws["host-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"Host": m.RewriteHost}}}
 			chain = append(chain, "host-"+m.ID)
 		}
-		router := map[string]any{"rule": rule, "entryPoints": []string{ep}, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
+		router := map[string]any{"rule": rule, "entryPoints": mainEPs, "service": "s-" + m.ID, "middlewares": chain, "priority": prio}
 		var tlsCfg map[string]any
 		if m.Proto == model.ProtoHTTPS {
 			tlsCfg = map[string]any{}
@@ -292,7 +330,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 			services["g-"+m.ID] = map[string]any{"loadBalancer": map[string]any{
 				"servers": []map[string]string{{"url": fmt.Sprintf("http://127.0.0.1:%d", t.gatePort)}}, "passHostHeader": true}}
 			mws["gate-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"X-Hammerhead-Mapping": m.ID}}}
-			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": []string{ep}, "service": "g-" + m.ID,
+			g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": mainEPs, "service": "g-" + m.ID,
 				"middlewares": []string{"gate-" + m.ID}, "priority": prio + 1000}
 			if tlsCfg != nil {
 				g["tls"] = tlsCfg
@@ -305,7 +343,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin
 				redirPort = strconv.Itoa(m.Port)
 			}
 			mws["redir-"+m.ID] = map[string]any{"redirectScheme": map[string]any{"scheme": "https", "port": redirPort, "permanent": true}}
-			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": []string{epName(m.BindIP, 80)}, "service": "noop@internal",
+			routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": redirEPs, "service": "noop@internal",
 				"middlewares": []string{"redir-" + m.ID}, "priority": prio}
 		}
 	}
@@ -545,10 +583,7 @@ func (t *traefikMgr) probeCerts(ctx context.Context) {
 		t.mu.Unlock()
 		changed := false
 		for _, ms := range targets {
-			ip := ms.m.BindIP
+			ip := t.probeAddr(ms.m)
-			if pip := net.ParseIP(ip); pip != nil && pip.IsUnspecified() {
-				ip = "127.0.0.1"
-			}
 			status := t.probeOne(net.JoinHostPort(ip, strconv.Itoa(ms.m.Port)), ms.m.Hostname)
 			t.b.mu.Lock()
 			if t.b.acme.certs == nil {
@@ -598,3 +633,27 @@ func containsStr(list []string, s string) bool {
 	}
 	return false
 }
+
+// bindsOf is the addresses a web mapping listens on; t.mu is held, or the caller does not race sync.
+func (t *traefikMgr) bindsOf(m model.Mapping) []string {
+	if ips := t.binds[m.ID]; len(ips) > 0 {
+		return ips
+	}
+	return []string{m.BindIP}
+}
+
+// probeAddr picks an address on this machine to test a mapping's certificate through.
+func (t *traefikMgr) probeAddr(m model.Mapping) string {
+	t.mu.Lock()
+	ips := t.bindsOf(m)
+	t.mu.Unlock()
+	for _, ip := range ips {
+		if ip == "127.0.0.1" {
+			return ip
+		}
+	}
+	if p := net.ParseIP(ips[0]); p != nil && p.IsUnspecified() {
+		return "127.0.0.1"
+	}
+	return ips[0]
+}

web.go

@@ -264,6 +264,16 @@ func (l *listener) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		b.logAccess(entry)
 	}()
 
+	if ms.m.IsRedirect() {
+		code := http.StatusFound
+		if ms.m.RedirectPermanent {
+			code = http.StatusMovedPermanently
+		}
+		entry.Result = "redirect"
+		http.Redirect(rec, r, ms.m.RedirectLocation(r.URL.RequestURI()), code)
+		return
+	}
+
 	secure := l.kind == model.ProtoHTTPS
 	scheme := "http"
 	if secure {

yield_test.go

@@ -0,0 +1,37 @@
+package blacktip
+
+import (
+	"testing"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+func TestWildcardWebsitesStepAsideForNamedAddresses(t *testing.T) {
+	all := []model.Mapping{
+		{ID: "a", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 443, Hostname: "a.test"},
+		{ID: "b", Proto: model.ProtoHTTPS, BindIP: "127.0.0.1", Port: 443, Hostname: "b.test"},
+		{ID: "c", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 8443, Hostname: "c.test"},
+		{ID: "d", Proto: model.ProtoTCP, BindIP: "0.0.0.0", Port: 443},
+	}
+	// the wildcard on 443 gives up the address that "b" names
+	for _, ip := range bindIPs(all[0], all) {
+		if ip == "127.0.0.1" {
+			t.Fatalf("wildcard still listens on 127.0.0.1: %v", bindIPs(all[0], all))
+		}
+	}
+	// the named address keeps its own listener
+	if got := bindIPs(all[1], all); len(got) != 1 || got[0] != "127.0.0.1" {
+		t.Fatalf("named mapping: %v", got)
+	}
+	// a different port, or a raw TCP port, is not affected
+	if got := bindIPs(all[2], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("other port: %v", got)
+	}
+	if got := bindIPs(all[3], all); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("raw tcp: %v", got)
+	}
+	// with nothing named on that port the wildcard stays a single wildcard listener
+	if got := bindIPs(all[0], all[:1]); len(got) != 1 || got[0] != "0.0.0.0" {
+		t.Fatalf("alone: %v", got)
+	}
+}