Show the community server's status on the homepage

scripts/community-status.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+'use strict';
+
+// Checks the community server and writes what the homepage's status line
+// shows (docs/index.html, "Community server" under the join button).
+//
+// Run every ten minutes by .github/workflows/community-status.yml, which
+// keeps the result on the site-status branch. A visitor's browser cannot
+// read a certificate, so it could only tell "reachable" from "not"; this
+// says why: the certificate expired, it is not valid, the server does not
+// answer, or it cannot be reached at all.
+//
+//   node scripts/community-status.js [out.json] [previous.json]
+//
+// HOST overrides the server (default haven.moviethingy.xyz).
+
+const fs = require('fs');
+const https = require('https');
+const tls = require('tls');
+
+const HOST = process.env.HOST || 'haven.moviethingy.xyz';
+const OUT = process.argv[2] || 'status.json';
+const PREV = process.argv[3] || null;
+const TIMEOUT_MS = 15000;
+// A certificate this close to its end gets a warning while still working.
+const SOON_MS = 3 * 24 * 60 * 60 * 1000;
+
+// The certificate as the server presents it, valid or not.
+function readCertificate() {
+  return new Promise((resolve) => {
+    const sock = tls.connect({ host: HOST, port: 443, servername: HOST, rejectUnauthorized: false, timeout: TIMEOUT_MS }, () => {
+      const cert = sock.getPeerCertificate();
+      resolve({
+        reached: true,
+        authorized: sock.authorized,
+        error: sock.authorizationError ? String(sock.authorizationError) : null,
+        validTo: cert && cert.valid_to ? new Date(cert.valid_to).toISOString() : null,
+        issuer: cert && cert.issuer ? (cert.issuer.O || cert.issuer.CN || null) : null,
+      });
+      sock.end();
+    });
+    sock.on('timeout', () => { sock.destroy(); resolve({ reached: false, error: 'timeout' }); });
+    sock.on('error', (err) => resolve({ reached: false, error: err.code || err.message }));
+  });
+}
+
+// Haven's own health check, read even through a bad certificate, so an
+// expired one can still say whether the server behind it is running.
+function readHealth() {
+  return new Promise((resolve) => {
+    const req = https.get({ host: HOST, path: '/api/health', servername: HOST, rejectUnauthorized: false, timeout: TIMEOUT_MS }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { if (body.length < 4096) body += c; });
+      res.on('end', () => {
+        let json = null;
+        try { json = JSON.parse(body); } catch { /* not JSON: judged by the status code alone */ }
+        resolve({ status: res.statusCode, online: !!(json && json.status === 'online'), name: json && typeof json.name === 'string' ? json.name.slice(0, 80) : null });
+      });
+    });
+    req.on('timeout', () => { req.destroy(); resolve({ status: 0, online: false }); });
+    req.on('error', () => resolve({ status: 0, online: false }));
+  });
+}
+
+const day = (iso) => new Date(iso).toUTCString().replace(/:\d\d GMT$/, ' UTC');
+
+function judge(cert, health, now) {
+  if (!cert.reached) {
+    return { state: 'down', code: 'unreachable', message: "The community server can't be reached right now." };
+  }
+  if (!cert.authorized) {
+    if (cert.error === 'CERT_HAS_EXPIRED') {
+      return { state: 'down', code: 'cert-expired', message: `The community server's security certificate expired ${day(cert.validTo)}, so browsers won't connect until it's renewed.` };
+    }
+    return { state: 'down', code: 'cert-invalid', message: `The community server's security certificate isn't valid (${cert.error}), so browsers won't connect.` };
+  }
+  if (!health.online) {
+    return { state: 'down', code: 'not-answering', message: "The community server isn't answering right now." };
+  }
+  if (cert.validTo && new Date(cert.validTo).getTime() - now < SOON_MS) {
+    return { state: 'warn', code: 'cert-expiring', message: `The community server is online. Its security certificate runs out ${day(cert.validTo)}.` };
+  }
+  return { state: 'ok', code: 'online', message: 'The community server is online.' };
+}
+
+async function main() {
+  const now = Date.now();
+  const cert = await readCertificate();
+  const health = cert.reached ? await readHealth() : { status: 0, online: false };
+  const verdict = judge(cert, health, now);
+
+  // "Since" carries over while the verdict stays the same. An expired
+  // certificate has been down since the moment it ran out.
+  let since = verdict.code === 'cert-expired' && cert.validTo ? cert.validTo : new Date(now).toISOString();
+  if (PREV && verdict.code !== 'cert-expired') {
+    try {
+      const prev = JSON.parse(fs.readFileSync(PREV, 'utf8'));
+      if (prev && prev.code === verdict.code && typeof prev.since === 'string') since = prev.since;
+    } catch { /* no earlier result yet: this one starts the clock */ }
+  }
+
+  const out = {
+    host: HOST,
+    ...verdict,
+    since,
+    checkedAt: new Date(now).toISOString(),
+    certificateExpires: cert.validTo || null,
+    certificateIssuer: cert.issuer || null,
+  };
+  fs.writeFileSync(OUT, JSON.stringify(out, null, 2) + '\n');
+  console.log(`${out.state}: ${out.message}`);
+}
+
+main().catch((err) => {
+  console.error('[community-status]', err);
+  process.exit(1);
+});