Allow superstatic over https

[greghuc]

There doesn't seem to be an option to serve superstatic assets over https.
Could this be added?

My use case is that I plan to use divshot.com for static web hosting, where files will be served over https.

I want my local development environment to echo production.
So I'd like my local superstatic server to serve assets over https.

[scottcorgan]

Have this in the queue for 0.13.0 which should be released in the next few days.

[greghuc]

Cool. I've temporarily switched away from superstatic to a hacked-up 'send' server until this is fixed.

Code below, and I also found these instructions useful for generating keys: http://www.christophseydel.pro/blog/2013/08/18/create-a-local-ssl-certificate-to-include-it-in-your-local-rails-environment/ and https://gist.github.com/trcarden/3295935

https = require 'https'
fs = require 'fs'
send = require 'send'
url = require 'url'

rootDir = process.argv[2]
keyFile = process.argv[3]
certFile = process.argv[4]

console.log "Running server for directory: #{rootDir}"
console.log "Key file: #{keyFile}"
console.log "Cert file: #{certFile}"

options =
  key: fs.readFileSync keyFile
  cert: fs.readFileSync certFile

app = https.createServer(options, (req, res) ->
  console.log "Request: #{req.url}"

  error = (err) ->
    console.log "Error: #{req.url}"
    res.statusCode = err.status or 500
    res.end err.message

  send(req, url.parse(req.url).pathname, { root: rootDir })
    .on 'error', error
    .pipe res

).listen 4200, '0.0.0.0'

[greghuc]

And here's the magic command I used for create a self-certified cert and key:

openssl req -new -newkey rsa:2048 -sha1 -days 365 -nodes -x509 -keyout .ssl/dev-www.yourdomain.com.key -out .ssl/yourdomain.com.crt

[scottcorgan]

@greghuc any reason you're not just using Divshot hosting for your app. It has ssl built in.

That and we handle all scaling.

[greghuc]

@scottcorgan I am using divshot hosting, and am very happy with it :-)

However, I only use staging and production environments.
The request for https in superstatic is so that I can fully replicate divshot hosting in my local development environment, where I use superstatic alone.
I use https in divshot staging/prod, so I want it locally too.

[scottcorgan]

@greghuc fantastic point, thanks

[hijonathan]

@greghuc how'd this pan out? Any chance you could share your setup now that 0.13.0 has been merged?

[greghuc]

@hijonathan sorry for the delay. I just switched back to superstatic today, and setup is as follows:

• Certificates are generated as above in this thread
• Files are served out of sub-dir called 'dist'
• Server config is in divshot.json
• Server is run with server.coffee program, which takes location of keyFile and vertFile as inputs. It also overrides cache_control variable, so have no file caching locally

server.coffee:

fs = require 'fs'
superstatic = require 'superstatic'

keyFile = process.argv[2]
certFile = process.argv[3]

console.log 'Running server'
console.log "Key file: #{keyFile}"
console.log "Cert file: #{certFile}"

server = superstatic(
  secure:
    key: fs.readFileSync keyFile
    cert: fs.readFileSync certFile
  config:
    cache_control:
      '/**': false
  localEnv:
    envName: 'development'
).listen 4200, '0.0.0.0'

[hijonathan]

👍 thanks!

[tsmgodoi]

@greghuc
Do you know if the above solution is still working? I didn't find about it on the docs and I couldn't make it work. Thanks.

[mbleigh]

@tsmgodoi you could use superstatic as a middleware in an HTTPS express app without much difficulty, I bet.

[tsmgodoi]

Thanks @mbleigh,

I've managed to make it work with the plain https-server:

'use strict';

var superstatic = require('superstatic');
var connect = require('connect');
var https = require('https');
var fs = require('fs');

var keyFile = process.argv[2];
var certFile = process.argv[3];

var spec = {
  config: {
    public: './app',
    rewrites: [{
      source: '**',
      destination: '/index.html'
    }]
  },
  cwd: process.cwd()
};

var httpsOptions = {
  key: fs.readFileSync(keyFile),
  cert: fs.readFileSync(certFile)
};

var app = connect().use(superstatic(spec));

https.createServer(httpsOptions, app).listen(3474, function(err) {
  if (err) { console.log(err); }
  console.log('Superstatic now serving on port 3474 ...');
});

[specious]

A solution is to start superstatic and then use the ngrok service as a proxy to the local server which gives you an option to connect securely from the client's point of view:

ngrok http 3474