Custom Domains for Territories

.env.development

@@ -114,7 +114,7 @@ NEXT_PUBLIC_EXTRA_LONG_POLL_INTERVAL=300000
 
 # containers can't use localhost, so we need to use the container name
 IMGPROXY_URL_DOCKER=http://imgproxy:8080
-MEDIA_URL_DOCKER=http://s3:4566/uploads
+MEDIA_URL_DOCKER=http://aws:4566/uploads
 
 # postgres container stuff
 POSTGRES_PASSWORD=password
@@ -177,6 +177,7 @@ AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
 AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
 PERSISTENCE=1
 SKIP_SSL_CERT_DOWNLOAD=1
+LOCALSTACK_ENDPOINT=http://localhost:4566
 
 # tor proxy
 TOR_PROXY=http://tor:7050/
@@ -190,4 +191,10 @@ CPU_SHARES_IMPORTANT=1024
 CPU_SHARES_MODERATE=512
 CPU_SHARES_LOW=256
 
-NEXT_TELEMETRY_DISABLED=1
+NEXT_TELEMETRY_DISABLED=1
+
+# DNS resolver for custom domain verification
+DNS_RESOLVER=1.1.1.1
+
+# domain debug logger
+CUSTOM_DOMAIN_LOGGER=false

.env.production

@@ -23,3 +23,6 @@ DB_APP_CONNECTION_LIMIT=4
 DB_WORKER_CONNECTION_LIMIT=2
 DB_TRANSACTION_TIMEOUT=10000
 NEXT_TELEMETRY_DISABLED=1
+
+# DNS resolver for custom domain verification
+DNS_RESOLVER=1.1.1.1

api/acm/index.js

@@ -0,0 +1,53 @@
+import AWS from 'aws-sdk'
+
+AWS.config.update({
+  region: 'us-east-1'
+})
+
+const config = {}
+
+export async function requestCertificate (domain) {
+  // for local development, we use the LOCALSTACK_ENDPOINT
+  if (process.env.NODE_ENV === 'development') {
+    config.endpoint = process.env.LOCALSTACK_ENDPOINT
+  }
+
+  const acm = new AWS.ACM(config)
+  const params = {
+    DomainName: domain,
+    ValidationMethod: 'DNS',
+    Tags: [
+      {
+        Key: 'ManagedBy',
+        Value: 'stacker.news'
+      }
+    ]
+  }
+
+  const certificate = await acm.requestCertificate(params).promise()
+  return certificate.CertificateArn
+}
+
+export async function describeCertificate (certificateArn) {
+  if (process.env.NODE_ENV === 'development') {
+    config.endpoint = process.env.LOCALSTACK_ENDPOINT
+  }
+  const acm = new AWS.ACM(config)
+  const certificate = await acm.describeCertificate({ CertificateArn: certificateArn }).promise()
+  return certificate
+}
+
+export async function getCertificateStatus (certificateArn) {
+  const certificate = await describeCertificate(certificateArn)
+  return certificate.Certificate.Status
+}
+
+export async function deleteCertificate (certificateArn) {
+  if (process.env.NODE_ENV === 'development') {
+    config.endpoint = process.env.LOCALSTACK_ENDPOINT
+  }
+  const acm = new AWS.ACM(config)
+  const result = await acm.deleteCertificate({ CertificateArn: certificateArn }).promise()
+  console.log(`delete certificate attempt for ${certificateArn}, result: ${JSON.stringify(result)}`)
+  return result
+}

api/resolvers/branding.js

@@ -0,0 +1,75 @@
+import { GqlAuthenticationError, GqlInputError } from '@/lib/error'
+import { validateSchema, customBrandingSchema } from '@/lib/validate'
+
+export default {
+  Query: {
+    customBranding: async (parent, { subName }, { models }) => {
+      return models.customBranding.findUnique({ where: { subName } })
+    }
+  },
+  Mutation: {
+    setCustomBranding: async (parent, { subName, branding }, { me, models }) => {
+      if (!me) {
+        throw new GqlAuthenticationError()
+      }
+
+      const sub = await models.sub.findUnique({ where: { name: subName } })
+      if (!sub) {
+        throw new GqlInputError('sub not found')
+      }
+
+      if (sub.userId !== me.id) {
+        throw new GqlInputError('you do not own this sub')
+      }
+
+      const { title, colors, logoId, faviconId } = branding
+
+      const parsedLogoId = parseInt(logoId)
+      const parsedFaviconId = parseInt(faviconId)
+
+      if (parsedLogoId) {
+        const logo = await models.upload.findUnique({ where: { id: parsedLogoId } })
+        if (!logo) {
+          throw new GqlInputError('logo not found')
+        }
+      }
+
+      if (parsedFaviconId) {
+        const favicon = await models.upload.findUnique({ where: { id: parsedFaviconId } })
+        if (!favicon) {
+          throw new GqlInputError('favicon not found')
+        }
+      }
+
+      if (!validateSchema(customBrandingSchema, {
+        title,
+        primary: colors.primary,
+        secondary: colors.secondary,
+        info: colors.info,
+        success: colors.success,
+        danger: colors.danger,
+        logoId,
+        faviconId
+      })) {
+        throw new GqlInputError('invalid branding')
+      }
+
+      return await models.customBranding.upsert({
+        where: { subName },
+        update: {
+          title: title || subName,
+          colors,
+          ...(parsedLogoId && { logo: { connect: { id: parsedLogoId } } }),
+          ...(parsedFaviconId && { favicon: { connect: { id: parsedFaviconId } } })
+        },
+        create: {
+          title: title || subName,
+          colors,
+          ...(parsedLogoId && { logo: { connect: { id: parsedLogoId } } }),
+          ...(parsedFaviconId && { favicon: { connect: { id: parsedFaviconId } } }),
+          sub: { connect: { name: subName } }
+        }
+      })
+    }
+  }
+}

api/resolvers/domain.js

@@ -0,0 +1,105 @@
+import { validateSchema, customDomainSchema } from '@/lib/validate'
+import { GqlAuthenticationError, GqlInputError } from '@/lib/error'
+import { randomBytes } from 'node:crypto'
+import { getDomainMappingsCache } from '@/lib/domains'
+
+export default {
+  Query: {
+    customDomain: async (parent, { subName }, { models }) => {
+      return models.customDomain.findUnique({ where: { subName } })
+    },
+    domainMapping: async (parent, { domain }, { models }) => {
+      const domainMappings = await getDomainMappingsCache()
+      return domainMappings?.[domain]
+    }
+  },
+  Mutation: {
+    setCustomDomain: async (parent, { subName, domain }, { me, models }) => {
+      if (!me) {
+        throw new GqlAuthenticationError()
+      }
+
+      const sub = await models.sub.findUnique({ where: { name: subName } })
+      if (!sub) {
+        throw new GqlInputError('sub not found')
+      }
+
+      if (sub.userId !== me.id) {
+        throw new GqlInputError('you do not own this sub')
+      }
+
+      domain = domain.trim() // protect against trailing spaces
+      if (domain && !validateSchema(customDomainSchema, { domain })) {
+        throw new GqlInputError('invalid domain format')
+      }
+
+      const existing = await models.customDomain.findUnique({ where: { subName } })
+
+      if (domain) {
+        if (existing && existing.domain === domain && existing.status !== 'HOLD') {
+          throw new GqlInputError('domain already set')
+        }
+
+        const initializeDomain = {
+          domain,
+          createdAt: new Date(),
+          status: 'PENDING',
+          verification: {
+            dns: {
+              state: 'PENDING',
+              cname: 'stacker.news',
+              // generate a random txt record only if it's a new domain
+              txt: existing?.domain === domain && existing.verification.dns.txt
+                ? existing.verification.dns.txt
+                : randomBytes(32).toString('base64')
+            },
+            ssl: {
+              state: 'WAITING',
+              arn: null,
+              cname: null,
+              value: null
+            }
+          }
+        }
+
+        const updatedDomain = await models.customDomain.upsert({
+          where: { subName },
+          update: {
+            ...initializeDomain
+          },
+          create: {
+            ...initializeDomain,
+            sub: {
+              connect: { name: subName }
+            }
+          }
+        })
+
+        // schedule domain verification in 30 seconds
+        await models.$executeRaw`
+        INSERT INTO pgboss.job (name, data, retrylimit, retrydelay, startafter, keepuntil)
+        VALUES ('domainVerification',
+                jsonb_build_object('domainId', ${updatedDomain.id}::INTEGER),
+                3,
+                30,
+                now() + interval '30 seconds',
+                now() + interval '2 days')`
+
+        return updatedDomain
+      } else {
+        try {
+          // delete any existing domain verification jobs
+          await models.$queryRaw`
+          DELETE FROM pgboss.job
+          WHERE name = 'domainVerification'
+                AND data->>'domainId' = ${existing.id}::TEXT`
+
+          return await models.customDomain.delete({ where: { subName } })
+        } catch (error) {
+          console.error(error)
+          throw new GqlInputError('failed to delete domain')
+        }
+      }
+    }
+  }
+}

api/resolvers/index.js

@@ -20,6 +20,8 @@ import { GraphQLScalarType, Kind } from 'graphql'
 import { createIntScalar } from 'graphql-scalar'
 import paidAction from './paidAction'
 import vault from './vault'
+import domain from './domain'
+import branding from './branding'
 
 const date = new GraphQLScalarType({
   name: 'Date',
@@ -56,4 +58,4 @@ const limit = createIntScalar({
 
 export default [user, item, message, wallet, lnurl, notifications, invite, sub,
   upload, search, growth, rewards, referrals, price, admin, blockHeight, chainFee,
-  { JSONObject }, { Date: date }, { Limit: limit }, paidAction, vault]
+  domain, branding, { JSONObject }, { Date: date }, { Limit: limit }, paidAction, vault]

api/resolvers/sub.js

@@ -310,6 +310,12 @@ export default {
 
       return sub.SubSubscription?.length > 0
     },
+    customDomain: async (sub, args, { models }) => {
+      return models.customDomain.findUnique({ where: { subName: sub.name } })
+    },
+    customBranding: async (sub, args, { models }) => {
+      return models.customBranding.findUnique({ where: { subName: sub.name } })
+    },
     createdAt: sub => sub.createdAt || sub.created_at
   }
 }

api/ssrApollo.js

@@ -11,6 +11,7 @@ import { ME } from '@/fragments/users'
 import { PRICE } from '@/fragments/price'
 import { BLOCK_HEIGHT } from '@/fragments/blockHeight'
 import { CHAIN_FEE } from '@/fragments/chainFee'
+import { GET_CUSTOM_BRANDING } from '@/fragments/brandings'
 import { getServerSession } from 'next-auth/next'
 import { getAuthOptions } from '@/pages/api/auth/[...nextauth]'
 import { NOFOLLOW_LIMIT } from '@/lib/constants'
@@ -152,6 +153,18 @@ export function getGetServerSideProps (
 
     const client = await getSSRApolloClient({ req, res })
 
+    const isCustomDomain = req.headers.host !== process.env.NEXT_PUBLIC_URL.replace(/^https?:\/\//, '')
+    const subName = req.headers['x-stacker-news-subname'] || null
+    let customDomain = null
+    if (isCustomDomain && subName) {
+      const { data: { customBranding } } = await client.query({ query: GET_CUSTOM_BRANDING, variables: { subName } })
+      customDomain = {
+        domain: req.headers.host,
+        subName,
+        branding: customBranding || null
+      }
+    }
+
     let { data: { me } } = await client.query({ query: ME })
 
     // required to redirect to /signup on page reload
@@ -216,6 +229,7 @@ export function getGetServerSideProps (
     return {
       props: {
         ...props,
+        customDomain,
         me,
         price,
         blockHeight,

api/typeDefs/branding.js

@@ -0,0 +1,27 @@
+import { gql } from 'graphql-tag'
+
+export default gql`
+  extend type Query {
+    customBranding(subName: String!): CustomBranding
+  }
+
+  extend type Mutation {
+    setCustomBranding(subName: String!, branding: CustomBrandingInput!): CustomBranding
+  }
+
+  type CustomBranding {
+    title: String
+    colors: JSONObject
+    logoId: String
+    faviconId: String
+    subName: String
+  }
+
+  input CustomBrandingInput {
+    title: String
+    colors: JSONObject
+    logoId: String
+    faviconId: String
+    subName: String
+  }
+`