mirror of
https://github.com/lbr77/SideImpactor.git
synced 2026-08-05 14:55:22 -04:00
82 lines
1.9 KiB
Markdown
82 lines
1.9 KiB
Markdown
# backend (Cloudflare Workers demo)
|
|
|
|
This demo shows how to run the Wisp proxy path (`/wisp/`) on Cloudflare Workers by combining:
|
|
|
|
- Wisp protocol handling from `@mercuryworkshop/wisp-js`
|
|
- Outbound TCP from `cloudflare:sockets`
|
|
|
|
It is a minimal proof-of-concept based on:
|
|
|
|
- `../../AssppWeb/backend/src/services/wsProxy.ts`
|
|
- `../wisp-js`
|
|
|
|
The Worker also serves static files from `../frontend/dist` via Wrangler `assets`.
|
|
|
|
## What this demo supports
|
|
|
|
- `GET /healthz` health check
|
|
- `WS /wisp/` Wisp v2 server path
|
|
- Apple host allowlist + port `443` only
|
|
- Optional token auth (`?token=...`)
|
|
|
|
## What this demo does not support
|
|
|
|
- UDP streams (disabled)
|
|
- Legacy wsproxy path (for example `/wisp/example.com:443`)
|
|
- Asspp backend HTTP APIs (`/api/*`)
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
bun install
|
|
cd backend
|
|
bun run types
|
|
bun run check
|
|
```
|
|
|
|
`bun run check` will build frontend first, then run Worker dry-run deploy.
|
|
|
|
## Local dev
|
|
|
|
```bash
|
|
cd backend
|
|
bun run dev
|
|
```
|
|
|
|
Default local URL: `http://127.0.0.1:8787`
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
cd backend
|
|
bun run deploy
|
|
```
|
|
|
|
Pushes to `main` deploy automatically to the Worker's `workers.dev` URL through
|
|
`.github/workflows/deploy-workers.yml`.
|
|
|
|
Configure these repository secrets under **Settings → Secrets and variables →
|
|
Actions**:
|
|
|
|
- `CLOUDFLARE_API_TOKEN`: a Cloudflare API token with `Workers Scripts: Edit`,
|
|
scoped to the deployment account
|
|
- `CLOUDFLARE_ACCOUNT_ID`: the target Cloudflare account ID
|
|
|
|
Create the token from the Cloudflare dashboard's **Manage Account → Account API
|
|
Tokens** page. Find the account ID on the target account's Cloudflare dashboard
|
|
overview page.
|
|
|
|
## Optional auth
|
|
|
|
Set one of these as Worker secrets:
|
|
|
|
1. `ACCESS_TOKEN_HASH` (preferred): expected token value directly
|
|
2. `ACCESS_PASSWORD`: plaintext password, Worker computes SHA-256 hex and compares with `?token=`
|
|
|
|
```bash
|
|
cd backend
|
|
bunx wrangler secret put ACCESS_TOKEN_HASH
|
|
# or
|
|
bunx wrangler secret put ACCESS_PASSWORD
|
|
```
|