Package managed server for Linux production

dotnet/src/VoiceCat.Server/ServerCommand.cs

@@ -1,9 +1,13 @@
 using System.Globalization;
 using System.Net;
+using System.Net.Sockets;
 using System.Runtime.InteropServices;
+using System.Security.Authentication;
+using System.Security.Cryptography;
 using System.Text.Json;
 using VoiceCat.Crypto;
 using VoiceCat.Server.Data;
+using VoiceCat.Transport;
 
 namespace VoiceCat.Server;
 
@@ -55,11 +59,20 @@ internal static class ServerCommand
     {
         if (args.Contains("--help"))
         {
-            await output.WriteLineAsync("VoiceCat TLS/UDP server\n--data-dir PATH --bind IP --port PORT --name NAME --allow-guests true|false\n--max-connections N --handshake-seconds N --idle-seconds N --reaper-seconds N\n--auth-burst N --auth-refill-seconds N --print-config --print-fingerprint\naccount add|reset|delete|list [USERNAME] [--admin]\nAccount passwords: hidden prompt, or VOICECAT_ADMIN_PASSWORD (never command arguments).\nDefaults: 0.0.0.0:8384 TCP+UDP, ./voicecat-data; VOICECAT_* environment overrides supported.");
+            await output.WriteLineAsync("VoiceCat TLS/UDP server\n--data-dir PATH --bind IP --port PORT --name NAME --allow-guests true|false\n--max-connections N --handshake-seconds N --idle-seconds N --reaper-seconds N\n--auth-burst N --auth-refill-seconds N --print-config --print-fingerprint\n--health-check HOST:PORT [--expect-fingerprint SHA256]\naccount add|reset|delete|list [USERNAME] [--admin]\nAccount passwords: hidden prompt, or VOICECAT_ADMIN_PASSWORD (never command arguments).\nDefaults: 0.0.0.0:8384 TCP+UDP, ./voicecat-data; VOICECAT_* environment overrides supported.");
             return 0;
         }
         try
         {
+            int healthIndex = Array.IndexOf(args, "--health-check");
+            if (healthIndex >= 0)
+            {
+                if (healthIndex + 1 >= args.Length) throw new ArgumentException("Health endpoint required.");
+                string? expected = null;
+                int fingerprintIndex = Array.IndexOf(args, "--expect-fingerprint");
+                if (fingerprintIndex >= 0) expected = fingerprintIndex + 1 < args.Length ? args[fingerprintIndex + 1] : throw new ArgumentException("Expected fingerprint required.");
+                return await HealthCheckAsync(args[healthIndex + 1], expected, output, cancellationToken).ConfigureAwait(false);
+            }
             ServerConfiguration config = Parse(args, Environment.GetEnvironmentVariable);
             if (args.Contains("--print-config")) { await output.WriteLineAsync(JsonSerializer.Serialize(config)); return 0; }
             CreateDataDirectory(config.Directory);
@@ -96,13 +109,36 @@ internal static class ServerCommand
                 if (server is not null) await server.DisposeAsync().AsTask().WaitAsync(TimeSpan.FromSeconds(10)).ConfigureAwait(false);
             }
         }
-        catch (Exception exception) when (exception is ArgumentException or FormatException or OverflowException or IOException or InvalidOperationException or System.Net.Sockets.SocketException or Microsoft.Data.Sqlite.SqliteException or TimeoutException)
+        catch (Exception exception) when (exception is ArgumentException or FormatException or OverflowException or IOException or InvalidOperationException or SocketException or AuthenticationException or CryptographicException or Microsoft.Data.Sqlite.SqliteException or TimeoutException || exception is OperationCanceledException && !cancellationToken.IsCancellationRequested)
         {
             await error.WriteLineAsync("VoiceCat command failed: " + exception.GetType().Name + ". Check configuration, data files and port availability.");
             return 1;
         }
     }
 
+    private static async Task<int> HealthCheckAsync(string endpoint, string? expectedFingerprint, TextWriter output, CancellationToken cancellationToken)
+    {
+        int separator = endpoint.LastIndexOf(':');
+        if (separator < 1 || !ushort.TryParse(endpoint[(separator + 1)..], out ushort port)) throw new ArgumentException("Health endpoint must be HOST:PORT.");
+        string host = endpoint[..separator].Trim('[', ']');
+        byte[]? expected = null;
+        if (expectedFingerprint is not null)
+        {
+            try { expected = Convert.FromHexString(expectedFingerprint); } catch (FormatException) { throw new ArgumentException("Expected fingerprint must be hexadecimal."); }
+            if (expected.Length != 32) throw new ArgumentException("Expected fingerprint must be SHA-256.");
+        }
+        string? actual = null;
+        using var deadline = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken); deadline.CancelAfter(TimeSpan.FromSeconds(5));
+        using var socket = new Socket(SocketType.Stream, ProtocolType.Tcp);
+        await socket.ConnectAsync(host, port, deadline.Token).ConfigureAwait(false);
+        using var tls = TlsSession.CreateClient(fingerprint => { actual = fingerprint; return true; });
+        await using var connection = new TlsControlConnection(socket, tls, deadline.Token, TimeSpan.FromSeconds(5));
+        using MediaSessionCrypto crypto = await connection.TakeMediaCryptoAsync(deadline.Token).ConfigureAwait(false);
+        if (actual is null || expected is not null && !CryptographicOperations.FixedTimeEquals(Convert.FromHexString(actual), expected)) return 1;
+        await output.WriteLineAsync(JsonSerializer.Serialize(new { status = "healthy", certificate_fingerprint = actual }));
+        return 0;
+    }
+
     private static void CreateDataDirectory(string directory)
     {
         if (OperatingSystem.IsWindows()) System.IO.Directory.CreateDirectory(directory);