Self-host Serveo

#!/usr/bin/env python3
"""Minimal Serveo policy plugin. Keep stdout reserved for JSON-RPC."""

import json
import os
import sys


def send(message):
    print(json.dumps(message, separators=(",", ":")), flush=True)


def result(request, value):
    send({"jsonrpc": "2.0", "id": request["id"], "result": value})


for line in sys.stdin:
    try:
        request = json.loads(line)
        method = request.get("method")

        if method == "plugin.initialize":
            result(request, {
                "protocol_version": 1,
                "auth_mode": "keys",  # Set to "plugin" to replace authorized_keys.
                "name": "python-example",
                "version": "1.0.0",
                "subscriptions": [
                    {"event": "auth.check", "timeout_ms": 1000, "on_error": "deny"},
                    {"event": "tunnel.check", "timeout_ms": 1000, "on_error": "deny"},
                    {"event": "tunnel.started"},
                    {"event": "tunnel.stopped"},
                    {"event": "private-tcp.connect.check", "timeout_ms": 1000, "on_error": "deny"},
                ],
            })
            send({"jsonrpc": "2.0", "id": "status-1", "method": "serveo.status", "params": {}})
        elif method == "plugin.auth.check":
            # Replace this allowlist with your account/key directory lookup.
            params = request["params"]
            fingerprints = os.environ.get("SERVEO_PLUGIN_FINGERPRINTS", "").split(",")
            result(request, {"allow": params["authorized_key"] or params["identity"]["fingerprint"] in fingerprints})
        elif method == "plugin.private-tcp.connect.check":
            params = request["params"]
            result(request, {"allow": params["identity"]["id"] == params["tunnel"]["identity"]["id"]})
        elif method == "plugin.tunnel.check":
            result(request, {"allow": True})
        elif method in ("plugin.tunnel.started", "plugin.tunnel.stopped"):
            tunnel = request["params"]["tunnel"]
            print(f"{method}: {tunnel['id']} {tunnel['endpoint']}", file=sys.stderr)
        elif method is None and request.get("id") == "status-1":
            print(f"Serveo status: {request.get('result')}", file=sys.stderr)
    except Exception as error:
        print(f"plugin error: {error}", file=sys.stderr)

#!/usr/bin/env node
import readline from 'node:readline';

const send = (message) => process.stdout.write(`${JSON.stringify(message)}\n`);
const result = (request, value) => send({ jsonrpc: '2.0', id: request.id, result: value });

const lines = readline.createInterface({ input: process.stdin });
lines.on('line', (line) => {
  try {
    const request = JSON.parse(line);
    switch (request.method) {
      case 'plugin.initialize':
        result(request, {
          protocol_version: 1,
          auth_mode: 'keys', // Set to 'plugin' to replace authorized_keys.
          name: 'node-example',
          version: '1.0.0',
          subscriptions: [
            { event: 'auth.check', timeout_ms: 1000, on_error: 'deny' },
            { event: 'tunnel.check', timeout_ms: 1000, on_error: 'deny' },
            { event: 'tunnel.started' },
            { event: 'tunnel.stopped' },
            { event: 'private-tcp.connect.check', timeout_ms: 1000, on_error: 'deny' },
          ],
        });
        send({ jsonrpc: '2.0', id: 'status-1', method: 'serveo.status', params: {} });
        break;
      case 'plugin.auth.check':
        // Replace this allowlist with your account/key directory lookup.
        result(request, { allow: request.params.authorized_key ||
          (process.env.SERVEO_PLUGIN_FINGERPRINTS || '').split(',').includes(request.params.identity.fingerprint) });
        break;
      case 'plugin.private-tcp.connect.check':
        result(request, { allow: request.params.identity.id === request.params.tunnel.identity.id });
        break;
      case 'plugin.tunnel.check':
        result(request, { allow: true });
        break;
      case 'plugin.tunnel.started':
      case 'plugin.tunnel.stopped':
        console.error(request.method, request.params.tunnel.id, request.params.tunnel.endpoint);
        break;
      default:
        if (!request.method && request.id === 'status-1') {
          console.error('Serveo status:', request.result);
        }
    }
  } catch (error) {
    console.error('plugin error:', error.message);
  }
});

package main

import (
	"bufio"
	"encoding/json"
	"fmt"
	"os"
	"strings"
)

type message struct {
	JSONRPC string          `json:"jsonrpc"`
	ID      json.RawMessage `json:"id,omitempty"`
	Method  string          `json:"method,omitempty"`
	Params  json.RawMessage `json:"params,omitempty"`
	Result  any             `json:"result,omitempty"`
}

func main() {
	encoder := json.NewEncoder(os.Stdout)
	scanner := bufio.NewScanner(os.Stdin)
	for scanner.Scan() {
		var request message
		if err := json.Unmarshal(scanner.Bytes(), &request); err != nil {
			fmt.Fprintln(os.Stderr, "plugin error:", err)
			continue
		}
		switch request.Method {
		case "plugin.initialize":
			_ = encoder.Encode(message{JSONRPC: "2.0", ID: request.ID, Result: map[string]any{
				"protocol_version": 1,
				"auth_mode":        "keys", // Set to "plugin" to replace authorized_keys.
				"name":             "go-example",
				"version":          "1.0.0",
				"subscriptions": []map[string]any{
					{"event": "auth.check", "timeout_ms": 1000, "on_error": "deny"},
					{"event": "tunnel.check", "timeout_ms": 1000, "on_error": "deny"},
					{"event": "tunnel.started"},
					{"event": "tunnel.stopped"},
					{"event": "private-tcp.connect.check", "timeout_ms": 1000, "on_error": "deny"},
				},
			}})
			_ = encoder.Encode(message{JSONRPC: "2.0", ID: json.RawMessage(`"status-1"`), Method: "serveo.status", Params: json.RawMessage(`{}`)})
		case "plugin.auth.check", "plugin.private-tcp.connect.check":
			var params struct {
				AuthorizedKey bool `json:"authorized_key"`
				Identity      struct {
					ID          string `json:"id"`
					Fingerprint string `json:"fingerprint"`
				} `json:"identity"`
				Tunnel struct {
					Identity struct {
						ID string `json:"id"`
					} `json:"identity"`
				} `json:"tunnel"`
			}
			allow := false
			if json.Unmarshal(request.Params, &params) == nil {
				if request.Method == "plugin.auth.check" {
					// Replace this allowlist with your account/key directory lookup.
					allow = params.AuthorizedKey
					for _, fp := range strings.Split(os.Getenv("SERVEO_PLUGIN_FINGERPRINTS"), ",") {
						allow = allow || (fp != "" && fp == params.Identity.Fingerprint)
					}
				} else {
					allow = params.Identity.ID != "" && params.Identity.ID == params.Tunnel.Identity.ID
				}
			}
			_ = encoder.Encode(message{JSONRPC: "2.0", ID: request.ID, Result: map[string]any{"allow": allow}})
		case "plugin.tunnel.check":
			_ = encoder.Encode(message{JSONRPC: "2.0", ID: request.ID, Result: map[string]any{"allow": true}})
		case "plugin.tunnel.started", "plugin.tunnel.stopped":
			fmt.Fprintln(os.Stderr, request.Method, string(request.Params))
		case "":
			if string(request.ID) == `"status-1"` {
				fmt.Fprintln(os.Stderr, "Serveo status:", request.Result)
			}
		}
	}
}