如何实现自定义域名功能

/** 域名状态 */type DomainStatus =  | 'pending'      // 等待配置  | 'verifying'    // 验证中  | 'active'       // 已激活  | 'cert_pending' // 等待证书  | 'cert_issued'  // 证书已签发  | 'error'        // 错误  | 'expired'      // 已过期  | 'deleted';     // 已删除
/** 站点记录 */interface Site {  id: string;  cnameKey: string;         // 随机生成的 CNAME 标识,如 cname-a3f8x2k9m4n7p1  // ...其他字段}
/** 域名记录 */interface Domain {  id: string;  siteId: string;           // 关联站点  domain: string;           // 用户自定义域名  status: DomainStatus;  dnsType?: 'A' | 'CNAME';  verifiedAt?: Date;  errorMessage?: string;  retryCount: number;  createdAt: Date;  updatedAt: Date;}
/** 证书记录 */interface Certificate {  id: string;  domainId: string;  domain: string;           // 冗余,便于查询  certPath: string;         // 证书路径  keyPath: string;          // 私钥路径  issuer: string;           // 颁发机构  issuedAt: Date;           // 签发时间  expiresAt: Date;          // 过期时间  autoRenew: boolean;       // 自动续期  lastRenewedAt?: Date;  createdAt: Date;}
/** 操作日志(可选) */interface DomainLog {  id: string;  domainId: string;  action: 'create' | 'verify' | 'activate' | 'cert_issue' | 'cert_renew' | 'error' | 'recover' | 'delete';  fromStatus?: DomainStatus;  toStatus?: DomainStatus;  message?: string;  operator: string;         // 'system' | userId  createdAt: Date;}

import { nanoid } from 'nanoid';
const generateCnameKey = () => `cname-${nanoid(16)}`;

import dns from 'dns/promises';
const PLATFORM_CNAME = 'site.platform.com';const PLATFORM_IPS = ['1.2.3.4', '5.6.7.8'];
/** 弱校验:检查域名是否指向平台 */export async function verifyDomain(domain: string): Promise<boolean> {  // 优先检查 CNAME  try {    const cnames = await dns.resolveCname(domain);    if (cnames.some(c => c.endsWith(PLATFORM_CNAME))) return true;  } catch {}
  // 兜底检查 A 记录  try {    const ips = await dns.resolve4(domain);    if (ips.some(ip => PLATFORM_IPS.includes(ip))) return true;  } catch {}
  return false;}
/** 周期轮询更新状态 */async function pollDomains() {  const domains = await db.domains.findMany({    where: { status: { in: ['pending', 'verifying'] } }  });
  for (const d of domains) {    const ok = await verifyDomain(d.domain);    await db.domains.update({      where: { id: d.id },      data: { status: ok ? 'active' : d.status }    });  }}

// ACME HTTP-01 验证路由app.get('/.well-known/acme-challenge/:token', async (req, res) => {  const { token } = req.params;  const host = req.headers.host;  if (!host) return res.status(400).send('Missing host header');
  // 从缓存读取该域名的 challenge  const challenge = await cache.get(`acme:${host}:${token}`);  if (!challenge) return res.status(404).send('Not found');
  res.type('text/plain').send(challenge);});
async function getSiteIdByHost(host: string): Promise<string | null> {  // 1. 先查缓存  const cached = await cache.get(`domain:${host}`);  if (cached) return JSON.parse(cached).siteId;
  // 2. 缓存未命中,查数据库  const domain = await db.domains.findUnique({    where: { domain: host, status: 'cert_issued' }  });  if (!domain) return null;
  // 3. 回填缓存  await cache.set(`domain:${host}`, JSON.stringify({ siteId: domain.siteId }), 'EX', 3600);  return domain.siteId;}
app.use(async (req, res, next) => {  const host = req.headers.host;  if (!host) return res.status(400).send('Missing host header');
  const siteId = await getSiteIdByHost(host);  if (!siteId) return res.status(404).send('Site not found');  req.siteId = siteId;  next();});
// 根据 siteId 渲染站点内容app.get('*', async (req, res) => {  const siteId = req.siteId;  const content = await db.sites.findOne({ where: { id: siteId } });  res.send(renderTemplate(content));});

import acme from 'acme-client';import fs from 'fs';import { exec } from 'child_process';
async function issueCertificate(domain: string) {  const client = new acme.Client({    directoryUrl: acme.directory.letsencrypt.production  });  const [key, csr] = await client.createCsr({ commonName: domain });
  const cert = await client.auto({    csr,    email: 'admin@platform.com',    termsOfServiceAgreed: true,    challengeCreateFn: async (authz, challenge, keyAuthorization) => {      // HTTP-01: 将验证内容写入缓存      if (challenge.type === 'http-01') {        await cache.set(          `acme:${domain}:${challenge.token}`,          keyAuthorization,          'EX',          600 // 10分钟过期        );      }    },    challengeRemoveFn: async (authz, challenge, keyAuthorization) => {      // 移除缓存      if (challenge.type === 'http-01') {        await cache.del(`acme:${domain}:${challenge.token}`);      }    },  });
  await fs.promises.writeFile(`/etc/nginx/certs/${domain}.crt`, cert.cert);  await fs.promises.writeFile(`/etc/nginx/certs/${domain}.key`, key.toString());
  // 校验 Nginx 配置  await execAsync('nginx -t');
  // 校验通过后重载  await execAsync('nginx -s reload');}
function execAsync(cmd: string): Promise<void> {  return new Promise((resolve, reject) => {    exec(cmd, (error) => {      if (error) reject(error);      else resolve();    });  });}

async function addDomain(userId: string, siteId: string, domain: string) {  // 1. 检查是否已被其他站点绑定且激活  const existing = await db.domains.findFirst({    where: { domain, status: { in: ['active', 'cert_issued'] } }  });
  if (existing && existing.siteId !== siteId) {    // 已被其他站点激活,检查当前 DNS 是否指向该用户的 CNAME    const site = await db.sites.findUnique({ where: { id: siteId } });    const isPointingToMe = await checkDnsPointsTo(domain, site.cnameKey);
    if (!isPointingToMe) {      throw new Error('该域名已被其他站点使用');    }
    // DNS 指向当前用户,标记原记录为过期,创建新记录    await db.domains.update({      where: { id: existing.id },      data: { status: 'expired' }    });  }
  // 2. 创建新的域名记录  return db.domains.create({    data: { siteId, domain, status: 'pending' }  });}
async function checkDnsPointsTo(domain: string, cnameKey: string): Promise<boolean> {  try {    const cnames = await dns.resolveCname(domain);    return cnames.some(c => c.startsWith(cnameKey));  } catch {    return false;  }}