$ show daquinoaldo/https-localhost
https-localhost is a developer tool that runs an HTTPS server on localhost using locally-trusted SSL certificates. It downloads the mkcert binary appropriate for the host OS/architecture, executes it to install a local CA into system/browser trust stores, and generates per-host certificates. The resulting HTTPS server can either serve static files from a directory or act as a reverse proxy to an existing HTTP/HTTPS server, with optional HTTP-to-HTTPS redirection. It ships as both a global CLI (the `serve` binary) and a programmatic API (`createServer()`, `getCerts()`). Architecturally it is a small, well-separated set of ES modules built directly on Node's built-in http/https servers with no framework dependency. The router dispatches between a static file handler and a proxy handler; CORS headers are applied globally; environment/CLI configuration is validated through a zod schema where CLI flags take precedence over environment variables. External runtime dependencies are deliberately minimal: only `mrmime` for MIME lookup and `zod` for config validation, plus the downloaded mkcert binary. The static handler is the strongest piece: it implements path-traversal sanitization, ETag/Last-Modified conditional requests, byte-range responses (206/416), HEAD/OPTIONS support, directory index serving with query-preserving trailing-slash redirects, and custom 404.html lookup. The proxy handler strips hop-by-hop headers, injects X-Forwarded-* headers, tunnels WebSocket upgrades, and cleanly returns 502 when upstreams fail or die mid-response. Test coverage is comprehensive and genuinely exercises real sockets: unit tests for env parsing and certificate lifecycle, integration tests for static serving and proxying, CLI spawn tests, and edge-case tests for malformed percent-encoding, CORS preflight without upstream contact, and client hang prevention. CI runs a matrix across Ubuntu/macOS and Node 24/26 with strict type-aware linting, dead-code detection (knip), and formatting checks. Minor weaknesses: synchronous fs calls in the static handler (fine for a dev tool), a `process.exit()` call inside library code for unsupported platforms, minimal error handling in the mkcert download routine (only follows 302s, ignores non-2xx statuses), and no Windows CI coverage despite Windows-specific code paths.
The LLM identified 3 files worth highlighting for reuse:
A self-contained static file server on Node's http module. Implements path-traversal sanitization by resolving the URL against the base directory and verifying the prefix, byte-range requests with correct 206/416 semantics and Content-Range headers, ETag/If-None-Match plus Last-Modified/If-Modified-Since conditional handling, HEAD/OPTIONS support, 405 for other methods, directory index serving with query-string-preserving trailing-slash redirects, and optional custom 404.html. Only depends on node:fs, node:path, node:http types, and mrmime for MIME detection, so it can be lifted into any Node project needing a secure, spec-correct static handler.
An HTTP(S) reverse proxy component with correct hop-by-hop header filtering (Connection, Transfer-Encoding, Proxy-Authorization, etc.), X-Forwarded-For/Proto/Host injection, protocol-aware default port selection, clean 502 responses when the upstream is unreachable, and destruction of the client connection if the upstream dies mid-stream to prevent hangs. Also exports a WebSocket upgrade handler that tunnels connections by writing the upstream 101 response headers manually and piping client socket to upstream socket. Imports only Node built-ins, making it directly reusable as a standalone proxy module.
Manages the full lifecycle of locally-trusted development certificates: selects the correct mkcert binary per OS/arch, downloads it from GitHub releases when missing, chmods it executable, runs it with -install to register a local CA, falls back to regenerating certificates when key/cert files are absent (with a custom-path error path that fails loudly rather than silently regenerating elsewhere), and provides an idempotent removal routine. Includes reinstall semantics and cross-platform app-data path resolution. A clean example of platform-aware binary provisioning plus certificate lifecycle management that could be reused in other local development tooling.