feat(serve): Add --tls-cert and --tls-key to deno serve CLI (#25177)

Author: adamgreg

cli/args/flags.rs

@@ -4137,6 +4137,20 @@ Start a server defined in server.ts, watching for changes and running on port 50
       .help("Open the browser on the address that the server is running on.")
       .action(ArgAction::SetTrue)
     )
+    .arg(
+      Arg::new("tls-cert")
+        .long("tls-cert")
+        .value_name("FILE")
+        .help("Load TLS certificate from PEM encoded file")
+        .value_hint(ValueHint::FilePath)
+    )
+    .arg(
+      Arg::new("tls-key")
+        .long("tls-key")
+        .value_name("FILE")
+        .help("Load TLS private key from PEM encoded file")
+        .value_hint(ValueHint::FilePath)
+    )
     .arg(
       parallel_arg("multiple server workers")
     )
@@ -7842,6 +7856,22 @@ fn serve_parse(
 
   flags.tunnel = matches.get_flag("tunnel");
 
+  let tls_cert = matches.remove_one::<String>("tls-cert");
+  let tls_key = matches.remove_one::<String>("tls-key");
+
+  let tls_cert_and_key = match (tls_cert, tls_key) {
+    (Some(cert), Some(key)) => Some((cert, key)),
+    (None, None) => None,
+    _ => {
+      let mut app = app;
+      let subcommand = &mut app.find_subcommand_mut("serve").unwrap();
+      return Err(subcommand.error(
+        clap::error::ErrorKind::MissingRequiredArgument,
+        "Both --tls-cert and --tls-key must be specified, or neither",
+      ));
+    }
+  };
+
   let mut script_arg =
     matches.remove_many::<String>("script_arg").ok_or_else(|| {
       let mut app = app;
@@ -7865,6 +7895,7 @@ fn serve_parse(
     host,
     parallel: matches.get_flag("parallel"),
     open_site,
+    tls_cert_and_key,
   });
 
   Ok(())
@@ -9664,6 +9695,49 @@ mod tests {
         ..Flags::default()
       }
     );
+    let r = flags_from_vec(svec![
+      "deno",
+      "serve",
+      "--tls-cert",
+      "cert.pem",
+      "--tls-key",
+      "cert.key",
+      "main.ts"
+    ]);
+    assert_eq!(
+      r.unwrap(),
+      Flags {
+        subcommand: DenoSubcommand::Serve(ServeFlags {
+          tls_cert_and_key: Some((
+            "cert.pem".to_string(),
+            "cert.key".to_string()
+          )),
+          ..ServeFlags::new_default("main.ts".to_string(), 8000, "0.0.0.0")
+        }),
+        permissions: PermissionFlags {
+          allow_net: None,
+          ..Default::default()
+        },
+        code_cache_enabled: true,
+        ..Flags::default()
+      }
+    );
+    let r = flags_from_vec(svec![
+      "deno",
+      "serve",
+      "--tls-cert",
+      "cert.pem",
+      "main.ts"
+    ]);
+    assert!(r.is_err());
+    let r = flags_from_vec(svec![
+      "deno",
+      "serve",
+      "--tls-key",
+      "cert.key",
+      "main.ts"
+    ]);
+    assert!(r.is_err());
   }
 
   #[test]

cli/args/mod.rs

@@ -34,6 +34,7 @@ use deno_config::workspace::WorkspaceDirLintConfig;
 use deno_config::workspace::WorkspaceDirectory;
 use deno_config::workspace::WorkspaceDirectoryRc;
 use deno_config::workspace::WorkspaceLintConfig;
+use deno_core::anyhow::Context;
 use deno_core::anyhow::bail;
 use deno_core::error::AnyError;
 use deno_core::url::Url;
@@ -694,6 +695,37 @@ impl CliOptions {
     }
   }
 
+  pub fn serve_cert(&self) -> Result<Option<String>, AnyError> {
+    if let DenoSubcommand::Serve(flags) = self.sub_command() {
+      flags
+        .tls_cert_and_key
+        .as_ref()
+        .map(|(cert, _key)| {
+          std::fs::read_to_string(cert).with_context(|| {
+            format!("Failed to read TLS certificate file: {cert:?}")
+          })
+        })
+        .transpose()
+    } else {
+      Ok(None)
+    }
+  }
+
+  pub fn serve_key(&self) -> Result<Option<String>, AnyError> {
+    if let DenoSubcommand::Serve(flags) = self.sub_command() {
+      flags
+        .tls_cert_and_key
+        .as_ref()
+        .map(|(_cert, key)| {
+          std::fs::read_to_string(key)
+            .with_context(|| format!("Failed to read TLS key file: {key:?}"))
+        })
+        .transpose()
+    } else {
+      Ok(None)
+    }
+  }
+
   pub fn eszip(&self) -> bool {
     self.flags.eszip
   }

cli/factory.rs

@@ -1283,6 +1283,8 @@ impl CliFactory {
       node_ipc_init: cli_options.node_ipc_init(&self.sys())?,
       serve_port: cli_options.serve_port(),
       serve_host: cli_options.serve_host(),
+      serve_cert: cli_options.serve_cert()?,
+      serve_key: cli_options.serve_key()?,
       otel_config: cli_options.otel_config(),
       no_legacy_abort: cli_options.no_legacy_abort(),
       startup_snapshot: deno_snapshots::CLI_SNAPSHOT,

cli/lib/worker.rs

@@ -291,6 +291,8 @@ pub struct LibMainWorkerOptions {
   pub residual_lazy_esm_sources: &'static [(&'static str, &'static str)],
   pub serve_port: Option<u16>,
   pub serve_host: Option<String>,
+  pub serve_cert: Option<String>,
+  pub serve_key: Option<String>,
   pub close_on_idle: bool,
   pub maybe_initial_cwd: Option<Url>,
   /// When true, the `OffscreenCanvas` global is removed at bootstrap.
@@ -493,6 +495,8 @@ impl<TSys: DenoLibSys> LibWorkerFactorySharedState<TSys> {
           mode: WorkerExecutionMode::Worker,
           serve_port: shared.options.serve_port,
           serve_host: shared.options.serve_host.clone(),
+          serve_cert: shared.options.serve_cert.clone(),
+          serve_key: shared.options.serve_key.clone(),
           otel_config: shared.options.otel_config.clone(),
           no_legacy_abort: shared.options.no_legacy_abort,
           close_on_idle: args.close_on_idle,
@@ -739,6 +743,8 @@ impl<TSys: DenoLibSys> LibMainWorkerFactory<TSys> {
         no_legacy_abort: shared.options.no_legacy_abort,
         serve_port: shared.options.serve_port,
         serve_host: shared.options.serve_host.clone(),
+        serve_cert: shared.options.serve_cert.clone(),
+        serve_key: shared.options.serve_key.clone(),
         otel_config: shared.options.otel_config.clone(),
         close_on_idle: shared.options.close_on_idle,
         disable_offscreen_canvas: shared.options.disable_offscreen_canvas,

cli/rt/run.rs

@@ -1223,6 +1223,8 @@ pub struct RunOptions {
   pub auto_serve: bool,
   pub serve_port: Option<u16>,
   pub serve_host: Option<String>,
+  pub serve_cert: Option<String>,
+  pub serve_key: Option<String>,
   /// Enable HMR file watching from this directory.
   pub hmr_watch_dir: Option<PathBuf>,
   /// Callback invoked after each successful HMR replacement.
@@ -1677,6 +1679,8 @@ pub async fn run_with_options(
     node_ipc_init: deno_lib::args::node_ipc_init(&sys)?,
     serve_port: options.serve_port,
     serve_host: options.serve_host,
+    serve_cert: options.serve_cert,
+    serve_key: options.serve_key,
     otel_config: metadata.otel_config,
     no_legacy_abort: false,
     startup_snapshot: deno_snapshots::CLI_SNAPSHOT,

cli/rt_desktop/lib.rs

@@ -1669,6 +1669,8 @@ async fn run_desktop(
     auto_serve: true,
     serve_port: Some(desktop_serve_port),
     serve_host: Some("127.0.0.1".to_string()),
+    serve_cert: None,
+    serve_key: None,
     hmr_watch_dir: if is_framework_dev {
       None
     } else {

cli/tools/serve.rs

@@ -69,7 +69,11 @@ pub async fn serve(
   );
 
   if serve_flags.open_site {
-    let url = resolve_serve_url(serve_flags.host, serve_flags.port);
+    let url = resolve_serve_url(
+      serve_flags.host,
+      serve_flags.port,
+      serve_flags.tls_cert_and_key.is_some(),
+    );
     let _ = open::that_detached(url);
   }
 
@@ -232,18 +236,20 @@ async fn serve_with_watch(
   Ok(0)
 }
 
-fn resolve_serve_url(host: String, port: u16) -> String {
+fn resolve_serve_url(host: String, port: u16, https: bool) -> String {
   let host = if matches!(host.as_str(), "0.0.0.0" | "::") {
     "127.0.0.1".to_string()
   } else if std::net::Ipv6Addr::from_str(&host).is_ok() {
     format!("[{}]", host)
   } else {
     host
   };
-  if port == 80 {
-    format!("http://{host}/")
+  let (scheme, default_port) =
+    if https { ("https", 443) } else { ("http", 80) };
+  if port == default_port {
+    format!("{scheme}://{host}/")
   } else {
-    format!("http://{host}:{port}/")
+    format!("{scheme}://{host}:{port}/")
   }
 }
 
@@ -254,17 +260,36 @@ mod test {
   #[test]
   fn test_resolve_serve_url() {
     assert_eq!(
-      resolve_serve_url("localhost".to_string(), 80),
+      resolve_serve_url("localhost".to_string(), 80, false),
       "http://localhost/"
     );
     assert_eq!(
-      resolve_serve_url("0.0.0.0".to_string(), 80),
+      resolve_serve_url("0.0.0.0".to_string(), 80, false),
+      "http://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 80, false),
       "http://127.0.0.1/"
     );
-    assert_eq!(resolve_serve_url("::".to_string(), 80), "http://127.0.0.1/");
     assert_eq!(
-      resolve_serve_url("::".to_string(), 90),
+      resolve_serve_url("::".to_string(), 90, false),
       "http://127.0.0.1:90/"
     );
+    assert_eq!(
+      resolve_serve_url("localhost".to_string(), 443, true),
+      "https://localhost/"
+    );
+    assert_eq!(
+      resolve_serve_url("0.0.0.0".to_string(), 443, true),
+      "https://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 443, true),
+      "https://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 90, true),
+      "https://127.0.0.1:90/"
+    );
   }
 }

ext/http/00_serve.ts

@@ -1689,11 +1689,15 @@ function registerDeclarativeServer(exports) {
   return ({
     servePort,
     serveHost,
+    serveCert,
+    serveKey,
     workerCountWhenMain,
   }) => {
     const server = Deno.serve({
       port: servePort,
       hostname: serveHost,
+      cert: serveCert ?? undefined,
+      key: serveKey ?? undefined,
       [kLoadBalanced]: workerCountWhenMain == null
         ? true
         : workerCountWhenMain > 0,
@@ -1706,11 +1710,13 @@ function registerDeclarativeServer(exports) {
 
           let target;
           switch (localAddr.transport) {
-            case "tcp":
-              target = `http://${
+            case "tcp": {
+              const protocol = serveCert === null ? "http" : "https";
+              target = `${protocol}://${
                 formatHostName(localAddr.hostname)
               }:${localAddr.port}/`;
               break;
+            }
             case "unix":
               target = localAddr.path;
               break;

libs/cli_parser/src/flags.rs

@@ -576,6 +576,7 @@ pub struct ServeFlags {
   pub host: String,
   pub parallel: bool,
   pub open_site: bool,
+  pub tls_cert_and_key: Option<(String, String)>,
 }
 
 impl ServeFlags {
@@ -587,6 +588,7 @@ impl ServeFlags {
       host: host.to_owned(),
       parallel: false,
       open_site: false,
+      tls_cert_and_key: None,
     }
   }
 }

runtime/js/99_main.js

@@ -883,14 +883,16 @@ function bootstrapMainRuntime(runtimeOptions, warmup = false) {
       8: mode,
       9: servePort,
       10: serveHost,
-      11: serveIsMain,
-      12: serveWorkerCountOrIndex,
-      13: otelConfig,
-      15: standalone,
-      16: autoServe,
-      17: nodeClusterUniqueId,
-      18: nodeClusterSchedPolicy,
-      19: disableOffscreenCanvas,
+      11: serveCert,
+      12: serveKey,
+      13: serveIsMain,
+      14: serveWorkerCountOrIndex,
+      15: otelConfig,
+      17: standalone,
+      18: autoServe,
+      19: nodeClusterUniqueId,
+      20: nodeClusterSchedPolicy,
+      21: disableOffscreenCanvas,
     } = runtimeOptions;
 
     denoNs.build.standalone = standalone;
@@ -962,6 +964,8 @@ function bootstrapMainRuntime(runtimeOptions, warmup = false) {
             serve({
               servePort,
               serveHost,
+              serveCert,
+              serveKey,
               workerCountWhenMain: serveIsMain_
                 ? serveWorkerCountOrIndex_
                 : undefined,
@@ -1137,16 +1141,16 @@ function bootstrapWorkerRuntime(
       5: hasNodeModulesDir,
       6: argv0,
       7: nodeDebug,
-      13: otelConfig,
-      15: standalone,
-      17: nodeClusterUniqueId,
-      18: nodeClusterSchedPolicy,
-      19: disableOffscreenCanvas,
+      15: otelConfig,
+      17: standalone,
+      19: nodeClusterUniqueId,
+      20: nodeClusterSchedPolicy,
+      21: disableOffscreenCanvas,
     } = runtimeOptions;
 
     denoNs.build.standalone = standalone;
 
-    closeOnIdle = runtimeOptions[14];
+    closeOnIdle = runtimeOptions[16];
 
     performance.setTimeOrigin();
     globalThis_ = globalThis;