feat(serve): Add --tls-cert and --tls-key to deno serve CLI (#25177)

Author: adamgreg

cli/args/mod.rs

@@ -698,6 +698,37 @@ impl CliOptions {
     }
   }
 
+  pub fn serve_cert(&self) -> Result<Option<String>, AnyError> {
+    if let DenoSubcommand::Serve(flags) = self.sub_command() {
+      flags
+        .tls_cert_and_key
+        .as_ref()
+        .map(|(cert, _key)| {
+          std::fs::read_to_string(cert).with_context(|| {
+            format!("Failed to read TLS certificate file: {cert:?}")
+          })
+        })
+        .transpose()
+    } else {
+      Ok(None)
+    }
+  }
+
+  pub fn serve_key(&self) -> Result<Option<String>, AnyError> {
+    if let DenoSubcommand::Serve(flags) = self.sub_command() {
+      flags
+        .tls_cert_and_key
+        .as_ref()
+        .map(|(_cert, key)| {
+          std::fs::read_to_string(key)
+            .with_context(|| format!("Failed to read TLS key file: {key:?}"))
+        })
+        .transpose()
+    } else {
+      Ok(None)
+    }
+  }
+
   pub fn eszip(&self) -> bool {
     self.flags.eszip
   }

cli/factory.rs

@@ -1352,6 +1352,8 @@ impl CliFactory {
       node_ipc_init: cli_options.node_ipc_init(&self.sys())?,
       serve_port: cli_options.serve_port(),
       serve_host: cli_options.serve_host(),
+      serve_cert: cli_options.serve_cert()?,
+      serve_key: cli_options.serve_key()?,
       otel_config: cli_options.otel_config(),
       no_legacy_abort: cli_options.no_legacy_abort(),
       startup_snapshot: deno_snapshots::CLI_SNAPSHOT,

cli/lib/worker.rs

@@ -296,6 +296,8 @@ pub struct LibMainWorkerOptions {
   pub residual_lazy_esm_sources: &'static [(&'static str, &'static str)],
   pub serve_port: Option<u16>,
   pub serve_host: Option<String>,
+  pub serve_cert: Option<String>,
+  pub serve_key: Option<String>,
   pub close_on_idle: bool,
   pub maybe_initial_cwd: Option<Url>,
   /// When true, the `OffscreenCanvas` global is removed at bootstrap.
@@ -501,6 +503,8 @@ impl<TSys: DenoLibSys> LibWorkerFactorySharedState<TSys> {
           mode: WorkerExecutionMode::Worker,
           serve_port: shared.options.serve_port,
           serve_host: shared.options.serve_host.clone(),
+          serve_cert: shared.options.serve_cert.clone(),
+          serve_key: shared.options.serve_key.clone(),
           otel_config: shared.options.otel_config.clone(),
           no_legacy_abort: shared.options.no_legacy_abort,
           close_on_idle: args.close_on_idle,
@@ -752,6 +756,8 @@ impl<TSys: DenoLibSys> LibMainWorkerFactory<TSys> {
         no_legacy_abort: shared.options.no_legacy_abort,
         serve_port: shared.options.serve_port,
         serve_host: shared.options.serve_host.clone(),
+        serve_cert: shared.options.serve_cert.clone(),
+        serve_key: shared.options.serve_key.clone(),
         otel_config: shared.options.otel_config.clone(),
         close_on_idle: shared.options.close_on_idle,
         disable_offscreen_canvas: shared.options.disable_offscreen_canvas,

cli/rt/run.rs

@@ -1313,6 +1313,8 @@ pub struct RunOptions {
   pub auto_serve: bool,
   pub serve_port: Option<u16>,
   pub serve_host: Option<String>,
+  pub serve_cert: Option<String>,
+  pub serve_key: Option<String>,
   /// Enable HMR file watching from this directory.
   pub hmr_watch_dir: Option<PathBuf>,
   /// Callback invoked after each successful HMR replacement.
@@ -1778,6 +1780,8 @@ pub async fn run_with_options(
     node_ipc_init: deno_lib::args::node_ipc_init(&sys)?,
     serve_port: options.serve_port,
     serve_host: options.serve_host,
+    serve_cert: options.serve_cert,
+    serve_key: options.serve_key,
     otel_config: metadata.otel_config,
     no_legacy_abort: false,
     startup_snapshot: deno_snapshots::CLI_SNAPSHOT,

cli/rt_desktop/lib.rs

@@ -1800,6 +1800,8 @@ async fn run_desktop(
     auto_serve: true,
     serve_port: Some(desktop_serve_port),
     serve_host: Some("127.0.0.1".to_string()),
+    serve_cert: None,
+    serve_key: None,
     hmr_watch_dir: if is_framework_dev {
       None
     } else {

cli/tools/serve.rs

@@ -69,7 +69,11 @@ pub async fn serve(
   );
 
   if serve_flags.open_site {
-    let url = resolve_serve_url(serve_flags.host, serve_flags.port);
+    let url = resolve_serve_url(
+      serve_flags.host,
+      serve_flags.port,
+      serve_flags.tls_cert_and_key.is_some(),
+    );
     let _ = open::that_detached(url);
   }
 
@@ -229,18 +233,20 @@ async fn serve_with_watch(
   Ok(0)
 }
 
-fn resolve_serve_url(host: String, port: u16) -> String {
+fn resolve_serve_url(host: String, port: u16, https: bool) -> String {
   let host = if matches!(host.as_str(), "0.0.0.0" | "::") {
     "127.0.0.1".to_string()
   } else if std::net::Ipv6Addr::from_str(&host).is_ok() {
     format!("[{}]", host)
   } else {
     host
   };
-  if port == 80 {
-    format!("http://{host}/")
+  let (scheme, default_port) =
+    if https { ("https", 443) } else { ("http", 80) };
+  if port == default_port {
+    format!("{scheme}://{host}/")
   } else {
-    format!("http://{host}:{port}/")
+    format!("{scheme}://{host}:{port}/")
   }
 }
 
@@ -251,17 +257,36 @@ mod test {
   #[test]
   fn test_resolve_serve_url() {
     assert_eq!(
-      resolve_serve_url("localhost".to_string(), 80),
+      resolve_serve_url("localhost".to_string(), 80, false),
       "http://localhost/"
     );
     assert_eq!(
-      resolve_serve_url("0.0.0.0".to_string(), 80),
+      resolve_serve_url("0.0.0.0".to_string(), 80, false),
+      "http://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 80, false),
       "http://127.0.0.1/"
     );
-    assert_eq!(resolve_serve_url("::".to_string(), 80), "http://127.0.0.1/");
     assert_eq!(
-      resolve_serve_url("::".to_string(), 90),
+      resolve_serve_url("::".to_string(), 90, false),
       "http://127.0.0.1:90/"
     );
+    assert_eq!(
+      resolve_serve_url("localhost".to_string(), 443, true),
+      "https://localhost/"
+    );
+    assert_eq!(
+      resolve_serve_url("0.0.0.0".to_string(), 443, true),
+      "https://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 443, true),
+      "https://127.0.0.1/"
+    );
+    assert_eq!(
+      resolve_serve_url("::".to_string(), 90, true),
+      "https://127.0.0.1:90/"
+    );
   }
 }

ext/http/00_serve.ts

@@ -1649,11 +1649,15 @@ function registerDeclarativeServer(exports) {
   return ({
     servePort,
     serveHost,
+    serveCert,
+    serveKey,
     workerCountWhenMain,
   }) => {
     const server = Deno.serve({
       port: servePort,
       hostname: serveHost,
+      cert: serveCert ?? undefined,
+      key: serveKey ?? undefined,
       [kLoadBalanced]: workerCountWhenMain == null
         ? true
         : workerCountWhenMain > 0,
@@ -1666,11 +1670,13 @@ function registerDeclarativeServer(exports) {
 
           let target;
           switch (localAddr.transport) {
-            case "tcp":
-              target = `http://${
+            case "tcp": {
+              const protocol = serveCert === null ? "http" : "https";
+              target = `${protocol}://${
                 formatHostName(localAddr.hostname)
               }:${localAddr.port}/`;
               break;
+            }
             case "unix":
               target = localAddr.path;
               break;

libs/cli_parser/src/convert.rs

@@ -1480,6 +1480,14 @@ fn serve_parse(
   flags.code_cache_enabled = !result.get_bool("no-code-cache");
   flags.tunnel = result.get_bool("tunnel");
 
+  let tls_cert = result.get_one("tls-cert");
+  let tls_key = result.get_one("tls-key");
+
+  let tls_cert_and_key = match (tls_cert, tls_key) {
+    (Some(cert), Some(key)) => Some((cert.to_owned(), key.to_owned())),
+    _ => None,
+  };
+
   let script = result
     .get_one("script_arg")
     .map(|s| s.to_string())
@@ -1495,6 +1503,7 @@ fn serve_parse(
     script,
     port,
     host,
+    tls_cert_and_key,
     parallel,
     open_site: result.get_bool("open"),
   });

libs/cli_parser/src/defs.rs

@@ -745,6 +745,18 @@ pub static SERVE_SUBCOMMAND: CommandDef = CommandDef {
       .action(ArgAction::Set)
       .num_args(NumArgs::Exact(1))
 .help("The TCP address to serve on, defaulting to 0.0.0.0 (all interfaces)"),
+    ArgDef::new("tls-cert")
+      .long("tls-cert")
+      .action(ArgAction::Set)
+      .num_args(NumArgs::Exact(1))
+      .requires(&["tls-key"])
+      .help("Load TLS certificate from PEM encoded file"),
+    ArgDef::new("tls-key")
+      .long("tls-key")
+      .action(ArgAction::Set)
+      .num_args(NumArgs::Exact(1))
+      .requires(&["tls-cert"])
+      .help("Load TLS private key from PEM encoded file"),
     ArgDef::new("open").long("open").set_true()
 .help("Open the browser on the address that the server is running on."),
     ArgDef::new("tunnel")

libs/cli_parser/src/flags.rs

@@ -593,6 +593,7 @@ pub struct ServeFlags {
   pub host: String,
   pub parallel: bool,
   pub open_site: bool,
+  pub tls_cert_and_key: Option<(String, String)>,
 }
 
 impl ServeFlags {
@@ -603,6 +604,7 @@ impl ServeFlags {
       host: host.to_owned(),
       parallel: false,
       open_site: false,
+      tls_cert_and_key: None,
     }
   }
 }