1 files changed, 61 insertions, 0 deletions

diff --git a/webd/src/main.rs b/webd/src/main.rs
new file mode 100644
index 0000000..c2cf0ff
--- /dev/null
+++ b/webd/src/main.rs
@@ -0,0 +1,61 @@
+//! Browser gateway for zagan-bet.
+//!
+//! nginx terminates TLS, serves the static app and proxies `/ws` here. This
+//! process owns one upstream TLS connection and one `ClientCore` per browser
+//! session, so the browser never speaks the game wire protocol and never sees
+//! a certificate.
+
+mod config;
+mod session;
+
+use std::net::TcpListener;
+use std::sync::Arc;
+use std::thread;
+
+use config::Config;
+
+fn main() {
+    let config = match Config::from_env() {
+        Ok(config) => config,
+        Err(error) => {
+            eprintln!("webd: {error}");
+            std::process::exit(2);
+        }
+    };
+
+    let listener = match TcpListener::bind(&config.bind) {
+        Ok(listener) => listener,
+        Err(error) => {
+            eprintln!("webd: could not bind {}: {error}", config.bind);
+            std::process::exit(1);
+        }
+    };
+
+    println!(
+        "webd listening on ws://{} for origin {}; upstream {} pinned to {}; grace {}s",
+        config.bind,
+        config.origin,
+        config.upstream,
+        config.fingerprint,
+        config.grace.as_secs()
+    );
+
+    let registry = session::new_registry();
+    for stream in listener.incoming() {
+        let stream = match stream {
+            Ok(stream) => stream,
+            Err(error) => {
+                eprintln!("webd: accept failed: {error}");
+                continue;
+            }
+        };
+        let _ = stream.set_nodelay(true);
+        let config = config.clone();
+        let registry = Arc::clone(&registry);
+        thread::spawn(move || {
+            if let Err(error) = session::accept(stream, config, registry) {
+                eprintln!("webd: {error}");
+            }
+        });
+    }
+}