chore: release 1.2.8

.editorconfig

@@ -0,0 +1,16 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab
+indent_size = 2

.github/workflows/docker.yml

@@ -4,7 +4,15 @@ concurrency:
   group: docker-${{ github.ref }}
   cancel-in-progress: true
 
-on: [push, workflow_dispatch]
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/docker.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'stapler/*'
+      - 'Dockerfile'
 
 env:
   BUILDKIT_VERSION: 'v0.29.0'

.github/workflows/lint.yml

@@ -1,10 +1,18 @@
-name: Python CI
+name: Python Lint CI
 
 concurrency:
-  group: python-${{ github.ref }}
+  group: lint-${{ github.ref }}
   cancel-in-progress: true
 
-on: [push, workflow_dispatch]
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/lint.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
 
 jobs:
   ruff:
@@ -12,47 +20,27 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
       - name: Run Ruff check
-        uses: https://github.com/astral-sh/ruff-action@v3
+        run: uv run ruff check --output-format=github
-        with:
-          args: "check"
 
   ruff-format-check:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
       - name: Run Ruff format check
-        uses: https://github.com/astral-sh/ruff-action@v3
+        run: uv run ruff format --check --output-format=github
-        with:
-          args: "format --check --diff"
 
   ty:
     runs-on: ubuntu-latest
     steps:
-      - name: Install UV
-        run: python3 -m pip install uv --break-system-packages
       - name: Checkout repository
         uses: actions/checkout@v5
-      - name: Sync Python dependencies
+      - name: Set up UV
-        run: python3 -m uv sync
+        uses: actions/setup-uv@v1
       - name: Run ty check
-        run: python3 -m uv run ty check --output-format github
+        run: uv run ty check --output-format=github
-
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install UV
-        run: python3 -m pip install uv --break-system-packages
-      - name: Checkout repository
-        uses: actions/checkout@v5
-      - name: Sync Python dependencies
-        run: python3 -m uv sync
-      - name: Run tests with coverage
-        run: python3 -m uv run coverage run -m unittest -v
-      - name: Generate coverage XML report
-        run: python3 -m uv run coverage xml
-      - name: Create coverage summary
-        uses: https://github.com/irongut/CodeCoverageSummary@v1.3.0
-        with:
-          filename: coverage.xml

.github/workflows/test.yml

@@ -0,0 +1,32 @@
+name: Python Test CI
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/test.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run tests with coverage
+        run: uv run coverage run -m unittest -v
+      - name: Generate coverage XML report
+        run: uv run coverage xml
+      - name: Create coverage summary
+        uses: actions/code-coverage-summary@v1.3.0
+        with:
+          filename: coverage.xml

README.md

@@ -1,4 +1,4 @@
-[![](https://git.klemek.fr/klemek/stapler/actions/workflows/lint.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=lint.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/docker.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=docker.yml)
+[![](https://git.klemek.fr/klemek/stapler/actions/workflows/lint.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=lint.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/test.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=test.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/docker.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=docker.yml)
 
 # Stapler <!-- omit in toc -->
 
@@ -115,18 +115,21 @@ PUT /{page}/
 # create archive from 'dist' dir and upload it to /my-project/
 tar -czC dist -f dist.tar.gz .
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary "@dist.tar.gz" \
   https://stapler-host/my-project/
 
 # same thing but one-liner
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary @- \
   https://stapler-host/my-project/
 
 # make stapler server identify myproject.example.com and /my-project/
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host: myproject.example.com' \
@@ -134,6 +137,7 @@ tar -czC dist . | curl -X PUT \
 
 # make stapler server identifiers myproject.example.com only
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host-Only: myproject.example.com' \
@@ -141,6 +145,7 @@ tar -czC dist . | curl -X PUT \
 
 # make a SPA site at /my-project/index.html
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-SPA: index.html' \
@@ -163,12 +168,14 @@ PUT /{page}/
 ```bash
 # create /my-project/ that redirects to https://github.com/my-project
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Redirect: https://github.com/my-project' \
   https://stapler-host/my-project/
 
 # simple redirect from root host to www
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: https://www.my-website.com' \
   -H 'X-Host: my-website.com' \
@@ -188,6 +195,7 @@ PUT /{page}/
 ```bash
 # create /my-website/ that proxies to http://host.containers.internal:8000
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: http://host.containers.internal:8000' \
   https://stapler-host/my-project/
@@ -203,6 +211,7 @@ DELETE /{page}/
 ```bash
 # delete /my-project/
 curl -X DELETE \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   https://stapler-host/my-project/
 ```
@@ -229,7 +238,7 @@ curl -X DELETE \
         run: tar -czC dist -f dist.tar.gz .
       - name: Deploy to Stapler server
         run: |
-          curl -X PUT --data-binary "@dist.tar.gz" \
+          curl -X PUT --fail-with-body --data-binary "@dist.tar.gz" \
             -H 'X-Token: ${{ secrets.STAPLER_TOKEN }}' \
             -H 'X-Host: ${{ vars.TARGET_HOST }}' \
             ${{ vars.STAPLER_URL }}

crontab.example

@@ -1,3 +1,3 @@
 # do daily/weekly/monthly maintenance
 # min   hour    day     month   weekday command
-0       3       *       *       1       /app/main.py renew
+0       3       *       *       1       stapler renew

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stapler"
-version = "1.2.2"
+version = "1.2.8"
 description = "Static pages as simple as a gzip file"
 requires-python = ">=3.14"
 dependencies = [
@@ -21,6 +21,7 @@ module-name = "stapler"
 [dependency-groups]
 dev = [
     "coverage>=7.13.5",
+    "parameterized>=0.9.0",
     "pytest>=9.0.3",
     "ruff>=0.15.10",
     "ty>=0.0.29",
@@ -28,7 +29,7 @@ dev = [
 
 [tool.ruff.lint]
 select = ["ALL"]
-ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT"]
+ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT", "E722"]
 
 [tool.coverage.run]
 source = ["stapler"]

stapler/cert_manager.py

@@ -5,6 +5,8 @@ import ssl
 import subprocess
 import typing
 
+from stapler.strings import valid_host
+
 if typing.TYPE_CHECKING:
     from .params import Parameters
 
@@ -57,7 +59,7 @@ class CertManager:
 
     def create_or_update(self, host: str) -> bool:
         created = self.init_cert(host)
-        if self.with_certbot and self.__create_certbot(host):
+        if self.with_certbot and valid_host(host) and self.__create_certbot(host):
             return True
         return created or self.__create_self_signed(host)
 

stapler/handlers.py

@@ -16,6 +16,7 @@ import requests
 
 from . import PKG_VERSION, STAPLER_ASCII, logs
 from .data_dir import DataDir
+from .strings import sanitize_string, valid_host
 
 if typing.TYPE_CHECKING:
     from .page import Page
@@ -25,6 +26,9 @@ if typing.TYPE_CHECKING:
 
 
 class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
+    timeout = 10
+    REQUEST_COUNT = 0
+
     @typing.override
     def __init__(
         self,
@@ -38,7 +42,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.__host: str | None = None
         self.__in_size: int | None = None
         self.https: bool = params.https
+        self.__class__.REQUEST_COUNT += 1
         super().__init__(*args, **kwargs)
+        with contextlib.suppress(Exception):
+            self.connection.close()
 
     @typing.override
     def send_error(
@@ -73,6 +80,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         else:
             self.send_status_only(code, message)
 
+    @typing.override
+    def address_string(self) -> str:  # pragma: no cover
+        return sanitize_string(super().address_string())
+
     @typing.override
     def log_message(self, format: str, *args: typing.Any) -> None:  # pragma: no cover
         fmt = "%s - " + format
@@ -83,6 +94,20 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         fmt = "%s - " + format
         self.logger.error(fmt, self.address_string(), *args)
 
+    def _pre_log_request(self) -> None:  # pragma: no cover
+        args = (
+            "...",
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "← %s - %s - %s - %s - %s"
+        if self.in_size > 0:
+            args = (*args, self.in_size)
+            fmt += " - %s"
+        self.logger.debug(fmt, *args)
+
     @typing.override
     def log_request(self, code: str = "?", size: str = "-") -> None:  # ty:ignore[invalid-method-override] # pragma: no cover
         if isinstance(code, http.HTTPStatus):
@@ -98,8 +123,14 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             code = color + str(code.value) + logs.TermColor.RESET
         if size == "" and self.out_size > 0:
             size = str(self.out_size)
-        args = (code, self.address_string(), self.host, self.requestline)
+        args = (
-        fmt = "→ %s - %s - %s - %s"
+            code,
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "→ %s - %s - %s - %s - %s"
         if size != "":
             args = (*args, size)
             fmt += " - %s"
@@ -117,6 +148,7 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.send_response(code, message)
         self.send_header("Content-Type", f"{content_type}; charset=UTF-8")
         self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Connection", "close")
         self.end_headers()
         self.wfile.write(encoded)
         self.close_connection = True
@@ -131,6 +163,7 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             headers = {}
         self.send_response(code, message)
         self.send_header("Content-Length", "0")
+        self.send_header("Connection", "close")
         for header, value in headers.items():
             self.send_header(header, value)
         self.end_headers()
@@ -179,9 +212,11 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 "transfer-encoding",
                 "server",
                 "date",
+                "connection",
             ]:
                 self.send_header(header, value.replace(target_host, self.host))
         self.send_header("Content-Length", str(out_size := len(response.content)))
+        self.send_header("Connection", "close")
         self.end_headers()
         if out_size > 0:
             self.wfile.write(response.content)
@@ -218,14 +253,6 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             and len(self.headers[key]) > 0
         )
 
-    def _pre_log_request(self) -> None:  # pragma: no cover
-        args = ("...", self.address_string(), self.host, self.requestline)
-        fmt = "← %s - %s - %s - %s"
-        if self.in_size > 0:
-            args = (*args, self.in_size)
-            fmt += " - %s"
-        self.logger.debug(fmt, *args)
-
     def server_signature(self) -> str:
         return self.server_version + "\n\n" + STAPLER_ASCII + "\n"
 
@@ -275,7 +302,12 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
         self.__target_redirect: str | None = None
         self.__target_proxy: str | None = None
         self.__target_spa: str | None = None
-        super().__init__(*args, directory=params.data_dir, **kwargs, params=params)  # ty:ignore[unknown-argument]
+        try:
+            super().__init__(*args, directory=params.data_dir, **kwargs, params=params)  # ty:ignore[unknown-argument]
+        except (BrokenPipeError, ConnectionResetError) as e:
+            self.logger.error("Connection lost: %s", str(e))  # noqa: TRY400
+        except:
+            self.logger.exception("Could not handle request")
 
     @property
     def token(self) -> str:
@@ -547,7 +579,7 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
                 f"Cannot use {self.HOST_ONLY_HEADER} with {self.HOST_HEADER}",
             )
             return None
-        if self.has_target_host and not self.__valid_host(self.target_host):
+        if self.has_target_host and not valid_host(self.target_host):
             self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid requested host")
             return None
         if self.has_target_proxy and self.has_target_redirect:
@@ -570,12 +602,6 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
             return match.group(1)
         return None
 
-    def __valid_host(self, host: str) -> bool:
-        return (
-            all(self.HOST_PART_REGEX.fullmatch(part) for part in host.split("."))
-            and len(host) < 256
-        )
-
     def __get_page(self, src_path: str) -> Page | None:
         if self.host == self.default_host:
             if (

stapler/strings.py

@@ -0,0 +1,19 @@
+import re
+
+__HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
+__SANITIZE_REGEX = re.compile(r"[^\x20-\x7F]")
+
+
+def valid_host(host: str) -> bool:
+    parts = host.split(".")
+    return (
+        len(parts) > 1
+        and len(parts[-1]) > 1
+        and all(__HOST_PART_REGEX.fullmatch(part) for part in parts)
+        and not all(part.isnumeric() for part in parts)
+        and len(host) < 256
+    )
+
+
+def sanitize_string(raw: str) -> str:
+    return __SANITIZE_REGEX.sub("?", raw)

tests/test_cert_manager.py

@@ -44,32 +44,32 @@ class TestRegistry(BaseTestCase):
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self._make_self_signed("localhost")
+            self._make_self_signed("example.com")
-            self.cert_manager.init(["localhost"])
+            self.cert_manager.init(["example.com"])
 
     def test_exists_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
-        assert self.cert_manager.exists("localhost")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
-        assert self.cert_manager.exists("localhost")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_fail(self) -> None:
-        assert not self.cert_manager.exists("localhost")
+        assert not self.cert_manager.exists("example.com")
 
     def test_exists_fail_without_certbot(self) -> None:
         self.cert_manager.with_certbot = False
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
-        assert not self.cert_manager.exists("localhost")
+        assert not self.cert_manager.exists("example.com")
 
     def test_init_cert_existing(self) -> None:
         with (
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self._make_self_signed("localhost")
+            self._make_self_signed("example.com")
-            assert not self.cert_manager.init_cert("localhost")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_fail(self) -> None:
         with (
@@ -77,7 +77,7 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.init_cert("localhost")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_new(self) -> None:
         with (
@@ -85,135 +85,137 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.init_cert("localhost")
+            assert self.cert_manager.init_cert("example.com")
 
     def test_create_or_update_existing_no_certbot(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.cert_manager.with_certbot = False
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.create_or_update("localhost")
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
-            process_mock.side_effect = lambda *_, **__: self._make_certbot("localhost")
+            process_mock.side_effect = lambda *_, **__: self._make_certbot(
-            assert self.cert_manager.create_or_update("localhost")
+                "example.com"
+            )
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value="", count=2),
             self.patch("subprocess.check_output", count=2) as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both_binary(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", count=2),
             self.patch("subprocess.check_output", count=0),
         ):
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_get_cert_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
+            self.cert_manager.get_cert("example.com"),
-            self.certbot_conf / "live" / "localhost" / CertManager.CRT_FILE,
+            self.certbot_conf / "live" / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
+            self.cert_manager.get_cert("example.com"),
-            self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+            self.self_signed_path / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_cert("localhost"),
+            lambda: self.cert_manager.get_cert("example.com"),
         )
 
     def test_get_key_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
+            self.cert_manager.get_key("example.com"),
-            self.certbot_conf / "live" / "localhost" / CertManager.KEY_FILE,
+            self.certbot_conf / "live" / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
+            self.cert_manager.get_key("example.com"),
-            self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+            self.self_signed_path / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_key("localhost"),
+            lambda: self.cert_manager.get_key("example.com"),
         )
 
     def test_sni_callback_no_host(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", count=0),
         ):
             self.cert_manager.sni_callback(self.socket_mock, None, self.context_mock)
 
     def test_sni_callback_fail(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("shutil.which", count=3),
             self.patch("ssl.create_default_context", count=0),
         ):
             self.cert_manager.sni_callback(
-                self.socket_mock, "new_host", self.context_mock
+                self.socket_mock, "example.fr", self.context_mock
             )
 
     def test_sni_callback_create_context(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.mock_call(
                 self.context_mock.load_cert_chain,
                 [
-                    self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+                    self.self_signed_path / "example.com" / CertManager.CRT_FILE,
-                    self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                    self.self_signed_path / "example.com" / CertManager.KEY_FILE,
                 ],
             ),
             self.patch("shutil.which", count=0),
         ):
             self.cert_manager.sni_callback(
-                self.socket_mock, "localhost", self.context_mock
+                self.socket_mock, "example.com", self.context_mock
             )
 
     def test_sni_callback_create_context_fail(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.patch("shutil.which", count=0),
         ):
             self.context_mock.load_cert_chain.side_effect = Exception
             self.cert_manager.sni_callback(
-                self.socket_mock, "localhost", self.context_mock
+                self.socket_mock, "example.com", self.context_mock
             )
             self.context_mock.load_cert_chain.assert_called_once_with(
-                self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+                self.self_signed_path / "example.com" / CertManager.CRT_FILE,
-                self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                self.self_signed_path / "example.com" / CertManager.KEY_FILE,
             )
 
     def _make_self_signed(self, host: str) -> None:

tests/test_data_dir.py

@@ -59,11 +59,6 @@ class TestDataDir(BaseTestCase):
         self.__create_path("test_1")
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 
-    def test_get_file_cannot_read(self) -> None:
-        self.__create_path("test_1", {".value": "value"})
-        (self.tmp_path / "test_1" / ".value").chmod(0o333)
-        self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
-
     def test_get_file_invalid_path(self) -> None:
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 

tests/test_handlers.py

@@ -162,6 +162,36 @@ class TestRequestHandler(BaseHandlerTestCase):
             handler.data_dir = self.data_dir
             return handler
 
+    def test_handle_errors_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = Exception
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
+    def test_handle_disconnect_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = BrokenPipeError
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
     def test_do_head_forward(self) -> None:
         handler = self._get_handler()
         with (
@@ -1253,6 +1283,7 @@ class TestUpgradeHandler(BaseHandlerTestCase):
             handler.headers = collections.defaultdict(lambda: None, headers)  # ty:ignore[invalid-assignment]
             handler.rfile = rfile if rfile is not None else io.BytesIO()
             handler.wfile = io.BytesIO()
+            handler.client_address = ("127.0.0.1", 12345)
             handler.logger = unittest.mock.Mock(logging.Logger)
             handler.data_dir = self.data_dir
             return handler

tests/test_strings.py

@@ -0,0 +1,22 @@
+import parameterized
+
+from stapler.strings import sanitize_string, valid_host
+
+from . import BaseTestCase
+
+
+class TestStrings(BaseTestCase):
+    def test_sanitize(self) -> None:
+        self.assertEqual("??A??", sanitize_string("\n\tA\x00\x99"))
+
+    @parameterized.parameterized.expand(
+        [("example.com"), ("test-test.com"), ("subdomain.example.com")]
+    )
+    def test_valid_host(self, host: str) -> None:
+        self.assertTrue(valid_host(host), host)
+
+    @parameterized.parameterized.expand(
+        [("example.c"), ("localhost"), ("127.0.0.1"), ("test..com"), ("www-.test.com")]
+    )
+    def test_invalid_host(self, host: str) -> None:
+        self.assertFalse(valid_host(host), host)

uv.lock

@@ -127,6 +127,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
 ]
 
+[[package]]
+name = "parameterized"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ea/49/00c0c0cc24ff4266025a53e41336b79adaa5a4ebfad214f433d623f9865e/parameterized-0.9.0.tar.gz", hash = "sha256:7fc905272cefa4f364c1a3429cbbe9c0f98b793988efb5bf90aac80f08db09b1", size = 24351, upload-time = "2023-03-27T02:01:11.592Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/00/2f/804f58f0b856ab3bf21617cccf5b39206e6c4c94c2cd227bde125ea6105f/parameterized-0.9.0-py2.py3-none-any.whl", hash = "sha256:4e0758e3d41bea3bbd05ec14fc2c24736723f243b28d702081aef438c9372b1b", size = 20475, upload-time = "2023-03-27T02:01:09.31Z" },
+]
+
 [[package]]
 name = "pluggy"
 version = "1.6.0"
@@ -203,7 +212,7 @@ wheels = [
 
 [[package]]
 name = "stapler"
-version = "1.2.2"
+version = "1.2.8"
 source = { editable = "." }
 dependencies = [
     { name = "requests" },
@@ -212,6 +221,7 @@ dependencies = [
 [package.dev-dependencies]
 dev = [
     { name = "coverage" },
+    { name = "parameterized" },
     { name = "pytest" },
     { name = "ruff" },
     { name = "ty" },
@@ -223,6 +233,7 @@ requires-dist = [{ name = "requests", specifier = ">=2.33.1" }]
 [package.metadata.requires-dev]
 dev = [
     { name = "coverage", specifier = ">=7.13.5" },
+    { name = "parameterized", specifier = ">=0.9.0" },
     { name = "pytest", specifier = ">=9.0.3" },
     { name = "ruff", specifier = ">=0.15.10" },
     { name = "ty", specifier = ">=0.0.29" },
@@ -230,26 +241,26 @@ dev = [
 
 [[package]]
 name = "ty"
-version = "0.0.33"
+version = "0.0.34"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/84/44/9478c50c266826c1bf30d1692e589755bffa8f1c0a3eb7af8a346c255991/ty-0.0.33.tar.gz", hash = "sha256:46d63bda07403322cb6c28ccfdd5536be916e13df725c29f7ccd0a21f06bd9e8", size = 5559373, upload-time = "2026-04-28T10:45:13.18Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c4/69/e24eefe2c35c0fdbdec9b60e162727af669bb76d64d993d982eb67b24c38/ty-0.0.34.tar.gz", hash = "sha256:a6efe66b0f13c03a65e6c72ec9abfe2792e2fd063c74fa67e2c4930e29d661be", size = 5585933, upload-time = "2026-05-01T23:06:46.388Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/24/e287388c63a19191be26b32ff4dbd06029834068150ebe2532939bc4c851/ty-0.0.33-py3-none-linux_armv6l.whl", hash = "sha256:94d0a9d2234261a8911396d59e506b5923fe0971dbda43b9dcea287936887fcc", size = 11021308, upload-time = "2026-04-28T10:45:43.34Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7b/8b85003d6639ef17a97dcbb31f4511cfe78f1c81a964470db100c8c883e7/ty-0.0.34-py3-none-linux_armv6l.whl", hash = "sha256:9ecc3d14f07a95a6ceb88e07f8e62358dbd37325d3d5bd56da7217ff1fef7fb8", size = 11067094, upload-time = "2026-05-01T23:06:21.133Z" },
-    { url = "https://files.pythonhosted.org/packages/00/ca/ba1eed819895bd239fba8ee35dfcd5fcb266c203b0914a17a59579096bb5/ty-0.0.33-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:e4a2b5ba078f90de342f56b5f7979bb77c9b9b1d8625a041352ffc6ee93c4073", size = 10777272, upload-time = "2026-04-28T10:45:32.905Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/25/b0098f65b020b015c40567c763fc66fffbec88b2ba6f584bca1e92f05ebb/ty-0.0.34-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0dccffd8a9d02321cd2dee3249df205e26d62694e741f4eeca36b157fd8b419f", size = 10840909, upload-time = "2026-05-01T23:06:18.409Z" },
-    { url = "https://files.pythonhosted.org/packages/25/a8/c3131d37b44b3fea1d6654a1c929a0cd0873822f77a90482b8ec28f6fbbd/ty-0.0.33-py3-none-macosx_11_0_arm64.whl", hash = "sha256:84ff5707825e9af9668d2bcf66975f93e520a63b524ab494e3a8265735be2563", size = 10201078, upload-time = "2026-04-28T10:45:23.374Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/55/5e4adcf7d2a1006b844903b27cb81244a9b748d850433a46a6c21776c401/ty-0.0.34-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b0ea47a2998e167ab3b21d2f4b5309a9cf33c297809f6d7e3e753252223174d0", size = 10279378, upload-time = "2026-05-01T23:06:37.962Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/db/d8e37ff0045810cc65e1ff36aa0da0a2253c05659787ac987df8a16c7897/ty-0.0.33-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e375285736f57886868e7af0b11c7b0ec5b6543fa15e7ad2a714fed9f077d4e0", size = 10732347, upload-time = "2026-04-28T10:45:21.444Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/91/f537dca0db8fe2558e8ab04d8941d687b384fcc1df5eb9023b2db75ac26c/ty-0.0.34-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b37da00b41a118a459ae56d8947e70651073fb33ebfbceb820e4a10b22d5023", size = 10817423, upload-time = "2026-05-01T23:06:26.247Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/1a/20e83a412506a918e4684fc67b567cf7cc13b105470b3428cb23c3d5aa13/ty-0.0.33-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:5680f6350c3b4e46b8bff6d7bb132366ea239463d6cad4892725d06046e65464", size = 10808238, upload-time = "2026-04-28T10:45:38.565Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/c4/55a3ad1da2815af1009bdc1b8c90dc11a364cd314e4b48c5128ba9d38859/ty-0.0.34-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:81cbbb93c2342fe3de43e625d3a9eb149633e9f485e816ebf6395d08685355d8", size = 10851826, upload-time = "2026-05-01T23:06:24.198Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/4b/d0a39f4464dc6cb4cc2c159473ce216bd1846bfb684c0323a3cb36dce5c6/ty-0.0.33-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c5535538bad8d0f7e62bcdff02197cdb30e41451d80b35d27e17d128f2e1dc5d", size = 11288348, upload-time = "2026-04-28T10:45:08.419Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/8c/9c7606af22d73fb43ea4369472d9c66ece11231be73b0efe8e3c61655559/ty-0.0.34-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4c5b4dea1594a021289e172582df9cde7089dce14b276fc650e7b212b1772e12", size = 11356318, upload-time = "2026-05-01T23:06:51.139Z" },
-    { url = "https://files.pythonhosted.org/packages/35/7e/f1745e0f9583363d7a83d9a4990fc244f76ecc30840ddad83dc16a33c52d/ty-0.0.33-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:da196c42bbbc069e1e21e3e52107c061aa9660352dae57a41930690b56e2c02d", size = 11789907, upload-time = "2026-04-28T10:45:19.064Z" },
+    { url = "https://files.pythonhosted.org/packages/20/54/bb423f663721ab4138b216425c6b55eaefd3a068243b24d6d8fe988f4e13/ty-0.0.34-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:030fb00aa2d2a5b5ae9d9183d574e0c82dae80566700a7490c43669d8ece40cd", size = 11902968, upload-time = "2026-05-01T23:06:35.82Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/71/25f39f46a12d662859d45bc648555d0661044eb43db6b5648c9947487da9/ty-0.0.33-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9281672921ef6d4460e03146b5e6c18cb1a3e3a3b8a1a88f6f33226d05a469b7", size = 11500774, upload-time = "2026-04-28T10:45:48.012Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/22/01122b21ab6b534a2f618c6bbe5f1f7f49fd56f4b2ec8887cd6d40d08fb3/ty-0.0.34-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ae9555e24e36c63a8218e037a5a63f15579eb6aa94f41017e57cd41d335cfb5", size = 11548860, upload-time = "2026-05-01T23:06:42.155Z" },
-    { url = "https://files.pythonhosted.org/packages/94/ec/136959ecbb7c71cb90537f5aea441c73f4ab24612868a6ecdc9d7444d32d/ty-0.0.33-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:82c1b8f303f82da64e878108e764be3ecbcd7c9903ac0a7f7031614ed00b97ab", size = 11360314, upload-time = "2026-04-28T10:45:05.402Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/50/86008b1392ec64bed1957bbcc7aaa43b466b50dfc91bb131841c21d7c5c3/ty-0.0.34-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:99eb23df9ed129fc26d1ab00d6f0b8dfe5253b09c2ac6abdb11523fa70d67f10", size = 11457097, upload-time = "2026-05-01T23:06:53.477Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/95/32809575c222f00beed498cb728e9290a0f5009f930025381bb7253b2206/ty-0.0.33-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:efe3af412c9ff67bce5fa37d0a2b0d8555c24072b145a5bac6c79637f1c83abe", size = 10707785, upload-time = "2026-04-28T10:45:10.836Z" },
+    { url = "https://files.pythonhosted.org/packages/92/3e/4558b2296963ba99c58d8409c57d7db4f3061b656c3613cb21c02c1ef4c2/ty-0.0.34-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:85de45382016eceae69e104815eb2cfa200787df104002e262a86cbd43ed2c02", size = 10798192, upload-time = "2026-05-01T23:06:40.004Z" },
-    { url = "https://files.pythonhosted.org/packages/13/89/c8e9531f7aa4a093359e15fa32c8e1277fbbe90d16894d7c6032d29f4b34/ty-0.0.33-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:aeec29c91ea768601747da546c3efc20b72c2fb1bd52bcc786a5c6eeff51d27b", size = 10834987, upload-time = "2026-04-28T10:45:40.738Z" },
+    { url = "https://files.pythonhosted.org/packages/76/bf/650d24402be2ef678528d60caac1d9477a40fc37e3792ecef07834fd7a4a/ty-0.0.34-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:14cb575fb8fa5131f5129d100cfe23c1575d23faf5dfc5158432749a3e38c9b5", size = 10890390, upload-time = "2026-05-01T23:06:33.076Z" },
-    { url = "https://files.pythonhosted.org/packages/31/16/9835fbcf5338af1a1917bd28fdb8a7193c210b83f243aa286fa9f79cb3ad/ty-0.0.33-py3-none-musllinux_1_2_i686.whl", hash = "sha256:a535977c52bbb5f7e96b8b70a6ad375ad077f4a9ff2492508ea3816a2b403819", size = 10968968, upload-time = "2026-04-28T10:45:30.26Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/ef/ccd2ca13906079f7935fd7e067661b24233017f57d987d51d6a121d85bb5/ty-0.0.34-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c6fc0b69d8450e6910ba9db34572b959b81329a97ae273c391f70e9fb6c1aade", size = 11031564, upload-time = "2026-05-01T23:06:55.812Z" },
-    { url = "https://files.pythonhosted.org/packages/36/69/64c76aabc1bc70c7f24b686cd93c3407f8ea430905e395f59bf9603ef571/ty-0.0.33-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:1d732facf39fcb221ba279d469c5040d37883e964f123b1563888efd34818180", size = 11458077, upload-time = "2026-04-28T10:45:45.971Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/2d/d27b72005b6f43599e3bcabab0d7135ac0c230b7a307bb99f9eea02c1cda/ty-0.0.34-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:30dfcec2f0fde3993f4f912ed0e057dcbebc8615299f610a4c2ddb7b5a3e1e06", size = 11553430, upload-time = "2026-05-01T23:06:31.096Z" },
-    { url = "https://files.pythonhosted.org/packages/91/84/fae27b0c4718776a298690d31ca4cc1995f2e3e1c63a7b59e84c41498e9a/ty-0.0.33-py3-none-win32.whl", hash = "sha256:d90960b574428dc252f85e8598ec5fcb7f619794196b2fc95a90da075ed4681c", size = 10345364, upload-time = "2026-04-28T10:45:16.836Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/12/20812e1ad930b8d4af70eebf19ad23cff6e31efcfa613ef884531fcdbaa1/ty-0.0.34-py3-none-win32.whl", hash = "sha256:97b77ddf007271b812a313a8f0a14929bc5590958433e1fb83ef585676f53342", size = 10436048, upload-time = "2026-05-01T23:06:49.108Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/a0/a2938b23ae3e1a09a2d7c189e2ac5f7113676bae4e0e23948b568e18e5f8/ty-0.0.33-py3-none-win_amd64.whl", hash = "sha256:c1c3aec62c44de610c6e95f0a4e97ac3dbc07934bfdbf1fd90d758c9ff72f48e", size = 11342470, upload-time = "2026-04-28T10:45:26.455Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6a/afa095c5987868fbda27c0f731146ac8e3d07b357adfa83daccaee5b1a16/ty-0.0.34-py3-none-win_amd64.whl", hash = "sha256:1f543968accb952705134028d1fda8656882787dbbc667ad4d6c3ba23791d604", size = 11462526, upload-time = "2026-05-01T23:06:28.514Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/62/7fb948aace38d2f6329261bb33c035a8484549c74f1db28649c7a4c6fed9/ty-0.0.33-py3-none-win_arm64.whl", hash = "sha256:0d44f99ba1b441e55e2aa301b2ac0a21112784931b46a5f66f4ea9efe5620d97", size = 10742673, upload-time = "2026-04-28T10:45:35.555Z" },
+    { url = "https://files.pythonhosted.org/packages/63/8f/bf041a06260d77662c0605e56dacfe90b786bf824cbe1aed238d15fe5e84/ty-0.0.34-py3-none-win_arm64.whl", hash = "sha256:ea09108cbcb16b6b06d7596312b433bf49681e78d30e4dc7fb3c1b248a95e09a", size = 10846945, upload-time = "2026-05-01T23:06:44.428Z" },
 ]
 
 [[package]]