feat: support openresty

[oowl]

support openresty luajit interactive

[guysv]

Hey thanks for the PR! Could you please instruct me on how to use it?

[oowl]

Ok, https://github.com/openresty/lua-nginx-module running luajit on Nginx, And it impl some nginx api in luajit, so i want to use ilua online to execute this nginx related api. i use websocket to connect openresty server, use websocket message to trigger lua execute and complete, and return result to jupyter. Just install openresty, and then exec
ilua -i openresty

[guysv]

Okay I managed to try it out!
First, there's a missing module exception for autobahn. consider adding it to the dependencies.

Second, very cool.

I see ssl is not implemented. Maybe we can self-sign ssl certs and configure openresty to use them so the console will have access to the ssl module. But maybe that's a feature for later 🤣

---

Now regarding actually merging this.
I'd like to ask you to consider publishing this as a stand-alone package. You can depend on ilua for the kernel classes and override what you need. If you need help API-wise for such integration i'd love to help! But I actually think you can manage to get this working just by subclassing my kernel.

[guysv]

from . import websocket

[guysv]

I see nginx is listening on 0.0.0.0, and that route goes into the unsandboxed lua interpreter

Not good for security.

[guysv]

Well to solve this the first step would be to switch to 127.0.0.1. But even then is vulnerable to dns rebind.

This is (semi? not really?) mitigated in the native lua implementation by sticking to FIFOs. I don't plan on adding HMAC to the lua implementation soon 🤣 , so I guess you can for now at least listen too on a unix socket instead of tcp.

[oowl]

Oh, i switched to TCP that does not using a UNIX socket, because twisted WebSocket not support UNIX socket. I debug this long time.

[guysv]

pretty sure you can, let me get back to you with a POC.

[oowl]

I will consider creating iresty repo to achieve this( using ilua for the kernel classes ), but now I have no more time to do this. This implement looks dirty now.