main.go

package main

import (
	"bytes"
	cryptorand "crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"encoding/json"
	"errors"
	"flag"
	"fmt"
	"github.com/Sirupsen/logrus"
	"github.com/hashicorp/golang-lru"
	"github.com/kardianos/service"
	"gopkg.in/natefinch/lumberjack.v2"
	"io"
	"io/ioutil"
	"math"
	"net"
	"os"
	"regexp"
	"runtime"
	"runtime/debug"
	"strconv"
	"strings"
	"sync"
	"time"
)

const (
	LETSENCRYPT_CREATE_CERTIFICATE_TIMEOUT = time.Minute
	LETSENCRYPT_PRODUCTION_API_URL         = "https://acme-v01.api.letsencrypt.org/directory"
	LETSENCRYPT_STAGING_API_URL            = "https://acme-staging.api.letsencrypt.org/directory"
	PRIVATE_KEY_BITS                       = 2048
	TRY_COUNT                              = 10
	RETRY_SLEEP                            = time.Second * 5
	STATE_FILEMODE                         = 0600
	SERVICE_NAME_EXAMPLE                   = "<service-name>"
	WORKING_DIR_ARG_NAME                   = "working-dir"
)

var (
	bindTo                        = flag.String("bind-to", ":443", "")
	targetConnString              = flag.String("target", ":80", "IP, :port or IP:port. Default port is 80. Default IP - same which receive connection.")
	targetConnTimeout             = flag.Duration("target-conn-timeout", time.Second, "")
	acmeApiUrl                    = flag.String("acme-server", LETSENCRYPT_PRODUCTION_API_URL, "")
	acmeTestServer                = flag.Bool("test", false, "Use test lets encrypt server instead of <acme-server>")
	certDir                       = flag.String("cert-dir", "certificates", `Directory for save cached certificates. Set cert-dir=- for disable save certs`)
	certMemCount                  = flag.Int("in-memory-cnt", 100, "How many count of certs cache in memory for prevent parse it from file")
	stateFilePath                 = flag.String("state-file", "state.json", "Path to save some state data, for example account key")
	proxyMode                     = flag.String("proxy-mode", "http", "Proxy-mode after tls handle (http|tcp).")
	httpRealIPHeader              = flag.String("real-ip-header", "X-Real-IP", "The header will contain original IP of remote connection. It can be few headers, separated by comma.")
	additionalHeadersParam        = flag.String("additional-headers", "X-Forwarded-Proto=https", "Additional headers for proxied requests. Several headers separated by comma.")
	logLevel                      = flag.String("loglevel", "warning", "fatal|error|warning|info|debug")
	logOutput                     = flag.String("logout", "-", "Path to logout. Special: '-' (without quotes) - stderr")
	versionPrint                  = flag.Bool("version", false, "print version and exit.")
	nonCertDomains                = flag.String("non-cert-domains", "", "No obtain certificate for mathed domains. Regexpes separated by comma.")
	serviceAction                 = flag.String("service-action", "", "start,stop,install,uninstall,reinstall")
	serviceName                   = flag.String("service-name", SERVICE_NAME_EXAMPLE, "service name, need for service actions")
	workingDir                    = flag.String(WORKING_DIR_ARG_NAME, "", "Set working dir")
	parallelAcmeRequests          = flag.Int("acme-parallel", 10, "count of parallel requests for acme server")
	timeToRenew                   = flag.Duration("time-to-renew", time.Hour*24*30, "Time to end of certificate for background renew.")
	logrotateTime                 = flag.String("logrotate-time", "", "minutely|hourly|daily|weekly|monthly|yearly|\"\", empty or none mean no logrotate by time. Weekly - rotate log at midnight from sunday to monday")
	logrotateSize                 = flag.Int("logrotate-mb", 100, "logrotate by size in megabytes. 0 Mean no logrotate by size.")
	logrotateMaxBackups           = flag.Int("logrotate-count", 30, "How many old backups keep. 0 mean infinite")
	logrotateMaxAge               = flag.Int("logrotate-age", 30, "How many days keep old backups")
	noLogStderr                   = flag.Bool("no-log-stderr", false, "supress log to stderr")
	allowIPsString                = flag.String("allowed-ips", "auto", "allowable ip-addresses (ipv4,ipv6) separated by comma. It can contain special variables (without quotes): 'auto' - try to auto determine allowable address, it logic can change between versions. 'local' (all autodetected local IP) and 'nat' - detect IP by request to http://ifconfig.io/ip - it need for public ip autodetection behinde nat.")
	allowIPRefreshInterval        = flag.Duration("allow-ips-refresh", time.Hour, "For local, domain and ifconfig.io - how often allow ip addresses will be refreshed. Allowable format https://golang.org/pkg/time/#ParseDuration")
	getIPByExternalRequestTimeout = flag.Duration("get-ip-by-external-request-timeout", 10*time.Second, "Timeout for request to external service for ip detection. For example when server behind nat.")
	minTLSVersion                 = flag.String("min-tls", "", "Minimul supported tls version: ssl3,tls10,tls11,tls12. Default is golang's default.")
	connectionIDHeader            = flag.String("connection-id-header", "", "Header name for send connection id to backend in http proxy mode. Default it isn't send.")
	defaultDomain                 = flag.String("default-domain", "", "Usage when SNI domain doesn't available (have zero length). For example client doesn't support SNI. It used for obtain and use certificate only. It isn't forse set header HOST in request.")
)

var (
	VERSION               = "unversioned" // need be var becouse it redefine by --ldflags "-X main.VERSION" during autobuild
	realIPHeaderNames     [][]byte        // IP headers, generated by the proxy, included real IP address
	cutHeaders            [][]byte        // internal - all headers, that cut from request (upper case).
	additionalHeaders     []byte          // prepared additional headers
	acmeService           *acmeStruct
	nonCertDomainsRegexps []*regexp.Regexp
	paramTargetTcpAddr    *net.TCPAddr

	certDomainsObtaining      = make(map[string]bool)
	certDomainsObtainingMutex = &sync.Mutex{}
)

type stateStruct struct {
	PrivateKey *rsa.PrivateKey
	changed    bool
}

type nullWriter struct{}

type ConnectionID string

func (cid ConnectionID) String() string {
	return string(cid)
}

func (nullWriter) Write(buf []byte) (int, error) {
	return len(buf), nil
}

func main() {
	flag.Usage = usage
	flag.Parse()

	if *workingDir != "" {
		err := os.Chdir(*workingDir)
		if err != nil {
			logrus.Error("Can't change working dir: ", err)
		}
	}

	if *versionPrint {
		fmt.Println(strings.TrimSpace(VERSION))
		return
	}

	logouts := []io.Writer{}
	if *noLogStderr || // force ignore stderr by flag
		!service.Interactive() && runtime.GOOS == "windows" { // Run as windows-service
		// pass
	} else {
		logouts = append(logouts, os.Stderr)
	}

	if *logOutput != "-" {
		lr := &lumberjack.Logger{
			Filename:   *logOutput,
			MaxSize:    *logrotateSize,
			MaxAge:     *logrotateMaxAge,
			MaxBackups: *logrotateMaxBackups,
			LocalTime:  true,
		}
		if *logrotateSize == 0 {
			lr.MaxSize = int(math.MaxInt32) // about 2 Petabytes. Really no reachable in this scenario.
		}
		defer lr.Close()

		_, err := lr.Write([]byte{})
		if err == nil {
			logouts = append(logouts, lr)
			go startTimeLogRotator(lr)
		} else {
			logrus.Errorf("Can't log to file '%v': %v", *logOutput, err)
		}
	}

	// setlogout
	switch len(logouts) {
	case 0:
		logrus.SetOutput(nullWriter{})
	case 1:
		logrus.SetOutput(logouts[0])
	default:
		logrus.SetOutput(io.MultiWriter(logouts...))
	}

	logrus.Info("Version: ", VERSION)

	prepare()

	var serviceArguments []string
	if *workingDir == "" {
		wd, _ := os.Getwd()
		serviceArguments = append([]string{"--" + WORKING_DIR_ARG_NAME + "=" + wd}, os.Args[1:]...)
	} else {
		serviceArguments = os.Args[1:]
	}

	// remove --service-action argument
	newServiceArguments := make([]string, 0, len(serviceArguments))
	for _, arg := range serviceArguments {
		if strings.HasPrefix(arg, "--service-action=") {
			continue
		}
		newServiceArguments = append(newServiceArguments, arg)
	}
	serviceArguments = newServiceArguments

	logrus.Debug("Service arguments:", serviceArguments)
	svcConfig := &service.Config{
		Name:        *serviceName,
		Description: "Reverse proxy for handle ssl/https requests",
		Arguments:   serviceArguments,
	}
	program := &letsService{}
	s, err := service.New(program, svcConfig)
	if err != nil {
		logrus.Error("Can't init service", err)
	}
	if err == nil && !service.Interactive() {
		s.Run()
		return
	}

	if *serviceAction != "" && *serviceName == SERVICE_NAME_EXAMPLE {
		logrus.Error("Setup service-name for usage service-action")
		os.Exit(1)
	}

	switch *serviceAction {
	case "":
		logrus.Info("Start interactive mode")

		// Simple start
		listener, err := startListener()
		if listener != nil {
			acceptConnections(listener)
			return
		}
		logrus.Error("Can't start listener:", err)
		os.Exit(1)

	case "install":
		err = s.Install()
		if err == nil {
			fmt.Println("Service installed")
		} else {
			fmt.Println("Service install error:", err)
			os.Exit(1)
		}
	case "uninstall":
		err = s.Uninstall()
		if err == nil {
			fmt.Println("Service uninstalled")
		} else {
			fmt.Println("Service uninstall error:", err)
			os.Exit(1)
		}
	case "reinstall":
		// Uninstall
		err = s.Uninstall()
		if err == nil {
			fmt.Println("Service uninstalled")
		} else {
			fmt.Println("Service uninstall error:", err)
		}

		// Install
		err = s.Install()
		if err == nil {
			fmt.Println("Service installed")
		} else {
			fmt.Println("Service install error:", err)
			os.Exit(1)
		}
	case "start":
		err = s.Start()
		if err == nil {
			fmt.Println("Service started")
		} else {
			fmt.Println("Service start error:", err)
			os.Exit(1)
		}
	case "stop":
		err = s.Stop()
		if err == nil {
			fmt.Println("Service stopped")
		} else {
			fmt.Println("Service stopped error")
			os.Exit(1)
		}
	default:
		fmt.Printf("Unknown service action: '%v'\n", *serviceAction)
		os.Exit(1)
	}

}

func acceptConnections(listener *net.TCPListener) {
	started := time.Now().Unix()
	connectionNum := 0
	for {
		connectionNum++
		tcpConn, err := listener.AcceptTCP()
		if err != nil || tcpConn == nil {
			logrus.Warn("Can't accept tcp connection: ", err)
			if tcpConn != nil {
				tcpConn.Close()
			}
			continue
		}
		go func(cn int) {
			cid := ConnectionID(strconv.FormatInt(started, 10) + "-" + strconv.Itoa(cn))

			defer func() {
				recoveredErr := recover()
				if recoveredErr != nil {
					logrus.Errorf("PANIC error, handled by recover cid '%v': %v. Version '%v'. Stacktrace: %s",
						cid, recoveredErr, VERSION, debug.Stack(),
					)
				}
			}()

			handleTcpConnection(cid, tcpConn)
		}(connectionNum)
	}
}

func certificateGet(clientHello *tls.ClientHelloInfo) (cert *tls.Certificate, err error) {
	domain := clientHello.ServerName
	if domain == "" {
		domain = *defaultDomain
	}
	err = domainValidName(domain)
	if err != nil {
		logrus.Infof("Bad domain name '%v': %v", domain, err)
		return nil, errors.New("Bad domain name")
	}
	domain = strings.ToLower(domain)
	if logrus.GetLevel() >= logrus.DebugLevel {
		logrus.Debugf("Required certificate for domain '%v'", domain)
	}

	if strings.HasSuffix(domain, ACME_DOMAIN_SUFFIX) {
		// force generate new certificate, without caching.
		return acmeService.CreateCertificate(domain)
	}

	now := time.Now()
checkCertInCache:
	for {
		cert = certificateCacheGet(domain)

		switch {
		case cert != nil && cert.Leaf.NotAfter.Before(now):
			// pass to obtain cert
			logrus.Warnf("Expired certificate got from cache for domain '%v'", domain)

		case cert != nil:
			// need for background cert renew
			if cert.Leaf != nil && cert.Leaf.NotAfter.Before(time.Now().Add(*timeToRenew)) {
				go func() {
					certDomainsObtainingMutex.Lock()
					obtainInProcess := certDomainsObtaining[domain]
					if !obtainInProcess {
						certDomainsObtaining[domain] = true
						defer func() {
							certDomainsObtainingMutex.Lock()
							delete(certDomainsObtaining, domain)
							certDomainsObtainingMutex.Unlock()
						}()
					}
					certDomainsObtainingMutex.Unlock()

					if obtainInProcess {
						return
					}

					newCert, err := acmeService.CreateCertificate(domain)
					if err == nil {
						certificateCachePut(domain, newCert)
					}
				}()
			}
			return cert, nil
		default:
			// pass to obtain cert
		}

		// Check if the domain in process already
		certDomainsObtainingMutex.Lock()

		needWait := certDomainsObtaining[domain]
		if !needWait {
			// other requests will wait
			certDomainsObtaining[domain] = true
		}
		certDomainsObtainingMutex.Unlock()

		if needWait {
			// wait, then cert in cache again
			logrus.Infof("Obtain certificate in process for domain '%v', wait a second and check it again", domain)
			time.Sleep(time.Second)
			continue checkCertInCache
		} else {
			break checkCertInCache
		}
	}

	defer func() {
		certDomainsObtainingMutex.Lock()
		delete(certDomainsObtaining, domain)
		certDomainsObtainingMutex.Unlock()
	}()

	// check if certificate obtained between check cache and check obtaining lock
	cert = certificateCacheGet(domain) // check if cert obtained before lock
	if cert != nil && cert.Leaf.NotAfter.Before(now) {
		return cert, nil
	}

	for _, re := range nonCertDomainsRegexps {
		if re.MatchString(domain) {
			logrus.Debugf("Ignore obtain cert for domain '%v' by regexp '%v'", domain, re.String())
			return nil, errors.New("Ignore cert obtain by regexp")
		}
	}

	cert, err = acmeService.CreateCertificate(domain)
	if err == nil {
		certificateCachePut(domain, cert)
	} else {
		return nil, errors.New("Can't obtain acme certificate")
	}

	return cert, err
}

func getTargetAddr(in *net.TCPConn) (net.TCPAddr, error) {
	var target net.TCPAddr
	if paramTargetTcpAddr.IP == nil || paramTargetTcpAddr.IP.IsUnspecified() {
		receiveAddr, ok := in.LocalAddr().(*net.TCPAddr)
		if !ok {
			logrus.Errorf("Can't cast incoming addr to tcp addr: '%v'", in.LocalAddr())
			return net.TCPAddr{}, errors.New("Can't cast incoming addr to tcp addr")
		}
		target.IP = receiveAddr.IP
		target.Port = paramTargetTcpAddr.Port
	} else {
		target.IP = paramTargetTcpAddr.IP
		target.Port = paramTargetTcpAddr.Port
	}
	return target, nil
}

func handleTcpConnection(cid ConnectionID, in *net.TCPConn) {
	logrus.Debugf("Receive incoming connection from %v, cid: '%v'", in.RemoteAddr(), cid)

	target, err := getTargetAddr(in)
	if err != nil {
		logrus.Errorf("Can't get target IP/port for '%v' (cid '%v'): %v", in.RemoteAddr(), cid, err)
		return
	}

	// handle ssl
	tlsConfig := tls.Config{
		GetCertificate: certificateGet,
	}
	switch strings.TrimSpace(*minTLSVersion) {
	case "":
		// pass
	case "ssl3":
		tlsConfig.MinVersion = tls.VersionSSL30
	case "tls10":
		tlsConfig.MinVersion = tls.VersionTLS10
	case "tls11":
		tlsConfig.MinVersion = tls.VersionTLS11
	case "tls12":
		tlsConfig.MinVersion = tls.VersionTLS12
	default:
		logrus.Errorf("Doesn't know tls version '%v', use default. cid '%v'", *minTLSVersion, cid)
	}
	tlsConn := tls.Server(in, &tlsConfig)
	err = tlsConn.Handshake()
	logrus.Debugf("tls ciper, cid %v: %v", cid, tlsConn.ConnectionState().CipherSuite)
	if err == nil {
		logrus.Debugf("Handshake for incoming cid '%v': %v", cid, tlsConn.RemoteAddr())
	} else {
		logrus.Infof("Error in tls handshake from '%v' cid '%v' :%v", tlsConn.RemoteAddr(), cid, err)
	}

	startProxy(cid, target, tlsConn)
}

func prepare() {
	var err error

	// Init
	logrus.SetLevel(logrus.WarnLevel)
	switch *logLevel {
	case "fatal":
		logrus.SetLevel(logrus.FatalLevel)
	case "error":
		logrus.SetLevel(logrus.ErrorLevel)
	case "warning":
		logrus.SetLevel(logrus.WarnLevel)
	case "info":
		logrus.SetLevel(logrus.InfoLevel)
	case "debug":
		logrus.SetLevel(logrus.DebugLevel)
	default:
		logrus.Errorf("Use default loglevel '%v', becouse unknow level: '%v'", logrus.GetLevel(), *logLevel)
	}
	logrus.Infof("Use log level: '%v'", logrus.GetLevel())

	if *proxyMode != "http" && *proxyMode != "tcp" {
		logrus.Panicf("Unknow proxy mode: %v", *proxyMode)
	}
	logrus.Infof("Proxy mode: %v", *proxyMode)

	for _, ignoreDomain := range strings.Split(*nonCertDomains, ",") {
		ignoreDomain = strings.TrimSpace(ignoreDomain)
		if ignoreDomain == "" {
			continue
		}
		ignoreDomainRE, err := regexp.Compile(ignoreDomain)
		if err != nil {
			logrus.Errorf("Bad ignore domain regexp '%v': %v", ignoreDomain, err)
		}
		if ignoreDomainRE != nil {
			nonCertDomainsRegexps = append(nonCertDomainsRegexps, ignoreDomainRE)
		}
	}
	if logrus.GetLevel() >= logrus.InfoLevel {
		regexps := []string{}
		for _, re := range nonCertDomainsRegexps {
			regexps = append(regexps, re.String())
		}
		logrus.Info("Non cert domain regexps: ", "['"+strings.Join(regexps, "', '")+"']")
	}

	for _, line := range strings.Split(*httpRealIPHeader, ",") {
		line = strings.TrimSpace(line)
		if line != "" {
			realIPHeaderNames = append(realIPHeaderNames, []byte(line))
			cutHeaders = append(realIPHeaderNames, []byte(strings.ToUpper(line)))
		}
	}

	for _, addHeader := range strings.Split(*additionalHeadersParam, ",") {
		headerParts := strings.SplitN(addHeader, "=", 2)
		if len(headerParts) > 0 {
			cutHeaders = append(cutHeaders, []byte(strings.ToUpper(headerParts[0])))
		}
		buf := &bytes.Buffer{}
		buf.WriteString(headerParts[0])
		buf.WriteByte(':')
		if len(headerParts) == 2 {
			buf.WriteString(headerParts[1])
		}
		buf.WriteString("\r\n")
		additionalHeaders = append(additionalHeaders, buf.Bytes()...)
	}

	initAllowedIPs()
	acmeService = &acmeStruct{}
	if *certMemCount > 0 {
		logrus.Infof("Create memory cache for '%v' certificates", *certMemCount)
		certMemCache, err = lru.New(*certMemCount)
		if err != nil {
			logrus.Errorf("Can't create memory cache:", err)
			certMemCache = nil
		}
	} else {
		logrus.Info("Memory cache turned off")
	}
	if *certDir == "-" {
		*certDir = ""
	}

	workingDir, err := os.Getwd()
	logrus.Infof("Working dir '%v', err: %v", workingDir, err)

	// targetConn
	targetAddrS := *targetConnString
	if !strings.ContainsRune(*targetConnString, ':') || // doesn't contain colon (only ipv4 or domain name)
		len(*targetConnString) > 0 && (*targetConnString)[len(*targetConnString)-1] == ']' { // is ipv6 only, without port
		targetAddrS += ":80"
	}
	paramTargetTcpAddr, err = net.ResolveTCPAddr("tcp", targetAddrS)
	if err != nil {
		logrus.Panicf("Can't resolve target addr '%v': %v", targetConnString, err)
	}
	logrus.Info("Target addr: ", paramTargetTcpAddr)

	// init service
	var state stateStruct
	stateBytes, err := ioutil.ReadFile(*stateFilePath)
	if err == nil {
		err = json.Unmarshal(stateBytes, &state)
		if err != nil {
			logrus.Errorf("Can't parse state file '%v': %v", *stateFilePath, err)
		}
	} else {
		logrus.Errorf("Can't read state file '%v': %v", *stateFilePath, err)
	}

	acmeService = &acmeStruct{}
	acmeService.timeToRenew = *timeToRenew
	if *acmeTestServer {
		acmeService.serverAddress = LETSENCRYPT_STAGING_API_URL
	} else {
		acmeService.serverAddress = *acmeApiUrl
	}

	if state.PrivateKey == nil {
		logrus.Info("Generate private keys")
		state.PrivateKey, err = rsa.GenerateKey(cryptorand.Reader, PRIVATE_KEY_BITS)
		state.changed = true
		if err != nil {
			logrus.Panic("Can't generate private key")
		}
	} else {
		logrus.Debugf("Skip generate keys - it was read from state")
	}

	saveState(state)

	acmeService.privateKey = state.PrivateKey

	acmeService.Init()
}

func saveState(state stateStruct) {
	if state.changed {
		logrus.Infof("Saving state to '%v'", *stateFilePath)
	} else {
		logrus.Debug("Skip save state becouse it isn't changed")
		return
	}
	stateBytes, err := json.MarshalIndent(&state, "", "    ")
	if err != nil {
		logrus.Errorf("Can't save state to file '%v': %v", *stateFilePath, err)
		return
	}
	err = ioutil.WriteFile(*stateFilePath+".new", stateBytes, STATE_FILEMODE)
	if err != nil {
		logrus.Errorf("Error while write state bytes to file '%v': %v", *stateFilePath+".new", err)
		return
	}

	if _, err := os.Stat(*stateFilePath); !os.IsNotExist(err) {
		logrus.Infof("Rename current state file '%v' -> '%v'", *stateFilePath, *stateFilePath+".old")

		err = os.Rename(*stateFilePath, *stateFilePath+".old")
		if err != nil {
			logrus.Errorf("Can't rename '%v' to '%v': %v", *stateFilePath, *stateFilePath+".old", err)
		}
	} else {
		logrus.Infof("Create new state file '%v'", *stateFilePath)
	}

	err = os.Rename(*stateFilePath+".new", *stateFilePath)
	if err != nil {
		logrus.Errorf("Can't rename '%v' to '%v': %v", *stateFilePath+".new", *stateFilePath, err)
	}
}

func startListener() (*net.TCPListener, error) {

	// Start listen
	tcpAddr, err := net.ResolveTCPAddr("tcp", *bindTo)
	if err != nil {
		logrus.Panicf("Can't resolve bind-to address '%v': %v", *bindTo, err)
	}
	logrus.Infof("Start listen: %v", tcpAddr)

	listener, err := net.ListenTCP("tcp", tcpAddr)
	if err != nil {
		logrus.Errorf("Can't start listen on '%v': %v", tcpAddr, err)
	}
	return listener, err
}

func startTimeLogRotator(logger *lumberjack.Logger) {
	for {
		now := time.Now()
		var sleepUntil time.Time
		switch *logrotateTime {
		case "", "none":
			return // no rotate by time
		case "minutely":
			sleepUntil = time.Date(now.Year(), now.Month(), now.Day(), now.Hour(), now.Minute()+1, 0, 0, time.Local)
		case "hourly":
			sleepUntil = time.Date(now.Year(), now.Month(), now.Day(), now.Hour()+1, 0, 0, 0, time.Local)
		case "daily":
			sleepUntil = time.Date(now.Year(), now.Month(), now.Day()+1, 0, 0, 0, 0, time.Local)
		case "weekly":
			sleepUntil := now.AddDate(0, 0, -int(now.Weekday())+int(time.Monday))                                   // Set to this week monday
			sleepUntil = time.Date(sleepUntil.Year(), sleepUntil.Month(), sleepUntil.Day(), 0, 0, 0, 0, time.Local) // set to midnight
			if sleepUntil.Before(now) {
				sleepUntil = sleepUntil.AddDate(0, 0, 7)
			}
		case "monthly":
			sleepUntil = time.Date(now.Year(), now.Month()+1, 1, 0, 0, 0, 0, time.Local)
		case "yearly":
			sleepUntil = time.Date(now.Year()+1, 1, 1, 0, 0, 0, 0, time.Local)
		default:
			logrus.Errorf("Doesn't know logrotate time interval: '%v'. Turn off time rotation.", *logrotateTime)
			return
		}

		time.Sleep(sleepUntil.Sub(now))
		logrus.Info("Rotate log:", *logrotateTime)
		logger.Rotate()
	}
}

func usage() {
	flag.CommandLine.SetOutput(os.Stderr)

	fmt.Fprintln(os.Stderr, "Version:", VERSION)
	fmt.Fprintln(os.Stderr, "Website: https://github.com/rekby/lets-proxy")
	fmt.Fprintln(os.Stderr, "Developer: timofey@koolin.ru")
	fmt.Fprintln(os.Stderr)

	flag.PrintDefaults()
}