cronekorkn/bundlewrap
1
0
Fork 0
Code Issues Pull requests 8 Projects Releases Wiki Activity

aliases

Browse source
This commit is contained in:
mwiegand 2021-11-06 16:11:48 +01:00
parent 4f633eab8e
commit 684c2b46e1
9 changed files with 66 additions and 63 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
bundles/bind-acme/metadata.py
View file

@ -2,16 +2,19 @@
'dns',
)
def acme_records(metadata):
if metadata.get('bind/type') == 'slave':
return {}
domains = set()
for other_node in repo.nodes:
for domain, conf in other_node.metadata.get('letsencrypt/domains', {}).items():
domains.add(domain)
domains.update(conf.get('aliases', []))
return {
'dns': {
f'_acme-challenge.{domain}': {
'CNAME': {f"{domain}.{metadata.get('bind/acme_zone')}."},
}
for other_node in repo.nodes
for domain in other_node.metadata.get('letsencrypt/domains', {}).keys()
for domain in domains
}
}
@ -20,16 +23,13 @@ def acme_records(metadata):
'bind/zones',
)
def acme_zone(metadata):
if metadata.get('bind/type') == 'slave':
return {}
return {
'bind': {
'zones': {
metadata.get('bind/acme_zone'): {
'dynamic': True,
'records': set(),
'views': ['external'],
'records': set(),
},
},
},

4
bundles/letsencrypt/files/domains.txt
View file

@ -1,3 +1,3 @@
% for domain, aliases in sorted(node.metadata.get('letsencrypt/domains', {}).items()):
${domain} ${' '.join(sorted(aliases))}
% for domain, conf in sorted(domains.items()):
${domain} ${' '.join(sorted(conf.get('aliases', [])))}
% endfor

64
bundles/letsencrypt/files/hook.sh
View file

@ -8,7 +8,7 @@ deploy_challenge() {
zone ${zone}.
update add $1.${zone}. 60 IN TXT \"$3\"
send
" | tee | nsupdate -y hmac-sha512:acme.sublimity.de:${acme_key}
" | tee | nsupdate -y hmac-sha512:${zone}:${acme_key}
sleep 10
}
@ -19,43 +19,37 @@ clean_challenge() {
zone ${zone}.
update delete $1.${zone}. TXT
send
" | tee | nsupdate -y hmac-sha512:acme.sublimity.de:${acme_key}
" | tee | nsupdate -y hmac-sha512:${zone}:${acme_key}
}
deploy_cert() {<%text>
local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"</%text>
% for service, config in node.metadata.get('letsencrypt/concat_and_deploy', {}).items():
# concat_and_deploy ${service}
if [ "$DOMAIN" = "${config['match_domain']}" ]; then
cat $KEYFILE > ${config['target']}
cat $FULLCHAINFILE >> ${config['target']}
% if 'chown' in config:
chown ${config['chown']} ${config['target']}
% endif
% if 'chmod' in config:
chmod ${config['chmod']} ${config['target']}
% endif
% if 'commands' in config:
% for command in config['commands']:
${command}
% endfor
% endif
fi
% endfor
deploy_cert() {
DOMAIN="$1"
KEYFILE="$2"
CERTFILE="$3"
FULLCHAINFILE="$4"
CHAINFILE="$5"
% for domain, conf in sorted(domains.items()):
% if conf.get('location', None):
if [[ $DOMAIN = ${domain} ]]
then
cat "$KEYFILE" > "${conf['location']}/privkey.pem"
cat "$CERTFILE" > "${conf['location']}/cert.pem"
cat "$FULLCHAINFILE" > "${conf['location']}/fullchain.pem"
cat "$CHAINFILE" > "${conf['location']}/chain.pem"
fi
% endif
% if conf.get('owner', None):
chown ${conf['owner']} "${conf['location']}/privkey.pem" "${conf['location']}/cert.pem" "${conf['location']}/fullchain.pem" "${conf['location']}/chain.pem"
% endif
% for service in sorted(conf.get('reload', [])):
systemctl reload-or-restart ${service}
% endfor
% endfor
}
exit_hook() {<%text>
local ERROR="${1:-}"</%text>
% for service in sorted(node.metadata.get('letsencrypt/reload_after', set())):
systemctl reload-or-restart ${service}
% endfor
}
<%text>
HANDLER="$1"; shift
if [[ "${HANDLER}" =~ ^(deploy_cert|exit_hook|deploy_challenge|clean_challenge)$ ]]; then
if [[ $HANDLER =~ ^(deploy_cert|deploy_challenge|clean_challenge)$ ]]
then
"$HANDLER" "$@"
fi</%text>
fi

4
bundles/letsencrypt/items.py
View file

@ -13,6 +13,9 @@ directories = {
files = {
'/etc/dehydrated/domains.txt': {
'content_type': 'mako',
'context': {
'domains': node.metadata.get('letsencrypt/domains'),
},
'triggers': {
'action:letsencrypt_update_certificates',
},
@ -28,6 +31,7 @@ files = {
'server': ip_interface(acme_node.metadata.get('network/external/ipv4')).ip,
'zone': acme_node.metadata.get('bind/acme_zone'),
'acme_key': acme_node.metadata.get('bind/keys/' + acme_node.metadata.get('bind/acme_zone')),
'domains': node.metadata.get('letsencrypt/domains'),
},
'mode': '0755',
},

13
bundles/letsencrypt/metadata.py
View file

@ -53,22 +53,19 @@ def renew(metadata):
)
def delegated_domains(metadata):
delegated_domains = {
domain
domain: conf
for other_node in repo.nodes
if other_node.has_bundle('letsencrypt')
and other_node.metadata.get('letsencrypt/delegate_to_node', None) == node.name
for domain in other_node.metadata.get('letsencrypt/domains').keys()
and other_node.metadata.get('letsencrypt/delegate_to_node', None) == node.name
for domain, conf in other_node.metadata.get('letsencrypt/domains').items()
}
return {
'letsencrypt': {
'domains': {
domain: set()
for domain in delegated_domains
},
'domains': delegated_domains,
},
'dns': {
domain: repo.libs.dns.get_a_records(metadata, internal=False)
for domain in delegated_domains
for domain in delegated_domains.keys()
},
}

4
bundles/mailserver/metadata.py
View file

@ -60,7 +60,9 @@ def letsencrypt(metadata):
return {
'letsencrypt': {
'domains': {
metadata.get('mailserver/hostname'): set(),
metadata.get('mailserver/hostname'): {
'reload': {'dovecot', 'postfix'},
},
},
},
}

2
bundles/mosquitto/metadata.py
View file

@ -84,7 +84,7 @@ def letsencrypt(metadata):
return {
'letsencrypt': {
'domains': {
metadata.get('mosquitto/hostname'): set(),
metadata.get('mosquitto/hostname'): {},
},
},
}

8
bundles/nginx/metadata.py
View file

@ -104,10 +104,10 @@ def letsencrypt(metadata):
return {
'letsencrypt': {
'domains': {
domain: set() for domain in metadata.get('nginx/vhosts').keys()
},
'reload_after': {
'nginx',
domain: {
'reload': {'nginx'},
}
for domain in metadata.get('nginx/vhosts').keys()
},
},
}

12
nodes/htz.mails.py
View file

@ -63,9 +63,15 @@
},
'letsencrypt': {
'domains': {
'ckn.li': set(),
'sublimity.de': set(),
'freibrief.net': set(),
'ckn.li': {},
'test6.ckn.li': {
'aliases': {'www.test6.ckn.li'},
'location': '/root/temp',
'owner': 'telegraf',
'reload': {'telegraf'},
},
'sublimity.de': {},
'freibrief.net': {},
},
},
'mailserver': {