ci: make TLS provisioning dynamic as domains are added
Adding a domain was a manual per-domain script run. With domains arriving continuously that does not hold, so certificate issuance is now automatic. HTTP already needed no work: the nginx catch-all serves any Host and the SPA resolves its tenant from that header. Only TLS needed a name-by-name step. Two mechanisms: - setup-wildcard-tls.sh issues one DNS-01 wildcard for *.<apex>, after which a new tenant subdomain is live over HTTPS with zero certificate work. - sync-domains.sh reconciles tenant-owned domains against a desired list on a 10-minute timer: issues what is missing, skips certificates with >30 days left, skips names already covered by the wildcard, waits out unpropagated DNS, and caps issuance per run so a bad source cannot burn the weekly ACME budget. Safety properties worth stating: a failed fetch of the desired list aborts the run rather than reading as "remove every domain"; removing a domain disables its server block but keeps the certificate, so re-adding is instant; malformed hostnames are rejected before reaching certbot or an nginx server_name. The source is pluggable - a file today, the Phase 9 domain registry once it exists, whose MarketplaceDomain statuses already match what this needs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
sdarbinyan
234
scripts/deploy/sync-domains.sh
Normal file
234
scripts/deploy/sync-domains.sh
Normal file
@@ -0,0 +1,234 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Reconcile the set of TLS-enabled domains on this server against a desired
|
||||
# list. Idempotent and safe to run on a timer: it issues what is missing,
|
||||
# leaves what is current alone, and disables what has been removed.
|
||||
#
|
||||
# The nginx catch-all already serves ANY Host over HTTP with no config, so a
|
||||
# new domain works on port 80 the moment DNS resolves. This script exists only
|
||||
# because TLS needs a certificate per name.
|
||||
#
|
||||
# sync-domains.sh # reconcile from $DOMAINS_SOURCE
|
||||
# sync-domains.sh --dry-run # print the plan, change nothing
|
||||
#
|
||||
# Config: /etc/marketplaces/domains.env
|
||||
# DOMAINS_SOURCE=file:/etc/marketplaces/domains.txt
|
||||
# DOMAINS_SOURCE=https://api.example.com/api/admin/v2/domains (JSON array)
|
||||
# CERTBOT_EMAIL=ops@example.com
|
||||
# MAX_ISSUE_PER_RUN=10
|
||||
#
|
||||
# Let's Encrypt caps new certificates per registered domain per week. The
|
||||
# per-run issuance cap keeps a misconfigured source from burning that budget
|
||||
# in one pass; the remainder is picked up on the next run.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
CONFIG="/etc/marketplaces/domains.env"
|
||||
STATE_DIR="/var/lib/marketplaces"
|
||||
DRY_RUN=0
|
||||
RENEW_WINDOW_DAYS=30
|
||||
|
||||
[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=1
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
[[ -f "$CONFIG" ]] && source "$CONFIG"
|
||||
|
||||
DOMAINS_SOURCE="${DOMAINS_SOURCE:-file:/etc/marketplaces/domains.txt}"
|
||||
CERTBOT_EMAIL="${CERTBOT_EMAIL:-}"
|
||||
MAX_ISSUE_PER_RUN="${MAX_ISSUE_PER_RUN:-10}"
|
||||
WILDCARD_APEX="${WILDCARD_APEX:-}"
|
||||
|
||||
[[ $EUID -eq 0 ]] || { echo "must run as root" >&2; exit 1; }
|
||||
[[ -n "$CERTBOT_EMAIL" ]] || { echo "CERTBOT_EMAIL not set in $CONFIG" >&2; exit 1; }
|
||||
|
||||
mkdir -p "$STATE_DIR"
|
||||
log() { printf '%s %s\n' "$(date -Is)" "$*"; }
|
||||
|
||||
# ---------------------------------------------------------------- desired set
|
||||
|
||||
fetch_desired() {
|
||||
case "$DOMAINS_SOURCE" in
|
||||
file:*)
|
||||
local path="${DOMAINS_SOURCE#file:}"
|
||||
[[ -f "$path" ]] || { log "source file $path missing"; return 1; }
|
||||
# one domain per line; # comments and blanks ignored
|
||||
sed -e 's/#.*//' -e 's/[[:space:]]//g' "$path" | grep -v '^$' || true
|
||||
;;
|
||||
http://*|https://*)
|
||||
# Expected shape: ["a.example.com","b.example.com"] or
|
||||
# [{"domain":"a.example.com","status":"active"}, ...]
|
||||
local body
|
||||
body="$(curl -fsS --max-time 20 ${DOMAINS_API_TOKEN:+-H "Authorization: Bearer $DOMAINS_API_TOKEN"} "$DOMAINS_SOURCE")" || {
|
||||
log "ERROR: could not fetch $DOMAINS_SOURCE — leaving current config untouched"
|
||||
return 1
|
||||
}
|
||||
echo "$body" | jq -r '
|
||||
if type=="array" and (.[0]|type)=="object"
|
||||
then .[] | select((.status // "active") == "active") | .domain
|
||||
else .[] end' 2>/dev/null || {
|
||||
log "ERROR: unparseable response from $DOMAINS_SOURCE"
|
||||
return 1
|
||||
}
|
||||
;;
|
||||
*)
|
||||
log "ERROR: unsupported DOMAINS_SOURCE: $DOMAINS_SOURCE"; return 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# A source failure must never be read as "all domains removed". Bail instead.
|
||||
if ! DESIRED_RAW="$(fetch_desired)"; then
|
||||
log "reconcile aborted: desired set unavailable"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Reject anything that is not a plausible hostname before it reaches certbot
|
||||
# or an nginx server_name.
|
||||
DESIRED="$(echo "$DESIRED_RAW" | grep -Ei '^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$' | sort -u || true)"
|
||||
REJECTED="$(comm -23 <(echo "$DESIRED_RAW" | sort -u) <(echo "$DESIRED") || true)"
|
||||
[[ -n "$REJECTED" ]] && log "WARNING: ignoring malformed entries: $(echo "$REJECTED" | tr '\n' ' ')"
|
||||
|
||||
if [[ -z "$DESIRED" ]]; then
|
||||
log "desired set is empty — nothing to do (not treating this as 'remove everything')"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
log "desired: $(echo "$DESIRED" | wc -l) domain(s)"
|
||||
|
||||
# ------------------------------------------------------------------ helpers
|
||||
|
||||
covered_by_wildcard() {
|
||||
# A domain one label under the wildcard apex needs no certificate of its own.
|
||||
local d="$1"
|
||||
[[ -n "$WILDCARD_APEX" ]] || return 1
|
||||
[[ "$d" == *".$WILDCARD_APEX" ]] || return 1
|
||||
[[ "${d%.$WILDCARD_APEX}" != *.* ]]
|
||||
}
|
||||
|
||||
cert_is_current() {
|
||||
local d="$1" live="/etc/letsencrypt/live/$1/cert.pem"
|
||||
[[ -f "$live" ]] || return 1
|
||||
openssl x509 -in "$live" -noout -checkend $((RENEW_WINDOW_DAYS * 86400)) >/dev/null 2>&1
|
||||
}
|
||||
|
||||
resolves_here() {
|
||||
local d="$1"
|
||||
local got want
|
||||
got="$(getent hosts "$d" | awk '{print $1}' | sort -u)"
|
||||
[[ -n "$got" ]] || return 1
|
||||
# Compare against every address this host actually answers on.
|
||||
want="$(hostname -I | tr ' ' '\n' | grep -v '^$')"
|
||||
grep -qxF -f <(echo "$want") <(echo "$got")
|
||||
}
|
||||
|
||||
write_block() {
|
||||
local d="$1" conf="/etc/nginx/sites-available/tenant-$1.conf"
|
||||
cat > "$conf" <<NGINX
|
||||
# Managed by sync-domains.sh. Manual edits are overwritten.
|
||||
# Same root as the catch-all: the SPA resolves its tenant from the Host header.
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name $d;
|
||||
root /srv/marketplaces/current/frontend;
|
||||
index index.html;
|
||||
|
||||
location = /index.html {
|
||||
add_header Cache-Control "no-store, must-revalidate" always;
|
||||
try_files \$uri =404;
|
||||
}
|
||||
location ~* \.(js|css|woff2?|png|jpe?g|svg|gif|webp|avif|ico)\$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
try_files \$uri =404;
|
||||
}
|
||||
location /health { access_log off; return 200 "ok\n"; add_header Content-Type text/plain; }
|
||||
location /api/ {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
location / { try_files \$uri \$uri/ /index.html; }
|
||||
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
gzip on;
|
||||
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
|
||||
gzip_min_length 1024;
|
||||
}
|
||||
NGINX
|
||||
ln -sfn "$conf" "/etc/nginx/sites-enabled/tenant-$d.conf"
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------ reconcile
|
||||
|
||||
issued=0 skipped=0 waiting=0 wildcarded=0 failed=0
|
||||
|
||||
while read -r d; do
|
||||
[[ -n "$d" ]] || continue
|
||||
|
||||
if covered_by_wildcard "$d"; then
|
||||
wildcarded=$((wildcarded + 1)); continue
|
||||
fi
|
||||
|
||||
if cert_is_current "$d"; then
|
||||
skipped=$((skipped + 1)); continue
|
||||
fi
|
||||
|
||||
if ! resolves_here "$d"; then
|
||||
log "waiting on DNS: $d (does not resolve to this server yet)"
|
||||
waiting=$((waiting + 1)); continue
|
||||
fi
|
||||
|
||||
if [[ $issued -ge $MAX_ISSUE_PER_RUN ]]; then
|
||||
log "issuance cap ($MAX_ISSUE_PER_RUN) reached — remaining domains roll to the next run"
|
||||
break
|
||||
fi
|
||||
|
||||
if [[ $DRY_RUN -eq 1 ]]; then
|
||||
log "DRY RUN would issue: $d"; issued=$((issued + 1)); continue
|
||||
fi
|
||||
|
||||
log "issuing: $d"
|
||||
write_block "$d"
|
||||
if ! nginx -t >/dev/null 2>&1; then
|
||||
log "ERROR: nginx config invalid after adding $d — reverting that block"
|
||||
rm -f "/etc/nginx/sites-enabled/tenant-$d.conf"
|
||||
failed=$((failed + 1)); continue
|
||||
fi
|
||||
systemctl reload nginx
|
||||
|
||||
if certbot --nginx -d "$d" --non-interactive --agree-tos \
|
||||
--email "$CERTBOT_EMAIL" --redirect --keep-until-expiring >>"$STATE_DIR/certbot.log" 2>&1; then
|
||||
issued=$((issued + 1))
|
||||
log "issued: $d"
|
||||
else
|
||||
log "ERROR: certbot failed for $d (see $STATE_DIR/certbot.log) — HTTP still served, HTTPS not yet"
|
||||
failed=$((failed + 1))
|
||||
fi
|
||||
done <<< "$DESIRED"
|
||||
|
||||
# Domains dropped from the source: stop serving them, but never delete the
|
||||
# certificate — a domain re-added next week should not need a fresh issuance.
|
||||
for link in /etc/nginx/sites-enabled/tenant-*.conf; do
|
||||
[[ -e "$link" ]] || continue
|
||||
name="$(basename "$link")"; name="${name#tenant-}"; name="${name%.conf}"
|
||||
if ! grep -qxF "$name" <<< "$DESIRED"; then
|
||||
if [[ $DRY_RUN -eq 1 ]]; then
|
||||
log "DRY RUN would disable: $name"
|
||||
else
|
||||
log "disabling (removed from source): $name"
|
||||
rm -f "$link"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ $DRY_RUN -eq 0 ]]; then
|
||||
nginx -t && systemctl reload nginx
|
||||
fi
|
||||
|
||||
log "done. issued=$issued current=$skipped wildcard=$wildcarded awaiting-dns=$waiting failed=$failed"
|
||||
[[ $failed -eq 0 ]]
|
||||
Reference in New Issue
Block a user