Fix jwt-token
This commit is contained in:
3
.gitignore
vendored
3
.gitignore
vendored
@@ -59,3 +59,6 @@ tmp/
|
||||
temp/
|
||||
*.tmp
|
||||
*.temp
|
||||
|
||||
# SSL Certificate configuration
|
||||
ssl/.env
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
{
|
||||
"device_id": 1,
|
||||
"drone_id": 2001,
|
||||
"drone_type": 1,
|
||||
"rssi": -72,
|
||||
"freq": 2450,
|
||||
"geo_lat": 59.3293,
|
||||
"geo_lon": 18.0686,
|
||||
"device_timestamp": 1692252000000,
|
||||
"confidence_level": 0.92,
|
||||
"signal_duration": 3200
|
||||
}
|
||||
19
ssl/.env.example
Normal file
19
ssl/.env.example
Normal file
@@ -0,0 +1,19 @@
|
||||
# SSL Certificate Configuration
|
||||
# Copy this to ssl/.env and customize the values
|
||||
|
||||
# Domain for SSL certificate (will also create wildcard *.domain if using DNS challenge)
|
||||
DOMAIN=dev.uggla.uamils.com
|
||||
|
||||
# Email for Let's Encrypt notifications
|
||||
EMAIL=admin@uggla.uamils.com
|
||||
|
||||
# Days before expiry to trigger renewal (default: 10)
|
||||
RENEWAL_DAYS=10
|
||||
|
||||
# Loopia DNS API credentials (optional, for wildcard certificates)
|
||||
# If not provided, will use HTTP challenge (main domain only)
|
||||
LOOPIA_USER=your_loopia_username
|
||||
LOOPIA_PASSWORD=your_loopia_password
|
||||
|
||||
# Webroot path for HTTP challenges (if not using DNS)
|
||||
WEBROOT_PATH=/var/www/html
|
||||
139
ssl/README.md
Normal file
139
ssl/README.md
Normal file
@@ -0,0 +1,139 @@
|
||||
# SSL Certificate Auto-Renewal with Cron
|
||||
|
||||
This directory contains scripts for managing SSL certificates with Let's Encrypt outside of Docker containers.
|
||||
|
||||
## Setup
|
||||
|
||||
1. **Install dependencies:**
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install certbot nginx openssl
|
||||
|
||||
# Optional: For DNS challenges with Loopia
|
||||
sudo pip install dns-lexicon[full]
|
||||
```
|
||||
|
||||
2. **Configure environment:**
|
||||
```bash
|
||||
cp .env.example .env
|
||||
nano .env # Edit with your domain and credentials
|
||||
```
|
||||
|
||||
3. **Make scripts executable:**
|
||||
```bash
|
||||
chmod +x certbot-manager.sh loopia-hook.sh
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
### Manual Certificate Management
|
||||
|
||||
```bash
|
||||
# Check certificate status
|
||||
./certbot-manager.sh status
|
||||
|
||||
# Check if renewal is needed
|
||||
./certbot-manager.sh check
|
||||
|
||||
# Force certificate renewal
|
||||
./certbot-manager.sh renew
|
||||
|
||||
# Auto-renew only if needed (for cron)
|
||||
./certbot-manager.sh auto
|
||||
```
|
||||
|
||||
### Automatic Renewal with Cron
|
||||
|
||||
1. **Setup cron job** (recommended - runs daily at 2 AM):
|
||||
```bash
|
||||
sudo crontab -e
|
||||
```
|
||||
|
||||
Add this line:
|
||||
```
|
||||
0 2 * * * cd /path/to/your/project/ssl && source .env && ./certbot-manager.sh auto >> /var/log/letsencrypt/cron.log 2>&1
|
||||
```
|
||||
|
||||
2. **Alternative: Setup systemd timer** (more modern approach):
|
||||
```bash
|
||||
sudo cp ssl-renewal.service /etc/systemd/system/
|
||||
sudo cp ssl-renewal.timer /etc/systemd/system/
|
||||
sudo systemctl enable ssl-renewal.timer
|
||||
sudo systemctl start ssl-renewal.timer
|
||||
```
|
||||
|
||||
## Certificate Types
|
||||
|
||||
### HTTP Challenge (Single Domain)
|
||||
- Works for: `dev.uggla.uamils.com`
|
||||
- Requirements: Port 80 accessible, nginx configured for ACME challenges
|
||||
- No additional credentials needed
|
||||
|
||||
### DNS Challenge (Wildcard Support)
|
||||
- Works for: `dev.uggla.uamils.com` and `*.dev.uggla.uamils.com`
|
||||
- Requirements: Loopia DNS API credentials
|
||||
- Set `LOOPIA_USER` and `LOOPIA_PASSWORD` in `.env`
|
||||
|
||||
## Nginx Configuration
|
||||
|
||||
Ensure your nginx configuration includes ACME challenge support:
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name dev.uggla.uamils.com *.dev.uggla.uamils.com;
|
||||
|
||||
# ACME challenge location
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/html;
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
# Redirect other traffic to HTTPS
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Monitoring
|
||||
|
||||
### Check Certificate Status
|
||||
```bash
|
||||
./certbot-manager.sh status
|
||||
```
|
||||
|
||||
### View Renewal Logs
|
||||
```bash
|
||||
tail -f /var/log/letsencrypt/renewal.log
|
||||
```
|
||||
|
||||
### Check Cron Logs
|
||||
```bash
|
||||
tail -f /var/log/letsencrypt/cron.log
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### DNS Challenge Issues
|
||||
- Verify Loopia credentials are correct
|
||||
- Check DNS propagation: `dig _acme-challenge.dev.uamils.com TXT`
|
||||
- Ensure API access is enabled in Loopia control panel
|
||||
|
||||
### HTTP Challenge Issues
|
||||
- Verify port 80 is accessible from internet
|
||||
- Check nginx configuration: `nginx -t`
|
||||
- Ensure webroot path exists and is writable
|
||||
|
||||
### Permission Issues
|
||||
- Ensure scripts are executable: `chmod +x *.sh`
|
||||
- Run with sudo if accessing system directories
|
||||
- Check log file permissions
|
||||
|
||||
## Files
|
||||
|
||||
- `certbot-manager.sh` - Main certificate management script
|
||||
- `loopia-hook.sh` - DNS challenge hook for Loopia
|
||||
- `.env.example` - Configuration template
|
||||
- `ssl-renewal.service` - Systemd service file
|
||||
- `ssl-renewal.timer` - Systemd timer file
|
||||
279
ssl/certbot-manager.sh
Normal file
279
ssl/certbot-manager.sh
Normal file
@@ -0,0 +1,279 @@
|
||||
#!/bin/bash
|
||||
|
||||
# SSL Certificate Management Script for dev.uggla.uamils.com
|
||||
# This script manages Let's Encrypt certificates for use with external nginx
|
||||
|
||||
set -e
|
||||
|
||||
# Configuration
|
||||
DOMAIN="${DOMAIN:-dev.uggla.uamils.com}"
|
||||
EMAIL="${EMAIL:-admin@uggla.uamils.com}"
|
||||
RENEWAL_DAYS="${RENEWAL_DAYS:-10}"
|
||||
CERT_DIR="/etc/letsencrypt"
|
||||
WEBROOT_PATH="/var/www/html"
|
||||
LOG_FILE="/var/log/letsencrypt/renewal.log"
|
||||
|
||||
# Loopia API credentials (optional, for DNS challenge)
|
||||
LOOPIA_USER="${LOOPIA_USER:-}"
|
||||
LOOPIA_PASSWORD="${LOOPIA_PASSWORD:-}"
|
||||
|
||||
log() {
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
|
||||
}
|
||||
|
||||
check_dependencies() {
|
||||
local missing_deps=()
|
||||
|
||||
if ! command -v certbot >/dev/null 2>&1; then
|
||||
missing_deps+=("certbot")
|
||||
fi
|
||||
|
||||
if ! command -v nginx >/dev/null 2>&1; then
|
||||
missing_deps+=("nginx")
|
||||
fi
|
||||
|
||||
if ! command -v openssl >/dev/null 2>&1; then
|
||||
missing_deps+=("openssl")
|
||||
fi
|
||||
|
||||
if [[ ${#missing_deps[@]} -gt 0 ]]; then
|
||||
log "ERROR: Missing dependencies: ${missing_deps[*]}"
|
||||
log "Please install missing packages and try again"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
check_certificate_expiry() {
|
||||
local cert_path="$CERT_DIR/live/$DOMAIN/cert.pem"
|
||||
|
||||
if [[ ! -f "$cert_path" ]]; then
|
||||
log "Certificate not found at $cert_path - will attempt to obtain new certificate"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Get certificate expiry date
|
||||
local expiry_date=$(openssl x509 -in "$cert_path" -noout -enddate | cut -d= -f2)
|
||||
local expiry_epoch=$(date -d "$expiry_date" +%s)
|
||||
local current_epoch=$(date +%s)
|
||||
local days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
|
||||
|
||||
log "Certificate expires in $days_until_expiry days"
|
||||
|
||||
if [[ $days_until_expiry -le $RENEWAL_DAYS ]]; then
|
||||
log "Certificate expires in $days_until_expiry days - renewal needed"
|
||||
return 1
|
||||
else
|
||||
log "Certificate is valid for $days_until_expiry more days - no renewal needed"
|
||||
return 0
|
||||
fi
|
||||
}
|
||||
|
||||
attempt_dns_challenge() {
|
||||
log "Attempting DNS challenge..."
|
||||
|
||||
if [[ -z "$LOOPIA_USER" || -z "$LOOPIA_PASSWORD" ]]; then
|
||||
log "LOOPIA_USER or LOOPIA_PASSWORD not set - skipping DNS challenge"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check if dns-lexicon is available
|
||||
if command -v lexicon >/dev/null 2>&1; then
|
||||
log "Using dns-lexicon for DNS challenge..."
|
||||
certbot certonly \
|
||||
--dns-lexicon \
|
||||
--dns-lexicon-provider loopia \
|
||||
--dns-lexicon-loopia-username="$LOOPIA_USER" \
|
||||
--dns-lexicon-loopia-password="$LOOPIA_PASSWORD" \
|
||||
--email "$EMAIL" \
|
||||
--agree-tos \
|
||||
--non-interactive \
|
||||
--expand \
|
||||
-d "$DOMAIN" \
|
||||
-d "*.$DOMAIN"
|
||||
return $?
|
||||
fi
|
||||
|
||||
# Fallback: Manual DNS with custom hook
|
||||
if [[ -f "$(dirname "$0")/loopia-hook.sh" ]]; then
|
||||
log "Using custom Loopia hook for DNS challenge..."
|
||||
LOOPIA_USER="$LOOPIA_USER" LOOPIA_PASSWORD="$LOOPIA_PASSWORD" \
|
||||
certbot certonly \
|
||||
--manual \
|
||||
--preferred-challenges dns \
|
||||
--manual-auth-hook "$(dirname "$0")/loopia-hook.sh auth" \
|
||||
--manual-cleanup-hook "$(dirname "$0")/loopia-hook.sh cleanup" \
|
||||
--email "$EMAIL" \
|
||||
--agree-tos \
|
||||
--non-interactive \
|
||||
--expand \
|
||||
-d "$DOMAIN" \
|
||||
-d "*.$DOMAIN"
|
||||
return $?
|
||||
fi
|
||||
|
||||
log "No DNS challenge method available"
|
||||
return 1
|
||||
}
|
||||
|
||||
attempt_http_challenge() {
|
||||
log "Attempting HTTP challenge..."
|
||||
|
||||
# Ensure webroot directory exists
|
||||
mkdir -p "$WEBROOT_PATH"
|
||||
|
||||
# Check if nginx is configured for ACME challenges
|
||||
if ! nginx -t 2>/dev/null; then
|
||||
log "WARNING: nginx configuration test failed"
|
||||
fi
|
||||
|
||||
certbot certonly \
|
||||
--webroot \
|
||||
--webroot-path="$WEBROOT_PATH" \
|
||||
--email "$EMAIL" \
|
||||
--agree-tos \
|
||||
--non-interactive \
|
||||
--expand \
|
||||
-d "$DOMAIN"
|
||||
|
||||
return $?
|
||||
}
|
||||
|
||||
reload_nginx() {
|
||||
log "Reloading nginx configuration..."
|
||||
|
||||
# Test nginx configuration first
|
||||
if nginx -t; then
|
||||
systemctl reload nginx || service nginx reload || nginx -s reload
|
||||
log "Nginx reloaded successfully"
|
||||
else
|
||||
log "ERROR: nginx configuration test failed - not reloading"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
show_certificate_info() {
|
||||
local cert_path="$CERT_DIR/live/$DOMAIN/cert.pem"
|
||||
|
||||
if [[ ! -f "$cert_path" ]]; then
|
||||
log "No certificate found for $DOMAIN"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log "Certificate Information:"
|
||||
log "========================"
|
||||
|
||||
# Get certificate details
|
||||
local subject=$(openssl x509 -in "$cert_path" -noout -subject | sed 's/subject=//')
|
||||
local issuer=$(openssl x509 -in "$cert_path" -noout -issuer | sed 's/issuer=//')
|
||||
local expiry_date=$(openssl x509 -in "$cert_path" -noout -enddate | cut -d= -f2)
|
||||
local san=$(openssl x509 -in "$cert_path" -noout -text | grep -A1 "Subject Alternative Name" | tail -1 | sed 's/^[[:space:]]*//')
|
||||
|
||||
# Calculate days until expiry
|
||||
local expiry_epoch=$(date -d "$expiry_date" +%s)
|
||||
local current_epoch=$(date +%s)
|
||||
local days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
|
||||
|
||||
log " Domain: $DOMAIN"
|
||||
log " Subject: $subject"
|
||||
log " Issuer: $issuer"
|
||||
log " SAN: $san"
|
||||
log " Expires: $expiry_date"
|
||||
log " Days until expiry: $days_until_expiry"
|
||||
|
||||
if [[ $days_until_expiry -le $RENEWAL_DAYS ]]; then
|
||||
log " STATUS: ⚠️ Certificate expires soon - renewal recommended"
|
||||
elif [[ $days_until_expiry -le 30 ]]; then
|
||||
log " STATUS: ⚡ Certificate expires in less than 30 days"
|
||||
else
|
||||
log " STATUS: ✅ Certificate is valid"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
# Create log directory
|
||||
mkdir -p "$(dirname "$LOG_FILE")"
|
||||
|
||||
log "Starting SSL certificate management for $DOMAIN"
|
||||
|
||||
# Check dependencies
|
||||
check_dependencies
|
||||
|
||||
case "${1:-check}" in
|
||||
"check")
|
||||
log "Checking certificate status..."
|
||||
if check_certificate_expiry; then
|
||||
log "Certificate is valid - no action needed"
|
||||
show_certificate_info
|
||||
exit 0
|
||||
else
|
||||
log "Certificate renewal required"
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
|
||||
"renew")
|
||||
log "Forcing certificate renewal..."
|
||||
|
||||
# Try DNS challenge first (for wildcard support)
|
||||
if attempt_dns_challenge; then
|
||||
log "DNS challenge successful!"
|
||||
reload_nginx
|
||||
show_certificate_info
|
||||
log "Certificate renewal completed successfully"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Fallback to HTTP challenge
|
||||
log "DNS challenge failed - falling back to HTTP challenge"
|
||||
if attempt_http_challenge; then
|
||||
log "HTTP challenge successful!"
|
||||
reload_nginx
|
||||
show_certificate_info
|
||||
log "Certificate renewal completed successfully"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
log "ERROR: All certificate renewal attempts failed"
|
||||
exit 1
|
||||
;;
|
||||
|
||||
"status"|"info")
|
||||
show_certificate_info
|
||||
;;
|
||||
|
||||
"auto")
|
||||
log "Auto-renewal check (runs only if needed)..."
|
||||
if check_certificate_expiry; then
|
||||
log "Certificate is valid - no renewal needed"
|
||||
exit 0
|
||||
else
|
||||
log "Certificate needs renewal - attempting automatic renewal"
|
||||
exec "$0" renew
|
||||
fi
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "SSL Certificate Management for $DOMAIN"
|
||||
echo "======================================"
|
||||
echo ""
|
||||
echo "Usage: $0 [command]"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " check Check if certificate needs renewal"
|
||||
echo " renew Force certificate renewal"
|
||||
echo " status Show certificate information"
|
||||
echo " auto Auto-renew only if needed (for cron)"
|
||||
echo ""
|
||||
echo "Environment variables:"
|
||||
echo " DOMAIN Domain name (default: $DOMAIN)"
|
||||
echo " EMAIL Email for Let's Encrypt (default: $EMAIL)"
|
||||
echo " RENEWAL_DAYS Days before expiry to renew (default: $RENEWAL_DAYS)"
|
||||
echo " LOOPIA_USER Loopia username for DNS challenge"
|
||||
echo " LOOPIA_PASSWORD Loopia password for DNS challenge"
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Run main function
|
||||
main "$@"
|
||||
158
ssl/loopia-hook.sh
Normal file
158
ssl/loopia-hook.sh
Normal file
@@ -0,0 +1,158 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Loopia DNS API hook for certbot
|
||||
# This script handles DNS TXT record creation and cleanup for Let's Encrypt challenges
|
||||
|
||||
set -e
|
||||
|
||||
LOOPIA_USER="${LOOPIA_USER:-}"
|
||||
LOOPIA_PASSWORD="${LOOPIA_PASSWORD:-}"
|
||||
LOOPIA_API_URL="https://api.loopia.se/RPCSERV"
|
||||
|
||||
log() {
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Loopia Hook: $1" >&2
|
||||
}
|
||||
|
||||
# Extract domain and subdomain parts
|
||||
extract_domain_parts() {
|
||||
local full_domain="$1"
|
||||
|
||||
# For *.dev.uggla.uamils.com -> domain=uamils.com, subdomain=_acme-challenge.dev
|
||||
# For dev.uggla.uamils.com -> domain=uamils.com, subdomain=_acme-challenge.dev
|
||||
|
||||
if [[ "$full_domain" == *.uamils.com ]]; then
|
||||
DOMAIN="uamils.com"
|
||||
local prefix="${full_domain%.uamils.com}"
|
||||
if [[ "$prefix" == *"*"* ]]; then
|
||||
# Wildcard domain *.dev.uggla.uamils.com
|
||||
SUBDOMAIN="_acme-challenge.${prefix#*.}"
|
||||
else
|
||||
# Regular domain dev.uggla.uamils.com
|
||||
SUBDOMAIN="_acme-challenge.$prefix"
|
||||
fi
|
||||
else
|
||||
log "ERROR: Unsupported domain format: $full_domain"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Call Loopia API
|
||||
call_loopia_api() {
|
||||
local method="$1"
|
||||
shift
|
||||
local params="$@"
|
||||
|
||||
curl -s -X POST "$LOOPIA_API_URL" \
|
||||
-H "Content-Type: text/xml" \
|
||||
-d "<?xml version=\"1.0\"?>
|
||||
<methodCall>
|
||||
<methodName>$method</methodName>
|
||||
<params>
|
||||
<param><value><string>$LOOPIA_USER</string></value></param>
|
||||
<param><value><string>$LOOPIA_PASSWORD</string></value></param>
|
||||
$params
|
||||
</params>
|
||||
</methodCall>"
|
||||
}
|
||||
|
||||
# Add DNS TXT record
|
||||
add_txt_record() {
|
||||
local domain="$1"
|
||||
local subdomain="$2"
|
||||
local txt_value="$3"
|
||||
|
||||
log "Adding TXT record: $subdomain.$domain = $txt_value"
|
||||
|
||||
local response=$(call_loopia_api "addZoneRecord" \
|
||||
"<param><value><string>$domain</string></value></param>
|
||||
<param><value><string>$subdomain</string></value></param>
|
||||
<param><value><struct>
|
||||
<member>
|
||||
<name>type</name>
|
||||
<value><string>TXT</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>rdata</name>
|
||||
<value><string>$txt_value</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>ttl</name>
|
||||
<value><int>300</int></value>
|
||||
</member>
|
||||
</struct></value></param>")
|
||||
|
||||
if echo "$response" | grep -q "OK"; then
|
||||
log "Successfully added TXT record"
|
||||
else
|
||||
log "ERROR adding TXT record: $response"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Remove DNS TXT record
|
||||
remove_txt_record() {
|
||||
local domain="$1"
|
||||
local subdomain="$2"
|
||||
|
||||
log "Removing TXT records for: $subdomain.$domain"
|
||||
|
||||
# Get existing records
|
||||
local records=$(call_loopia_api "getZoneRecords" \
|
||||
"<param><value><string>$domain</string></value></param>
|
||||
<param><value><string>$subdomain</string></value></param>")
|
||||
|
||||
# Extract record IDs for TXT records
|
||||
local record_ids=$(echo "$records" | grep -A5 "<name>type</name>" | grep -B5 "<string>TXT</string>" | grep "record_id" | sed 's/.*<int>\([0-9]*\)<\/int>.*/\1/')
|
||||
|
||||
for record_id in $record_ids; do
|
||||
if [[ -n "$record_id" ]]; then
|
||||
log "Removing TXT record ID: $record_id"
|
||||
call_loopia_api "removeZoneRecord" \
|
||||
"<param><value><string>$domain</string></value></param>
|
||||
<param><value><string>$subdomain</string></value></param>
|
||||
<param><value><int>$record_id</int></value></param>"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# Main script logic
|
||||
case "$1" in
|
||||
"auth")
|
||||
if [[ -z "$CERTBOT_DOMAIN" || -z "$CERTBOT_VALIDATION" ]]; then
|
||||
log "ERROR: CERTBOT_DOMAIN or CERTBOT_VALIDATION not set"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z "$LOOPIA_USER" || -z "$LOOPIA_PASSWORD" ]]; then
|
||||
log "ERROR: LOOPIA_USER or LOOPIA_PASSWORD not set"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
extract_domain_parts "$CERTBOT_DOMAIN"
|
||||
add_txt_record "$DOMAIN" "$SUBDOMAIN" "$CERTBOT_VALIDATION"
|
||||
|
||||
# Wait for DNS propagation
|
||||
log "Waiting 60 seconds for DNS propagation..."
|
||||
sleep 60
|
||||
;;
|
||||
|
||||
"cleanup")
|
||||
if [[ -z "$CERTBOT_DOMAIN" ]]; then
|
||||
log "ERROR: CERTBOT_DOMAIN not set"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -z "$LOOPIA_USER" || -z "$LOOPIA_PASSWORD" ]]; then
|
||||
log "WARNING: LOOPIA_USER or LOOPIA_PASSWORD not set - skipping cleanup"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
extract_domain_parts "$CERTBOT_DOMAIN"
|
||||
remove_txt_record "$DOMAIN" "$SUBDOMAIN"
|
||||
;;
|
||||
|
||||
*)
|
||||
log "Usage: $0 {auth|cleanup}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
94
ssl/setup.sh
Normal file
94
ssl/setup.sh
Normal file
@@ -0,0 +1,94 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Quick setup script for SSL certificate management
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
echo "SSL Certificate Management Setup"
|
||||
echo "==============================="
|
||||
echo ""
|
||||
|
||||
# Check if running as root
|
||||
if [[ $EUID -eq 0 ]]; then
|
||||
echo "WARNING: Running as root. This is required for system-wide certificate management."
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Check dependencies
|
||||
echo "Checking dependencies..."
|
||||
missing_deps=()
|
||||
|
||||
if ! command -v certbot >/dev/null 2>&1; then
|
||||
missing_deps+=("certbot")
|
||||
fi
|
||||
|
||||
if ! command -v nginx >/dev/null 2>&1; then
|
||||
missing_deps+=("nginx")
|
||||
fi
|
||||
|
||||
if ! command -v openssl >/dev/null 2>&1; then
|
||||
missing_deps+=("openssl")
|
||||
fi
|
||||
|
||||
if [[ ${#missing_deps[@]} -gt 0 ]]; then
|
||||
echo "❌ Missing dependencies: ${missing_deps[*]}"
|
||||
echo ""
|
||||
echo "Install them with:"
|
||||
echo " sudo apt update"
|
||||
echo " sudo apt install ${missing_deps[*]}"
|
||||
echo ""
|
||||
echo "For DNS challenges (optional):"
|
||||
echo " sudo pip install dns-lexicon[full]"
|
||||
exit 1
|
||||
else
|
||||
echo "✅ All dependencies found"
|
||||
fi
|
||||
|
||||
# Make scripts executable
|
||||
echo "Making scripts executable..."
|
||||
chmod +x "$SCRIPT_DIR/certbot-manager.sh"
|
||||
chmod +x "$SCRIPT_DIR/loopia-hook.sh"
|
||||
echo "✅ Scripts are now executable"
|
||||
|
||||
# Setup environment file
|
||||
if [[ ! -f "$SCRIPT_DIR/.env" ]]; then
|
||||
echo "Creating .env file from template..."
|
||||
cp "$SCRIPT_DIR/.env.example" "$SCRIPT_DIR/.env"
|
||||
echo "📝 Please edit $SCRIPT_DIR/.env with your configuration:"
|
||||
echo " nano $SCRIPT_DIR/.env"
|
||||
echo ""
|
||||
else
|
||||
echo "✅ .env file already exists"
|
||||
fi
|
||||
|
||||
# Create log directory
|
||||
sudo mkdir -p /var/log/letsencrypt
|
||||
echo "✅ Log directory created"
|
||||
|
||||
# Setup instructions
|
||||
echo ""
|
||||
echo "Setup Complete! 🎉"
|
||||
echo "=================="
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo "1. Edit configuration: nano $SCRIPT_DIR/.env"
|
||||
echo "2. Test certificate: $SCRIPT_DIR/certbot-manager.sh check"
|
||||
echo "3. Get certificate: $SCRIPT_DIR/certbot-manager.sh renew"
|
||||
echo "4. Setup auto-renewal:"
|
||||
echo ""
|
||||
echo " Option A - Cron (simple):"
|
||||
echo " sudo crontab -e"
|
||||
echo " Add: 0 2 * * * cd $SCRIPT_DIR && source .env && ./certbot-manager.sh auto >> /var/log/letsencrypt/cron.log 2>&1"
|
||||
echo ""
|
||||
echo " Option B - Systemd (recommended):"
|
||||
echo " sudo cp $SCRIPT_DIR/ssl-renewal.service /etc/systemd/system/"
|
||||
echo " sudo cp $SCRIPT_DIR/ssl-renewal.timer /etc/systemd/system/"
|
||||
echo " Edit paths in /etc/systemd/system/ssl-renewal.service"
|
||||
echo " sudo systemctl enable ssl-renewal.timer"
|
||||
echo " sudo systemctl start ssl-renewal.timer"
|
||||
echo ""
|
||||
echo "View logs with:"
|
||||
echo " tail -f /var/log/letsencrypt/renewal.log"
|
||||
12
ssl/ssl-renewal.service
Normal file
12
ssl/ssl-renewal.service
Normal file
@@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=SSL Certificate Renewal Service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
User=root
|
||||
WorkingDirectory=/path/to/your/project/ssl
|
||||
EnvironmentFile=/path/to/your/project/ssl/.env
|
||||
ExecStart=/path/to/your/project/ssl/certbot-manager.sh auto
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
11
ssl/ssl-renewal.timer
Normal file
11
ssl/ssl-renewal.timer
Normal file
@@ -0,0 +1,11 @@
|
||||
[Unit]
|
||||
Description=Run SSL Certificate Renewal Daily
|
||||
Requires=ssl-renewal.service
|
||||
|
||||
[Timer]
|
||||
OnCalendar=daily
|
||||
RandomizedDelaySec=3600
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -1,46 +0,0 @@
|
||||
@echo off
|
||||
REM Health Probe Simulator Startup Script (Windows)
|
||||
REM This script starts the health probe simulator that continuously sends heartbeats
|
||||
|
||||
echo 🏥 Starting Health Probe Simulator...
|
||||
echo ==================================
|
||||
|
||||
REM Set defaults if not provided
|
||||
if not defined PROBE_FAILRATE set PROBE_FAILRATE=30
|
||||
if not defined PROBE_INTERVAL_SECONDS set PROBE_INTERVAL_SECONDS=60
|
||||
if not defined API_BASE_URL set API_BASE_URL=https://selfservice.cqers.com/drones/api
|
||||
|
||||
echo 🔧 Configuration:
|
||||
echo Failure Rate: %PROBE_FAILRATE%%%
|
||||
echo Probe Interval: %PROBE_INTERVAL_SECONDS% seconds
|
||||
echo API URL: %API_BASE_URL%
|
||||
echo.
|
||||
|
||||
REM Check if running with Docker
|
||||
if "%1"=="docker" (
|
||||
echo 🐳 Starting with Docker Compose...
|
||||
docker-compose --profile healthprobe up healthprobe
|
||||
) else (
|
||||
echo 💻 Running locally...
|
||||
|
||||
REM Check if Python is available
|
||||
python --version >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo ❌ Python is required but not installed
|
||||
pause
|
||||
exit /b 1
|
||||
)
|
||||
|
||||
REM Check if requests module is available
|
||||
python -c "import requests" >nul 2>&1
|
||||
if errorlevel 1 (
|
||||
echo 📦 Installing requests module...
|
||||
pip install requests
|
||||
)
|
||||
|
||||
REM Run the health probe simulator
|
||||
echo 🚀 Starting health probe simulator...
|
||||
python health_probe_simulator.py
|
||||
)
|
||||
|
||||
pause
|
||||
@@ -1,38 +0,0 @@
|
||||
@echo off
|
||||
setlocal
|
||||
|
||||
echo 🐳 Testing Docker Builds
|
||||
echo =======================
|
||||
|
||||
echo [INFO] Building backend container...
|
||||
docker build -t drone-backend ./server
|
||||
if %errorlevel% neq 0 (
|
||||
echo [ERROR] Backend build failed
|
||||
exit /b 1
|
||||
)
|
||||
echo [SUCCESS] Backend build completed
|
||||
|
||||
echo [INFO] Building frontend container...
|
||||
docker build -t drone-frontend ./client
|
||||
if %errorlevel% neq 0 (
|
||||
echo [ERROR] Frontend build failed
|
||||
exit /b 1
|
||||
)
|
||||
echo [SUCCESS] Frontend build completed
|
||||
|
||||
echo [INFO] Building simulator container...
|
||||
docker build -f docker/simulator/Dockerfile -t drone-simulator .
|
||||
if %errorlevel% neq 0 (
|
||||
echo [ERROR] Simulator build failed
|
||||
exit /b 1
|
||||
)
|
||||
echo [SUCCESS] Simulator build completed
|
||||
|
||||
echo [SUCCESS] All builds completed successfully!
|
||||
echo.
|
||||
echo You can now run:
|
||||
echo docker compose up -d
|
||||
echo or
|
||||
echo docker compose -f docker compose.simple.yml up -d
|
||||
|
||||
pause
|
||||
Reference in New Issue
Block a user