Refactor Letsencrypt stack
This commit is contained in:
VirtuBox
@@ -339,7 +339,8 @@ def setupwordpress(self, data):
|
||||
.format(WOVariables.wo_wpcli_path) +
|
||||
"config create " +
|
||||
"--dbname=\'{0}\' --dbprefix=\'{1}\' --dbhost=\'{2}\' "
|
||||
.format(data['wo_db_name'], wo_wp_prefix, data['wo_db_host']) +
|
||||
.format(data['wo_db_name'],
|
||||
wo_wp_prefix, data['wo_db_host']) +
|
||||
"--dbuser=\'{0}\' --dbpass=\'{1}\' "
|
||||
"--extra-php<<PHP \n {2} {3} {4} \nPHP\""
|
||||
.format(data['wo_db_user'], data['wo_db_pass'],
|
||||
@@ -1267,38 +1268,66 @@ def doCleanupAction(self, domain='', webroot='', dbname='', dbuser='',
|
||||
|
||||
|
||||
# setup letsencrypt for domain + www.domain
|
||||
def setupLetsEncrypt(self, wo_domain_name):
|
||||
def setupLetsEncrypt(self, wo_domain_name, subdomain=false, wildcard=false,
|
||||
wo_dns=false, wo_acme_dns='dns_cf'):
|
||||
|
||||
if os.path.isfile("/etc/letsencrypt/renewal/{0}_ecc/{0}.conf"
|
||||
.format(wo_domain_name)):
|
||||
if os.path.isfile("/etc/letsencrypt/"
|
||||
"renewal/{0}_ecc/"
|
||||
"fullchain.cer".format(wo_domain_name)):
|
||||
Log.debug(self, "Let's Encrypt certificate "
|
||||
"found for the domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
ssl = archivedCertificateHandle(self, wo_domain_name)
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d www.{0} -w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
if os.path.isfile("/etc/letsencrypt/"
|
||||
"renewal/{0}_ecc/"
|
||||
"fullchain.cer".format(wo_domain_name)):
|
||||
Log.debug(self, "Let's Encrypt certificate "
|
||||
"found for the domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
ssl = archivedCertificateHandle(self, wo_domain_name)
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d www.{0} -w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
|
||||
if subdomain:
|
||||
if wo_dns:
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} --dns {1} "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name,
|
||||
wo_acme_dns))
|
||||
else:
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
elif wildcard:
|
||||
if wo_dns:
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d *.{0} --dns {1} "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name,
|
||||
wo_acme_dns))
|
||||
else:
|
||||
if wo_dns:
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d www.{0} --dns {1} "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name,
|
||||
wo_acme_dns))
|
||||
else:
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d www.{0} "
|
||||
"-w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
if ssl:
|
||||
|
||||
try:
|
||||
Log.info(self, "Deploying SSL cert with acme.sh")
|
||||
Log.debug(self, "Cert deployment for domain: {0}"
|
||||
@@ -1349,176 +1378,6 @@ def setupLetsEncrypt(self, wo_domain_name):
|
||||
"you are running Let\'s Encrypt Client "
|
||||
"\n to allow it to verify the site automatically.")
|
||||
|
||||
# setup letsencrypt for a subdomain
|
||||
|
||||
|
||||
def setupLetsEncryptSubdomain(self, wo_domain_name):
|
||||
|
||||
if os.path.isfile("/etc/letsencrypt/renewal/{0}_ecc/{0}.conf"
|
||||
.format(wo_domain_name)):
|
||||
if os.path.isfile("/etc/letsencrypt/"
|
||||
"renewal/{0}_ecc/"
|
||||
"fullchain.cer".format(wo_domain_name)):
|
||||
Log.debug(self, "Let's Encrypt certificate "
|
||||
"found for the domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
ssl = archivedCertificateHandle(self, wo_domain_name)
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -w /var/www/html "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name))
|
||||
if ssl:
|
||||
|
||||
try:
|
||||
Log.info(self, "Deploying SSL cert with acme.sh")
|
||||
Log.debug(self, "Deploying cert for domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
sslsetup = WOShellExec.cmd_exec(self, "mkdir -p {0}/{1} && "
|
||||
"/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--install-cert -d {1} --ecc "
|
||||
"--cert-file {0}/{1}/cert.pem "
|
||||
"--key-file {0}/{1}/key.pem "
|
||||
"--fullchain-file "
|
||||
"{0}/{1}/fullchain.pem "
|
||||
"--ca-file {0}/{1}/ca.pem "
|
||||
"--reloadcmd "
|
||||
"\"nginx -t && service nginx restart\" "
|
||||
.format(WOVariables.wo_ssl_live,
|
||||
wo_domain_name))
|
||||
|
||||
Log.info(
|
||||
self, "Adding /var/www/{0}/conf/nginx/ssl.conf"
|
||||
.format(wo_domain_name))
|
||||
|
||||
sslconf = open("/var/www/{0}/conf/nginx/ssl.conf"
|
||||
.format(wo_domain_name),
|
||||
encoding='utf-8', mode='w')
|
||||
sslconf.write("listen 443 ssl http2;\n"
|
||||
"listen [::]:443 ssl http2;\n"
|
||||
"ssl_certificate {0}/{1}/fullchain.pem;\n"
|
||||
"ssl_certificate_key {0}/{1}/key.pem;\n"
|
||||
"ssl_trusted_certificate {0}/{1}/ca.pem;\n"
|
||||
"ssl_stapling_verify on;\n"
|
||||
.format(WOVariables.wo_ssl_live, wo_domain_name))
|
||||
sslconf.close()
|
||||
updateSiteInfo(self, wo_domain_name, ssl=True)
|
||||
|
||||
WOGit.add(self, ["/etc/letsencrypt"],
|
||||
msg="Adding letsencrypt folder")
|
||||
|
||||
except IOError as e:
|
||||
Log.debug(self, str(e))
|
||||
Log.debug(self, "Error occured while generating "
|
||||
"ssl.conf")
|
||||
else:
|
||||
Log.error(self, "Unable to create ssl.conf", False)
|
||||
Log.error(self, "Please make sure that your site is pointed to \n"
|
||||
"same server on which "
|
||||
"you are running Let\'s Encrypt Client "
|
||||
"\n to allow it to verify the site automatically.")
|
||||
|
||||
# setup letsencrypt for domain + www.domain
|
||||
|
||||
|
||||
def setupLetsEncryptWildcard(self, wo_domain_name, wo_acme_dns='dns_cf'):
|
||||
|
||||
if os.path.isfile("/etc/letsencrypt/renewal/{0}_ecc/{0}.conf"
|
||||
.format(wo_domain_name)):
|
||||
if os.path.isfile("/etc/letsencrypt/"
|
||||
"renewal/{0}_ecc/"
|
||||
"fullchain.cer".format(wo_domain_name)):
|
||||
Log.debug(self, "Let's Encrypt certificate "
|
||||
"found for the domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
ssl = archivedCertificateHandle(self, wo_domain_name)
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d *.{0} --dns {1} "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name, wo_acme_dns))
|
||||
else:
|
||||
Log.info(self, "Issuing SSL cert with acme.sh")
|
||||
ssl = WOShellExec.cmd_exec(self, "/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--issue "
|
||||
"-d {0} -d *.{0} --dns {1} "
|
||||
"-k ec-384 -f"
|
||||
.format(wo_domain_name, wo_acme_dns))
|
||||
|
||||
if ssl:
|
||||
|
||||
try:
|
||||
Log.info(self, "Deploying SSL cert with acme.sh")
|
||||
Log.debug(self, "Cert deployment for domain: {0}"
|
||||
.format(wo_domain_name))
|
||||
sslsetup = WOShellExec.cmd_exec(self, "mkdir -p {0}/{1} && "
|
||||
"/etc/letsencrypt/acme.sh "
|
||||
"--config-home "
|
||||
"'/etc/letsencrypt/config' "
|
||||
"--install-cert -d {1} --ecc "
|
||||
"--cert-file {0}/{1}/cert.pem "
|
||||
"--key-file {0}/{1}/key.pem "
|
||||
"--fullchain-file "
|
||||
"{0}/{1}/fullchain.pem "
|
||||
"--ca-file {0}/{1}/ca.pem "
|
||||
"--reloadcmd "
|
||||
"\"nginx -t && "
|
||||
"service nginx restart\" "
|
||||
.format(WOVariables.wo_ssl_live,
|
||||
wo_domain_name))
|
||||
Log.info(
|
||||
self, "Adding /var/www/{0}/conf/nginx/ssl.conf"
|
||||
.format(wo_domain_name))
|
||||
|
||||
sslconf = open("/var/www/{0}/conf/nginx/ssl.conf"
|
||||
.format(wo_domain_name),
|
||||
encoding='utf-8', mode='w')
|
||||
sslconf.write("listen 443 ssl http2;\n"
|
||||
"listen [::]:443 ssl http2;\n"
|
||||
"ssl_certificate {0}/{1}/fullchain.pem;\n"
|
||||
"ssl_certificate_key {0}/{1}/key.pem;\n"
|
||||
"ssl_trusted_certificate {0}/{1}/ca.pem;\n"
|
||||
"ssl_stapling_verify on;\n"
|
||||
.format(WOVariables.wo_ssl_live, wo_domain_name))
|
||||
sslconf.close()
|
||||
updateSiteInfo(self, wo_domain_name, ssl=True)
|
||||
|
||||
WOGit.add(self, ["/etc/letsencrypt"],
|
||||
msg="Adding letsencrypt folder")
|
||||
|
||||
except IOError as e:
|
||||
Log.debug(self, str(e))
|
||||
Log.debug(self, "Error occured while generating "
|
||||
"ssl.conf")
|
||||
else:
|
||||
Log.error(self, "Unable to install certificate", False)
|
||||
Log.error(self, "Please make sure that your site is pointed to \n"
|
||||
"same server on which "
|
||||
"you are running Let\'s Encrypt Client "
|
||||
"\n to allow it to verify the site automatically.")
|
||||
|
||||
|
||||
# letsencrypt cert renewal
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user