Skip to content

Commit 724e89d

Browse files
author
Jamie Curnow
committed
Nginx templates
1 parent 05d9742 commit 724e89d

15 files changed

+128
-274
lines changed

‎src/backend/index.js

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@
55
const logger = require('./logger').global;
66

77
function appStart () {
8-
const migrate = require('./migrate');
9-
const setup = require('./setup');
10-
const app = require('./app');
11-
const apiValidator = require('./lib/validator/api');
12-
const internalSsl = require('./internal/ssl');
8+
const migrate = require('./migrate');
9+
const setup = require('./setup');
10+
const app = require('./app');
11+
const apiValidator = require('./lib/validator/api');
12+
const internalCertificate = require('./internal/certificate');
1313

1414
return migrate.latest()
1515
.then(() => {
@@ -20,7 +20,7 @@ function appStart () {
2020
})
2121
.then(() => {
2222

23-
internalSsl.initTimer();
23+
internalCertificate.initTimer();
2424

2525
const server = app.listen(81, () => {
2626
logger.info('PID ' + process.pid + ' listening on port 81 ...');

‎src/backend/internal/certificate.js

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,43 @@ function omissions () {
1818

1919
const internalCertificate = {
2020

21-
allowed_ssl_files: ['certificate', 'certificate_key', 'intermediate_certificate'],
21+
allowed_ssl_files: ['certificate', 'certificate_key', 'intermediate_certificate'],
22+
interval_timeout: 1000 * 60 * 60 * 12, // 12 hours
23+
interval: null,
24+
interval_processing: false,
25+
26+
initTimer: () => {
27+
logger.info('Let\'s Encrypt Renewal Timer initialized');
28+
internalCertificate.interval = setInterval(internalCertificate.processExpiringHosts, internalCertificate.interval_timeout);
29+
},
30+
31+
/**
32+
* Triggered by a timer, this will check for expiring hosts and renew their ssl certs if required
33+
*/
34+
processExpiringHosts: () => {
35+
let internalNginx = require('./nginx');
36+
37+
if (!internalCertificate.interval_processing) {
38+
internalCertificate.interval_processing = true;
39+
logger.info('Renewing SSL certs close to expiry...');
40+
41+
return utils.exec(certbot_command + ' renew -q ' + (debug_mode ? '--staging' : ''))
42+
.then(result => {
43+
logger.info(result);
44+
internalCertificate.interval_processing = false;
45+
46+
return internalNginx.reload()
47+
.then(() => {
48+
logger.info('Renew Complete');
49+
return result;
50+
});
51+
})
52+
.catch(err => {
53+
logger.error(err);
54+
internalCertificate.interval_processing = false;
55+
});
56+
}
57+
},
2258

2359
/**
2460
* @param {Access} access
@@ -493,7 +529,7 @@ const internalCertificate = {
493529
* @returns {Promise}
494530
*/
495531
requestLetsEncryptSsl: certificate => {
496-
logger.info('Requesting Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
532+
logger.info('Requesting Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
497533

498534
return utils.exec(certbot_command + ' certonly --cert-name "npm-' + certificate.id + '" --agree-tos ' +
499535
'--email "' + certificate.meta.letsencrypt_email + '" ' +
@@ -511,14 +547,24 @@ const internalCertificate = {
511547
* @returns {Promise}
512548
*/
513549
renewLetsEncryptSsl: certificate => {
514-
logger.info('Renewing Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
550+
logger.info('Renewing Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
515551

516552
return utils.exec(certbot_command + ' renew -n --force-renewal --disable-hook-validation --cert-name "npm-' + certificate.id + '" ' + (debug_mode ? '--staging' : ''))
517553
.then(result => {
518554
logger.info(result);
519555
return result;
520556
});
521557
},
558+
559+
/**
560+
* @param {Object} certificate
561+
* @returns {Boolean}
562+
*/
563+
hasLetsEncryptSslCerts: certificate => {
564+
let le_path = '/etc/letsencrypt/live/npm-' + certificate.id;
565+
566+
return fs.existsSync(le_path + '/fullchain.pem') && fs.existsSync(le_path + '/privkey.pem');
567+
}
522568
};
523569

524570
module.exports = internalCertificate;

‎src/backend/internal/nginx.js

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
'use strict';
22

3-
const _ = require('lodash');
4-
const fs = require('fs');
5-
const Liquid = require('liquidjs');
6-
const logger = require('../logger').nginx;
7-
const utils = require('../lib/utils');
8-
const error = require('../lib/error');
9-
const internalSsl = require('./ssl');
10-
const debug_mode = process.env.NODE_ENV !== 'production';
3+
const _ = require('lodash');
4+
const fs = require('fs');
5+
const Liquid = require('liquidjs');
6+
const logger = require('../logger').nginx;
7+
const utils = require('../lib/utils');
8+
const error = require('../lib/error');
9+
const internalCertificate = require('./certificate');
10+
const debug_mode = process.env.NODE_ENV !== 'production';
1111

1212
const internalNginx = {
1313

@@ -32,11 +32,6 @@ const internalNginx = {
3232
// We're deleting this config regardless.
3333
return internalNginx.deleteConfig(host_type, host); // Don't throw errors, as the file may not exist at all
3434
})
35-
.then(() => {
36-
if (host.ssl && !internalSsl.hasValidSslCerts(host_type, host)) {
37-
return internalSsl.configureSsl(host_type, host);
38-
}
39-
})
4035
.then(() => {
4136
return internalNginx.generateConfig(host_type, host);
4237
})
@@ -56,7 +51,6 @@ const internalNginx = {
5651
});
5752
})
5853
.catch(err => {
59-
6054
if (debug_mode) {
6155
logger.error('Nginx test failed:', err.message);
6256
}

‎src/backend/internal/ssl.js

Lines changed: 0 additions & 164 deletions
This file was deleted.

‎src/backend/templates/_assets.conf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{% if caching_enabled == 1 or caching_enabled == true -%}
2+
# Asset Caching
3+
include conf.d/include/assets.conf;
4+
{%- endif %}

‎src/backend/templates/_certificates.conf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{%- if certificate and certificate_id > 0 -%}
2+
{%- if certificate.provider == "letsencrypt" %}
3+
# Let's Encrypt SSL
4+
include conf.d/include/letsencrypt-acme-challenge.conf;
5+
include conf.d/include/ssl-ciphers.conf;
6+
ssl_certificate /etc/letsencrypt/live/npm-{{ certificate.id }}/fullchain.pem;
7+
ssl_certificate_key /etc/letsencrypt/live/npm-{{ certificate.id }}/privkey.pem;
8+
{%- endif -%}
9+
10+
# TODO: Custom SSL paths
11+
12+
{%- endif %}

‎src/backend/templates/_exploits.conf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{% if block_exploits == 1 or block_exploits == true -%}
2+
# Block Exploits
3+
include conf.d/include/block-exploits.conf;
4+
{%- endif -%}

‎src/backend/templates/_forced_ssl.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{%- if certificate and certificate_id > 0 -%}
2+
{%- if ssl_forced == 1 or ssl_forced == true -%}
3+
# Force SSL
4+
include conf.d/include/force-ssl.conf;
5+
{%- endif -%}
6+
{%- endif %}

‎src/backend/templates/_header_comment.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# ------------------------------------------------------------
2+
# {{ domain_names | join: ", " }}
3+
# ------------------------------------------------------------

‎src/backend/templates/_listen.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
listen 80;
2+
{%- if certificate -%}
3+
listen 443 ssl;
4+
{%- endif %}
5+
server_name {{ domain_names | join: " " }};

0 commit comments

Comments
 (0)