mirrors/nginx-ui
1
0
Fork 0
mirror of https://github.com/0xJacky/nginx-ui.git synced 2025-05-11 02:15:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

refactor: auto certificate options

Browse source 
1. Add OCSP Must Staple options #292
2. Add LEGO_DISABLE_CNAME_SUPPORT options #407
This commit is contained in:
Jacky 2024-07-24 22:53:22 +08:00
parent 532d6e83c5
commit 4660a46a7e
No known key found for this signature in database
GPG key ID: 215C21B10DF38B4D
18 changed files with 234 additions and 212 deletions
Download patch file Download diff file Expand all files Collapse all files

14
internal/cert/auto_cert.go
View file

@ -71,12 +71,14 @@ func autoCert(certModel *model.Cert) {
// support SAN certification
payload := &ConfigPayload{
CertID: certModel.ID,
ServerName: certModel.Domains,
ChallengeMethod: certModel.ChallengeMethod,
DNSCredentialID: certModel.DnsCredentialID,
KeyType: certModel.GetKeyType(),
NotBefore: certInfo.NotBefore,
CertID: certModel.ID,
ServerName: certModel.Domains,
ChallengeMethod: certModel.ChallengeMethod,
DNSCredentialID: certModel.DnsCredentialID,
KeyType: certModel.GetKeyType(),
NotBefore: certInfo.NotBefore,
MustStaple: certModel.MustStaple,
LegoDisableCNAMESupport: certModel.LegoDisableCNAMESupport,
}
if certModel.Resource != nil {

13
internal/cert/cert.go
View file

@ -130,7 +130,6 @@ func IssueCert(payload *ConfigPayload, logChan chan string, errChan chan error)
errChan <- errors.Wrap(err, "environment configuration is empty")
return
}
}
if err != nil {
@ -138,6 +137,18 @@ func IssueCert(payload *ConfigPayload, logChan chan string, errChan chan error)
return
}
// fix #407
if payload.LegoDisableCNAMESupport {
err = os.Setenv("LEGO_DISABLE_CNAME_SUPPORT", "true")
if err != nil {
errChan <- errors.Wrap(err, "set env flag to disable lego CNAME support error")
return
}
defer func() {
_ = os.Unsetenv("LEGO_DISABLE_CNAME_SUPPORT")
}()
}
if time.Now().Sub(payload.NotBefore).Hours()/24 <= 21 &&
payload.Resource != nil && payload.Resource.Certificate != nil {
renew(payload, client, l, errChan)

5
internal/cert/obtain.go
View file

@ -10,8 +10,9 @@ import (
func obtain(payload *ConfigPayload, client *lego.Client, l *log.Logger, errChan chan error) {
request := certificate.ObtainRequest{
Domains: payload.ServerName,
Bundle: true,
Domains: payload.ServerName,
Bundle: true,
MustStaple: payload.MustStaple,
}
l.Println("[INFO] [Nginx UI] Obtaining certificate")

24
internal/cert/payload.go
View file

@ -16,17 +16,19 @@ import (
)
type ConfigPayload struct {
CertID int `json:"cert_id"`
ServerName []string `json:"server_name"`
ChallengeMethod string `json:"challenge_method"`
DNSCredentialID int `json:"dns_credential_id"`
ACMEUserID int `json:"acme_user_id"`
KeyType certcrypto.KeyType `json:"key_type"`
Resource *model.CertificateResource `json:"resource,omitempty"`
NotBefore time.Time `json:"-"`
CertificateDir string `json:"-"`
SSLCertificatePath string `json:"-"`
SSLCertificateKeyPath string `json:"-"`
CertID int `json:"cert_id"`
ServerName []string `json:"server_name"`
ChallengeMethod string `json:"challenge_method"`
DNSCredentialID int `json:"dns_credential_id"`
ACMEUserID int `json:"acme_user_id"`
KeyType certcrypto.KeyType `json:"key_type"`
Resource *model.CertificateResource `json:"resource,omitempty"`
MustStaple bool `json:"must_staple"`
LegoDisableCNAMESupport bool `json:"lego_disable_cname_support"`
NotBefore time.Time `json:"-"`
CertificateDir string `json:"-"`
SSLCertificatePath string `json:"-"`
SSLCertificateKeyPath string `json:"-"`
}
func (c *ConfigPayload) GetACMEUser() (user *model.AcmeUser, err error) {

53
internal/cert/renew.go
View file

@ -1,38 +1,39 @@
package cert
import (
"github.com/0xJacky/Nginx-UI/model"
"github.com/go-acme/lego/v4/certificate"
"github.com/go-acme/lego/v4/lego"
"github.com/pkg/errors"
"log"
"github.com/0xJacky/Nginx-UI/model"
"github.com/go-acme/lego/v4/certificate"
"github.com/go-acme/lego/v4/lego"
"github.com/pkg/errors"
"log"
)
func renew(payload *ConfigPayload, client *lego.Client, l *log.Logger, errChan chan error) {
if payload.Resource == nil {
errChan <- errors.New("resource is nil")
return
}
if payload.Resource == nil {
errChan <- errors.New("resource is nil")
return
}
options := &certificate.RenewOptions{
Bundle: true,
}
options := &certificate.RenewOptions{
Bundle: true,
MustStaple: payload.MustStaple,
}
cert, err := client.Certificate.RenewWithOptions(payload.Resource.GetResource(), options)
if err != nil {
errChan <- errors.Wrap(err, "renew cert error")
return
}
cert, err := client.Certificate.RenewWithOptions(payload.Resource.GetResource(), options)
if err != nil {
errChan <- errors.Wrap(err, "renew cert error")
return
}
payload.Resource = &model.CertificateResource{
Resource: cert,
PrivateKey: cert.PrivateKey,
Certificate: cert.Certificate,
IssuerCertificate: cert.IssuerCertificate,
CSR: cert.CSR,
}
payload.Resource = &model.CertificateResource{
Resource: cert,
PrivateKey: cert.PrivateKey,
Certificate: cert.Certificate,
IssuerCertificate: cert.IssuerCertificate,
CSR: cert.CSR,
}
payload.WriteFile(l, errChan)
payload.WriteFile(l, errChan)
l.Println("[INFO] [Nginx UI] Certificate renewed successfully")
l.Println("[INFO] [Nginx UI] Certificate renewed successfully")
}