shadowdaoandClaude Opus 5.5
8c7fd93387
- H1: request_ssl_bundle uses live/<primary> exactly (certbot was given
--cert-name <primary>) instead of find_certbot_live_dir(), which returns the
newest of <primary>/<primary>-NNNN. After a "not yet due" no-op that
published a stale -0001 and retired the real <primary> lineage. keep_lineage
is now the primary; the bundle's own lineage is never a retirement candidate.
- H2: retire_lineage_tree() moves live/<x>, archive/<x> and renewal/<x>.conf
together to /etc/letsencrypt/retired/<stamp>/{live,archive,renewal}/ (same
depth, relative symlinks still resolve, restore is three mv's). Leaving
archive/<x> behind made certbot's new_lineage() refuse the name forever
(CertStorageError) and leave an empty renewal conf. Test re-issues the name
through certbot's own storage code after retirement.
- M2: cert_retire_expired_pems moves already-published EXPIRED pems out of
/etc/haproxy/certs to cert-retired/ (never the last pem, never the default
self-signed cert) and the scripts reload when anything was retired.
- GET /api/capabilities + `capabilities` in the bundle response, and VERSION is
copied into the image, so WHP can refuse whole-site re-bundling against an
older edge.
Tests: test-cert-write-safety.py 47 -> 52, test-cert-scripts.py 44 -> 50; each
fix reverted in a scratch copy turns its suite red.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
116 lines
4.4 KiB
Bash
Executable File
116 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Certificate Sync Script for HAProxy Manager
|
|
# This script syncs all Let's Encrypt certificates to HAProxy format without running certbot renew
|
|
|
|
# Configuration
|
|
LOG_FILE="${LOG_FILE:-/var/log/haproxy-manager.log}"
|
|
ERROR_LOG_FILE="${ERROR_LOG_FILE:-/var/log/haproxy-manager-errors.log}"
|
|
DB_FILE="${DB_FILE:-/etc/haproxy/haproxy_config.db}"
|
|
SSL_CERTS_DIR="${SSL_CERTS_DIR:-/etc/haproxy/certs}"
|
|
LETSENCRYPT_LIVE_DIR="${LETSENCRYPT_LIVE_DIR:-/etc/letsencrypt/live}"
|
|
|
|
# Logging functions
|
|
log_info() {
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO] $*" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
log_error() {
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $*" | tee -a "$LOG_FILE" >> "$ERROR_LOG_FILE"
|
|
}
|
|
|
|
# Safe certificate publication helpers (cert_publish / cert_bundle_valid /
|
|
# haproxy_config_ok). Sourced AFTER the log_* functions above so the library
|
|
# uses this script's logging rather than its own fallbacks.
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=cert-publish-lib.sh
|
|
if [ -r "${SCRIPT_DIR}/cert-publish-lib.sh" ]; then
|
|
. "${SCRIPT_DIR}/cert-publish-lib.sh"
|
|
else
|
|
log_error "Missing ${SCRIPT_DIR}/cert-publish-lib.sh - refusing to touch live certificates"
|
|
exit 1
|
|
fi
|
|
|
|
log_info "Starting certificate sync process"
|
|
|
|
# Ensure SSL certs directory exists
|
|
mkdir -p "$SSL_CERTS_DIR"
|
|
|
|
# Get all SSL-enabled domains from database
|
|
DOMAINS=$(find "$LETSENCRYPT_LIVE_DIR/" -mindepth 1 -maxdepth 1 -type d -printf '%f\n')
|
|
|
|
if [ -z "$DOMAINS" ]; then
|
|
log_info "No SSL-enabled domains found"
|
|
exit 0
|
|
fi
|
|
|
|
# Copy certificates for each domain
|
|
UPDATED=0
|
|
FAILED=0
|
|
SKIPPED_EXPIRED=0
|
|
|
|
while read -r domain; do
|
|
CERT_FILE="${LETSENCRYPT_LIVE_DIR}/${domain}/fullchain.pem"
|
|
KEY_FILE="${LETSENCRYPT_LIVE_DIR}/${domain}/privkey.pem"
|
|
COMBINED_FILE="${SSL_CERTS_DIR}/${domain}.pem"
|
|
|
|
if [ -f "$CERT_FILE" ] && cert_is_expired "$CERT_FILE"; then
|
|
# Never publish an expired lineage. It cannot help any client and,
|
|
# because HAProxy serves the first file claiming an SNI name, it can
|
|
# shadow a valid bundle for a name it shares (brainjar.net, 2026-10-07).
|
|
# Counted separately from FAILED: a dead lineage that keeps expiring is
|
|
# reported on every run (ERROR log) without making every run "fail".
|
|
log_error "Skipping EXPIRED certificate lineage $domain (notAfter $(cert_not_after "$CERT_FILE")) - not publishing it"
|
|
SKIPPED_EXPIRED=$((SKIPPED_EXPIRED + 1))
|
|
elif [ -f "$CERT_FILE" ] && [ -f "$KEY_FILE" ]; then
|
|
# Assemble in a staging dir and rename into place. NEVER redirect into
|
|
# $COMBINED_FILE: the shell truncates the live pem before cat runs, and
|
|
# HAProxy loads $SSL_CERTS_DIR as a directory, so one bad file there
|
|
# takes down the whole ssl bind. See scripts/cert-publish-lib.sh.
|
|
if cert_publish "$CERT_FILE" "$KEY_FILE" "$COMBINED_FILE"; then
|
|
log_info "Updated certificate for $domain"
|
|
UPDATED=$((UPDATED + 1))
|
|
else
|
|
log_error "Failed to combine certificate for $domain"
|
|
FAILED=$((FAILED + 1))
|
|
fi
|
|
else
|
|
log_error "Certificate files not found for $domain"
|
|
FAILED=$((FAILED + 1))
|
|
fi
|
|
done <<< "$DOMAINS"
|
|
|
|
# Already-published pems that have expired since are moved out too (they
|
|
# can only shadow; see cert_retire_expired_pems).
|
|
cert_retire_expired_pems
|
|
RETIRED_EXPIRED=$CERT_RETIRED_EXPIRED
|
|
|
|
log_info "Certificate sync completed: $UPDATED updated, $FAILED failed, $SKIPPED_EXPIRED expired lineage(s) skipped, $RETIRED_EXPIRED expired pem(s) retired"
|
|
|
|
# Reload HAProxy if any certificates were updated
|
|
if [ $UPDATED -gt 0 ] || [ "$RETIRED_EXPIRED" -gt 0 ]; then
|
|
# Never reload onto unvalidated material: a reload that fails to load the
|
|
# certs directory drops HTTPS for every site on this host.
|
|
if ! haproxy_config_ok; then
|
|
log_error "HAProxy configuration does not validate - refusing to reload after certificate sync"
|
|
exit 1
|
|
fi
|
|
|
|
if echo "reload" | socat stdio /tmp/haproxy-cli 2>/dev/null; then
|
|
log_info "HAProxy reloaded successfully"
|
|
else
|
|
log_error "Failed to reload HAProxy"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# See the matching block in renew-certificates.sh: a run in which every domain
|
|
# failed to publish must not look like a clean run to its caller.
|
|
if [ "$FAILED" -gt 0 ]; then
|
|
log_error "Certificate sync process completed with failures: $UPDATED updated, $FAILED failed"
|
|
exit 1
|
|
fi
|
|
|
|
log_info "Certificate sync process completed"
|
|
exit 0
|