safebox/proxy-scheduler
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Enhance error handling in certificate generation and improve logging for better debugging
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse Source
This commit is contained in:
gyurix
2025-04-21 09:42:47 +02:00
parent 61047a8913
commit 18ff17af6a
1 changed files with 263 additions and 255 deletions
Download Patch File Download Diff File Expand all files Collapse all files

164
scripts/nginx_config_create.sh
View File

@@ -4,13 +4,13 @@ GENERATE_CERTIFICATE=$GENERATE_CERTIFICATE
cd /proxy_config cd /proxy_config
FILENAME="$1"; FILENAME="$1"
DOMAIN_SOURCE=/domains/$FILENAME DOMAIN_SOURCE=/domains/$FILENAME
#DOMAIN_SOURCE=./domains/$FILENAME #TEMP #DOMAIN_SOURCE=./domains/$FILENAME #TEMP
DOMAIN_NAME=$(jq -r .DOMAIN $DOMAIN_SOURCE) DOMAIN_NAME=$(jq -r .DOMAIN $DOMAIN_SOURCE)
HTTP_PORT=$(jq -r .HTTP_PORT $DOMAIN_SOURCE) HTTP_PORT=$(jq -r .HTTP_PORT $DOMAIN_SOURCE)
HTTPS_PORT=$(jq -r .HTTPS_PORT $DOMAIN_SOURCE); HTTPS_PORT=$(jq -r .HTTPS_PORT $DOMAIN_SOURCE)
ALIASES_HTTP=$(jq -r '.ALIASES_HTTP | select(.!="null") | join(" ")' $DOMAIN_SOURCE) ALIASES_HTTP=$(jq -r '.ALIASES_HTTP | select(.!="null") | join(" ")' $DOMAIN_SOURCE)
ALIASES_HTTPS=$(jq -r '.ALIASES_HTTPS | select(.!="null") | join(" ")' $DOMAIN_SOURCE) ALIASES_HTTPS=$(jq -r '.ALIASES_HTTPS | select(.!="null") | join(" ")' $DOMAIN_SOURCE)
REDIRECT_HTTP=$(jq -r .REDIRECT_HTTP $DOMAIN_SOURCE) REDIRECT_HTTP=$(jq -r .REDIRECT_HTTP $DOMAIN_SOURCE)
@@ -20,23 +20,24 @@ MAX_BODY_SIZE=$(jq -r .MAX_BODY_SIZE $DOMAIN_SOURCE)
DEBUG=$(jq -r .DEBUG $DOMAIN_SOURCE) DEBUG=$(jq -r .DEBUG $DOMAIN_SOURCE)
ALLOWED_NETWORK=$(jq -r '.ALLOWED_NETWORK | select(.!="null") | join(" ")' $DOMAIN_SOURCE) ALLOWED_NETWORK=$(jq -r '.ALLOWED_NETWORK | select(.!="null") | join(" ")' $DOMAIN_SOURCE)
OPERATION=$(jq -r '.OPERATION' $DOMAIN_SOURCE) OPERATION=$(jq -r '.OPERATION' $DOMAIN_SOURCE)
BASIC_AUTH=$(jq -r .BASIC_AUTH $DOMAIN_SOURCE)
ALTERNATE_LOCATION_PATH=$(jq -r .ALTERNATE_LOCATION_PATH $DOMAIN_SOURCE) ALTERNATE_LOCATION_PATH=$(jq -r .ALTERNATE_LOCATION_PATH $DOMAIN_SOURCE)
LOCAL_NAME=$(jq -r .LOCAL_NAME $DOMAIN_SOURCE 2>/dev/null); LOCAL_NAME=$(jq -r .LOCAL_NAME $DOMAIN_SOURCE 2>/dev/null)
if [[ "$LOCAL_NAME" == "" || "$LOCAL_NAME" == "null" ]]; then if [[ "$LOCAL_NAME" == "" || "$LOCAL_NAME" == "null" ]]; then
LOCAL_NAME=$(jq -r .LOCAL_IP $DOMAIN_SOURCE 2>/dev/null); LOCAL_NAME=$(jq -r .LOCAL_IP $DOMAIN_SOURCE 2>/dev/null)
fi fi
RELOAD_LOCATIONS=""; RELOAD_LOCATIONS=""
if [ -n "$2" ]; then if [ -n "$2" ]; then
echo "$DOMAIN_NAME DELETED"; echo "$DOMAIN_NAME DELETED"
rm $DOMAIN_NAME.conf; rm $DOMAIN_NAME.conf
exit; exit
fi fi
add_alternate_location() { add_alternate_location() {
{ {
cat $DOMAIN_NAME.conf | head -n -1 cat $DOMAIN_NAME.conf | head -n -1
add_location; add_location
echo "}" echo "}"
} >>"$file" } >>"$file"
@@ -49,47 +50,52 @@ add_location() {
ALP_IDX=$(jq -r '.ALTERNATE_LOCATION_PATH | length' $DOMAIN_SOURCE) ALP_IDX=$(jq -r '.ALTERNATE_LOCATION_PATH | length' $DOMAIN_SOURCE)
ALP_IDX=$(($ALP_IDX - 1)) ALP_IDX=$(($ALP_IDX - 1))
for i in $(seq 0 $ALP_IDX) ; for i in $(seq 0 $ALP_IDX); do
do
ALP=$(jq -r .ALTERNATE_LOCATION_PATH[$i] $DOMAIN_SOURCE) ALP=$(jq -r .ALTERNATE_LOCATION_PATH[$i] $DOMAIN_SOURCE)
ALP_LOCAL_PATH=$(echo $ALP | jq -rc .LOCAL_PATH); ALP_LOCAL_PATH=$(echo $ALP | jq -rc .LOCAL_PATH)
ALP_LOCAL_NAME=$(echo $ALP | jq -rc .LOCAL_NAME); ALP_LOCAL_NAME=$(echo $ALP | jq -rc .LOCAL_NAME)
ALP_LOCAL_PORT=$(echo $ALP | jq -rc .LOCAL_PORT); ALP_LOCAL_PORT=$(echo $ALP | jq -rc .LOCAL_PORT)
ALP_LOCAL_ALLOWED_NETWORK=$(echo $ALP | jq -rc '.LOCAL_ALLOWED_NETWORK | select(.!="null") | join(" ")'); ALP_LOCAL_ALLOWED_NETWORK=$(echo $ALP | jq -rc '.LOCAL_ALLOWED_NETWORK | select(.!="null") | join(" ")')
# do not duplicate locations # do not duplicate locations
EXISTS=$(grep -rn "location $ALP_LOCAL_PATH {" -m 1 $DOMAIN_NAME.conf); EXISTS=$(grep -rn "location $ALP_LOCAL_PATH {" -m 1 $DOMAIN_NAME.conf)
if [ -n "$EXISTS" ]; then if [ -n "$EXISTS" ]; then
ROW_NUMBER=$(echo $EXISTS | cut -d ':' -f1); ROW_NUMBER=$(echo $EXISTS | cut -d ':' -f1)
START=$(($ROW_NUMBER + 2)); START=$(($ROW_NUMBER + 2))
OFFSET=$(tail -n+$START $DOMAIN_NAME.conf | grep -n '}' -m 1 | cut -d ':' -f1); OFFSET=$(tail -n+$START $DOMAIN_NAME.conf | grep -n '}' -m 1 | cut -d ':' -f1)
OFFSET=$(($OFFSET - 2)); OFFSET=$(($OFFSET - 2))
ALP_ALLOWED=$(echo $(tail -n+$START $DOMAIN_NAME.conf | head -n $OFFSET | awk '{print $2}')); # echo removes space at the end ALP_ALLOWED=$(echo $(tail -n+$START $DOMAIN_NAME.conf | head -n $OFFSET | awk '{print $2}')) # echo removes space at the end
if [ "$ALP_LOCAL_ALLOWED_NETWORK" != "$ALP_ALLOWED" ]; then if [ "$ALP_LOCAL_ALLOWED_NETWORK" != "$ALP_ALLOWED" ]; then
RELOAD_LOCATIONS=$RELOAD_LOCATIONS$ALP_LOCAL_PATH" " RELOAD_LOCATIONS=$RELOAD_LOCATIONS$ALP_LOCAL_PATH" "
fi; fi
# skip if exists # skip if exists
continue; continue
fi; fi
if [[ "$ALP_LOCAL_NAME" = "" ]]; then if [[ "$ALP_LOCAL_NAME" = "" ]]; then
ALP_LOCAL_NAME=$LOCAL_NAME ALP_LOCAL_NAME=$LOCAL_NAME
fi; fi
if [[ "$ALP_LOCAL_PORT" = "" ]]; then if [[ "$ALP_LOCAL_PORT" = "" ]]; then
ALP_LOCAL_PORT=$HTTP_PORT ALP_LOCAL_PORT=$HTTP_PORT
fi; fi
echo "location $ALP_LOCAL_PATH {" echo "location $ALP_LOCAL_PATH {"
if [ "$BASIC_AUTH" == "TRUE" ]; then
echo ' auth_basic "Administrator’s Area";
auth_basic_user_file conf/htpasswd;
'
fi
if [[ "$ALP_LOCAL_ALLOWED_NETWORK" != "" ]]; then if [[ "$ALP_LOCAL_ALLOWED_NETWORK" != "" ]]; then
echo " limit_except GET HEAD {"; echo " limit_except GET HEAD {"
for i in $(echo $ALP_LOCAL_ALLOWED_NETWORK); do for i in $(echo $ALP_LOCAL_ALLOWED_NETWORK); do
echo " allow $i"; echo " allow $i"
done; done
echo " deny all;"; echo " deny all;"
echo " }"; echo " }"
fi fi
if [[ "$ALP_LOCAL_PORT" != "" ]]; then if [[ "$ALP_LOCAL_PORT" != "" ]]; then
@@ -117,8 +123,8 @@ add_location() {
echo " proxy_buffering off;" echo " proxy_buffering off;"
echo "}" echo "}"
echo "# location end" echo "# location end"
done; done
fi; fi
} }
@@ -129,32 +135,31 @@ remove_alternate_location() {
ALP_IDX=$(jq -r '.ALTERNATE_LOCATION_PATH | length' $DOMAIN_SOURCE) ALP_IDX=$(jq -r '.ALTERNATE_LOCATION_PATH | length' $DOMAIN_SOURCE)
ALP_IDX=$(($ALP_IDX - 1)) ALP_IDX=$(($ALP_IDX - 1))
for i in $(seq 0 $ALP_IDX) ; for i in $(seq 0 $ALP_IDX); do
do
ALP=$(jq -r .ALTERNATE_LOCATION_PATH[$i] $DOMAIN_SOURCE) ALP=$(jq -r .ALTERNATE_LOCATION_PATH[$i] $DOMAIN_SOURCE)
ALP_LOCAL_PATH=$(echo $ALP | jq -rc .LOCAL_PATH); ALP_LOCAL_PATH=$(echo $ALP | jq -rc .LOCAL_PATH)
remove_location $ALP_LOCAL_PATH remove_location $ALP_LOCAL_PATH
done; done
fi; fi
} }
remove_location() { remove_location() {
local LOCATION=$1 local LOCATION=$1
LOCATION_ROW="location $LOCATION {"; LOCATION_ROW="location $LOCATION {"
ROW_NUMBER=$(grep -rn "$LOCATION_ROW" $DOMAIN_NAME.conf | cut -d ':' -f1); ROW_NUMBER=$(grep -rn "$LOCATION_ROW" $DOMAIN_NAME.conf | cut -d ':' -f1)
if [ -n "$ROW_NUMBER" ]; then if [ -n "$ROW_NUMBER" ]; then
OFFSET=$(tail -n+$ROW_NUMBER $DOMAIN_NAME.conf | grep -n '# location end' -m 1 | cut -d ':' -f1); OFFSET=$(tail -n+$ROW_NUMBER $DOMAIN_NAME.conf | grep -n '# location end' -m 1 | cut -d ':' -f1)
START=$(($ROW_NUMBER - 1)); START=$(($ROW_NUMBER - 1))
END=$(($ROW_NUMBER + $OFFSET)); END=$(($ROW_NUMBER + $OFFSET))
{ {
head -n$START $DOMAIN_NAME.conf head -n$START $DOMAIN_NAME.conf
tail -n+$END $DOMAIN_NAME.conf tail -n+$END $DOMAIN_NAME.conf
} >>$file } >>$file
mv $file $DOMAIN_NAME.conf; mv $file $DOMAIN_NAME.conf
fi; fi
} }
# create new nginx config # create new nginx config
@@ -201,26 +206,31 @@ if [[ "$HTTP_PORT" != "" && "$HTTP_PORT" != "80" ]]; then
echo "rewrite_log on;" echo "rewrite_log on;"
if [[ "$REDIRECT_HTTP" != "" ]]; then if [[ "$REDIRECT_HTTP" != "" ]]; then
echo "return 301 $REDIRECT_HTTP;" echo "return 301 $REDIRECT_HTTP;"
elif [[ "$HTTP_PORT" == "" ]]; then elif [[ "$HTTP_PORT" == "" ]]; then
echo "return 301 https://"$DOMAIN_NAME; echo "return 301 https://"$DOMAIN_NAME
else else
echo "location / {" echo "location / {"
if [ "$BASIC_AUTH" == "TRUE" ]; then
echo ' auth_basic "Administrator’s Area";
auth_basic_user_file conf/htpasswd;
'
fi
if [[ "$ALLOWED_NETWORK" != "" ]]; then if [[ "$ALLOWED_NETWORK" != "" ]]; then
ALLOWED_NETWORK_IDX=$(jq -r '.ALLOWED_NETWORK | length' $DOMAIN_SOURCE) ALLOWED_NETWORK_IDX=$(jq -r '.ALLOWED_NETWORK | length' $DOMAIN_SOURCE)
ALLOWED_NETWORK_IDX=$(($ALLOWED_NETWORK_IDX - 1)) ALLOWED_NETWORK_IDX=$(($ALLOWED_NETWORK_IDX - 1))
echo " limit_except GET HEAD {"; echo " limit_except GET HEAD {"
for i in $(seq 0 $ALLOWED_NETWORK_IDX); do for i in $(seq 0 $ALLOWED_NETWORK_IDX); do
AN=$(jq -r .ALLOWED_NETWORK[$i] $DOMAIN_SOURCE) AN=$(jq -r .ALLOWED_NETWORK[$i] $DOMAIN_SOURCE)
echo " allow "$AN";" echo " allow "$AN";"
done done
echo " deny all;" echo " deny all;"
echo " }"; echo " }"
fi fi
if [[ "$HTTP_PORT" != "" ]]; then if [[ "$HTTP_PORT" != "" ]]; then
@@ -295,7 +305,6 @@ ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m; ssl_session_timeout 5m;
ssl_stapling on;" ssl_stapling on;"
if [[ "$ERROR_PAGE" != "" && "$HTTPS_PORT" != "" ]]; then if [[ "$ERROR_PAGE" != "" && "$HTTPS_PORT" != "" ]]; then
echo "error_page 404 /$ERROR_PAGE; echo "error_page 404 /$ERROR_PAGE;
location = /$ERROR_PAGE { location = /$ERROR_PAGE {
@@ -315,13 +324,13 @@ location = /$ERROR_PAGE {
ALLOWED_NETWORK_IDX=$(jq -r '.ALLOWED_NETWORK | length' $DOMAIN_SOURCE) ALLOWED_NETWORK_IDX=$(jq -r '.ALLOWED_NETWORK | length' $DOMAIN_SOURCE)
ALLOWED_NETWORK_IDX=$(($ALLOWED_NETWORK_IDX - 1)) ALLOWED_NETWORK_IDX=$(($ALLOWED_NETWORK_IDX - 1))
echo " limit_except GET HEAD {"; echo " limit_except GET HEAD {"
for i in $(seq 0 $ALLOWED_NETWORK_IDX); do for i in $(seq 0 $ALLOWED_NETWORK_IDX); do
AN=$(jq -r .ALLOWED_NETWORK[$i] $DOMAIN_SOURCE) AN=$(jq -r .ALLOWED_NETWORK[$i] $DOMAIN_SOURCE)
echo " allow "$AN";" echo " allow "$AN";"
done done
echo " deny all;" echo " deny all;"
echo " }"; echo " }"
fi fi
echo " proxy_pass http://$LOCAL_NAME:$HTTPS_PORT;" echo " proxy_pass http://$LOCAL_NAME:$HTTPS_PORT;"
@@ -344,15 +353,15 @@ echo " proxy_pass http://$LOCAL_NAME:$HTTPS_PORT;"
echo " proxy_buffering off;" echo " proxy_buffering off;"
echo "}" echo "}"
echo "# first location end"; echo "# first location end"
add_location; add_location
fi fi
if [ "$REGENERATE" == "" ]; then if [ "$REGENERATE" == "" ]; then
echo "}" echo "}"
fi; fi
fi fi
@@ -361,14 +370,14 @@ fi
regenerate_config() { regenerate_config() {
mv $file $DOMAIN_NAME.conf; mv $file $DOMAIN_NAME.conf
# regenerates nginx config into $file # regenerates nginx config into $file
create_new_config "regenerate"; create_new_config "regenerate"
# append existing alternate locations to new config file # append existing alternate locations to new config file
OFFSET=$(cat $DOMAIN_NAME.conf | grep -n '# first location end' -m 1 | cut -d ':' -f1); OFFSET=$(cat $DOMAIN_NAME.conf | grep -n '# first location end' -m 1 | cut -d ':' -f1)
OFFSET=$(($OFFSET + 1)); OFFSET=$(($OFFSET + 1))
{ {
tail -n+$OFFSET $DOMAIN_NAME.conf tail -n+$OFFSET $DOMAIN_NAME.conf
} >>$file } >>$file
@@ -378,8 +387,7 @@ file="/tmp/$DOMAIN_NAME.conf"
# check whether certificates exist or not # check whether certificates exist or not
echo "created domain name: "$DOMAIN_NAME
echo "created domain name: "$DOMAIN_NAME;
#cp -a /scripts/nginx_template.conf /tmp/$DOMAIN.conf #cp -a /scripts/nginx_template.conf /tmp/$DOMAIN.conf
@@ -387,40 +395,40 @@ echo "created domain name: "$DOMAIN_NAME;
if [ -f $DOMAIN_NAME.conf ]; then if [ -f $DOMAIN_NAME.conf ]; then
if [ "$OPERATION" = "DELETE" ]; then if [ "$OPERATION" = "DELETE" ]; then
remove_alternate_location; remove_alternate_location
elif [ "$OPERATION" = "MODIFY" ]; then elif [ "$OPERATION" = "MODIFY" ]; then
# must be before create_new_config # must be before create_new_config
remove_alternate_location; remove_alternate_location
add_alternate_location; add_alternate_location
regenerate_config; regenerate_config
else else
# default CREATE, append location # default CREATE, append location
add_alternate_location; add_alternate_location
regenerate_config; regenerate_config
# reload alternate locations if allowed networks has changed # reload alternate locations if allowed networks has changed
if [ -n "$RELOAD_LOCATIONS" ]; then if [ -n "$RELOAD_LOCATIONS" ]; then
rm $file; rm $file
remove_alternate_location; remove_alternate_location
add_alternate_location; add_alternate_location
fi; fi
fi; fi
else else
# rewrite operation if nginx config file doesn't exists # rewrite operation if nginx config file doesn't exists
OPERATION="CREATE"; OPERATION="CREATE"
create_new_config; create_new_config
fi; # end of create new nginx config fi # end of create new nginx config
if [ "$OPERATION" != "DELETE" ]; then if [ "$OPERATION" != "DELETE" ]; then
mv $file $DOMAIN_NAME.conf; mv $file $DOMAIN_NAME.conf
fi; fi
echo "$DOMAIN" >>new_config echo "$DOMAIN" >>new_config
if [ "$HTTPS_PORT" != "" ]; then if [ "$HTTPS_PORT" != "" ]; then
/scripts/check_certificates.sh "$DOMAIN_NAME"; /scripts/check_certificates.sh "$DOMAIN_NAME"
fi fi