lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: stateless API token workflow for Zoraxy

Browse source
This commit is contained in:
Claus Lohmar 2026-07-08 08:42:40 +01:00
parent abeae6cbbf
commit 6ea3164d72
1 changed files with 24 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
deploy.sh
View file

@ -135,7 +135,7 @@ if [ "$GREENFIELD" = true ]; then
CERT_SRC="$BACKUP_DIR/certificates/${FQDN}/fullchain.pem"
KEY_SRC="$BACKUP_DIR/certificates/${FQDN}/privkey.pem"
if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.crt"
cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.pem"
cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.key"
echo "[INFO] Cert deployed: ${FQDN}"
fi
@ -149,8 +149,9 @@ if [ "$GREENFIELD" = true ]; then
echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)"
fi
# --- Phase 1: Deploy Zoraxy with minimal config to get CSRF access ---
echo "[*] Phase 1: Deploying Zoraxy for configuration..."
# Generate stateless API token for Zoraxy
DEPLOY_TOKEN=$(openssl rand -hex 32 2>/dev/null || date +%s | sha256sum | head -c 64)
echo "[*] Stateless API token generated"
# Write ACME config + BoltDB (before Zoraxy starts, db not locked)
mkdir -p "$TARGET_DIR/config/zoraxy/conf"
@ -164,60 +165,49 @@ if [ "$GREENFIELD" = true ]; then
}
EOF
# Seed API token and admin into BoltDB
if [ -f "$TOOL_BIN" ]; then
mkdir -p "$TARGET_DIR/data/zoraxy"
touch "$TARGET_DIR/data/zoraxy/sys.db"
"$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
--set "auth:api_key:${DEPLOY_TOKEN}:{\"username\":\"${ADMIN_USERNAME:-master}\",\"permission\":\"admin\"}" 2>&1 || true
"$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
--set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
"$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://${APP_SUB}.${DOMAIN}/\"}" 2>&1 || true
echo " [OK] Admin + ZorxAuth written to BoltDB"
echo " [OK] API token + admin seeded into BoltDB"
fi
# Start Zoraxy (no custom proxy configs yet — CSRF will work)
# Start Zoraxy
cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
podman rm -f zoraxy 2>/dev/null || true
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues"
# Wait for Zoraxy to be ready
for i in $(seq 1 15); do
if curl -sf --max-time 3 "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then break; fi
if curl -sf --max-time 3 "http://127.0.0.1:8000/" > /dev/null 2>&1; then break; fi
sleep 2
done
# --- Phase 2: Upload certificates via API (no proxy rules to interfere) ---
echo "[*] Phase 2: Registering certificates..."
# Register certificates using stateless API token
echo "[*] Registering certificates via API token..."
CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
AUTH_HEADER="Authorization: Bearer ${DEPLOY_TOKEN}"
for SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
FQDN="${SUB}.${DOMAIN}"
CRT_FILE="$CERTS_DIR/${FQDN}.crt"
if [ ! -f "$CRT_FILE" ]; then echo " SKIP $FQDN (no file)"; continue; fi
echo " Uploading $FQDN..."
for TRY in 1 2 3; do
rm -f /tmp/zc.txt
PAGE=$(curl -s --max-time 5 -c /tmp/zc.txt "http://127.0.0.1:8000/login.html" 2>&1)
TOKEN=$(echo "$PAGE" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
if [ -z "$TOKEN" ]; then
echo " Retry $TRY: no CSRF token"
sleep 2; continue
fi
R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST \
-H "X-CSRF-Token: $TOKEN" \
-H "Referer: http://127.0.0.1:8000/login.html" \
"http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
--data-binary "@$CRT_FILE" 2>&1) || true
if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
echo " [OK] $FQDN registered"
break
fi
echo " Retry $TRY: $(echo $R | head -c 60)"
sleep 2
done
CRT_FILE="$CERTS_DIR/${FQDN}.pem"
if [ ! -f "$CRT_FILE" ]; then echo " SKIP $FQDN (no .pem file)"; continue; fi
R=$(curl -s --max-time 10 -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \
-H "${AUTH_HEADER}" -H "Content-Type: application/json" \
--data-binary "@${CRT_FILE}" 2>&1) || true
if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
echo " [OK] $FQDN registered"
else
echo " [WARN] $FQDN: $(echo $R | head -c 80)"
fi
done
# --- Phase 3: Stop Zoraxy, write custom configs ---
echo "[*] Phase 3: Writing custom proxy configs..."
podman stop zoraxy 2>/dev/null || true
# Stop Zoraxy to write proxy configs
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/${APP_SUB}.$DOMAIN.config" <<ZORAXY_APP
{