From 6ea3164d722be854e75de333127a347a69e98bb4 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Wed, 8 Jul 2026 08:42:40 +0100 Subject: [PATCH] feat: stateless API token workflow for Zoraxy --- deploy.sh | 58 +++++++++++++++++++++++-------------------------------- 1 file changed, 24 insertions(+), 34 deletions(-) diff --git a/deploy.sh b/deploy.sh index 94be546..58256ea 100755 --- a/deploy.sh +++ b/deploy.sh @@ -135,7 +135,7 @@ if [ "$GREENFIELD" = true ]; then CERT_SRC="$BACKUP_DIR/certificates/${FQDN}/fullchain.pem" KEY_SRC="$BACKUP_DIR/certificates/${FQDN}/privkey.pem" if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then - cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.crt" + cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.pem" cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.key" echo "[INFO] Cert deployed: ${FQDN}" fi @@ -149,8 +149,9 @@ if [ "$GREENFIELD" = true ]; then echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)" fi - # --- Phase 1: Deploy Zoraxy with minimal config to get CSRF access --- - echo "[*] Phase 1: Deploying Zoraxy for configuration..." + # Generate stateless API token for Zoraxy + DEPLOY_TOKEN=$(openssl rand -hex 32 2>/dev/null || date +%s | sha256sum | head -c 64) + echo "[*] Stateless API token generated" # Write ACME config + BoltDB (before Zoraxy starts, db not locked) mkdir -p "$TARGET_DIR/config/zoraxy/conf" @@ -164,60 +165,49 @@ if [ "$GREENFIELD" = true ]; then } EOF + # Seed API token and admin into BoltDB if [ -f "$TOOL_BIN" ]; then mkdir -p "$TARGET_DIR/data/zoraxy" touch "$TARGET_DIR/data/zoraxy/sys.db" + "$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \ + --set "auth:api_key:${DEPLOY_TOKEN}:{\"username\":\"${ADMIN_USERNAME:-master}\",\"permission\":\"admin\"}" 2>&1 || true "$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \ --set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true "$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \ --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://${APP_SUB}.${DOMAIN}/\"}" 2>&1 || true - echo " [OK] Admin + ZorxAuth written to BoltDB" + echo " [OK] API token + admin seeded into BoltDB" fi - # Start Zoraxy (no custom proxy configs yet — CSRF will work) + # Start Zoraxy cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml" podman rm -f zoraxy 2>/dev/null || true podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues" # Wait for Zoraxy to be ready for i in $(seq 1 15); do - if curl -sf --max-time 3 "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then break; fi + if curl -sf --max-time 3 "http://127.0.0.1:8000/" > /dev/null 2>&1; then break; fi sleep 2 done - # --- Phase 2: Upload certificates via API (no proxy rules to interfere) --- - echo "[*] Phase 2: Registering certificates..." + # Register certificates using stateless API token + echo "[*] Registering certificates via API token..." CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs" + AUTH_HEADER="Authorization: Bearer ${DEPLOY_TOKEN}" for SUB in $APP_SUB $DNS_SUB $WWW_SUB; do FQDN="${SUB}.${DOMAIN}" - CRT_FILE="$CERTS_DIR/${FQDN}.crt" - if [ ! -f "$CRT_FILE" ]; then echo " SKIP $FQDN (no file)"; continue; fi - echo " Uploading $FQDN..." - for TRY in 1 2 3; do - rm -f /tmp/zc.txt - PAGE=$(curl -s --max-time 5 -c /tmp/zc.txt "http://127.0.0.1:8000/login.html" 2>&1) - TOKEN=$(echo "$PAGE" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//') - if [ -z "$TOKEN" ]; then - echo " Retry $TRY: no CSRF token" - sleep 2; continue - fi - R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST \ - -H "X-CSRF-Token: $TOKEN" \ - -H "Referer: http://127.0.0.1:8000/login.html" \ - "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \ - --data-binary "@$CRT_FILE" 2>&1) || true - if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then - echo " [OK] $FQDN registered" - break - fi - echo " Retry $TRY: $(echo $R | head -c 60)" - sleep 2 - done + CRT_FILE="$CERTS_DIR/${FQDN}.pem" + if [ ! -f "$CRT_FILE" ]; then echo " SKIP $FQDN (no .pem file)"; continue; fi + R=$(curl -s --max-time 10 -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \ + -H "${AUTH_HEADER}" -H "Content-Type: application/json" \ + --data-binary "@${CRT_FILE}" 2>&1) || true + if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then + echo " [OK] $FQDN registered" + else + echo " [WARN] $FQDN: $(echo $R | head -c 80)" + fi done - # --- Phase 3: Stop Zoraxy, write custom configs --- - echo "[*] Phase 3: Writing custom proxy configs..." - podman stop zoraxy 2>/dev/null || true + # Stop Zoraxy to write proxy configs cat > "$TARGET_DIR/config/zoraxy/conf/proxy/${APP_SUB}.$DOMAIN.config" <