fix: proper Zoraxy CSRF/session handling (login.html + cookie jar)
This commit is contained in:
parent
d0f9854084
commit
79bf23618d
1 changed files with 59 additions and 56 deletions
115
deploy.sh
115
deploy.sh
|
|
@ -264,84 +264,87 @@ EOF
|
||||||
done
|
done
|
||||||
sleep 1
|
sleep 1
|
||||||
|
|
||||||
# Shared cookie jar for CSRF-authenticated Zoraxy API calls
|
# Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues
|
||||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||||
|
rm -f "$COOKIE_JAR"
|
||||||
|
|
||||||
# Helper: fetch CSRF token from Zoraxy login page (uses $COOKIE_JAR)
|
|
||||||
fetch_csrf() {
|
fetch_csrf() {
|
||||||
rm -f "$COOKIE_JAR"
|
# Fetch /login.html directly (no redirect), save cookies, extract token
|
||||||
local page
|
local page
|
||||||
page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
|
page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
|
||||||
local token
|
local token
|
||||||
token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1)
|
||||||
echo "$token"
|
echo "$token"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
zoraxy_post() {
|
||||||
|
local path="$1" data="$2"
|
||||||
|
local csrf
|
||||||
|
csrf=$(fetch_csrf)
|
||||||
|
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \
|
||||||
|
-H "X-CSRF-Token: ${csrf}" -d "${data}"
|
||||||
|
}
|
||||||
|
|
||||||
|
zoraxy_get() {
|
||||||
|
local path="$1" data="$2"
|
||||||
|
local csrf
|
||||||
|
csrf=$(fetch_csrf)
|
||||||
|
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \
|
||||||
|
-H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"}
|
||||||
|
}
|
||||||
|
|
||||||
# Step 1: Create admin account
|
# Step 1: Create admin account
|
||||||
echo " Creating admin account..."
|
echo " Creating admin account..."
|
||||||
CSRF=$(fetch_csrf)
|
CSRF=$(fetch_csrf)
|
||||||
if [ -z "$CSRF" ]; then
|
ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||||
echo " [WARN] Could not fetch CSRF token — trying registration without it"
|
-H "X-CSRF-Token: ${CSRF}" \
|
||||||
ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
|
-d "username=${ADMIN_USERNAME:-master}" \
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
|
||||||
else
|
|
||||||
ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
|
||||||
-H "X-CSRF-Token: $CSRF" \
|
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
|
||||||
fi
|
|
||||||
|
|
||||||
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||||
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
||||||
echo " [OK] Admin account already exists"
|
echo " [OK] Admin account already exists"
|
||||||
else
|
else
|
||||||
echo " [INFO] Admin registration response: $ADMIN_RESULT"
|
echo " [INFO] Admin registration: $ADMIN_RESULT"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Step 2: Login with Zoraxy admin for LE configuration
|
# Step 2: Login (saves session cookie in $COOKIE_JAR)
|
||||||
echo " Logging in for LE configuration..."
|
echo " Logging in for LE configuration..."
|
||||||
CSRF=$(fetch_csrf)
|
CSRF=$(fetch_csrf)
|
||||||
if [ -z "$CSRF" ]; then
|
LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||||
echo " [WARN] No CSRF token — skipping LE automation"
|
-H "X-CSRF-Token: ${CSRF}" \
|
||||||
|
-d "username=${ADMIN_USERNAME:-master}" \
|
||||||
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||||
|
|
||||||
|
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
||||||
|
echo " [OK] Logged in as $ADMIN_USERNAME"
|
||||||
|
|
||||||
|
# Set LE email
|
||||||
|
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
||||||
|
zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null
|
||||||
|
|
||||||
|
# Obtain certificates for all subdomains
|
||||||
|
LE_CA="Let%27s%20Encrypt"
|
||||||
|
for SUB in app dns; do
|
||||||
|
echo " Requesting LE certificate for ${SUB}.${DOMAIN}..."
|
||||||
|
CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||||
|
-H "X-CSRF-Token: $(fetch_csrf)" \
|
||||||
|
-G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
|
||||||
|
-d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
|
||||||
|
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then
|
||||||
|
echo " [OK] Certificate obtained for ${SUB}.${DOMAIN}"
|
||||||
|
else
|
||||||
|
echo " [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Enable auto-renew
|
||||||
|
echo " Enabling auto-renew..."
|
||||||
|
zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null
|
||||||
|
echo " [OK] LE auto-renew enabled"
|
||||||
else
|
else
|
||||||
LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
echo " [WARN] Login failed: $LOGIN_RESULT"
|
||||||
-H "X-CSRF-Token: $CSRF" \
|
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
|
||||||
|
|
||||||
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
|
||||||
echo " [OK] Logged in as $ADMIN_USERNAME"
|
|
||||||
|
|
||||||
# Set LE email
|
|
||||||
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
|
||||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
|
||||||
-d "set=${TLS_EMAIL}" > /dev/null
|
|
||||||
|
|
||||||
# Obtain certificates for all subdomains (30s timeout each)
|
|
||||||
# URL-encode "Let's Encrypt" as Let%27s%20Encrypt to avoid curl parsing issues
|
|
||||||
LE_CA="Let%27s%20Encrypt"
|
|
||||||
for SUB in app dns; do
|
|
||||||
echo " Requesting LE certificate for ${SUB}.${DOMAIN}..."
|
|
||||||
CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
|
||||||
-G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
|
|
||||||
-d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
|
|
||||||
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
|
|
||||||
echo " [OK] Certificate obtained for ${SUB}.${DOMAIN}"
|
|
||||||
else
|
|
||||||
echo " [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# Enable auto-renew
|
|
||||||
echo " Enabling auto-renew..."
|
|
||||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
|
||||||
-d "enable=true" > /dev/null
|
|
||||||
echo " [OK] LE auto-renew enabled"
|
|
||||||
else
|
|
||||||
echo " [WARN] Login failed: $LOGIN_RESULT"
|
|
||||||
fi
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Restart Zoraxy to pick up configs
|
# Restart Zoraxy to pick up configs
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue