refactor: configure Zoraxy via BoltDB + config files, no API/CSRF
This commit is contained in:
parent
90c8c57fbe
commit
c42807d076
1 changed files with 25 additions and 93 deletions
118
deploy.sh
118
deploy.sh
|
|
@ -254,105 +254,37 @@ apps:
|
|||
icon: "admin"
|
||||
EOF
|
||||
|
||||
# Configure Zoraxy admin + LE via API
|
||||
# Configure Zoraxy via BoltDB + config files (no CSRF-prone API calls)
|
||||
echo "[*] Configuring Zoraxy..."
|
||||
for i in $(seq 1 15); do
|
||||
if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
sleep 1
|
||||
SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
|
||||
|
||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||
|
||||
# Helper: fetch CSRF token from Zoraxy login page
|
||||
# Uses $COOKIE_JAR — appends cookies, preserves existing session
|
||||
fetch_csrf() {
|
||||
local page
|
||||
page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
|
||||
local token
|
||||
token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
|
||||
echo "$token"
|
||||
}
|
||||
|
||||
# First call — fresh cookie jar, retry until we get a valid CSRF
|
||||
rm -f "$COOKIE_JAR"
|
||||
CSRF=""
|
||||
for i in $(seq 1 15); do
|
||||
CSRF=$(fetch_csrf)
|
||||
if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then
|
||||
break
|
||||
fi
|
||||
echo " Waiting for Zoraxy to be ready... ($i/15)"
|
||||
sleep 2
|
||||
# Wait for Zoraxy to create the database
|
||||
for i in $(seq 1 20); do
|
||||
if [ -f "$SYS_DB" ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ -z "$CSRF" ] || [ ${#CSRF} -lt 10 ]; then
|
||||
echo " [WARN] Could not get valid CSRF — page response:"
|
||||
curl -s -c "$COOKIE_JAR" http://127.0.0.1:8000/login.html | head -c 300
|
||||
echo ""
|
||||
# Write admin user directly to BoltDB via helper tool
|
||||
if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
|
||||
"$TOOL_BIN" db --db "$SYS_DB" \
|
||||
--set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
|
||||
"$TOOL_BIN" db --db "$SYS_DB" \
|
||||
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
||||
echo " [OK] Admin + ZorxAuth written to BoltDB"
|
||||
fi
|
||||
|
||||
# Try API registration
|
||||
if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then
|
||||
ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) || true
|
||||
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||
else
|
||||
echo " [INFO] API registration: $ADMIN_CREATE"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Login using API
|
||||
CSRF=$(fetch_csrf)
|
||||
LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
|
||||
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
||||
echo " [OK] Logged in as $ADMIN_USERNAME"
|
||||
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||
-H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null
|
||||
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||
-H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null
|
||||
echo " [OK] LE auto-renew enabled"
|
||||
|
||||
# Upload existing certs to Zoraxy (so it registers them in sys.db)
|
||||
echo " Uploading certificates to Zoraxy..."
|
||||
CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
|
||||
for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do
|
||||
CRT_FILE="$CERTS_DIR/${FQDN}.crt"
|
||||
KEY_FILE="$CERTS_DIR/${FQDN}.key"
|
||||
if [ -f "$CRT_FILE" ] && [ -f "$KEY_FILE" ]; then
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
--data-binary "@${CRT_FILE}" > /dev/null 2>&1 || true
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pri&domain=${FQDN}" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
--data-binary "@${KEY_FILE}" > /dev/null 2>&1 || true
|
||||
echo " Uploaded cert for ${FQDN}"
|
||||
fi
|
||||
done
|
||||
|
||||
# BoltDB Zoraxy Auth gateway
|
||||
SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
|
||||
if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
|
||||
"$TOOL_BIN" db \
|
||||
--db "$SYS_DB" \
|
||||
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
||||
fi
|
||||
fi
|
||||
# Write ACME config file directly
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/conf"
|
||||
cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <<EOF
|
||||
{
|
||||
"Enabled": true,
|
||||
"Email": "${TLS_EMAIL}",
|
||||
"RenewAll": true,
|
||||
"FilesToRenew": [],
|
||||
"DNSServers": ""
|
||||
}
|
||||
EOF
|
||||
echo " [OK] ACME enabled (email: ${TLS_EMAIL})"
|
||||
|
||||
# Restart Zoraxy to pick up configs
|
||||
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
||||
|
|
|
|||
Loading…
Reference in a new issue