From c42807d0765e1aeff58be5c4f7046702661680db Mon Sep 17 00:00:00 2001 From: cclohmar Date: Tue, 7 Jul 2026 16:19:34 +0100 Subject: [PATCH] refactor: configure Zoraxy via BoltDB + config files, no API/CSRF --- deploy.sh | 118 ++++++++++++------------------------------------------ 1 file changed, 25 insertions(+), 93 deletions(-) diff --git a/deploy.sh b/deploy.sh index 925f003..6f7cff9 100755 --- a/deploy.sh +++ b/deploy.sh @@ -254,105 +254,37 @@ apps: icon: "admin" EOF - # Configure Zoraxy admin + LE via API + # Configure Zoraxy via BoltDB + config files (no CSRF-prone API calls) echo "[*] Configuring Zoraxy..." - for i in $(seq 1 15); do - if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then - break - fi - sleep 2 - done - sleep 1 + SYS_DB="$TARGET_DIR/data/zoraxy/sys.db" - COOKIE_JAR="/tmp/zoraxy_cookies.txt" - - # Helper: fetch CSRF token from Zoraxy login page - # Uses $COOKIE_JAR — appends cookies, preserves existing session - fetch_csrf() { - local page - page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1) - local token - token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//') - echo "$token" - } - - # First call — fresh cookie jar, retry until we get a valid CSRF - rm -f "$COOKIE_JAR" - CSRF="" - for i in $(seq 1 15); do - CSRF=$(fetch_csrf) - if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then - break - fi - echo " Waiting for Zoraxy to be ready... ($i/15)" - sleep 2 + # Wait for Zoraxy to create the database + for i in $(seq 1 20); do + if [ -f "$SYS_DB" ]; then break; fi + sleep 1 done - if [ -z "$CSRF" ] || [ ${#CSRF} -lt 10 ]; then - echo " [WARN] Could not get valid CSRF — page response:" - curl -s -c "$COOKIE_JAR" http://127.0.0.1:8000/login.html | head -c 300 - echo "" + # Write admin user directly to BoltDB via helper tool + if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then + "$TOOL_BIN" db --db "$SYS_DB" \ + --set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true + "$TOOL_BIN" db --db "$SYS_DB" \ + --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true + echo " [OK] Admin + ZorxAuth written to BoltDB" fi - # Try API registration - if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then - ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \ - -H "X-CSRF-Token: ${CSRF}" \ - -d "username=${ADMIN_USERNAME:-master}" \ - -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) || true - if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then - echo " [OK] Admin account created: $ADMIN_USERNAME" - else - echo " [INFO] API registration: $ADMIN_CREATE" - fi - fi - - # Login using API - CSRF=$(fetch_csrf) - LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \ - -H "X-CSRF-Token: ${CSRF}" \ - -d "username=${ADMIN_USERNAME:-master}" \ - -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) - - if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then - echo " [OK] Logged in as $ADMIN_USERNAME" - - CSRF=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \ - -H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null - - CSRF=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \ - -H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null - echo " [OK] LE auto-renew enabled" - - # Upload existing certs to Zoraxy (so it registers them in sys.db) - echo " Uploading certificates to Zoraxy..." - CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs" - for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do - CRT_FILE="$CERTS_DIR/${FQDN}.crt" - KEY_FILE="$CERTS_DIR/${FQDN}.key" - if [ -f "$CRT_FILE" ] && [ -f "$KEY_FILE" ]; then - CSRF=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \ - -H "X-CSRF-Token: ${CSRF}" \ - --data-binary "@${CRT_FILE}" > /dev/null 2>&1 || true - CSRF=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pri&domain=${FQDN}" \ - -H "X-CSRF-Token: ${CSRF}" \ - --data-binary "@${KEY_FILE}" > /dev/null 2>&1 || true - echo " Uploaded cert for ${FQDN}" - fi - done - - # BoltDB Zoraxy Auth gateway - SYS_DB="$TARGET_DIR/data/zoraxy/sys.db" - if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then - "$TOOL_BIN" db \ - --db "$SYS_DB" \ - --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true - fi - fi + # Write ACME config file directly + mkdir -p "$TARGET_DIR/config/zoraxy/conf" + cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <&1 || true