refactor: configure Zoraxy via BoltDB + config files, no API/CSRF
This commit is contained in:
parent
90c8c57fbe
commit
c42807d076
1 changed files with 25 additions and 93 deletions
118
deploy.sh
118
deploy.sh
|
|
@ -254,105 +254,37 @@ apps:
|
||||||
icon: "admin"
|
icon: "admin"
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
# Configure Zoraxy admin + LE via API
|
# Configure Zoraxy via BoltDB + config files (no CSRF-prone API calls)
|
||||||
echo "[*] Configuring Zoraxy..."
|
echo "[*] Configuring Zoraxy..."
|
||||||
for i in $(seq 1 15); do
|
SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
|
||||||
if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
sleep 1
|
|
||||||
|
|
||||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
# Wait for Zoraxy to create the database
|
||||||
|
for i in $(seq 1 20); do
|
||||||
# Helper: fetch CSRF token from Zoraxy login page
|
if [ -f "$SYS_DB" ]; then break; fi
|
||||||
# Uses $COOKIE_JAR — appends cookies, preserves existing session
|
sleep 1
|
||||||
fetch_csrf() {
|
|
||||||
local page
|
|
||||||
page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
|
|
||||||
local token
|
|
||||||
token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
|
|
||||||
echo "$token"
|
|
||||||
}
|
|
||||||
|
|
||||||
# First call — fresh cookie jar, retry until we get a valid CSRF
|
|
||||||
rm -f "$COOKIE_JAR"
|
|
||||||
CSRF=""
|
|
||||||
for i in $(seq 1 15); do
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
echo " Waiting for Zoraxy to be ready... ($i/15)"
|
|
||||||
sleep 2
|
|
||||||
done
|
done
|
||||||
|
|
||||||
if [ -z "$CSRF" ] || [ ${#CSRF} -lt 10 ]; then
|
# Write admin user directly to BoltDB via helper tool
|
||||||
echo " [WARN] Could not get valid CSRF — page response:"
|
if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
|
||||||
curl -s -c "$COOKIE_JAR" http://127.0.0.1:8000/login.html | head -c 300
|
"$TOOL_BIN" db --db "$SYS_DB" \
|
||||||
echo ""
|
--set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
|
||||||
|
"$TOOL_BIN" db --db "$SYS_DB" \
|
||||||
|
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
||||||
|
echo " [OK] Admin + ZorxAuth written to BoltDB"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Try API registration
|
# Write ACME config file directly
|
||||||
if [ -n "$CSRF" ] && [ ${#CSRF} -gt 10 ]; then
|
mkdir -p "$TARGET_DIR/config/zoraxy/conf"
|
||||||
ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <<EOF
|
||||||
-H "X-CSRF-Token: ${CSRF}" \
|
{
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
"Enabled": true,
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) || true
|
"Email": "${TLS_EMAIL}",
|
||||||
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
|
"RenewAll": true,
|
||||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
"FilesToRenew": [],
|
||||||
else
|
"DNSServers": ""
|
||||||
echo " [INFO] API registration: $ADMIN_CREATE"
|
}
|
||||||
fi
|
EOF
|
||||||
fi
|
echo " [OK] ACME enabled (email: ${TLS_EMAIL})"
|
||||||
|
|
||||||
# Login using API
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
|
||||||
-H "X-CSRF-Token: ${CSRF}" \
|
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
|
||||||
|
|
||||||
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
|
||||||
echo " [OK] Logged in as $ADMIN_USERNAME"
|
|
||||||
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
|
||||||
-H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null
|
|
||||||
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
|
||||||
-H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null
|
|
||||||
echo " [OK] LE auto-renew enabled"
|
|
||||||
|
|
||||||
# Upload existing certs to Zoraxy (so it registers them in sys.db)
|
|
||||||
echo " Uploading certificates to Zoraxy..."
|
|
||||||
CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
|
|
||||||
for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do
|
|
||||||
CRT_FILE="$CERTS_DIR/${FQDN}.crt"
|
|
||||||
KEY_FILE="$CERTS_DIR/${FQDN}.key"
|
|
||||||
if [ -f "$CRT_FILE" ] && [ -f "$KEY_FILE" ]; then
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=${FQDN}" \
|
|
||||||
-H "X-CSRF-Token: ${CSRF}" \
|
|
||||||
--data-binary "@${CRT_FILE}" > /dev/null 2>&1 || true
|
|
||||||
CSRF=$(fetch_csrf)
|
|
||||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pri&domain=${FQDN}" \
|
|
||||||
-H "X-CSRF-Token: ${CSRF}" \
|
|
||||||
--data-binary "@${KEY_FILE}" > /dev/null 2>&1 || true
|
|
||||||
echo " Uploaded cert for ${FQDN}"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# BoltDB Zoraxy Auth gateway
|
|
||||||
SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
|
|
||||||
if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
|
|
||||||
"$TOOL_BIN" db \
|
|
||||||
--db "$SYS_DB" \
|
|
||||||
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Restart Zoraxy to pick up configs
|
# Restart Zoraxy to pick up configs
|
||||||
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue