fix: robust Zoraxy admin creation + LE automation with proper CSRF
This commit is contained in:
parent
47efc2e62d
commit
d2fa6c7365
1 changed files with 67 additions and 34 deletions
101
deploy.sh
101
deploy.sh
|
|
@ -232,9 +232,8 @@ apps:
|
|||
icon: "admin"
|
||||
EOF
|
||||
|
||||
# Create Zoraxy admin account
|
||||
echo "[*] Creating Zoraxy admin account..."
|
||||
ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
|
||||
# --- Configure Zoraxy admin + LE via API ---
|
||||
echo "[*] Configuring Zoraxy..."
|
||||
|
||||
# Wait for Zoraxy to be ready
|
||||
for i in $(seq 1 15); do
|
||||
|
|
@ -244,46 +243,80 @@ EOF
|
|||
echo " Waiting for Zoraxy... ($i/15)"
|
||||
sleep 2
|
||||
done
|
||||
sleep 1
|
||||
|
||||
# Fetch CSRF token and create admin
|
||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||
rm -f "$COOKIE_JAR"
|
||||
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
||||
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
||||
if [ -n "$CSRF_TOKEN" ]; then
|
||||
ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
|
||||
-H "X-CSRF-Token: $CSRF_TOKEN" \
|
||||
# Helper: fetch CSRF token + cookie jar from Zoraxy login page
|
||||
fetch_csrf() {
|
||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||
rm -f "$COOKIE_JAR"
|
||||
local page
|
||||
page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
|
||||
local token
|
||||
token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
||||
echo "$token"
|
||||
}
|
||||
|
||||
# Step 1: Create admin account
|
||||
echo " Creating admin account..."
|
||||
CSRF=$(fetch_csrf)
|
||||
if [ -z "$CSRF" ]; then
|
||||
echo " [WARN] Could not fetch CSRF token — trying registration without it"
|
||||
ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
else
|
||||
ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||
echo "[OK] Zoraxy admin account created"
|
||||
else
|
||||
echo "[INFO] Admin API response: $ADMIN_CREATE"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Login to Zoraxy for LE config
|
||||
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
||||
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
||||
if [ -n "$CSRF_TOKEN" ]; then
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: $CSRF_TOKEN" \
|
||||
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
||||
echo " [OK] Admin account already exists"
|
||||
else
|
||||
echo " [INFO] Admin registration response: $ADMIN_RESULT"
|
||||
fi
|
||||
|
||||
# Step 2: Login with Zoraxy admin for LE configuration
|
||||
echo " Logging in for LE configuration..."
|
||||
CSRF=$(fetch_csrf)
|
||||
if [ -z "$CSRF" ]; then
|
||||
echo " [WARN] No CSRF token — skipping LE automation"
|
||||
else
|
||||
LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
|
||||
# Configure Let's Encrypt
|
||||
echo "[*] Setting Let's Encrypt email..."
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||
-d "set=${TLS_EMAIL}" > /dev/null
|
||||
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
||||
echo " [OK] Logged in as $ADMIN_USERNAME"
|
||||
|
||||
echo "[*] Obtaining certificates for app.${DOMAIN}..."
|
||||
curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||
-G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
|
||||
-d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" > /dev/null || true
|
||||
# Set LE email
|
||||
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||
-d "set=${TLS_EMAIL}" > /dev/null
|
||||
|
||||
echo "[*] Enabling auto-renew..."
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||
-d "enable=true" > /dev/null
|
||||
# Obtain certificate
|
||||
echo " Requesting LE certificate for app.${DOMAIN}..."
|
||||
CERT_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||
-G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
|
||||
-d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
|
||||
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
|
||||
echo " [OK] Certificate obtained for app.${DOMAIN}"
|
||||
else
|
||||
echo " [INFO] Certificate result: $CERT_RESULT (expected if DNS doesn't resolve yet)"
|
||||
fi
|
||||
|
||||
# Enable auto-renew
|
||||
echo " Enabling auto-renew..."
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||
-d "enable=true" > /dev/null
|
||||
echo " [OK] LE auto-renew enabled"
|
||||
else
|
||||
echo " [WARN] Login failed: $LOGIN_RESULT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Restart Zoraxy to pick up configs
|
||||
|
|
|
|||
Loading…
Reference in a new issue