From d2fa6c7365cdaade6a22215f0b409286fa6efb40 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 10:21:24 +0100
Subject: [PATCH] fix: robust Zoraxy admin creation + LE automation with proper
 CSRF

---
 deploy.sh | 101 ++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 67 insertions(+), 34 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 07ab167..d7d0c95 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -232,9 +232,8 @@ apps:
     icon: "admin"
 EOF
 
-    # Create Zoraxy admin account
-    echo "[*] Creating Zoraxy admin account..."
-    ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
+    # --- Configure Zoraxy admin + LE via API ---
+    echo "[*] Configuring Zoraxy..."
 
     # Wait for Zoraxy to be ready
     for i in $(seq 1 15); do
@@ -244,46 +243,80 @@ EOF
         echo "  Waiting for Zoraxy... ($i/15)"
         sleep 2
     done
+    sleep 1
 
-    # Fetch CSRF token and create admin
-    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
-    rm -f "$COOKIE_JAR"
-    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
-    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
-    if [ -n "$CSRF_TOKEN" ]; then
-        ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
-            -H "X-CSRF-Token: $CSRF_TOKEN" \
+    # Helper: fetch CSRF token + cookie jar from Zoraxy login page
+    fetch_csrf() {
+        COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+        rm -f "$COOKIE_JAR"
+        local page
+        page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
+        local token
+        token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+        echo "$token"
+    }
+
+    # Step 1: Create admin account
+    echo "  Creating admin account..."
+    CSRF=$(fetch_csrf)
+    if [ -z "$CSRF" ]; then
+        echo "  [WARN] Could not fetch CSRF token — trying registration without it"
+        ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+    else
+        ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
+            -H "X-CSRF-Token: $CSRF" \
             -d "username=${ADMIN_USERNAME:-master}" \
             -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
-        if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
-            echo "[OK] Zoraxy admin account created"
-        else
-            echo "[INFO] Admin API response: $ADMIN_CREATE"
-        fi
     fi
 
-    # Login to Zoraxy for LE config
-    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
-    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
-    if [ -n "$CSRF_TOKEN" ]; then
-        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
-            -H "X-CSRF-Token: $CSRF_TOKEN" \
+    if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
+        echo "  [OK] Admin account created: $ADMIN_USERNAME"
+    elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
+        echo "  [OK] Admin account already exists"
+    else
+        echo "  [INFO] Admin registration response: $ADMIN_RESULT"
+    fi
+
+    # Step 2: Login with Zoraxy admin for LE configuration
+    echo "  Logging in for LE configuration..."
+    CSRF=$(fetch_csrf)
+    if [ -z "$CSRF" ]; then
+        echo "  [WARN] No CSRF token — skipping LE automation"
+    else
+        LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+            -H "X-CSRF-Token: $CSRF" \
             -d "username=${ADMIN_USERNAME:-master}" \
-            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
 
-        # Configure Let's Encrypt
-        echo "[*] Setting Let's Encrypt email..."
-        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
-            -d "set=${TLS_EMAIL}" > /dev/null
+        if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
+            echo "  [OK] Logged in as $ADMIN_USERNAME"
 
-        echo "[*] Obtaining certificates for app.${DOMAIN}..."
-        curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
-            -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
-            -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" > /dev/null || true
+            # Set LE email
+            echo "  Setting Let's Encrypt email: ${TLS_EMAIL}"
+            curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
+                -d "set=${TLS_EMAIL}" > /dev/null
 
-        echo "[*] Enabling auto-renew..."
-        curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
-            -d "enable=true" > /dev/null
+            # Obtain certificate
+            echo "  Requesting LE certificate for app.${DOMAIN}..."
+            CERT_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+                -G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
+                -d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
+            if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
+                echo "  [OK] Certificate obtained for app.${DOMAIN}"
+            else
+                echo "  [INFO] Certificate result: $CERT_RESULT (expected if DNS doesn't resolve yet)"
+            fi
+
+            # Enable auto-renew
+            echo "  Enabling auto-renew..."
+            curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
+                -d "enable=true" > /dev/null
+            echo "  [OK] LE auto-renew enabled"
+        else
+            echo "  [WARN] Login failed: $LOGIN_RESULT"
+        fi
     fi
 
     # Restart Zoraxy to pick up configs