fix: robust Zoraxy admin creation + LE automation with proper CSRF
This commit is contained in:
parent
47efc2e62d
commit
d2fa6c7365
1 changed files with 67 additions and 34 deletions
101
deploy.sh
101
deploy.sh
|
|
@ -232,9 +232,8 @@ apps:
|
||||||
icon: "admin"
|
icon: "admin"
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
# Create Zoraxy admin account
|
# --- Configure Zoraxy admin + LE via API ---
|
||||||
echo "[*] Creating Zoraxy admin account..."
|
echo "[*] Configuring Zoraxy..."
|
||||||
ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
|
|
||||||
|
|
||||||
# Wait for Zoraxy to be ready
|
# Wait for Zoraxy to be ready
|
||||||
for i in $(seq 1 15); do
|
for i in $(seq 1 15); do
|
||||||
|
|
@ -244,46 +243,80 @@ EOF
|
||||||
echo " Waiting for Zoraxy... ($i/15)"
|
echo " Waiting for Zoraxy... ($i/15)"
|
||||||
sleep 2
|
sleep 2
|
||||||
done
|
done
|
||||||
|
sleep 1
|
||||||
|
|
||||||
# Fetch CSRF token and create admin
|
# Helper: fetch CSRF token + cookie jar from Zoraxy login page
|
||||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
fetch_csrf() {
|
||||||
rm -f "$COOKIE_JAR"
|
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||||
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
rm -f "$COOKIE_JAR"
|
||||||
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
local page
|
||||||
if [ -n "$CSRF_TOKEN" ]; then
|
page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
|
||||||
ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
|
local token
|
||||||
-H "X-CSRF-Token: $CSRF_TOKEN" \
|
token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
||||||
|
echo "$token"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Step 1: Create admin account
|
||||||
|
echo " Creating admin account..."
|
||||||
|
CSRF=$(fetch_csrf)
|
||||||
|
if [ -z "$CSRF" ]; then
|
||||||
|
echo " [WARN] Could not fetch CSRF token — trying registration without it"
|
||||||
|
ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||||
|
-d "username=${ADMIN_USERNAME:-master}" \
|
||||||
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||||
|
else
|
||||||
|
ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||||
|
-H "X-CSRF-Token: $CSRF" \
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
-d "username=${ADMIN_USERNAME:-master}" \
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||||
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
|
|
||||||
echo "[OK] Zoraxy admin account created"
|
|
||||||
else
|
|
||||||
echo "[INFO] Admin API response: $ADMIN_CREATE"
|
|
||||||
fi
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Login to Zoraxy for LE config
|
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||||
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||||
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
||||||
if [ -n "$CSRF_TOKEN" ]; then
|
echo " [OK] Admin account already exists"
|
||||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
else
|
||||||
-H "X-CSRF-Token: $CSRF_TOKEN" \
|
echo " [INFO] Admin registration response: $ADMIN_RESULT"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Step 2: Login with Zoraxy admin for LE configuration
|
||||||
|
echo " Logging in for LE configuration..."
|
||||||
|
CSRF=$(fetch_csrf)
|
||||||
|
if [ -z "$CSRF" ]; then
|
||||||
|
echo " [WARN] No CSRF token — skipping LE automation"
|
||||||
|
else
|
||||||
|
LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||||
|
-H "X-CSRF-Token: $CSRF" \
|
||||||
-d "username=${ADMIN_USERNAME:-master}" \
|
-d "username=${ADMIN_USERNAME:-master}" \
|
||||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||||
|
|
||||||
# Configure Let's Encrypt
|
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
||||||
echo "[*] Setting Let's Encrypt email..."
|
echo " [OK] Logged in as $ADMIN_USERNAME"
|
||||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
|
||||||
-d "set=${TLS_EMAIL}" > /dev/null
|
|
||||||
|
|
||||||
echo "[*] Obtaining certificates for app.${DOMAIN}..."
|
# Set LE email
|
||||||
curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
||||||
-G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||||
-d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" > /dev/null || true
|
-d "set=${TLS_EMAIL}" > /dev/null
|
||||||
|
|
||||||
echo "[*] Enabling auto-renew..."
|
# Obtain certificate
|
||||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
echo " Requesting LE certificate for app.${DOMAIN}..."
|
||||||
-d "enable=true" > /dev/null
|
CERT_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||||
|
-G -d "domains=app.${DOMAIN}" -d "filename=app.${DOMAIN}" \
|
||||||
|
-d "email=${TLS_EMAIL}" -d "ca=Let's Encrypt" -d "dns=false" 2>&1)
|
||||||
|
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
|
||||||
|
echo " [OK] Certificate obtained for app.${DOMAIN}"
|
||||||
|
else
|
||||||
|
echo " [INFO] Certificate result: $CERT_RESULT (expected if DNS doesn't resolve yet)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Enable auto-renew
|
||||||
|
echo " Enabling auto-renew..."
|
||||||
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||||
|
-d "enable=true" > /dev/null
|
||||||
|
echo " [OK] LE auto-renew enabled"
|
||||||
|
else
|
||||||
|
echo " [WARN] Login failed: $LOGIN_RESULT"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Restart Zoraxy to pick up configs
|
# Restart Zoraxy to pick up configs
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue