added opt-in managed nginx/TLS container (ADR 0005, plan step 13): server.nginx.* config serves GitTally over HTTPS on hosts without a reverse proxy — two-phase startup (ACME webroot via certbot container, then full HTTPS config), daily certificate renewal with nginx reload, labelled container removed on shutdown; all failures are non-fatal, the plain HTTP server keeps running
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Michael Hoennig
co-authored by
Claude Fable 5
Claude Fable 5
parent
fdbbd0516a
commit
b104eeee05
@@ -126,6 +126,17 @@ class InitCommand(
|
||||
bindAddress: 0.0.0.0
|
||||
# optional Impressum (legal disclosure) link in the web UI footer; empty hides the link
|
||||
impressumUrl: ""
|
||||
# Opt-in managed nginx+certbot Docker container for HTTPS, for hosts without
|
||||
# a usable reverse proxy (see docs/deployment.md). Off by default.
|
||||
nginx:
|
||||
enabled: false # manage an nginx container with Let's Encrypt certificates
|
||||
serverName: "" # public DNS name served by nginx; required when enabled
|
||||
httpPort: 8080 # host port published as nginx port 80
|
||||
httpsPort: 8443 # host port published as nginx port 443
|
||||
upstreamHost: "" # host nginx proxies to; empty = serverName
|
||||
containerName: "" # empty = gittally-nginx-<repo-name>
|
||||
stateDir: "" # empty = XDG_STATE_HOME (or ~/.local/state) + /gittally/nginx/<repo-key>
|
||||
letsencryptEmail: "" # e-mail for the Let's Encrypt account; empty registers without one
|
||||
|
||||
# Gitea integration for fetching commits and posting build statuses.
|
||||
gitea:
|
||||
|
||||
@@ -21,11 +21,24 @@ class ConfigLoader {
|
||||
|
||||
fun load(workingDir: Path = Paths.get(".")): GitTallyConfig {
|
||||
val raw = loadRaw(workingDir)
|
||||
return if (raw.isEmpty()) {
|
||||
GitTallyConfig()
|
||||
} else {
|
||||
yaml.convertValue(mergeBranchDefaults(raw), GitTallyConfig::class.java)
|
||||
val config =
|
||||
if (raw.isEmpty()) {
|
||||
GitTallyConfig()
|
||||
} else {
|
||||
yaml.convertValue(mergeBranchDefaults(raw), GitTallyConfig::class.java)
|
||||
}
|
||||
return defaultPublicBaseUrl(config)
|
||||
}
|
||||
|
||||
/** Legacy default: an empty `server.publicBaseUrl` becomes `https://<nginx.serverName>/`. */
|
||||
private fun defaultPublicBaseUrl(config: GitTallyConfig): GitTallyConfig {
|
||||
if (config.server.publicBaseUrl.isNotBlank() ||
|
||||
config.server.nginx.serverName
|
||||
.isBlank()
|
||||
) {
|
||||
return config
|
||||
}
|
||||
return config.copy(server = config.server.copy(publicBaseUrl = "https://${config.server.nginx.serverName}/"))
|
||||
}
|
||||
|
||||
fun loadRaw(workingDir: Path = Paths.get(".")): Map<String, Any?> {
|
||||
|
||||
@@ -11,12 +11,44 @@ data class GitTallyConfig(
|
||||
)
|
||||
|
||||
data class ServerConfig(
|
||||
/**
|
||||
* Public base URL of this installation; empty defaults to `https://<nginx.serverName>/`
|
||||
* when [NginxConfig.serverName] is set (applied by [ConfigLoader]).
|
||||
*/
|
||||
val publicBaseUrl: String = "",
|
||||
/** HTTP port of the `server` subcommand; 18080 like the legacy artifact server. */
|
||||
val port: Int = 18080,
|
||||
val bindAddress: String = "0.0.0.0",
|
||||
/** Optional Impressum (legal disclosure) link shown in the web UI footer; empty hides the link. */
|
||||
val impressumUrl: String = "",
|
||||
val nginx: NginxConfig = NginxConfig(),
|
||||
)
|
||||
|
||||
/**
|
||||
* Opt-in managed nginx+certbot Docker container serving GitTally over HTTPS,
|
||||
* for hosts without a usable reverse proxy (ADR 0005). Off by default; the
|
||||
* reverse-proxy deployment from `docs/deployment.md` stays the recommended setup.
|
||||
*/
|
||||
data class NginxConfig(
|
||||
/** Manage an nginx Docker container with Let's Encrypt certificates. */
|
||||
val enabled: Boolean = false,
|
||||
/** Public DNS name served by nginx and used for the certificate; required when [enabled]. */
|
||||
val serverName: String = "",
|
||||
/** Host port published as nginx port 80 (ACME challenge + HTTPS redirect). */
|
||||
val httpPort: Int = 8080,
|
||||
/** Host port published as nginx port 443. */
|
||||
val httpsPort: Int = 8443,
|
||||
/** Host nginx proxies to; empty uses [serverName] (the container cannot reach `localhost`). */
|
||||
val upstreamHost: String = "",
|
||||
/** Name of the managed container; empty means `gittally-nginx-<repo-name>`. */
|
||||
val containerName: String = "",
|
||||
/**
|
||||
* Directory for nginx config, certificates, and logs; empty means the platform
|
||||
* default `XDG_STATE_HOME` (or `~/.local/state`) + `/gittally/nginx/<repo-key>`.
|
||||
*/
|
||||
val stateDir: String = "",
|
||||
/** E-mail for the Let's Encrypt account; empty registers without one. */
|
||||
val letsencryptEmail: String = "",
|
||||
)
|
||||
|
||||
data class GitConfig(
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
package de.hoennig.gittally.server
|
||||
|
||||
/**
|
||||
* Generates the nginx configuration for the managed proxy container, ported from
|
||||
* the legacy `artifact_nginx_write_config`/`artifact_nginx_write_ssl_options`.
|
||||
* Values are substituted verbatim — callers must validate the server name and
|
||||
* upstream host (see [NginxProxyManager.HOST_NAME_PATTERN]) so no nginx directives
|
||||
* can be injected.
|
||||
*/
|
||||
object NginxConfigFiles {
|
||||
/**
|
||||
* The `nginx.conf` content. Without [full] it is the init config for the
|
||||
* two-phase startup: HTTP only, serving the ACME webroot challenge and
|
||||
* redirecting everything else to HTTPS. With [full] an HTTPS server block
|
||||
* with the Let's Encrypt certificate and the proxy to GitTally is added.
|
||||
*/
|
||||
fun nginxConf(
|
||||
serverName: String,
|
||||
upstreamHost: String,
|
||||
upstreamPort: Int,
|
||||
full: Boolean,
|
||||
): String {
|
||||
val httpServer =
|
||||
"""
|
||||
| server {
|
||||
| listen 80;
|
||||
| server_name $serverName;
|
||||
|
|
||||
| location /.well-known/acme-challenge/ {
|
||||
| root /var/www/certbot;
|
||||
| }
|
||||
|
|
||||
| location / {
|
||||
| return 301 https://${'$'}host${'$'}request_uri;
|
||||
| }
|
||||
| }
|
||||
""".trimMargin()
|
||||
val httpsServer =
|
||||
"""
|
||||
|
|
||||
| server {
|
||||
| listen 443 ssl;
|
||||
| server_name $serverName;
|
||||
|
|
||||
| ssl_certificate /etc/letsencrypt/live/$serverName/fullchain.pem;
|
||||
| ssl_certificate_key /etc/letsencrypt/live/$serverName/privkey.pem;
|
||||
| include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
|
|
||||
| location /.well-known/acme-challenge/ {
|
||||
| root /var/www/certbot;
|
||||
| }
|
||||
|
|
||||
| location / {
|
||||
| proxy_pass http://$upstreamHost:$upstreamPort;
|
||||
| proxy_set_header Host ${'$'}host;
|
||||
| proxy_set_header X-Real-IP ${'$'}remote_addr;
|
||||
| proxy_set_header X-Forwarded-For ${'$'}proxy_add_x_forwarded_for;
|
||||
| proxy_set_header X-Forwarded-Proto ${'$'}scheme;
|
||||
| add_header Cache-Control "no-store, max-age=0" always;
|
||||
| add_header Pragma "no-cache" always;
|
||||
| add_header Expires "0" always;
|
||||
| }
|
||||
| }
|
||||
""".trimMargin()
|
||||
return "events {}\n\nhttp {\n" + httpServer + (if (full) httpsServer else "") + "\n}\n"
|
||||
}
|
||||
|
||||
/** The certbot-recommended `options-ssl-nginx.conf`, verbatim from legacy. */
|
||||
const val SSL_OPTIONS: String =
|
||||
"ssl_session_cache shared:le_nginx_SSL:1m;\n" +
|
||||
"ssl_session_timeout 1440m;\n" +
|
||||
"ssl_protocols TLSv1.2 TLSv1.3;\n" +
|
||||
"ssl_prefer_server_ciphers off;\n" +
|
||||
"\n" +
|
||||
"ssl_ciphers \"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:" +
|
||||
"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:" +
|
||||
"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:" +
|
||||
"DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384\";\n" +
|
||||
"ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;\n"
|
||||
|
||||
/** Certbot's pinned DH parameters, downloaded once into the state dir (like legacy). */
|
||||
const val DH_PARAMS_URL: String = "https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem"
|
||||
}
|
||||
@@ -0,0 +1,442 @@
|
||||
package de.hoennig.gittally.server
|
||||
|
||||
import de.hoennig.gittally.build.ArtifactKeys
|
||||
import de.hoennig.gittally.build.DockerBuildRunner.Companion.GITTALLY_LABEL
|
||||
import de.hoennig.gittally.config.ConfigLoader
|
||||
import de.hoennig.gittally.git.GitCommandRunner
|
||||
import org.slf4j.LoggerFactory
|
||||
import org.springframework.stereotype.Component
|
||||
import java.net.URI
|
||||
import java.net.http.HttpClient
|
||||
import java.net.http.HttpRequest
|
||||
import java.net.http.HttpResponse
|
||||
import java.nio.file.Files
|
||||
import java.nio.file.Path
|
||||
import java.nio.file.Paths
|
||||
import java.time.Duration
|
||||
|
||||
/**
|
||||
* Manages the opt-in nginx+certbot Docker container that serves GitTally over
|
||||
* HTTPS on hosts without a reverse proxy (ADR 0005), ported from the legacy
|
||||
* `start_artifact_nginx` subsystem. Shells out to the `docker` CLI via the
|
||||
* generic [GitCommandRunner] process wrapper, like [de.hoennig.gittally.build.DockerBuildRunner].
|
||||
*
|
||||
* Startup is two-phase: an HTTP-only init config serves the ACME webroot
|
||||
* challenge, the certificate is obtained via a certbot container, then nginx is
|
||||
* restarted with the full HTTPS config. All failures are non-fatal warnings —
|
||||
* the plain HTTP server keeps running without the proxy (legacy behavior).
|
||||
* Nothing runs unless [start] is called (server profile only, see [ServerNginxLifecycle]).
|
||||
*/
|
||||
@Component
|
||||
class NginxProxyManager(
|
||||
private val commandRunner: GitCommandRunner,
|
||||
private val configLoader: ConfigLoader,
|
||||
) {
|
||||
private val log = LoggerFactory.getLogger(NginxProxyManager::class.java)
|
||||
|
||||
var workingDir: Path = Paths.get(".")
|
||||
|
||||
/** Replaceable for tests: fetches certbot's pinned DH parameters into [target]; throws on failure. */
|
||||
internal var dhParamsDownloader: (target: Path) -> Unit = ::downloadDhParams
|
||||
|
||||
/** Replaceable for tests: the wait between port-conflict re-checks. */
|
||||
internal var sleeper: (millis: Long) -> Unit = Thread::sleep
|
||||
|
||||
/** The settings the running container was started with; null while no container is managed. */
|
||||
private var running: NginxSettings? = null
|
||||
|
||||
fun isEnabled(): Boolean =
|
||||
configLoader
|
||||
.load(workingDir)
|
||||
.server.nginx.enabled
|
||||
|
||||
/**
|
||||
* Legacy `start_artifact_nginx`: prepare the state dir, remove stale containers,
|
||||
* run nginx (init config first when no certificate exists yet), obtain or renew
|
||||
* the certificate, then restart with the full HTTPS config.
|
||||
*/
|
||||
@Synchronized
|
||||
fun start() {
|
||||
try {
|
||||
val settings = resolveSettings() ?: return
|
||||
prepareStateDirs(settings)
|
||||
writeSslOptions(settings)
|
||||
cleanupStaleContainers(settings)
|
||||
if (!waitForPortsFree(settings)) {
|
||||
log.warn("managed nginx was not started because a configured port is still in use")
|
||||
return
|
||||
}
|
||||
writeNginxConf(settings, full = Files.exists(settings.certFile))
|
||||
if (!runContainer(settings)) {
|
||||
return
|
||||
}
|
||||
if (!obtainOrRenewCertificate(settings)) {
|
||||
log.warn("managed nginx is running, but Let's Encrypt certificate setup failed")
|
||||
return
|
||||
}
|
||||
writeNginxConf(settings, full = true)
|
||||
if (!runContainer(settings)) {
|
||||
log.warn("certificate is available, but restarting managed nginx with HTTPS failed")
|
||||
return
|
||||
}
|
||||
log.info(
|
||||
"managed nginx proxy: https://{}:{}/ -> http://{}:{}/ (state: {})",
|
||||
settings.serverName,
|
||||
settings.httpsPort,
|
||||
settings.upstreamHost,
|
||||
settings.upstreamPort,
|
||||
settings.stateDir,
|
||||
)
|
||||
} catch (e: Exception) {
|
||||
log.warn("could not start managed nginx: {}", e.toString())
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Renews the certificate and reloads nginx; scheduled daily by [ServerNginxLifecycle].
|
||||
* Improvement over legacy, which renewed only at process start and relied on
|
||||
* frequent self-update restarts. No-op while no container is managed.
|
||||
*/
|
||||
@Synchronized
|
||||
fun renewCertificateAndReload() {
|
||||
val settings = running ?: return
|
||||
try {
|
||||
val renew = commandRunner.run(certbotArgs(settings) + listOf("renew", "-q"), workingDir)
|
||||
if (!renew.isSuccess) {
|
||||
log.warn("certificate renewal failed: {}", renew.stderr.trim())
|
||||
return
|
||||
}
|
||||
val reload = commandRunner.run(listOf("docker", "exec", settings.containerName, "nginx", "-s", "reload"), workingDir)
|
||||
if (!reload.isSuccess) {
|
||||
log.warn("certificate renewed, but nginx reload failed: {}", reload.stderr.trim())
|
||||
}
|
||||
} catch (e: Exception) {
|
||||
log.warn("certificate renewal check failed: {}", e.toString())
|
||||
}
|
||||
}
|
||||
|
||||
/** Removes the managed container (legacy shutdown cleanup); safe to call when none runs. */
|
||||
@Synchronized
|
||||
fun stop() {
|
||||
val settings = running ?: return
|
||||
running = null
|
||||
try {
|
||||
commandRunner.run(listOf("docker", "rm", "-f", settings.containerName), workingDir)
|
||||
} catch (e: Exception) {
|
||||
log.warn("could not remove managed nginx container {}: {}", settings.containerName, e.toString())
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Legacy `configure_artifact_nginx_defaults` plus validation: resolves the
|
||||
* effective settings or returns null (with a warning) when misconfigured.
|
||||
* Host names are restricted to [HOST_NAME_PATTERN] so they substitute safely
|
||||
* into the nginx config.
|
||||
*/
|
||||
internal fun resolveSettings(): NginxSettings? {
|
||||
val config = configLoader.load(workingDir)
|
||||
val nginx = config.server.nginx
|
||||
if (!nginx.enabled) {
|
||||
return null
|
||||
}
|
||||
if (nginx.serverName.isBlank()) {
|
||||
log.warn("cannot start managed nginx because server.nginx.serverName is empty")
|
||||
return null
|
||||
}
|
||||
val upstreamHost = nginx.upstreamHost.ifBlank { nginx.serverName }
|
||||
if (!HOST_NAME_PATTERN.matches(nginx.serverName) || !HOST_NAME_PATTERN.matches(upstreamHost)) {
|
||||
log.warn("cannot start managed nginx because serverName or upstreamHost is not a valid host name")
|
||||
return null
|
||||
}
|
||||
if (nginx.httpPort !in 1..65535 || nginx.httpsPort !in 1..65535 || nginx.httpPort == nginx.httpsPort) {
|
||||
log.warn("cannot start managed nginx because the nginx ports are invalid")
|
||||
return null
|
||||
}
|
||||
if (config.server.port == nginx.httpPort || config.server.port == nginx.httpsPort) {
|
||||
log.warn("cannot start managed nginx because server.port {} collides with an nginx port", config.server.port)
|
||||
return null
|
||||
}
|
||||
val repoDir = workingDir.toAbsolutePath().normalize()
|
||||
val stateDir =
|
||||
if (nginx.stateDir.isNotBlank()) {
|
||||
repoDir.resolve(expandHome(nginx.stateDir)).normalize()
|
||||
} else {
|
||||
defaultStateDir(repoDir)
|
||||
}
|
||||
return NginxSettings(
|
||||
serverName = nginx.serverName,
|
||||
httpPort = nginx.httpPort,
|
||||
httpsPort = nginx.httpsPort,
|
||||
upstreamHost = upstreamHost,
|
||||
upstreamPort = config.server.port,
|
||||
containerName = nginx.containerName.ifBlank { defaultContainerName(repoDir) },
|
||||
stateDir = stateDir,
|
||||
letsencryptEmail = nginx.letsencryptEmail,
|
||||
repoKey = ArtifactKeys.repoKey(repoDir),
|
||||
)
|
||||
}
|
||||
|
||||
private fun prepareStateDirs(settings: NginxSettings) {
|
||||
Files.createDirectories(settings.certbotConf)
|
||||
Files.createDirectories(settings.certbotWww)
|
||||
Files.createDirectories(settings.certbotLog)
|
||||
Files.createDirectories(settings.nginxLog)
|
||||
}
|
||||
|
||||
/** Legacy `artifact_nginx_write_ssl_options`: the certbot nginx snippet plus its pinned DH parameters. */
|
||||
private fun writeSslOptions(settings: NginxSettings) {
|
||||
Files.writeString(settings.certbotConf.resolve("options-ssl-nginx.conf"), NginxConfigFiles.SSL_OPTIONS)
|
||||
val dhParams = settings.certbotConf.resolve("ssl-dhparams.pem")
|
||||
if (!Files.exists(dhParams)) {
|
||||
dhParamsDownloader(dhParams)
|
||||
}
|
||||
}
|
||||
|
||||
private fun writeNginxConf(
|
||||
settings: NginxSettings,
|
||||
full: Boolean,
|
||||
) {
|
||||
Files.writeString(
|
||||
settings.nginxConf,
|
||||
NginxConfigFiles.nginxConf(settings.serverName, settings.upstreamHost, settings.upstreamPort, full),
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Legacy `cleanup_stale_artifact_nginx_containers`: remove the container by
|
||||
* name, all nginx-role containers of this repository by label, and any
|
||||
* GitTally container still occupying the configured ports.
|
||||
*/
|
||||
private fun cleanupStaleContainers(settings: NginxSettings) {
|
||||
commandRunner.run(listOf("docker", "rm", "-f", settings.containerName), workingDir)
|
||||
val labelled =
|
||||
commandRunner.run(
|
||||
listOf(
|
||||
"docker",
|
||||
"ps",
|
||||
"-aq",
|
||||
"--filter",
|
||||
"label=$GITTALLY_LABEL=true",
|
||||
"--filter",
|
||||
"label=$GITTALLY_LABEL.repository=${settings.repoKey}",
|
||||
"--filter",
|
||||
"label=$GITTALLY_LABEL.role=nginx",
|
||||
),
|
||||
workingDir,
|
||||
)
|
||||
if (labelled.isSuccess && labelled.lines().isNotEmpty()) {
|
||||
commandRunner.run(listOf("docker", "rm", "-f") + labelled.lines(), workingDir)
|
||||
}
|
||||
for (container in listContainersUsingPorts(settings)) {
|
||||
if (container.labels.contains("$GITTALLY_LABEL=true") ||
|
||||
container.name.startsWith("gittally-") ||
|
||||
container.name.startsWith("git-watch-origin-and-test-nginx-")
|
||||
) {
|
||||
log.info("removing stale GitTally container using an nginx port: {}", container.name)
|
||||
commandRunner.run(listOf("docker", "rm", "-f", container.id), workingDir)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Legacy `wait_for_artifact_nginx_ports`: re-check up to four times, warning about foreign owners. */
|
||||
private fun waitForPortsFree(settings: NginxSettings): Boolean {
|
||||
repeat(4) {
|
||||
val owners = listContainersUsingPorts(settings)
|
||||
if (owners.isEmpty()) {
|
||||
return true
|
||||
}
|
||||
owners.forEach { log.warn("nginx port is already used by Docker container {} ({})", it.name, it.id) }
|
||||
sleeper(1000)
|
||||
}
|
||||
return listContainersUsingPorts(settings).isEmpty()
|
||||
}
|
||||
|
||||
private data class ContainerInfo(
|
||||
val id: String,
|
||||
val name: String,
|
||||
val ports: String,
|
||||
val labels: String,
|
||||
)
|
||||
|
||||
private fun listContainersUsingPorts(settings: NginxSettings): List<ContainerInfo> {
|
||||
val listing =
|
||||
commandRunner.run(
|
||||
listOf("docker", "ps", "--format", "{{.ID}}\t{{.Names}}\t{{.Ports}}\t{{.Labels}}"),
|
||||
workingDir,
|
||||
)
|
||||
if (!listing.isSuccess) {
|
||||
return emptyList()
|
||||
}
|
||||
return listing
|
||||
.lines()
|
||||
.mapNotNull { line ->
|
||||
val fields = line.split('\t')
|
||||
if (fields.size < 3) null else ContainerInfo(fields[0], fields[1], fields[2], fields.getOrElse(3) { "" })
|
||||
}.filter { container ->
|
||||
listOf(settings.httpPort, settings.httpsPort).any { container.ports.contains(":$it->") }
|
||||
}
|
||||
}
|
||||
|
||||
/** Legacy `artifact_nginx_run_container`; replaces any previous instance of the container. */
|
||||
private fun runContainer(settings: NginxSettings): Boolean {
|
||||
commandRunner.run(listOf("docker", "rm", "-f", settings.containerName), workingDir)
|
||||
val run = commandRunner.run(runContainerArgs(settings), workingDir)
|
||||
if (!run.isSuccess) {
|
||||
log.warn("could not start managed nginx container {}: {}", settings.containerName, run.stderr.trim())
|
||||
return false
|
||||
}
|
||||
running = settings
|
||||
return true
|
||||
}
|
||||
|
||||
internal fun runContainerArgs(settings: NginxSettings): List<String> =
|
||||
listOf(
|
||||
"docker",
|
||||
"run",
|
||||
"-d",
|
||||
"--name",
|
||||
settings.containerName,
|
||||
"--publish",
|
||||
"${settings.httpPort}:80",
|
||||
"--publish",
|
||||
"${settings.httpsPort}:443",
|
||||
"--network",
|
||||
"bridge",
|
||||
"--volume",
|
||||
"${settings.certbotConf}:/etc/letsencrypt",
|
||||
"--volume",
|
||||
"${settings.certbotWww}:/var/www/certbot",
|
||||
"--volume",
|
||||
"${settings.nginxLog}:/var/log/nginx",
|
||||
"--volume",
|
||||
"${settings.nginxConf}:/etc/nginx/nginx.conf:ro",
|
||||
"--label",
|
||||
"$GITTALLY_LABEL=true",
|
||||
"--label",
|
||||
"$GITTALLY_LABEL.repository=${settings.repoKey}",
|
||||
"--label",
|
||||
"$GITTALLY_LABEL.role=nginx",
|
||||
"nginx",
|
||||
)
|
||||
|
||||
/**
|
||||
* Legacy `artifact_nginx_obtain_or_renew_certificate`: `certonly` in webroot
|
||||
* mode for a first certificate, plain `renew` when one already exists (nginx
|
||||
* is already running and serves the challenge directory).
|
||||
*/
|
||||
private fun obtainOrRenewCertificate(settings: NginxSettings): Boolean {
|
||||
val args =
|
||||
if (Files.exists(settings.certFile)) {
|
||||
certbotArgs(settings) + listOf("renew", "-q")
|
||||
} else {
|
||||
obtainCertificateArgs(settings)
|
||||
}
|
||||
val result = commandRunner.run(args, workingDir)
|
||||
if (!result.isSuccess) {
|
||||
log.warn("certbot failed: {}", result.stderr.trim())
|
||||
}
|
||||
return result.isSuccess
|
||||
}
|
||||
|
||||
internal fun obtainCertificateArgs(settings: NginxSettings): List<String> {
|
||||
val emailArgs =
|
||||
if (settings.letsencryptEmail.isNotBlank()) {
|
||||
listOf("--email", settings.letsencryptEmail)
|
||||
} else {
|
||||
listOf("--register-unsafely-without-email")
|
||||
}
|
||||
return certbotArgs(settings) +
|
||||
listOf(
|
||||
"certonly",
|
||||
"--webroot",
|
||||
"--webroot-path",
|
||||
"/var/www/certbot",
|
||||
"--cert-name",
|
||||
settings.serverName,
|
||||
"-d",
|
||||
settings.serverName,
|
||||
"--rsa-key-size",
|
||||
"4096",
|
||||
"--non-interactive",
|
||||
"--agree-tos",
|
||||
) + emailArgs
|
||||
}
|
||||
|
||||
private fun certbotArgs(settings: NginxSettings): List<String> =
|
||||
listOf(
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"--volume",
|
||||
"${settings.certbotConf}:/etc/letsencrypt",
|
||||
"--volume",
|
||||
"${settings.certbotWww}:/var/www/certbot",
|
||||
"--volume",
|
||||
"${settings.certbotLog}:/var/log/letsencrypt",
|
||||
"certbot/certbot",
|
||||
)
|
||||
|
||||
private fun expandHome(path: String): Path =
|
||||
if (path == "~" || path.startsWith("~/")) {
|
||||
Paths.get(System.getProperty("user.home"), path.removePrefix("~"))
|
||||
} else {
|
||||
Paths.get(path)
|
||||
}
|
||||
|
||||
/** The effective managed-nginx settings with all defaults resolved. */
|
||||
internal data class NginxSettings(
|
||||
val serverName: String,
|
||||
val httpPort: Int,
|
||||
val httpsPort: Int,
|
||||
val upstreamHost: String,
|
||||
val upstreamPort: Int,
|
||||
val containerName: String,
|
||||
val stateDir: Path,
|
||||
val letsencryptEmail: String,
|
||||
val repoKey: String,
|
||||
) {
|
||||
val certbotConf: Path get() = stateDir.resolve("certbot/conf")
|
||||
val certbotWww: Path get() = stateDir.resolve("certbot/www")
|
||||
val certbotLog: Path get() = stateDir.resolve("certbot/log")
|
||||
val nginxLog: Path get() = stateDir.resolve("nginx/log")
|
||||
val nginxConf: Path get() = stateDir.resolve("nginx/nginx.conf")
|
||||
val certFile: Path get() = certbotConf.resolve("live/$serverName/fullchain.pem")
|
||||
}
|
||||
|
||||
companion object {
|
||||
/** Host names substitute unescaped into the nginx config, so only safe characters are allowed. */
|
||||
internal val HOST_NAME_PATTERN = Regex("[A-Za-z0-9][A-Za-z0-9.-]*")
|
||||
|
||||
/** Legacy `artifact_nginx_default_state_dir`. */
|
||||
fun defaultStateDir(repoDir: Path): Path {
|
||||
val stateHome =
|
||||
System.getenv("XDG_STATE_HOME")?.takeIf { it.isNotBlank() }?.let { Paths.get(it) }
|
||||
?: Paths.get(System.getProperty("user.home"), ".local", "state")
|
||||
return stateHome
|
||||
.resolve("gittally")
|
||||
.resolve("nginx")
|
||||
.resolve(ArtifactKeys.repoKey(repoDir))
|
||||
.toAbsolutePath()
|
||||
.normalize()
|
||||
}
|
||||
|
||||
/** Legacy default `gittally-nginx-<repo-name>` with unsafe characters replaced. */
|
||||
fun defaultContainerName(repoDir: Path): String =
|
||||
"gittally-nginx-" + repoDir.fileName.toString().replace(Regex("[^A-Za-z0-9_.-]"), "-")
|
||||
|
||||
private fun downloadDhParams(target: Path) {
|
||||
val response =
|
||||
HttpClient
|
||||
.newBuilder()
|
||||
.connectTimeout(Duration.ofSeconds(10))
|
||||
.followRedirects(HttpClient.Redirect.NORMAL)
|
||||
.build()
|
||||
.send(
|
||||
HttpRequest.newBuilder(URI.create(NginxConfigFiles.DH_PARAMS_URL)).GET().build(),
|
||||
HttpResponse.BodyHandlers.ofString(),
|
||||
)
|
||||
check(response.statusCode() == 200) { "downloading ssl-dhparams.pem failed with HTTP ${response.statusCode()}" }
|
||||
Files.writeString(target, response.body())
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
package de.hoennig.gittally.server
|
||||
|
||||
import jakarta.annotation.PreDestroy
|
||||
import org.springframework.boot.context.event.ApplicationReadyEvent
|
||||
import org.springframework.context.annotation.Profile
|
||||
import org.springframework.context.event.EventListener
|
||||
import org.springframework.stereotype.Component
|
||||
import java.util.concurrent.Executors
|
||||
import java.util.concurrent.ScheduledExecutorService
|
||||
import java.util.concurrent.TimeUnit
|
||||
|
||||
/**
|
||||
* Starts the managed nginx container once the web server is up and removes it on
|
||||
* shutdown, plus a daily certificate-renewal check — an improvement over legacy,
|
||||
* which renewed only at process start and relied on frequent self-update restarts.
|
||||
* Only in the `server` profile, like [ServerWatcherLifecycle]; with
|
||||
* `server.nginx.enabled: false` (the default) nothing is scheduled or touched.
|
||||
* Startup runs on the scheduler thread, so a slow certificate issuance never
|
||||
* blocks the web server; the single thread also serializes startup and renewals.
|
||||
*/
|
||||
@Component
|
||||
@Profile("server")
|
||||
class ServerNginxLifecycle(
|
||||
private val nginxProxyManager: NginxProxyManager,
|
||||
) {
|
||||
/** Replaceable for tests: the scheduler running startup and renewal checks. */
|
||||
internal var schedulerFactory: () -> ScheduledExecutorService = {
|
||||
Executors.newSingleThreadScheduledExecutor { runnable ->
|
||||
Thread(runnable, "gittally-nginx").apply { isDaemon = true }
|
||||
}
|
||||
}
|
||||
|
||||
private var scheduler: ScheduledExecutorService? = null
|
||||
|
||||
@EventListener(ApplicationReadyEvent::class)
|
||||
fun onApplicationReady() {
|
||||
if (!nginxProxyManager.isEnabled()) {
|
||||
return
|
||||
}
|
||||
scheduler =
|
||||
schedulerFactory().also {
|
||||
it.execute(nginxProxyManager::start)
|
||||
it.scheduleWithFixedDelay(
|
||||
nginxProxyManager::renewCertificateAndReload,
|
||||
RENEWAL_CHECK_INTERVAL_HOURS,
|
||||
RENEWAL_CHECK_INTERVAL_HOURS,
|
||||
TimeUnit.HOURS,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@PreDestroy
|
||||
fun onShutdown() {
|
||||
scheduler?.shutdownNow()
|
||||
scheduler = null
|
||||
nginxProxyManager.stop()
|
||||
}
|
||||
|
||||
companion object {
|
||||
/** Daily, like certbot's own systemd timer; `certbot renew` only acts when a certificate is due. */
|
||||
const val RENEWAL_CHECK_INTERVAL_HOURS = 24L
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user