|
1630
|
1 local Luan = require "luan:Luan.luan"
|
|
|
2 local error = Luan.error
|
|
|
3 local load_file = Luan.load_file or error()
|
|
|
4 local ipairs = Luan.ipairs or error()
|
|
|
5 local Boot = require "luan:Boot.luan"
|
|
|
6 local Io = require "luan:Io.luan"
|
|
|
7 local ip = Io.ip or error()
|
|
|
8 local uri = Io.uri or error()
|
|
|
9 local output_of = Io.output_of or error()
|
|
|
10 local String = require "luan:String.luan"
|
|
|
11 local regex_quote = String.regex_quote or error()
|
|
|
12 local matches = String.matches or error()
|
|
|
13 local Http = require "luan:http/Http.luan"
|
|
|
14 local Hosted = require "luan:host/Hosted.luan"
|
|
|
15 local Logging = require "luan:logging/Logging.luan"
|
|
|
16 local logger = Logging.logger "https"
|
|
|
17
|
|
|
18
|
|
|
19 local local_cer = [[
|
|
|
20 -----BEGIN CERTIFICATE-----
|
|
|
21 MIIGGDCCBQCgAwIBAgISA2I3DK1t/znI/s4eJX23gWOPMA0GCSqGSIb3DQEBCwUA
|
|
|
22 MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
|
|
|
23 ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODA2MTEwODQ1MDJaFw0x
|
|
|
24 ODA5MDkwODQ1MDJaMCIxIDAeBgNVBAMTF2h0dHBzLnRlc3QubHVhbmhvc3QuY29t
|
|
|
25 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvlvCVOGcE/79DJFCh45W
|
|
|
26 pmqfwljQMYWDNbyNb6zND4QzG80RPHgWNpoDyVUXG8eLn/rDazi0ldwkFH5usrO+
|
|
|
27 m3IC5lT/Y/wIr+wT9dQv0l0IJKdkA+cnpOB0z8BU0nBnw6TKhhEcZrPsMRzjbFTJ
|
|
|
28 BLeUEf855Y+t/8TeSykBbV9ufiisLnR2/5gvOBW19LHkcxQYzKbmHPVh3sD2wyK8
|
|
|
29 gg8B3jgqHJh+m/amOfaxZnOEtEd/TGd6QxCbVvh1jewneBoM9niVOScGUk9JuVol
|
|
|
30 tEgToV7vKYpwNRObbN7pitdwudbB3gieK1/BoxHNudjArur4Vapkx/+GSX1aHIsO
|
|
|
31 wQIDAQABo4IDHjCCAxowDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUF
|
|
|
32 BwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQhhVC3p8SHDpRt
|
|
|
33 GfyT/dPWQ7aSUDAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBvBggr
|
|
|
34 BgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5sZXRz
|
|
|
35 ZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5sZXRz
|
|
|
36 ZW5jcnlwdC5vcmcvMCIGA1UdEQQbMBmCF2h0dHBzLnRlc3QubHVhbmhvc3QuY29t
|
|
|
37 MIH+BgNVHSAEgfYwgfMwCAYGZ4EMAQIBMIHmBgsrBgEEAYLfEwEBATCB1jAmBggr
|
|
|
38 BgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwgasGCCsGAQUFBwIC
|
|
|
39 MIGeDIGbVGhpcyBDZXJ0aWZpY2F0ZSBtYXkgb25seSBiZSByZWxpZWQgdXBvbiBi
|
|
|
40 eSBSZWx5aW5nIFBhcnRpZXMgYW5kIG9ubHkgaW4gYWNjb3JkYW5jZSB3aXRoIHRo
|
|
|
41 ZSBDZXJ0aWZpY2F0ZSBQb2xpY3kgZm91bmQgYXQgaHR0cHM6Ly9sZXRzZW5jcnlw
|
|
|
42 dC5vcmcvcmVwb3NpdG9yeS8wggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdQApPFGW
|
|
|
43 VMg5ZbqqUPxYB9S3b79Yeily3KTDDPTlRUf0eAAAAWPuPA0tAAAEAwBGMEQCIFV8
|
|
|
44 xYbsY+O1vubYs0f6KVNlCMMd/d7R5HP76vnNWuGEAiBxlEyVDR4qPf8502v4cqfs
|
|
|
45 bG6UGaSqPT4gO8Xp8qOSCQB2ANt0r+7LKeyx/so+cW0s5bmquzb3hHGDx12dTze2
|
|
|
46 H79kAAABY+48DR0AAAQDAEcwRQIhAKdDQAa1EquTQzbZaiE88QccvGidohe/AbMB
|
|
|
47 Dd1TwQdwAiBGuXo3vKBKZpc1SONmXOz8Oq99JziXcsyLUvkBo99lejANBgkqhkiG
|
|
|
48 9w0BAQsFAAOCAQEASyfiSFAjL7nUuFrzhUPlMtWE6sF5JgIoLagHqcGiBZYW8Qzg
|
|
|
49 1Xs+zByFmIVl96T6Hgf/7ZRTD81CIinQCEeTPkx4P/S8xLSmyCmYjjxyvje4BHJW
|
|
|
50 AkW2eJtPwxQfKfLqaRFzJNE2I2PS1mQC2DyL76UghesujMx+B2uqb1geZ87XRwOu
|
|
|
51 iCwQtnLvdqAA3m2JMzahTWXElmW5YbzvbxWc1WLRn3lc3R9a9SFX++LTRxv44/i6
|
|
|
52 XiVFekc+IG6oL5bkcLIT70rLa8/vyqUaAicHvnkFp6CbmUX+Pe6nYAfBlYuQzGLM
|
|
|
53 e1qixE3bA1Mv6cpyOFIC+beASN/Xj7jbEa7EBA==
|
|
|
54 -----END CERTIFICATE-----
|
|
|
55 -----BEGIN CERTIFICATE-----
|
|
|
56 MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
|
|
|
57 MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
|
|
|
58 DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
|
|
|
59 SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
|
|
|
60 GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
|
|
|
61 AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
|
|
|
62 q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
|
|
|
63 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
|
|
|
64 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
|
|
|
65 a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
|
|
|
66 /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
|
|
|
67 AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
|
|
|
68 CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
|
|
|
69 bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
|
|
|
70 c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
|
|
|
71 VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
|
|
|
72 ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
|
|
|
73 MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
|
|
|
74 Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
|
|
|
75 AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
|
|
|
76 uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
|
|
|
77 wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
|
|
|
78 X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
|
|
|
79 PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
|
|
|
80 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
|
|
|
81 -----END CERTIFICATE-----
|
|
|
82 ]]
|
|
|
83
|
|
|
84 local local_key = [[
|
|
|
85 -----BEGIN RSA PRIVATE KEY-----
|
|
|
86 MIIEpAIBAAKCAQEAvlvCVOGcE/79DJFCh45WpmqfwljQMYWDNbyNb6zND4QzG80R
|
|
|
87 PHgWNpoDyVUXG8eLn/rDazi0ldwkFH5usrO+m3IC5lT/Y/wIr+wT9dQv0l0IJKdk
|
|
|
88 A+cnpOB0z8BU0nBnw6TKhhEcZrPsMRzjbFTJBLeUEf855Y+t/8TeSykBbV9ufiis
|
|
|
89 LnR2/5gvOBW19LHkcxQYzKbmHPVh3sD2wyK8gg8B3jgqHJh+m/amOfaxZnOEtEd/
|
|
|
90 TGd6QxCbVvh1jewneBoM9niVOScGUk9JuVoltEgToV7vKYpwNRObbN7pitdwudbB
|
|
|
91 3gieK1/BoxHNudjArur4Vapkx/+GSX1aHIsOwQIDAQABAoIBAFRgJcYr7luqpY2B
|
|
|
92 gYTGYcAH+OJTLY0Vye/ysJp0dLxQ87p57g7oh6gSImWGUuTcURZLN316OAlI97Eh
|
|
|
93 zX1mULFkGsbvm/g8ibk4oixPrhbHZ8mfbKSSPC9H0l8XuEFC06uTirVcNkOLssCe
|
|
|
94 NmwZNLTjjj1f7NDFG/IH2CRme5x3cRdfVDQ1tYiK8lHxoHRj2uN3P1gsJIlDYR1a
|
|
|
95 A3TqbLDFYGsvoMPtgkcK/wRpBQCX0FL2IDrigGF33Eb5BiqFHx7KXO9Qjsyb6Y6z
|
|
|
96 B/OusjQ6LA//Oq2aizdoDD/op5GRAG7R5wB/8SrjlkME4q8psLRYalcgPwBStQjL
|
|
|
97 9tWVHGUCgYEA7xK3xB29TwYoTRY9RwtTILnYXdKM5tY0npC9jDeL96KZeibd0l/S
|
|
|
98 2jDqn32O8WUGYHticWYFuUS8evcGtsaBmZPUFT5ndp4DmfahttyS+CoF/NDPlZGq
|
|
|
99 cpl92ZDDCQrY68zSY9UhHY/JaslOVv963UfrL30Wok1Bg0A0sqDVgY8CgYEAy9YS
|
|
|
100 KjnspIWgC8Fq2kkMAIdBXQVnaRP5l7gyRmVuVwDXS+iG/0DGZfmv1g9S17lUz3R0
|
|
|
101 rpKp4iorboJ2A4Wiv0dgar7CmzLMcMSUREX4L7DoRsEXUuxsCOf0F2Vt3baVdo3N
|
|
|
102 PtfV8QzpcRAlN4Fap7s0ErNP21OE/ZXocwQ1oq8CgYEA5+1GrVEUiAc3LaF3jOZl
|
|
|
103 nIfuaQaLfp0rqvBLki2I8ZGiRqhR5XbkfJub4WHTPEd/ajYIiG4q+1K9bqUatFHb
|
|
|
104 BHwu8PT7Nk2QvNpQg690PJ+38003NKh9rHNPbbNMIgeN7SNkr0jhuWX2RkxIXYm3
|
|
|
105 TdgpRoaZYJaGCahN90SkG+0CgYBWM1J9Pv+/V68mKYaJh2im9IwEzZs8ybC8o63H
|
|
|
106 LW/rJTTnKg+k9HyydVQR/2r2Ra8DCGmrxeRH+7NgSZWkyafYolO48LEVtvbUHZ3h
|
|
|
107 /YEGkha4jUHS1J6faZBFMKS0pVkxyKfqkpYsGVzDbqN+hJqU4ksUOXZk9z3/i5zA
|
|
|
108 vx/7iwKBgQCELMiakqU/tw3U+VwTRKoWYgCxg9SyG3UWpyuZSguK5k+4C+BvCaXN
|
|
|
109 PT7RjA5Gb8oQKUd9kcn1x/ljyTw3mqn5AT7TqfJkG/sMh+Fkl+JMpWFVfmexWihG
|
|
|
110 eW2FbldbFg8IUzTPHAOFmO7+9h5oN0pBWwcml2D1YUqfGOyezisuAA==
|
|
|
111 -----END RSA PRIVATE KEY-----
|
|
|
112 ]]
|
|
|
113
|
|
|
114
|
|
|
115 function Hosted.set_https(is_https)
|
|
|
116 local domain = Http.domain
|
|
|
117 local dir = uri("site:").parent()
|
|
|
118 local nginx_file = dir.child("nginx.ssl.conf")
|
|
|
119 local key_file = dir.child(domain..".key")
|
|
|
120 local local_cer_file = dir.child("fullchain.cer")
|
|
|
121 local local_ca_file = dir.child("ca.cer")
|
|
|
122 local top_dir = uri("file:.").canonical().to_string()
|
|
|
123 local changed = false
|
|
|
124 if is_https then -- https
|
|
|
125 if not key_file.exists() then
|
|
|
126 local is_local = ip(domain) == "127.0.0.1"
|
|
|
127 logger.info("is_local "..is_local)
|
|
|
128 if is_local then
|
|
|
129 key_file.write(local_key)
|
|
|
130 local_cer_file.write(local_cer)
|
|
|
131 else
|
|
|
132 local cmd = [[
|
|
|
133 ./acme.sh --debug --issue -d "]]..domain..[[" --stateless --cert-home "]]..top_dir..[[/sites" --config-home "]]..top_dir..[[/local/letsencrypt/config";
|
|
|
134 ]]
|
|
|
135 local s = uri("bash:"..cmd).read_text()
|
|
|
136 logger.info("issue certificate "..s)
|
|
|
137 end
|
|
|
138 if key_file.exists() and local_cer_file.exists() then
|
|
|
139 changed = true
|
|
|
140 local conf = load_file "file:startup/nginx.ssl.conf.luan"
|
|
|
141 local nginx = output_of( function() conf(top_dir,domain) end )
|
|
|
142 nginx_file.write(nginx)
|
|
|
143 end
|
|
|
144 end
|
|
|
145 else -- http
|
|
|
146 if key_file.exists() or nginx_file.exists() then
|
|
|
147 changed = true
|
|
|
148 nginx_file.delete()
|
|
|
149 local_cer_file.delete()
|
|
|
150 local_ca_file.delete()
|
|
|
151 local ptn = [[^]]..regex_quote(domain)..[[\.]]
|
|
|
152 for _, file in ipairs(dir.children()) do
|
|
|
153 if matches(file.name(),ptn) then
|
|
|
154 file.delete()
|
|
|
155 end
|
|
|
156 end
|
|
|
157 end
|
|
|
158 end
|
|
|
159 if changed then
|
|
|
160 local cmd = [[
|
|
|
161 sudo $(which nginx) -t -c "]]..top_dir..[[/local/nginx.conf" && sudo $(which nginx) -s reload;
|
|
|
162 ]]
|
|
|
163 local s = uri("bash:"..cmd).read_text()
|
|
|
164 logger.info("reload_nginx "..s)
|
|
|
165 end
|
|
|
166 --logger.info "done"
|
|
|
167 end
|
|
|
168 Hosted.set_https = Boot.no_security(Hosted.set_https)
|
