feat: add administrative and deployment scripts for infrastructure management

scripts/setup_tls_sync.py

@@ -0,0 +1,76 @@
+import paramiko
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+
+key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)
+
+sync_script = """#!/bin/bash
+set -euo pipefail
+
+LOG_FILE="/var/log/sync-rancher-tls.log"
+REMOTE_HOST="140.44.4.71"
+NPM_CERT_DIR="/data/glusterfs/swarm/brick/legacy_volumes/nginx/letsencrypt/live/npm-8"
+TMP_DIR="/tmp/rancher-tls-sync.$$"
+
+mkdir -p "$TMP_DIR"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+echo "[$(date -Is)] Checking Let's Encrypt certificate from $REMOTE_HOST..." >> "$LOG_FILE"
+
+# Fetch cert and key from NPM
+scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/fullchain.pem" "$TMP_DIR/fullchain.pem" >> "$LOG_FILE" 2>&1
+scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/privkey.pem" "$TMP_DIR/privkey.pem" >> "$LOG_FILE" 2>&1
+
+if [ ! -s "$TMP_DIR/fullchain.pem" ] || [ ! -s "$TMP_DIR/privkey.pem" ]; then
+    echo "[$(date -Is)] ERROR: Failed to retrieve certificate or key from $REMOTE_HOST" >> "$LOG_FILE"
+    exit 1
+fi
+
+# Compare fingerprints
+NEW_FP=$(openssl x509 -in "$TMP_DIR/fullchain.pem" -noout -fingerprint -sha256 2>/dev/null || echo "new_err")
+CURR_FP=$(k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' 2>/dev/null | base64 -d | openssl x509 -noout -fingerprint -sha256 2>/dev/null || echo "curr_err")
+
+if [ "$NEW_FP" = "$CURR_FP" ]; then
+    echo "[$(date -Is)] Certificate is unchanged. ($NEW_FP)" >> "$LOG_FILE"
+    exit 0
+fi
+
+echo "[$(date -Is)] Certificate update detected! Applying to secret tls-rancher-ingress..." >> "$LOG_FILE"
+k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
+  --cert="$TMP_DIR/fullchain.pem" \
+  --key="$TMP_DIR/privkey.pem" \
+  --dry-run=client -o yaml | k3s kubectl apply -f - >> "$LOG_FILE" 2>&1
+
+echo "[$(date -Is)] Successfully updated tls-rancher-ingress. New fingerprint: $NEW_FP" >> "$LOG_FILE"
+"""
+
+cmd = f"""
+cat << 'EOF' > /usr/local/bin/sync-rancher-tls.sh
+{sync_script}
+EOF
+chmod +x /usr/local/bin/sync-rancher-tls.sh
+
+# Run once to test
+/usr/local/bin/sync-rancher-tls.sh
+cat /var/log/sync-rancher-tls.log | tail -n 5
+
+# Create daily cron
+cat << 'EOF' > /etc/cron.daily/sync-rancher-tls
+#!/bin/bash
+/usr/local/bin/sync-rancher-tls.sh >/dev/null 2>&1
+EOF
+chmod +x /etc/cron.daily/sync-rancher-tls
+"""
+
+stdin, stdout, stderr = c.exec_command(cmd)
+print("=== SETUP OUTPUT ===")
+print(stdout.read().decode('utf-8'))
+err = stderr.read().decode('utf-8')
+if err: print("=== ERRORS ===", err)
+
+c.close()
+