feat: add automation scripts for NAS fixes, Authentik monitoring, and Technitium DNS management
This commit is contained in:
161
scripts/apply_synology_fixes.py
Normal file
161
scripts/apply_synology_fixes.py
Normal file
@@ -0,0 +1,161 @@
|
||||
import paramiko
|
||||
import sys
|
||||
|
||||
sys.stdout.reconfigure(encoding='utf-8')
|
||||
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
|
||||
|
||||
c = paramiko.SSHClient()
|
||||
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||||
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
||||
|
||||
print("1. Updating SQLite database for hosts 11 and 28...")
|
||||
dsm_adv = """proxy_buffer_size 128k;
|
||||
proxy_buffers 8 256k;
|
||||
proxy_busy_buffers_size 256k;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
proxy_ssl_verify off;"""
|
||||
|
||||
py_db = f"""
|
||||
import sqlite3, datetime
|
||||
conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
|
||||
cur = conn.cursor()
|
||||
now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
|
||||
|
||||
adv = '''{dsm_adv}'''
|
||||
|
||||
# Host 11: sn-nas.snarfnet.net -> 14.10.10.71:5001
|
||||
cur.execute('''UPDATE proxy_host
|
||||
SET forward_host = "14.10.10.71", forward_port = 5001, forward_scheme = "https",
|
||||
allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
|
||||
WHERE id = 11''', (adv, now))
|
||||
|
||||
# Host 28: snarfnas.snarfnet.net -> 14.10.10.72:5001 (Clean DSM, remove dead outpost)
|
||||
cur.execute('''UPDATE proxy_host
|
||||
SET forward_host = "14.10.10.72", forward_port = 5001, forward_scheme = "https",
|
||||
allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
|
||||
WHERE id = 28''', (adv, now))
|
||||
|
||||
conn.commit()
|
||||
print("Database updated for hosts 11 and 28.")
|
||||
conn.close()
|
||||
"""
|
||||
|
||||
sftp = c.open_sftp()
|
||||
with sftp.open('/tmp/update_nas_db.py', 'w') as f:
|
||||
f.write(py_db)
|
||||
sftp.close()
|
||||
|
||||
stdin, stdout, stderr = c.exec_command("python3 /tmp/update_nas_db.py")
|
||||
print(stdout.read().decode())
|
||||
err = stderr.read().decode()
|
||||
if err: print("DB err:", err)
|
||||
|
||||
print("2. Generating Nginx configuration files for hosts 11 and 28...")
|
||||
|
||||
def make_dsm_conf(pid, domain, cert_id, host, port):
|
||||
return f"""# ------------------------------------------------------------
|
||||
# {domain}
|
||||
# ------------------------------------------------------------
|
||||
|
||||
map $scheme $hsts_header {{
|
||||
https "max-age=63072000;includeSubDomains; preload";
|
||||
}}
|
||||
|
||||
server {{
|
||||
set $forward_scheme https;
|
||||
set $server "{host}";
|
||||
set $port {port};
|
||||
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
server_name {domain};
|
||||
http2 on;
|
||||
|
||||
# Let's Encrypt SSL
|
||||
include conf.d/include/letsencrypt-acme-challenge.conf;
|
||||
include conf.d/include/ssl-cache.conf;
|
||||
include conf.d/include/ssl-ciphers.conf;
|
||||
ssl_certificate /etc/letsencrypt/live/npm-{cert_id}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/npm-{cert_id}/privkey.pem;
|
||||
|
||||
# Asset Caching
|
||||
include conf.d/include/assets.conf;
|
||||
|
||||
# Block Exploits
|
||||
include conf.d/include/block-exploits.conf;
|
||||
|
||||
# HSTS
|
||||
add_header Strict-Transport-Security $hsts_header always;
|
||||
|
||||
# Force SSL
|
||||
set $trust_forwarded_proto "F";
|
||||
include conf.d/include/force-ssl.conf;
|
||||
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
access_log /data/logs/proxy-host-{pid}_access.log proxy;
|
||||
error_log /data/logs/proxy-host-{pid}_error.log warn;
|
||||
|
||||
location / {{
|
||||
# HSTS
|
||||
add_header Strict-Transport-Security $hsts_header always;
|
||||
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# DSM Buffer Tuning
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 8 256k;
|
||||
proxy_busy_buffers_size 256k;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
proxy_ssl_verify off;
|
||||
|
||||
# Proxy!
|
||||
include conf.d/include/proxy.conf;
|
||||
}}
|
||||
|
||||
# Custom
|
||||
include /data/nginx/custom/server_proxy[.]conf;
|
||||
}}
|
||||
"""
|
||||
|
||||
conf11 = make_dsm_conf(11, "sn-nas.snarfnet.net", 12, "14.10.10.71", 5001)
|
||||
conf28 = make_dsm_conf(28, "snarfnas.snarfnet.net", 22, "14.10.10.72", 5001)
|
||||
|
||||
path11 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/11.conf"
|
||||
path28 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/28.conf"
|
||||
|
||||
stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path11}\n{conf11}\nEOF\n")
|
||||
stdout.channel.recv_exit_status()
|
||||
print(f"Wrote {path11}")
|
||||
|
||||
stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path28}\n{conf28}\nEOF\n")
|
||||
stdout.channel.recv_exit_status()
|
||||
print(f"Wrote {path28}")
|
||||
|
||||
print("3. Testing Nginx configuration...")
|
||||
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t")
|
||||
out = stdout.read().decode()
|
||||
err = stderr.read().decode()
|
||||
print("nginx -t stdout:", out)
|
||||
print("nginx -t stderr:", err)
|
||||
|
||||
if "successful" in out or "successful" in err:
|
||||
print("4. Reloading Nginx Swarm service...")
|
||||
stdin, stdout, stderr = c.exec_command("docker service update --force nginx-proxy-manager_app")
|
||||
print(stdout.read().decode())
|
||||
print("Reload complete!")
|
||||
else:
|
||||
print("ERROR: Nginx config invalid!")
|
||||
|
||||
c.close()
|
||||
|
||||
Reference in New Issue
Block a user