From e0ebc120eee3945ee4dddb7d0ccfb7a9da2f7f44 Mon Sep 17 00:00:00 2001 From: Snarf Date: Sat, 7 Nov 2026 15:19:19 -0500 Subject: [PATCH] Configure VaultConfigurator direct proxy in NPM and update topology docs --- scripts/check_33_conf.py | 12 +++++ scripts/check_49_conf.py | 11 ++++ scripts/check_cert1_hosts.py | 12 +++++ scripts/check_npm_live_certs.py | 17 ++---- scripts/check_npm_next_id.py | 12 +++++ scripts/insert_vault_db.py | 1 + scripts/inspect_npm_certs.py | 16 ++++++ scripts/inspect_npm_proxy_host.py | 16 ++++++ scripts/inspect_proxy_provider_13.py | 18 +++++++ scripts/inspect_proxy_provider_24.py | 18 +++++++ scripts/run_insert_vault.py | 1 + scripts/update_vault_direct_proxy.py | 81 ++++++++++++++++++++++++++++ 12 files changed, 202 insertions(+), 13 deletions(-) create mode 100644 scripts/check_33_conf.py create mode 100644 scripts/check_49_conf.py create mode 100644 scripts/check_cert1_hosts.py create mode 100644 scripts/check_npm_next_id.py create mode 100644 scripts/inspect_npm_certs.py create mode 100644 scripts/inspect_npm_proxy_host.py create mode 100644 scripts/inspect_proxy_provider_13.py create mode 100644 scripts/inspect_proxy_provider_24.py create mode 100644 scripts/update_vault_direct_proxy.py diff --git a/scripts/check_33_conf.py b/scripts/check_33_conf.py new file mode 100644 index 0000000..2324289 --- /dev/null +++ b/scripts/check_33_conf.py @@ -0,0 +1,12 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'cat /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/33.conf' +stdin, stdout, stderr = client.exec_command(cmd) +print("33.conf:\n", stdout.read().decode()) + +client.close() + diff --git a/scripts/check_49_conf.py b/scripts/check_49_conf.py new file mode 100644 index 0000000..873f1e4 --- /dev/null +++ b/scripts/check_49_conf.py @@ -0,0 +1,11 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'cat /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/49.conf' +stdin, stdout, stderr = client.exec_command(cmd) +print("49.conf (ai.snarfnet.net):\n", stdout.read().decode()) + +client.close() diff --git a/scripts/check_cert1_hosts.py b/scripts/check_cert1_hosts.py new file mode 100644 index 0000000..bd36cf4 --- /dev/null +++ b/scripts/check_cert1_hosts.py @@ -0,0 +1,12 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'python3 -c "import sqlite3; conn=sqlite3.connect(\'/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite\'); print(conn.execute(\'SELECT id, domain_names, forward_port FROM proxy_host WHERE certificate_id=1;\').fetchall())"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Hosts using cert 1:", stdout.read().decode().strip()) + +client.close() + diff --git a/scripts/check_npm_live_certs.py b/scripts/check_npm_live_certs.py index e063765..9e531e0 100644 --- a/scripts/check_npm_live_certs.py +++ b/scripts/check_npm_live_certs.py @@ -1,20 +1,11 @@ import paramiko -import sys -sys.stdout.reconfigure(encoding='utf-8') - -key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet" client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) -client.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) -cmd = """ -for cert in /data/glusterfs/swarm/brick/legacy_volumes/nginx/letsencrypt/live/npm-*/cert.pem; do - echo "=== $cert ===" - openssl x509 -in "$cert" -noout -subject -dates -ext subjectAltName 2>/dev/null -done -""" +cmd = 'ls /var/lib/docker/volumes/nginx-proxy-manager_nginx-letsencrypt/_data/live/' stdin, stdout, stderr = client.exec_command(cmd) -print(stdout.read().decode('utf-8')) -client.close() +print("Live certs:", stdout.read().decode().strip()) +client.close() diff --git a/scripts/check_npm_next_id.py b/scripts/check_npm_next_id.py new file mode 100644 index 0000000..43a0a9f --- /dev/null +++ b/scripts/check_npm_next_id.py @@ -0,0 +1,12 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'python3 -c "import sqlite3; conn=sqlite3.connect(\'/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite\'); print(conn.execute(\'SELECT MAX(id) FROM proxy_host;\').fetchone())"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Max ID:", stdout.read().decode().strip()) + +client.close() + diff --git a/scripts/insert_vault_db.py b/scripts/insert_vault_db.py index 526b967..10a1fca 100644 --- a/scripts/insert_vault_db.py +++ b/scripts/insert_vault_db.py @@ -77,3 +77,4 @@ INSERT INTO proxy_host ( conn.commit() print("Successfully inserted proxy_host 56") conn.close() + diff --git a/scripts/inspect_npm_certs.py b/scripts/inspect_npm_certs.py new file mode 100644 index 0000000..c0d51c5 --- /dev/null +++ b/scripts/inspect_npm_certs.py @@ -0,0 +1,16 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'python3 -c "import sqlite3; conn=sqlite3.connect(\'/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite\'); print(conn.execute(\'SELECT id, nice_name, domain_names FROM certificate;\').fetchall())"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Certificates:\n", stdout.read().decode()) + +cmd = 'cat /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/22.conf' +stdin, stdout, stderr = client.exec_command(cmd) +print("Peanut config (id 22):\n", stdout.read().decode()) + +client.close() + diff --git a/scripts/inspect_npm_proxy_host.py b/scripts/inspect_npm_proxy_host.py new file mode 100644 index 0000000..d1bf02e --- /dev/null +++ b/scripts/inspect_npm_proxy_host.py @@ -0,0 +1,16 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +cmd = 'python3 -c "import sqlite3; conn=sqlite3.connect(\'/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite\'); print(conn.execute(\'SELECT * FROM proxy_host WHERE id=33;\').fetchone())"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Homebox proxy host row:\n", stdout.read().decode()) + +cmd = 'python3 -c "import sqlite3; conn=sqlite3.connect(\'/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite\'); print([col[1] for col in conn.execute(\'PRAGMA table_info(proxy_host);\').fetchall()])"' +stdin, stdout, stderr = client.exec_command(cmd) +print("Columns:\n", stdout.read().decode()) + +client.close() + diff --git a/scripts/inspect_proxy_provider_13.py b/scripts/inspect_proxy_provider_13.py new file mode 100644 index 0000000..0d60e5d --- /dev/null +++ b/scripts/inspect_proxy_provider_13.py @@ -0,0 +1,18 @@ +import urllib.request +import ssl +import json + +ctx = ssl.create_default_context() +ctx.check_hostname = False +ctx.verify_mode = ssl.CERT_NONE + +token = "SnarfNetPermanentAutomationToken2026" +headers = { + "Authorization": f"Bearer {token}", + "Content-Type": "application/json" +} + +req = urllib.request.Request("https://authentik.snarfnet.net/api/v3/providers/proxy/13/", headers=headers) +with urllib.request.urlopen(req, context=ctx) as resp: + p = json.loads(resp.read().decode()) + print(json.dumps(p, indent=2)) diff --git a/scripts/inspect_proxy_provider_24.py b/scripts/inspect_proxy_provider_24.py new file mode 100644 index 0000000..a8653d4 --- /dev/null +++ b/scripts/inspect_proxy_provider_24.py @@ -0,0 +1,18 @@ +import urllib.request +import ssl +import json + +ctx = ssl.create_default_context() +ctx.check_hostname = False +ctx.verify_mode = ssl.CERT_NONE + +token = "SnarfNetPermanentAutomationToken2026" +headers = { + "Authorization": f"Bearer {token}", + "Content-Type": "application/json" +} + +req = urllib.request.Request("https://authentik.snarfnet.net/api/v3/providers/proxy/24/", headers=headers) +with urllib.request.urlopen(req, context=ctx) as resp: + p = json.loads(resp.read().decode()) + print(json.dumps(p, indent=2)) diff --git a/scripts/run_insert_vault.py b/scripts/run_insert_vault.py index b720ac7..1ed3f29 100644 --- a/scripts/run_insert_vault.py +++ b/scripts/run_insert_vault.py @@ -17,3 +17,4 @@ stdin, stdout, stderr = client.exec_command(cmd) print("Reload output:", stdout.read().decode().strip()) client.close() + diff --git a/scripts/update_vault_direct_proxy.py b/scripts/update_vault_direct_proxy.py new file mode 100644 index 0000000..6fa886f --- /dev/null +++ b/scripts/update_vault_direct_proxy.py @@ -0,0 +1,81 @@ +import paramiko + +client = paramiko.SSHClient() +client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) +client.connect("140.44.4.71", username="root", key_filename=r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet", timeout=10) + +nginx_conf = """# ------------------------------------------------------------ +# vault.snarfnet.net +# ------------------------------------------------------------ + +map $scheme $hsts_header { + https "max-age=63072000;includeSubDomains; preload"; +} + +server { + set $forward_scheme http; + set $server "140.44.4.70"; + set $port 8085; + + listen 80; + listen [::]:80; + + listen 443 ssl; + listen [::]:443 ssl; + + server_name vault.snarfnet.net; + http2 off; + + # Let's Encrypt SSL + include conf.d/include/letsencrypt-acme-challenge.conf; + include conf.d/include/ssl-cache.conf; + include conf.d/include/ssl-ciphers.conf; + ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem; + + # Asset Caching + include conf.d/include/assets.conf; + + # Block Exploits + include conf.d/include/block-exploits.conf; + + # HSTS + add_header Strict-Transport-Security $hsts_header always; + + # Force SSL + set $trust_forwarded_proto "T"; + include conf.d/include/force-ssl.conf; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + proxy_http_version 1.1; + + access_log /data/logs/proxy-host-56_access.log proxy; + error_log /data/logs/proxy-host-56_error.log warn; + + location / { + add_header Strict-Transport-Security $hsts_header always; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + proxy_http_version 1.1; + + # Proxy! + include conf.d/include/proxy.conf; + } + + # Custom + include /data/nginx/custom/server_proxy[.]conf; +} +""" + +cmd = f"cat << 'EOF' > /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/56.conf\n{nginx_conf}\nEOF" +stdin, stdout, stderr = client.exec_command(cmd) + +cmd = "python3 -c \"import sqlite3; conn=sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite'); conn.execute('UPDATE proxy_host SET advanced_config=\"\" WHERE id=56;'); conn.commit();\"" +stdin, stdout, stderr = client.exec_command(cmd) + +cmd = "for id in $(docker ps -q -f name=nginx-proxy-manager_app); do docker exec $id nginx -s reload; done" +stdin, stdout, stderr = client.exec_command(cmd) + +print("Updated 56.conf to direct proxy and reloaded") +client.close()