SnarfCode/scripts/apply_h21_authentik.py

import paramiko

c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.71", username="root", key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

adv_config = """# Buffer tuning for Authentik headers
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# Outpost verification route - plain HTTP to internal VIP
location /outpost.goauthentik.io {
    auth_request off;
    proxy_pass              http://140.44.4.29:9000/outpost.goauthentik.io;
    proxy_set_header        Host authentik.snarfnet.net;
    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}

# Redirect to Authentik when unauthenticated
location @goauthentik_proxy_signin {
    internal;
    auth_request off;
    add_header Set-Cookie $auth_cookie;
    return 302 https://authentik.snarfnet.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

# Protected Topology HTML (Interactive)
location = /topology.html {
    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    alias /data/topology/snarfnet_homelab_topology.html;
    default_type text/html;
}

# Protected Topology PNG (High-Res Image)
location = /topology.png {
    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    alias /data/topology/snarfnet_homelab_topology.png;
    default_type image/png;
}

location = /snarfnet_homelab_topology.html {
    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    alias /data/topology/snarfnet_homelab_topology.html;
    default_type text/html;
}

location = /snarfnet_homelab_topology.png {
    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    alias /data/topology/snarfnet_homelab_topology.png;
    default_type image/png;
}
"""

# Upload adv_config to a file on remote
stdin, stdout, stderr = c.exec_command("cat > /tmp/adv_config_h21.txt")
stdin.write(adv_config)
stdin.close()
stdout.read()

remote_script = """import sqlite3, shutil, os

db_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite'
conf_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf'

with open('/tmp/adv_config_h21.txt', 'r') as f:
    adv = f.read()

# 1. Backup
shutil.copy(db_path, db_path + '.bak_authentik')
shutil.copy(conf_path, conf_path + '.bak_authentik')

# 2. Update DB
conn = sqlite3.connect(db_path)
cur = conn.cursor()
cur.execute("UPDATE proxy_host SET advanced_config = ? WHERE id = 21", (adv,))
conn.commit()
conn.close()
print("Updated database for host 21.")

# 3. Read conf, replace or insert adv
with open(conf_path, 'r') as f:
    conf = f.read()

if '# Buffer tuning for Authentik headers' not in conf:
    idx = conf.find('location / {')
    if idx != -1:
        new_conf = conf[:idx] + adv + "\\n\\n  " + conf[idx:]
    else:
        new_conf = conf.rstrip().rstrip('}') + "\\n\\n" + adv + "\\n}\\n"
    with open(conf_path, 'w') as f:
        f.write(new_conf)
    print("Updated 21.conf.")
else:
    print("21.conf already has Authentik configuration.")
"""

stdin, stdout, stderr = c.exec_command("cat > /tmp/apply_h21.py")
stdin.write(remote_script)
stdin.close()
stdout.read()

stdin, stdout, stderr = c.exec_command("python3 /tmp/apply_h21.py")
print("Remote python stdout:", stdout.read().decode())
print("Remote python stderr:", stderr.read().decode())

# Test nginx config inside container
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -t")
out = stdout.read().decode()
err = stderr.read().decode()
print("nginx -t stdout:", out)
print("nginx -t stderr:", err)

if "successful" in out or "successful" in err:
    print("Nginx syntax OK! Reloading nginx...")
    stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -s reload")
    print("Reload stdout:", stdout.read().decode())
    print("Reload stderr:", stderr.read().decode())
else:
    print("FAILED nginx -t test! Restoring backups...")
    c.exec_command("cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf.bak_authentik /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf")
    c.exec_command("cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak_authentik /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")

c.close()