150 lines
4.9 KiB
Python
150 lines
4.9 KiB
Python
import paramiko
|
|
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.71", username="root", key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)
|
|
|
|
adv_config = """# Buffer tuning for Authentik headers
|
|
proxy_buffers 8 16k;
|
|
proxy_buffer_size 32k;
|
|
|
|
# Outpost verification route - plain HTTP to internal VIP
|
|
location /outpost.goauthentik.io {
|
|
auth_request off;
|
|
proxy_pass http://140.44.4.29:9000/outpost.goauthentik.io;
|
|
proxy_set_header Host authentik.snarfnet.net;
|
|
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
|
add_header Set-Cookie $auth_cookie;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
}
|
|
|
|
# Redirect to Authentik when unauthenticated
|
|
location @goauthentik_proxy_signin {
|
|
internal;
|
|
auth_request off;
|
|
add_header Set-Cookie $auth_cookie;
|
|
return 302 https://authentik.snarfnet.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
|
|
}
|
|
|
|
# Protected Topology HTML (Interactive)
|
|
location = /topology.html {
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
add_header Set-Cookie $auth_cookie;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires 0;
|
|
|
|
alias /data/topology/snarfnet_homelab_topology.html;
|
|
default_type text/html;
|
|
}
|
|
|
|
# Protected Topology PNG (High-Res Image)
|
|
location = /topology.png {
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
add_header Set-Cookie $auth_cookie;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires 0;
|
|
|
|
alias /data/topology/snarfnet_homelab_topology.png;
|
|
default_type image/png;
|
|
}
|
|
|
|
location = /snarfnet_homelab_topology.html {
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
add_header Set-Cookie $auth_cookie;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires 0;
|
|
|
|
alias /data/topology/snarfnet_homelab_topology.html;
|
|
default_type text/html;
|
|
}
|
|
|
|
location = /snarfnet_homelab_topology.png {
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
add_header Set-Cookie $auth_cookie;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires 0;
|
|
|
|
alias /data/topology/snarfnet_homelab_topology.png;
|
|
default_type image/png;
|
|
}
|
|
"""
|
|
|
|
stdin, stdout, stderr = c.exec_command("cat > /tmp/adv_config_h21.txt")
|
|
stdin.write(adv_config)
|
|
stdin.close()
|
|
stdout.read()
|
|
|
|
remote_script = """import sqlite3, shutil, os
|
|
|
|
db_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite'
|
|
conf_path = '/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/21.conf'
|
|
|
|
with open('/tmp/adv_config_h21.txt', 'r') as f:
|
|
adv = f.read()
|
|
|
|
# Update DB
|
|
conn = sqlite3.connect(db_path)
|
|
cur = conn.cursor()
|
|
cur.execute("UPDATE proxy_host SET advanced_config = ? WHERE id = 21", (adv,))
|
|
conn.commit()
|
|
conn.close()
|
|
print("Updated database for host 21.")
|
|
|
|
# Update 21.conf
|
|
with open(conf_path, 'r') as f:
|
|
conf = f.read()
|
|
|
|
# Strip existing adv_config block if present
|
|
tag = '# Buffer tuning for Authentik headers'
|
|
if tag in conf:
|
|
idx_start = conf.find(tag)
|
|
idx_end = conf.find('location / {', idx_start)
|
|
if idx_start != -1 and idx_end != -1:
|
|
new_conf = conf[:idx_start] + adv + "\\n\\n " + conf[idx_end:]
|
|
else:
|
|
new_conf = conf
|
|
else:
|
|
idx = conf.find('location / {')
|
|
if idx != -1:
|
|
new_conf = conf[:idx] + adv + "\\n\\n " + conf[idx:]
|
|
else:
|
|
new_conf = conf.rstrip().rstrip('}') + "\\n\\n" + adv + "\\n}\\n"
|
|
|
|
with open(conf_path, 'w') as f:
|
|
f.write(new_conf)
|
|
print("Updated 21.conf.")
|
|
"""
|
|
|
|
stdin, stdout, stderr = c.exec_command("cat > /tmp/apply_h21.py")
|
|
stdin.write(remote_script)
|
|
stdin.close()
|
|
stdout.read()
|
|
|
|
stdin, stdout, stderr = c.exec_command("python3 /tmp/apply_h21.py")
|
|
print("Remote python stdout:", stdout.read().decode())
|
|
print("Remote python stderr:", stderr.read().decode())
|
|
|
|
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -t")
|
|
out = stdout.read().decode()
|
|
err = stderr.read().decode()
|
|
print("nginx -t stdout:", out)
|
|
print("nginx -t stderr:", err)
|
|
|
|
if "successful" in out or "successful" in err:
|
|
print("Nginx syntax OK! Reloading nginx...")
|
|
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q --filter 'name=nginx-proxy-manager_app') nginx -s reload")
|
|
print("Reload stdout:", stdout.read().decode())
|
|
print("Reload stderr:", stderr.read().decode())
|
|
|
|
c.close()
|