162 lines
4.8 KiB
Python
162 lines
4.8 KiB
Python
import paramiko
|
|
import sys
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
|
|
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
|
|
|
print("1. Updating SQLite database for hosts 11 and 28...")
|
|
dsm_adv = """proxy_buffer_size 128k;
|
|
proxy_buffers 8 256k;
|
|
proxy_busy_buffers_size 256k;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_ssl_verify off;"""
|
|
|
|
py_db = f"""
|
|
import sqlite3, datetime
|
|
conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
|
|
cur = conn.cursor()
|
|
now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
|
|
|
|
adv = '''{dsm_adv}'''
|
|
|
|
# Host 11: sn-nas.snarfnet.net -> 14.10.10.71:5001
|
|
cur.execute('''UPDATE proxy_host
|
|
SET forward_host = "14.10.10.71", forward_port = 5001, forward_scheme = "https",
|
|
allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
|
|
WHERE id = 11''', (adv, now))
|
|
|
|
# Host 28: snarfnas.snarfnet.net -> 14.10.10.72:5001 (Clean DSM, remove dead outpost)
|
|
cur.execute('''UPDATE proxy_host
|
|
SET forward_host = "14.10.10.72", forward_port = 5001, forward_scheme = "https",
|
|
allow_websocket_upgrade = 1, http2_support = 1, advanced_config = ?, modified_on = ?
|
|
WHERE id = 28''', (adv, now))
|
|
|
|
conn.commit()
|
|
print("Database updated for hosts 11 and 28.")
|
|
conn.close()
|
|
"""
|
|
|
|
sftp = c.open_sftp()
|
|
with sftp.open('/tmp/update_nas_db.py', 'w') as f:
|
|
f.write(py_db)
|
|
sftp.close()
|
|
|
|
stdin, stdout, stderr = c.exec_command("python3 /tmp/update_nas_db.py")
|
|
print(stdout.read().decode())
|
|
err = stderr.read().decode()
|
|
if err: print("DB err:", err)
|
|
|
|
print("2. Generating Nginx configuration files for hosts 11 and 28...")
|
|
|
|
def make_dsm_conf(pid, domain, cert_id, host, port):
|
|
return f"""# ------------------------------------------------------------
|
|
# {domain}
|
|
# ------------------------------------------------------------
|
|
|
|
map $scheme $hsts_header {{
|
|
https "max-age=63072000;includeSubDomains; preload";
|
|
}}
|
|
|
|
server {{
|
|
set $forward_scheme https;
|
|
set $server "{host}";
|
|
set $port {port};
|
|
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
|
|
server_name {domain};
|
|
http2 on;
|
|
|
|
# Let's Encrypt SSL
|
|
include conf.d/include/letsencrypt-acme-challenge.conf;
|
|
include conf.d/include/ssl-cache.conf;
|
|
include conf.d/include/ssl-ciphers.conf;
|
|
ssl_certificate /etc/letsencrypt/live/npm-{cert_id}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/npm-{cert_id}/privkey.pem;
|
|
|
|
# Asset Caching
|
|
include conf.d/include/assets.conf;
|
|
|
|
# Block Exploits
|
|
include conf.d/include/block-exploits.conf;
|
|
|
|
# HSTS
|
|
add_header Strict-Transport-Security $hsts_header always;
|
|
|
|
# Force SSL
|
|
set $trust_forwarded_proto "F";
|
|
include conf.d/include/force-ssl.conf;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
access_log /data/logs/proxy-host-{pid}_access.log proxy;
|
|
error_log /data/logs/proxy-host-{pid}_error.log warn;
|
|
|
|
location / {{
|
|
# HSTS
|
|
add_header Strict-Transport-Security $hsts_header always;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
# DSM Buffer Tuning
|
|
proxy_buffer_size 128k;
|
|
proxy_buffers 8 256k;
|
|
proxy_busy_buffers_size 256k;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_ssl_verify off;
|
|
|
|
# Proxy!
|
|
include conf.d/include/proxy.conf;
|
|
}}
|
|
|
|
# Custom
|
|
include /data/nginx/custom/server_proxy[.]conf;
|
|
}}
|
|
"""
|
|
|
|
conf11 = make_dsm_conf(11, "sn-nas.snarfnet.net", 12, "14.10.10.71", 5001)
|
|
conf28 = make_dsm_conf(28, "snarfnas.snarfnet.net", 22, "14.10.10.72", 5001)
|
|
|
|
path11 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/11.conf"
|
|
path28 = "/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/28.conf"
|
|
|
|
stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path11}\n{conf11}\nEOF\n")
|
|
stdout.channel.recv_exit_status()
|
|
print(f"Wrote {path11}")
|
|
|
|
stdin, stdout, stderr = c.exec_command(f"cat << 'EOF' > {path28}\n{conf28}\nEOF\n")
|
|
stdout.channel.recv_exit_status()
|
|
print(f"Wrote {path28}")
|
|
|
|
print("3. Testing Nginx configuration...")
|
|
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t")
|
|
out = stdout.read().decode()
|
|
err = stderr.read().decode()
|
|
print("nginx -t stdout:", out)
|
|
print("nginx -t stderr:", err)
|
|
|
|
if "successful" in out or "successful" in err:
|
|
print("4. Reloading Nginx Swarm service...")
|
|
stdin, stdout, stderr = c.exec_command("docker service update --force nginx-proxy-manager_app")
|
|
print(stdout.read().decode())
|
|
print("Reload complete!")
|
|
else:
|
|
print("ERROR: Nginx config invalid!")
|
|
|
|
c.close()
|
|
|