141 lines
4.4 KiB
Python
141 lines
4.4 KiB
Python
import paramiko
|
|
import sys
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
|
|
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
|
|
|
print("1. Creating backup of database and configs...")
|
|
backup_cmd = """
|
|
cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak.$(date +%s)
|
|
"""
|
|
stdin, stdout, stderr = c.exec_command(backup_cmd)
|
|
stdout.channel.recv_exit_status()
|
|
print("Backup complete.")
|
|
|
|
print("2. Updating database.sqlite for hosts 45, 41, and 37...")
|
|
py_db = """
|
|
import sqlite3, datetime
|
|
conn = sqlite3.connect("/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")
|
|
cur = conn.cursor()
|
|
now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
|
|
|
|
updates = [
|
|
(45, "140.44.4.34", 443, "https"), # Longhorn -> Aerodrome Traefik
|
|
(41, "140.44.4.62", 443, "https"), # Semaphore -> Spaceport Traefik
|
|
(37, "140.44.4.34", 443, "https"), # Uptime Kuma -> Aerodrome Traefik
|
|
]
|
|
|
|
for pid, host, port, scheme in updates:
|
|
cur.execute('''UPDATE proxy_host
|
|
SET forward_host = ?, forward_port = ?, forward_scheme = ?,
|
|
allow_websocket_upgrade = 1, http2_support = 1, modified_on = ?
|
|
WHERE id = ?''', (host, port, scheme, now, pid))
|
|
print(f"DB updated: Host {pid} -> {scheme}://{host}:{port}")
|
|
|
|
conn.commit()
|
|
conn.close()
|
|
"""
|
|
stdin, stdout, stderr = c.exec_command(f"python3 -c '{py_db}'")
|
|
print(stdout.read().decode())
|
|
err = stderr.read().decode()
|
|
if err: print("DB err:", err)
|
|
|
|
print("3. Generating updated nginx configuration files...")
|
|
|
|
def generate_conf(pid, domains, cert_id, host, port, scheme):
|
|
return f"""# ------------------------------------------------------------
|
|
# {domains}
|
|
# ------------------------------------------------------------
|
|
|
|
map $scheme $hsts_header {{
|
|
https "max-age=63072000; preload";
|
|
}}
|
|
|
|
server {{
|
|
set $forward_scheme {scheme};
|
|
set $server "{host}";
|
|
set $port {port};
|
|
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
|
|
server_name {domains};
|
|
http2 on;
|
|
|
|
# Let's Encrypt SSL
|
|
include conf.d/include/letsencrypt-acme-challenge.conf;
|
|
include conf.d/include/ssl-cache.conf;
|
|
include conf.d/include/ssl-ciphers.conf;
|
|
ssl_certificate /etc/letsencrypt/live/npm-{cert_id}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/npm-{cert_id}/privkey.pem;
|
|
|
|
# Asset Caching
|
|
include conf.d/include/assets.conf;
|
|
|
|
# Block Exploits
|
|
include conf.d/include/block-exploits.conf;
|
|
|
|
# Force SSL
|
|
set $trust_forwarded_proto "F";
|
|
include conf.d/include/force-ssl.conf;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
access_log /data/logs/proxy-host-{pid}_access.log proxy;
|
|
error_log /data/logs/proxy-host-{pid}_error.log warn;
|
|
|
|
location / {{
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
# Proxy!
|
|
include conf.d/include/proxy.conf;
|
|
}}
|
|
|
|
# Custom
|
|
include /data/nginx/custom/server_proxy[.]conf;
|
|
}}
|
|
"""
|
|
|
|
configs = [
|
|
(45, "longhorn.aerodrome.snarfnet.net", 37, "140.44.4.34", 443, "https"),
|
|
(41, "semaphore.snarfnet.net", 33, "140.44.4.62", 443, "https"),
|
|
(37, "uptime.snarfnet.net", 27, "140.44.4.34", 443, "https"),
|
|
]
|
|
|
|
for pid, dom, cert_id, host, port, scheme in configs:
|
|
cfg = generate_conf(pid, dom, cert_id, host, port, scheme)
|
|
path = f"/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/{pid}.conf"
|
|
cmd = f"cat << 'EOF' > {path}\n{cfg}\nEOF\n"
|
|
stdin, stdout, stderr = c.exec_command(cmd)
|
|
stdout.channel.recv_exit_status()
|
|
print(f"Wrote config: {path}")
|
|
|
|
print("4. Testing Nginx config inside container...")
|
|
stdin, stdout, stderr = c.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t")
|
|
out = stdout.read().decode()
|
|
err = stderr.read().decode()
|
|
print("nginx -t stdout:", out)
|
|
print("nginx -t stderr:", err)
|
|
|
|
if "successful" in out or "successful" in err:
|
|
print("5. Reloading Nginx via Swarm service update...")
|
|
stdin, stdout, stderr = c.exec_command("docker service update --force nginx-proxy-manager_app")
|
|
print(stdout.read().decode())
|
|
print("Reload completed.")
|
|
else:
|
|
print("ERROR: Nginx config test failed!")
|
|
|
|
c.close()
|
|
|