77 lines
2.6 KiB
Python
77 lines
2.6 KiB
Python
import paramiko
|
|
import sys
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
|
|
key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)
|
|
|
|
sync_script = """#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
LOG_FILE="/var/log/sync-rancher-tls.log"
|
|
REMOTE_HOST="140.44.4.71"
|
|
NPM_CERT_DIR="/data/glusterfs/swarm/brick/legacy_volumes/nginx/letsencrypt/live/npm-8"
|
|
TMP_DIR="/tmp/rancher-tls-sync.$$"
|
|
|
|
mkdir -p "$TMP_DIR"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
echo "[$(date -Is)] Checking Let's Encrypt certificate from $REMOTE_HOST..." >> "$LOG_FILE"
|
|
|
|
# Fetch cert and key from NPM
|
|
scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/fullchain.pem" "$TMP_DIR/fullchain.pem" >> "$LOG_FILE" 2>&1
|
|
scp -o BatchMode=yes -o StrictHostKeyChecking=no "root@${REMOTE_HOST}:${NPM_CERT_DIR}/privkey.pem" "$TMP_DIR/privkey.pem" >> "$LOG_FILE" 2>&1
|
|
|
|
if [ ! -s "$TMP_DIR/fullchain.pem" ] || [ ! -s "$TMP_DIR/privkey.pem" ]; then
|
|
echo "[$(date -Is)] ERROR: Failed to retrieve certificate or key from $REMOTE_HOST" >> "$LOG_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# Compare fingerprints
|
|
NEW_FP=$(openssl x509 -in "$TMP_DIR/fullchain.pem" -noout -fingerprint -sha256 2>/dev/null || echo "new_err")
|
|
CURR_FP=$(k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' 2>/dev/null | base64 -d | openssl x509 -noout -fingerprint -sha256 2>/dev/null || echo "curr_err")
|
|
|
|
if [ "$NEW_FP" = "$CURR_FP" ]; then
|
|
echo "[$(date -Is)] Certificate is unchanged. ($NEW_FP)" >> "$LOG_FILE"
|
|
exit 0
|
|
fi
|
|
|
|
echo "[$(date -Is)] Certificate update detected! Applying to secret tls-rancher-ingress..." >> "$LOG_FILE"
|
|
k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
|
|
--cert="$TMP_DIR/fullchain.pem" \
|
|
--key="$TMP_DIR/privkey.pem" \
|
|
--dry-run=client -o yaml | k3s kubectl apply -f - >> "$LOG_FILE" 2>&1
|
|
|
|
echo "[$(date -Is)] Successfully updated tls-rancher-ingress. New fingerprint: $NEW_FP" >> "$LOG_FILE"
|
|
"""
|
|
|
|
cmd = f"""
|
|
cat << 'EOF' > /usr/local/bin/sync-rancher-tls.sh
|
|
{sync_script}
|
|
EOF
|
|
chmod +x /usr/local/bin/sync-rancher-tls.sh
|
|
|
|
# Run once to test
|
|
/usr/local/bin/sync-rancher-tls.sh
|
|
cat /var/log/sync-rancher-tls.log | tail -n 5
|
|
|
|
# Create daily cron
|
|
cat << 'EOF' > /etc/cron.daily/sync-rancher-tls
|
|
#!/bin/bash
|
|
/usr/local/bin/sync-rancher-tls.sh >/dev/null 2>&1
|
|
EOF
|
|
chmod +x /etc/cron.daily/sync-rancher-tls
|
|
"""
|
|
|
|
stdin, stdout, stderr = c.exec_command(cmd)
|
|
print("=== SETUP OUTPUT ===")
|
|
print(stdout.read().decode('utf-8'))
|
|
err = stderr.read().decode('utf-8')
|
|
if err: print("=== ERRORS ===", err)
|
|
|
|
c.close()
|
|
|