209 lines
8.2 KiB
Python
209 lines
8.2 KiB
Python
import paramiko
|
|
import sys
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
|
|
key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
|
|
|
print("1. Creating safe backups of database and config files...")
|
|
backup_cmd = """
|
|
cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak.dns
|
|
cp -r /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host_bak_dns
|
|
"""
|
|
stdin, stdout, stderr = c.exec_command(backup_cmd)
|
|
stdout.channel.recv_exit_status()
|
|
print("Backups created successfully.")
|
|
|
|
print("2. Updating database.sqlite...")
|
|
py_script = """
|
|
import sqlite3, json, datetime
|
|
|
|
conn = sqlite3.connect("/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")
|
|
cur = conn.cursor()
|
|
now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
|
|
|
|
updates = [
|
|
(3, json.dumps(["pihole.snarfnet.net"]), "140.44.4.34", 443, "https"),
|
|
(43, json.dumps(["pihole2.snarfnet.net"]), "140.44.4.62", 443, "https"),
|
|
(51, json.dumps(["pihole3.snarfnet.net"]), "140.44.4.62", 443, "https"),
|
|
(52, json.dumps(["dns1.snarfnet.net"]), "140.44.4.34", 443, "https"),
|
|
(53, json.dumps(["dns2.snarfnet.net"]), "140.44.4.62", 443, "https"),
|
|
]
|
|
|
|
for pid, dnames, host, port, scheme in updates:
|
|
cur.execute('''UPDATE proxy_host
|
|
SET domain_names = ?, forward_host = ?, forward_port = ?, forward_scheme = ?,
|
|
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
|
|
hsts_enabled = 1, hsts_subdomains = 1, advanced_config = "", modified_on = ?
|
|
WHERE id = ?''', (dnames, host, port, scheme, now, pid))
|
|
print(f"Updated proxy host {pid} -> {host}:{port} ({scheme})")
|
|
|
|
cur.execute("SELECT id FROM proxy_host WHERE id = 54")
|
|
if not cur.fetchone():
|
|
cur.execute('''INSERT INTO proxy_host (
|
|
id, created_on, modified_on, owner_user_id, is_deleted,
|
|
domain_names, forward_host, forward_port, access_list_id,
|
|
certificate_id, ssl_forced, caching_enabled, block_exploits,
|
|
advanced_config, meta, allow_websocket_upgrade, http2_support,
|
|
forward_scheme, enabled, locations, hsts_enabled, hsts_subdomains,
|
|
trust_forwarded_proto
|
|
) VALUES (
|
|
54, ?, ?, 1, 0,
|
|
?, "140.44.4.34", 443, 0,
|
|
1, 1, 0, 1,
|
|
"", "{\\"nginx_online\\":true,\\"nginx_err\\":null}", 1, 1,
|
|
"https", 1, "[]", 1, 1,
|
|
0
|
|
)''', (now, now, json.dumps(["technitium.snarfnet.net"])))
|
|
print("Inserted proxy host 54: technitium.snarfnet.net -> 140.44.4.34:443")
|
|
else:
|
|
cur.execute('''UPDATE proxy_host
|
|
SET domain_names = ?, forward_host = "140.44.4.34", forward_port = 443, forward_scheme = "https",
|
|
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
|
|
hsts_enabled = 1, hsts_subdomains = 1, modified_on = ?
|
|
WHERE id = 54''', (json.dumps(["technitium.snarfnet.net"]), now))
|
|
print("Updated proxy host 54: technitium.snarfnet.net")
|
|
|
|
cur.execute("SELECT id FROM proxy_host WHERE id = 55")
|
|
if not cur.fetchone():
|
|
cur.execute('''INSERT INTO proxy_host (
|
|
id, created_on, modified_on, owner_user_id, is_deleted,
|
|
domain_names, forward_host, forward_port, access_list_id,
|
|
certificate_id, ssl_forced, caching_enabled, block_exploits,
|
|
advanced_config, meta, allow_websocket_upgrade, http2_support,
|
|
forward_scheme, enabled, locations, hsts_enabled, hsts_subdomains,
|
|
trust_forwarded_proto
|
|
) VALUES (
|
|
55, ?, ?, 1, 0,
|
|
?, "140.44.4.34", 443, 0,
|
|
1, 1, 0, 1,
|
|
"", "{\\"nginx_online\\":true,\\"nginx_err\\":null}", 1, 1,
|
|
"https", 1, "[]", 1, 1,
|
|
0
|
|
)''', (now, now, json.dumps(["pihole1.snarfnet.net"])))
|
|
print("Inserted proxy host 55: pihole1.snarfnet.net -> 140.44.4.34:443")
|
|
else:
|
|
cur.execute('''UPDATE proxy_host
|
|
SET domain_names = ?, forward_host = "140.44.4.34", forward_port = 443, forward_scheme = "https",
|
|
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
|
|
hsts_enabled = 1, hsts_subdomains = 1, modified_on = ?
|
|
WHERE id = 55''', (json.dumps(["pihole1.snarfnet.net"]), now))
|
|
print("Updated proxy host 55: pihole1.snarfnet.net")
|
|
|
|
conn.commit()
|
|
conn.close()
|
|
"""
|
|
|
|
stdin, stdout, stderr = c.exec_command(f"python3 -c '{py_script}'")
|
|
print(stdout.read().decode('utf-8'))
|
|
err = stderr.read().decode('utf-8')
|
|
if err: print("DB Update Err:", err)
|
|
|
|
print("3. Generating Nginx configuration files in proxy_host/...")
|
|
|
|
conf_template = """# ------------------------------------------------------------
|
|
# {domains}
|
|
# ------------------------------------------------------------
|
|
|
|
map $scheme $hsts_header {{
|
|
https "max-age=63072000;includeSubDomains; preload";
|
|
}}
|
|
|
|
server {{
|
|
set $forward_scheme {scheme};
|
|
set $server "{host}";
|
|
set $port {port};
|
|
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
|
|
server_name {domains};
|
|
http2 on;
|
|
|
|
# Let's Encrypt SSL
|
|
include conf.d/include/letsencrypt-acme-challenge.conf;
|
|
include conf.d/include/ssl-cache.conf;
|
|
include conf.d/include/ssl-ciphers.conf;
|
|
ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;
|
|
|
|
# Asset Caching
|
|
include conf.d/include/assets.conf;
|
|
|
|
# Block Exploits
|
|
include conf.d/include/block-exploits.conf;
|
|
|
|
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
|
|
add_header Strict-Transport-Security $hsts_header always;
|
|
|
|
# Force SSL
|
|
set $trust_forwarded_proto "F";
|
|
include conf.d/include/force-ssl.conf;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
access_log /data/logs/proxy-host-{pid}_access.log proxy;
|
|
error_log /data/logs/proxy-host-{pid}_error.log warn;
|
|
|
|
location / {{
|
|
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
|
|
add_header Strict-Transport-Security $hsts_header always;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
proxy_http_version 1.1;
|
|
|
|
# Proxy!
|
|
include conf.d/include/proxy.conf;
|
|
}}
|
|
|
|
# Custom
|
|
include /data/nginx/custom/server_proxy[.]conf;
|
|
}}
|
|
"""
|
|
|
|
configs = [
|
|
(3, "pihole.snarfnet.net", "140.44.4.34", 443, "https"),
|
|
(43, "pihole2.snarfnet.net", "140.44.4.62", 443, "https"),
|
|
(51, "pihole3.snarfnet.net", "140.44.4.62", 443, "https"),
|
|
(52, "dns1.snarfnet.net", "140.44.4.34", 443, "https"),
|
|
(53, "dns2.snarfnet.net", "140.44.4.62", 443, "https"),
|
|
(54, "technitium.snarfnet.net", "140.44.4.34", 443, "https"),
|
|
(55, "pihole1.snarfnet.net", "140.44.4.34", 443, "https"),
|
|
]
|
|
|
|
for pid, dom, host, port, scheme in configs:
|
|
cfg = conf_template.format(pid=pid, domains=dom, host=host, port=port, scheme=scheme)
|
|
remote_path = f"/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/{pid}.conf"
|
|
cmd_write = f"cat << 'EOF' > {remote_path}\n{cfg}\nEOF\n"
|
|
stdin, stdout, stderr = c.exec_command(cmd_write)
|
|
stdout.channel.recv_exit_status()
|
|
print(f"Wrote {remote_path} ({dom} -> {host}:{port})")
|
|
|
|
print("\n4. Testing Nginx configuration syntax inside container...")
|
|
test_cmd = "docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t"
|
|
stdin, stdout, stderr = c.exec_command(test_cmd)
|
|
test_out = stdout.read().decode('utf-8')
|
|
test_err = stderr.read().decode('utf-8')
|
|
print("nginx -t stdout:", test_out)
|
|
print("nginx -t stderr:", test_err)
|
|
|
|
if "successful" in test_err or "successful" in test_out:
|
|
print("\n5. Reloading Nginx across Swarm service...")
|
|
reload_cmd = "docker service update --force nginx-proxy-manager_app"
|
|
stdin, stdout, stderr = c.exec_command(reload_cmd)
|
|
print(stdout.read().decode('utf-8'))
|
|
print("NPM service reloaded successfully!")
|
|
else:
|
|
print("\nWARNING: Nginx test failed! Please check configuration.")
|
|
|
|
c.close()
|