104 lines
2.6 KiB
Python
Executable File
104 lines
2.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
"""
|
|
Nginx Proxy Manager ACME authority patch orchestrator.
|
|
|
|
This module:
|
|
1. Reads ACME gate configuration from environment variables.
|
|
2. Loads NPM certificate.js.
|
|
3. Applies only the requested mutations.
|
|
4. Verifies every requested mutation.
|
|
5. Writes the resulting source only after all enabled gates succeed.
|
|
|
|
Runtime ACME authority is NOT controlled here.
|
|
Patched NPM code reads the Pacemaker-controlled authority token.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from functions import common
|
|
from functions import request
|
|
from functions import renew
|
|
from functions import revoke
|
|
from functions import cluster_cert
|
|
|
|
|
|
DEFAULT_CERTIFICATE_JS = "/app/internal/certificate.js"
|
|
DEFAULT_CERTIFICATE_SCHEMA = "/app/schema/components/certificate-object.json"
|
|
|
|
|
|
def main() -> None:
|
|
certificate_js = Path(
|
|
os.environ.get(
|
|
"NPM_CERTIFICATE_JS",
|
|
DEFAULT_CERTIFICATE_JS,
|
|
)
|
|
)
|
|
|
|
certificate_schema = Path(
|
|
os.environ.get(
|
|
"NPM_CERTIFICATE_SCHEMA",
|
|
DEFAULT_CERTIFICATE_SCHEMA,
|
|
)
|
|
)
|
|
|
|
config = common.load_config()
|
|
|
|
common.log(f"certificate.js={certificate_js}")
|
|
common.log(f"certificate_schema={certificate_schema}")
|
|
common.log(f"request_gate={config.request}")
|
|
common.log(f"renew_gate={config.renew}")
|
|
common.log(f"revoke_gate={config.revoke}")
|
|
common.log(f"cluster_cert={config.cluster_cert}")
|
|
|
|
source = common.load_source(certificate_js)
|
|
|
|
schema_source = None
|
|
if config.cluster_cert:
|
|
schema_source = common.load_source(certificate_schema)
|
|
|
|
if config.any_enabled:
|
|
source = common.apply_authority_helper(source)
|
|
|
|
if config.request:
|
|
source = request.apply(source)
|
|
|
|
if config.renew:
|
|
source = renew.apply(source)
|
|
|
|
if config.revoke:
|
|
source = revoke.apply(source)
|
|
|
|
if config.cluster_cert:
|
|
source = cluster_cert.apply_certificate_js(source)
|
|
schema_source = cluster_cert.apply_schema(schema_source)
|
|
|
|
common.verify(source, config)
|
|
|
|
if config.request:
|
|
request.verify(source)
|
|
|
|
if config.renew:
|
|
renew.verify(source)
|
|
|
|
if config.revoke:
|
|
revoke.verify(source)
|
|
|
|
if config.cluster_cert:
|
|
cluster_cert.verify_certificate_js(source)
|
|
cluster_cert.verify_schema(schema_source)
|
|
|
|
common.write_source(certificate_js, source)
|
|
|
|
if config.cluster_cert:
|
|
common.write_source(certificate_schema, schema_source)
|
|
|
|
common.log("All requested ACME authority gates applied successfully")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|