sansenhoshi/acme-auto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

完善

Browse Source
This commit is contained in:
sansenhoshi
2026-07-20 10:26:58 +08:00
parent 9658015972
commit 1d8fe97a49
10 changed files with 105 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/acme_service.py
+26 -13
View File
@@ -250,10 +250,10 @@ class AcmeService:
except OSError:
pass
def issue_certificate(self, domain: str) -> tuple[bool, str]:
def issue_certificate(self, domain: str) -> tuple[bool, str, dict, str]:
"""
申请证书（使用 certbot + DNS-01 验证）
返回 (成功?, 日志信息)
返回 (成功?, 摘要信息, 证书详情dict, certbot原始输出)
泛域名 *.example.com 会自动同时申请裸域名 example.com
"""
@@ -264,23 +264,36 @@ class AcmeService:
success, output = self._run_certbot(domain, "certonly")
cert_info = {}
if success:
cert_path = domain_dir / "fullchain.pem"
if cert_path.exists():
cert_data = cert_path.read_bytes()
cert = x509.load_pem_x509_certificate(cert_data)
not_after = cert.not_valid_after_utc
san = []
try:
san_ext = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
san = san_ext.value.get_values_for_type(x509.DNSName)
except x509.ExtensionNotFound:
pass
return True, f"Certificate issued, expires: {not_after.strftime('%Y-%m-%d %H:%M:%S')}, SAN: {san}"
cert_data = cert_path.read_bytes()
cert = x509.load_pem_x509_certificate(cert_data)
not_before = getattr(cert, "not_valid_before_utc", None) or cert.not_valid_before
not_after = getattr(cert, "not_valid_after_utc", None) or cert.not_valid_after
san = []
try:
san_ext = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
san = san_ext.value.get_values_for_type(x509.DNSName)
except x509.ExtensionNotFound:
pass
cert_info = {
"not_before": not_before.isoformat(),
"not_after": not_after.isoformat(),
"serial_number": str(cert.serial_number),
"san": [str(s) for s in san],
"issuer": cert.issuer.rfc4514_string(),
}
msg = f"签发成功，过期时间: {not_after.strftime('%Y-%m-%d %H:%M:%S')}, SAN: {san}"
return True, msg, cert_info, output
except Exception as e:
return True, f"签发成功但解析证书失败: {e}", cert_info, output
return success, output
return success, output, cert_info, output
def renew_certificate(self, domain: str) -> tuple[bool, str]:
def renew_certificate(self, domain: str) -> tuple[bool, str, dict, str]:
"""续签证书"""
return self.issue_certificate(domain)
backend/database.py
+17
View File
@@ -55,6 +55,23 @@ async def init_db():
except Exception:
pass # 列已存在
# 迁移：给 deploy_logs 表加 hostname 列
try:
await conn.execute(__import__("sqlalchemy").text("ALTER TABLE deploy_logs ADD COLUMN hostname VARCHAR(200)"))
except Exception:
pass
# 迁移：给 acme_logs 表加证书信息列
for col_def in [
"ALTER TABLE acme_logs ADD COLUMN cert_not_after DATETIME",
"ALTER TABLE acme_logs ADD COLUMN cert_serial VARCHAR(100)",
"ALTER TABLE acme_logs ADD COLUMN cert_san VARCHAR(500)",
]:
try:
await conn.execute(__import__("sqlalchemy").text(col_def))
except Exception:
pass # 列已存在
# 确保至少有一条默认配置
result = await conn.execute(
__import__("sqlalchemy").text("SELECT COUNT(*) FROM acme_configs")
backend/main.py
+10 -5
View File
@@ -64,13 +64,18 @@ async def auto_renew_job():
await db.flush()
try:
success, msg = service.renew_certificate(d.domain)
success, msg, cert_info, raw_output = service.renew_certificate(d.domain)
log.status = "success" if success else "failed"
log.message = msg
if success:
info = service.get_cert_info(d.domain)
if info:
d.cert_not_after = datetime.fromisoformat(info["not_after"])
log.detail = raw_output[-5000:] if raw_output else None
if success and cert_info.get("not_after"):
d.cert_not_after = datetime.fromisoformat(cert_info["not_after"])
d.version = str(int(d.version or "0") + 1)
log.cert_not_after = d.cert_not_after
log.cert_serial = cert_info.get("serial_number", "")
log.cert_san = ", ".join(cert_info.get("san", []))
renewed += 1
elif success:
d.version = str(int(d.version or "0") + 1)
renewed += 1
logger.info(f"[定时任务] {d.domain}: {'成功' if success else '失败'} - {msg}")
backend/models.py
+5 -1
View File
@@ -44,6 +44,7 @@ class DeployLog(Base):
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
domain_id: Mapped[int] = mapped_column(Integer, ForeignKey("domains.id"), nullable=False)
server_id: Mapped[int] = mapped_column(Integer, ForeignKey("servers.id"), nullable=False)
hostname: Mapped[str | None] = mapped_column(String(200), nullable=True)
status: Mapped[str] = mapped_column(String(20), nullable=False) # success / failed / skipped
message: Mapped[str | None] = mapped_column(Text, nullable=True)
created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
@@ -84,7 +85,10 @@ class AcmeLog(Base):
action: Mapped[str] = mapped_column(String(50), nullable=False) # issue / renew / revoke / register
status: Mapped[str] = mapped_column(String(20), nullable=False) # success / failed / pending
message: Mapped[str | None] = mapped_column(Text, nullable=True)
detail: Mapped[str | None] = mapped_column(Text, nullable=True) # 详细日志
detail: Mapped[str | None] = mapped_column(Text, nullable=True) # certbot 原始输出
cert_not_after: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
cert_serial: Mapped[str | None] = mapped_column(String(100), nullable=True)
cert_san: Mapped[str | None] = mapped_column(String(500), nullable=True)
created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
domain: Mapped["Domain | None"] = relationship()
backend/routers/admin.py
+21 -12
View File
@@ -346,6 +346,7 @@ async def list_logs(status: str | None = None, db: AsyncSession = Depends(get_db
"id": log.id,
"domain": log.domain.domain if log.domain else None,
"server": log.domain.server.name if log.domain and log.domain.server else None,
"hostname": log.hostname,
"status": log.status,
"message": log.message,
"created_at": log.created_at.isoformat(),
@@ -488,19 +489,22 @@ async def issue_cert(domain_id: int, db: AsyncSession = Depends(get_db), _: bool
await db.flush()
try:
success, msg = service.issue_certificate(domain.domain)
success, msg, cert_info, raw_output = service.issue_certificate(domain.domain)
log.status = "success" if success else "failed"
log.message = msg
log.detail = raw_output[-5000:] if raw_output else None # 截断防止过大
if success:
info = service.get_cert_info(domain.domain)
if info:
domain.cert_not_after = datetime.fromisoformat(info["not_after"])
if cert_info.get("not_after"):
domain.cert_not_after = datetime.fromisoformat(cert_info["not_after"])
domain.version = str(int(domain.version or "0") + 1)
logger.info(f"证书信息已更新: {domain.domain}, 过期时间: {info['not_after']}")
log.cert_not_after = domain.cert_not_after
log.cert_serial = cert_info.get("serial_number", "")
log.cert_san = ", ".join(cert_info.get("san", []))
logger.info(f"证书信息已更新: {domain.domain}, 过期时间: {cert_info['not_after']}")
else:
logger.warning(f"无法获取证书信息: {domain.domain}")
domain.version = str(int(domain.version or "0") + 1)
logger.warning(f"无法获取证书信息: {domain.domain}")
await db.flush()
return {"success": success, "message": msg}
@@ -550,15 +554,17 @@ async def auto_renew_all(db: AsyncSession = Depends(get_db), _: bool = Depends(r
db.add(log)
await db.flush()
success, msg = service.renew_certificate(d.domain)
success, msg, cert_info, raw_output = service.renew_certificate(d.domain)
log.status = "success" if success else "failed"
log.message = msg
log.detail = raw_output[-5000:] if raw_output else None
if success:
info = service.get_cert_info(d.domain)
if info:
d.cert_not_after = datetime.fromisoformat(info["not_after"])
d.version = str(int(d.version or "0") + 1)
if success and cert_info.get("not_after"):
d.cert_not_after = datetime.fromisoformat(cert_info["not_after"])
d.version = str(int(d.version or "0") + 1)
log.cert_not_after = d.cert_not_after
log.cert_serial = cert_info.get("serial_number", "")
log.cert_san = ", ".join(cert_info.get("san", []))
results.append({"domain": d.domain, "success": success, "message": msg, "days_left": days_left})
else:
@@ -589,6 +595,9 @@ async def list_acme_logs(status: str | None = None, db: AsyncSession = Depends(g
"status": log.status,
"message": log.message,
"detail": log.detail,
"cert_not_after": log.cert_not_after.isoformat() if log.cert_not_after else None,
"cert_serial": log.cert_serial,
"cert_san": log.cert_san,
"created_at": log.created_at.isoformat(),
}
for log in logs
backend/routers/api.py
+2 -1
View File
@@ -133,6 +133,7 @@ async def report_deploy(
domain: str,
status: str,
message: str = "",
hostname: str = "",
server: Server = Depends(verify_token),
db: AsyncSession = Depends(get_db),
):
@@ -144,6 +145,6 @@ async def report_deploy(
if not d:
raise HTTPException(status_code=404, detail="Domain not found for this server")
log = DeployLog(domain_id=d.id, server_id=server.id, status=status, message=message)
log = DeployLog(domain_id=d.id, server_id=server.id, hostname=hostname, status=status, message=message)
db.add(log)
return {"ok": True}
backend/templates_cert/deploy-cert.ps1.j2
+3 -2
View File
@@ -37,16 +37,17 @@ Move-Item "$TmpDir\fullchain.pem" "$CertDir\fullchain.pem" -Force
Move-Item "$TmpDir\private.key" "$CertDir\private.key" -Force
# 5. 校验 & 重载 & 上报
$HostName = $env:COMPUTERNAME
try {
Invoke-Expression $CheckCmd
$remote | Out-File -NoNewline -Encoding ascii $VersionFile
Invoke-Expression $ReloadCmd
Write-Host "[$(Get-Date -Format o)] updated: $Domain -> $remote"
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=success&message=deployed+v$remote" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=success&hostname=$HostName&message=deployed+v$remote" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
} catch {
Move-Item "$CertDir\fullchain.pem.bak" "$CertDir\fullchain.pem" -Force -ErrorAction SilentlyContinue
Move-Item "$CertDir\private.key.bak" "$CertDir\private.key" -Force -ErrorAction SilentlyContinue
Write-Error "[$(Get-Date -Format o)] FAILED: $Domain, rolled back"
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=failed&message=check+failed+rolled+back" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=failed&hostname=$HostName&message=check+failed+rolled+back" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
exit 1
}
backend/templates_cert/deploy-cert.sh.j2
+3 -2
View File
@@ -42,15 +42,16 @@ mv -f "${TMP_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem"
mv -f "${TMP_DIR}/private.key" "${CERT_DIR}/private.key"
# 5. 校验 & 重载 & 上报
HOSTNAME=$(hostname)
if ${CHECK_CMD}; then
echo "${REMOTE}" > "${VERSION_FILE}"
${RELOAD_CMD}
echo "[$(date -Is)] updated: ${DOMAIN} -> ${REMOTE}"
curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=success&message=deployed+v${REMOTE}" 2>/dev/null || true
curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=success&hostname=${HOSTNAME}&message=deployed+v${REMOTE}" 2>/dev/null || true
else
mv -f "${CERT_DIR}/fullchain.pem.bak" "${CERT_DIR}/fullchain.pem" 2>/dev/null || true
mv -f "${CERT_DIR}/private.key.bak" "${CERT_DIR}/private.key" 2>/dev/null || true
echo "[$(date -Is)] FAILED: ${DOMAIN}, rolled back" >&2
curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=failed&message=check+failed+rolled+back" 2>/dev/null || true
curl "${curl_opts[@]}" "${auth[@]}" -X POST "${BASE_URL}/api/report?domain=${DOMAIN}&status=failed&hostname=${HOSTNAME}&message=check+failed+rolled+back" 2>/dev/null || true
exit 1
fi