首次提交

2026-07-18 20:09:26 +08:00
commit 521ad3b635
48 changed files with 7199 additions and 0 deletions
@@ -0,0 +1,535 @@
+from fastapi import APIRouter, Depends, HTTPException, Header, Cookie
+from fastapi.responses import JSONResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, func
+from sqlalchemy.orm import selectinload
+from pydantic import BaseModel
+from datetime import datetime, timedelta
+import hashlib
+import hmac
+import json
+import time
+
+from backend.database import get_db
+from backend.models import Server, Domain, DeployLog, AcmeConfig, AcmeLog
+from backend.config import get_settings
+
+router = APIRouter(tags=["admin-api"])
+
+
+# ──────────────── Auth ────────────────
+
+def generate_token(username: str, secret_key: str) -> str:
+    """生成简单的认证 token"""
+    expire = int(time.time()) + 86400 * 7  # 7 天过期
+    payload = f"{username}:{expire}"
+    signature = hmac.new(secret_key.encode(), payload.encode(), hashlib.sha256).hexdigest()[:16]
+    return f"{payload}:{signature}"
+
+
+def verify_token(token: str, secret_key: str) -> bool:
+    """验证 token"""
+    try:
+        parts = token.split(":")
+        if len(parts) != 3:
+            return False
+        username, expire_str, signature = parts
+        expire = int(expire_str)
+        if time.time() > expire:
+            return False
+        payload = f"{username}:{expire_str}"
+        expected = hmac.new(secret_key.encode(), payload.encode(), hashlib.sha256).hexdigest()[:16]
+        return hmac.compare_digest(signature, expected)
+    except Exception:
+        return False
+
+
+async def require_auth(authorization: str = Header(None), admin_token: str = Cookie(None)):
+    """认证依赖，检查 Header 或 Cookie 中的 token"""
+    settings = get_settings()
+
+    # 从 Header 获取
+    token = None
+    if authorization and authorization.startswith("Bearer "):
+        token = authorization[7:]
+    # 从 Cookie 获取
+    elif admin_token:
+        token = admin_token
+
+    if not token or not verify_token(token, settings.secret_key):
+        raise HTTPException(status_code=401, detail="未登录或登录已过期")
+    return True
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+@router.post("/login")
+async def login(data: LoginRequest):
+    settings = get_settings()
+    if data.username != settings.admin_username or data.password != settings.admin_password:
+        raise HTTPException(status_code=401, detail="用户名或密码错误")
+
+    token = generate_token(data.username, settings.secret_key)
+    response = JSONResponse(content={"ok": True, "token": token})
+    response.set_cookie(
+        key="admin_token",
+        value=token,
+        max_age=86400 * 7,
+        httponly=True,
+        samesite="lax",
+    )
+    return response
+
+
+@router.post("/logout")
+async def logout():
+    response = JSONResponse(content={"ok": True})
+    response.delete_cookie("admin_token")
+    return response
+
+
+@router.get("/me")
+async def check_auth(_: bool = Depends(require_auth)):
+    return {"ok": True}
+
+
+# ──────────────── Schemas ────────────────
+
+class ServerCreate(BaseModel):
+    name: str
+    platform: str = "linux"
+    token: str
+    ip: str | None = None
+
+
+class ServerUpdate(BaseModel):
+    name: str | None = None
+    platform: str | None = None
+    token: str | None = None
+    ip: str | None = None
+
+
+class DomainCreate(BaseModel):
+    server_id: int
+    domain: str
+    cert_dir: str
+    check_cmd: str = "nginx -t"
+    reload_cmd: str = "systemctl reload nginx"
+
+
+class DomainUpdate(BaseModel):
+    server_id: int | None = None
+    domain: str | None = None
+    cert_dir: str | None = None
+    check_cmd: str | None = None
+    reload_cmd: str | None = None
+    version: str | None = None
+
+
+# ──────────────── Stats ────────────────
+
+@router.get("/stats")
+async def get_stats(db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """仪表盘统计数据"""
+    server_count = (await db.execute(select(func.count(Server.id)))).scalar() or 0
+    domain_count = (await db.execute(select(func.count(Domain.id)))) .scalar() or 0
+
+    # 即将过期（7 天内）
+    now = datetime.utcnow()
+    soon = now.replace(day=now.day + 7) if now.day <= 24 else now.replace(month=now.month + 1, day=now.day + 7 - 30)
+    expiring = (await db.execute(
+        select(func.count(Domain.id)).where(
+            Domain.cert_not_after.isnot(None),
+            Domain.cert_not_after <= soon,
+        )
+    )).scalar() or 0
+
+    # 最近日志
+    result = await db.execute(
+        select(DeployLog)
+        .options(selectinload(DeployLog.domain), selectinload(DeployLog.domain).selectinload(Domain.server))
+        .order_by(DeployLog.created_at.desc())
+        .limit(10)
+    )
+    logs = result.scalars().all()
+
+    return {
+        "server_count": server_count,
+        "domain_count": domain_count,
+        "expiring_count": expiring,
+        "recent_logs": [
+            {
+                "id": log.id,
+                "domain": log.domain.domain if log.domain else None,
+                "server": log.domain.server.name if log.domain and log.domain.server else None,
+                "status": log.status,
+                "message": log.message,
+                "created_at": log.created_at.isoformat(),
+            }
+            for log in logs
+        ],
+    }
+
+
+# ──────────────── Servers ────────────────
+
+@router.get("/servers")
+async def list_servers(db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Server).options(selectinload(Server.domains)).order_by(Server.id))
+    servers = result.scalars().all()
+    return [
+        {
+            "id": s.id,
+            "name": s.name,
+            "platform": s.platform,
+            "token": s.token,
+            "ip": s.ip,
+            "domain_count": len(s.domains),
+            "created_at": s.created_at.isoformat(),
+        }
+        for s in servers
+    ]
+
+
+@router.get("/servers/{server_id}")
+async def get_server(server_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Server).where(Server.id == server_id))
+    s = result.scalar_one_or_none()
+    if not s:
+        raise HTTPException(404, "Server not found")
+    return {"id": s.id, "name": s.name, "platform": s.platform, "token": s.token, "ip": s.ip}
+
+
+@router.post("/servers", status_code=201)
+async def create_server(data: ServerCreate, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    server = Server(**data.model_dump())
+    db.add(server)
+    await db.flush()
+    await db.refresh(server)
+    return {"id": server.id, "name": server.name}
+
+
+@router.put("/servers/{server_id}")
+async def update_server(server_id: int, data: ServerUpdate, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Server).where(Server.id == server_id))
+    server = result.scalar_one_or_none()
+    if not server:
+        raise HTTPException(404, "Server not found")
+    for key, value in data.model_dump(exclude_unset=True).items():
+        setattr(server, key, value)
+    return {"id": server.id}
+
+
+@router.delete("/servers/{server_id}")
+async def delete_server(server_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Server).where(Server.id == server_id))
+    server = result.scalar_one_or_none()
+    if not server:
+        raise HTTPException(404, "Server not found")
+    await db.delete(server)
+    return {"ok": True}
+
+
+# ──────────────── Domains ────────────────
+
+@router.get("/domains")
+async def list_domains(db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(
+        select(Domain).options(selectinload(Domain.server)).order_by(Domain.id)
+    )
+    domains = result.scalars().all()
+    return [
+        {
+            "id": d.id,
+            "server_id": d.server_id,
+            "server_name": d.server.name if d.server else None,
+            "domain": d.domain,
+            "cert_dir": d.cert_dir,
+            "check_cmd": d.check_cmd,
+            "reload_cmd": d.reload_cmd,
+            "version": d.version,
+            "cert_not_after": d.cert_not_after.isoformat() if d.cert_not_after else None,
+        }
+        for d in domains
+    ]
+
+
+@router.get("/domains/{domain_id}")
+async def get_domain(domain_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(404, "Domain not found")
+    return {
+        "id": d.id,
+        "server_id": d.server_id,
+        "domain": d.domain,
+        "cert_dir": d.cert_dir,
+        "check_cmd": d.check_cmd,
+        "reload_cmd": d.reload_cmd,
+        "version": d.version,
+    }
+
+
+@router.post("/domains", status_code=201)
+async def create_domain(data: DomainCreate, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    domain = Domain(**data.model_dump())
+    db.add(domain)
+    await db.flush()
+    await db.refresh(domain)
+    return {"id": domain.id, "domain": domain.domain}
+
+
+@router.put("/domains/{domain_id}")
+async def update_domain(domain_id: int, data: DomainUpdate, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    domain = result.scalar_one_or_none()
+    if not domain:
+        raise HTTPException(404, "Domain not found")
+    for key, value in data.model_dump(exclude_unset=True).items():
+        setattr(domain, key, value)
+    return {"id": domain.id}
+
+
+@router.delete("/domains/{domain_id}")
+async def delete_domain(domain_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    domain = result.scalar_one_or_none()
+    if not domain:
+        raise HTTPException(404, "Domain not found")
+    await db.delete(domain)
+    return {"ok": True}
+
+
+# ──────────────── Logs ────────────────
+
+@router.get("/logs")
+async def list_logs(status: str | None = None, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    query = (
+        select(DeployLog)
+        .options(selectinload(DeployLog.domain), selectinload(DeployLog.domain).selectinload(Domain.server))
+        .order_by(DeployLog.created_at.desc())
+        .limit(100)
+    )
+    if status:
+        query = query.where(DeployLog.status == status)
+    result = await db.execute(query)
+    logs = result.scalars().all()
+    return [
+        {
+            "id": log.id,
+            "domain": log.domain.domain if log.domain else None,
+            "server": log.domain.server.name if log.domain and log.domain.server else None,
+            "status": log.status,
+            "message": log.message,
+            "created_at": log.created_at.isoformat(),
+        }
+        for log in logs
+    ]
+
+
+# ──────────────── ACME 配置 ────────────────
+
+class AcmeConfigUpdate(BaseModel):
+    acme_server: str | None = None
+    email: str | None = None
+    dns_provider: str | None = None
+    dns_credentials: str | None = None
+    renew_days: int | None = None
+
+
+@router.get("/acme/config")
+async def get_acme_config(db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(AcmeConfig).where(AcmeConfig.id == 1))
+    config = result.scalar_one_or_none()
+    if not config:
+        # 返回默认配置
+        return {
+            "acme_server": "https://acme-v02.api.letsencrypt.org/directory",
+            "email": "",
+            "dns_provider": "aliyun",
+            "dns_credentials": "{}",
+            "renew_days": 30,
+            "has_account_key": False,
+        }
+    return {
+        "acme_server": config.acme_server,
+        "email": config.email,
+        "dns_provider": config.dns_provider,
+        "dns_credentials": config.dns_credentials,
+        "renew_days": config.renew_days,
+        "has_account_key": config.account_key is not None,
+    }
+
+
+@router.put("/acme/config")
+async def update_acme_config(data: AcmeConfigUpdate, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    result = await db.execute(select(AcmeConfig).where(AcmeConfig.id == 1))
+    config = result.scalar_one_or_none()
+    if not config:
+        config = AcmeConfig(id=1)
+        db.add(config)
+    for key, value in data.model_dump(exclude_unset=True).items():
+        setattr(config, key, value)
+    return {"ok": True}
+
+
+# ──────────────── ACME 操作 ────────────────
+
+@router.post("/acme/issue/{domain_id}")
+async def issue_cert(domain_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """为指定域名申请证书"""
+    from backend.acme_service import AcmeService
+    from backend.config import get_settings
+
+    # 获取 ACME 配置
+    result = await db.execute(select(AcmeConfig).where(AcmeConfig.id == 1))
+    config = result.scalar_one_or_none()
+    if not config or not config.email:
+        raise HTTPException(400, "ACME not configured, please set email first")
+
+    # 获取域名
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    domain = result.scalar_one_or_none()
+    if not domain:
+        raise HTTPException(404, "Domain not found")
+
+    settings = get_settings()
+    service = AcmeService(config, settings.cert_dir)
+
+    # 记录开始
+    log = AcmeLog(domain_id=domain_id, action="issue", status="pending", message=f"Issuing certificate for {domain.domain}")
+    db.add(log)
+    await db.flush()
+
+    try:
+        success, msg = service.issue_certificate(domain.domain)
+        log.status = "success" if success else "failed"
+        log.message = msg
+
+        if success:
+            # 更新域名的证书到期时间
+            info = service.get_cert_info(domain.domain)
+            if info:
+                domain.cert_not_after = datetime.fromisoformat(info["not_after"])
+                domain.version = str(int(domain.version or "0") + 1)
+
+        await db.flush()
+        return {"success": success, "message": msg}
+    except Exception as e:
+        log.status = "failed"
+        log.message = str(e)
+        await db.flush()
+        raise HTTPException(500, str(e))
+
+
+@router.post("/acme/renew/{domain_id}")
+async def renew_cert(domain_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """续签指定域名的证书"""
+    return await issue_cert(domain_id, db)
+
+
+@router.post("/acme/auto-renew")
+async def auto_renew_all(db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """自动续签所有即将过期的证书"""
+    from backend.acme_service import AcmeService
+    from backend.config import get_settings
+
+    result = await db.execute(select(AcmeConfig).where(AcmeConfig.id == 1))
+    config = result.scalar_one_or_none()
+    if not config or not config.email:
+        raise HTTPException(400, "ACME not configured")
+
+    settings = get_settings()
+    service = AcmeService(config, settings.cert_dir)
+
+    # 获取所有域名
+    result = await db.execute(select(Domain))
+    domains = result.scalars().all()
+
+    results = []
+    for d in domains:
+        need_renew, days_left = service.check_expiry(d.domain)
+        if need_renew:
+            log = AcmeLog(domain_id=d.id, action="renew", status="pending", message=f"Auto-renewing {d.domain}")
+            db.add(log)
+            await db.flush()
+
+            success, msg = service.renew_certificate(d.domain)
+            log.status = "success" if success else "failed"
+            log.message = msg
+
+            if success:
+                info = service.get_cert_info(d.domain)
+                if info:
+                    d.cert_not_after = datetime.fromisoformat(info["not_after"])
+                    d.version = str(int(d.version or "0") + 1)
+
+            results.append({"domain": d.domain, "success": success, "message": msg, "days_left": days_left})
+        else:
+            results.append({"domain": d.domain, "success": True, "message": f"Skipped, {days_left} days left", "days_left": days_left})
+
+    return {"results": results}
+
+
+# ──────────────── ACME 日志 ────────────────
+
+@router.get("/acme/logs")
+async def list_acme_logs(status: str | None = None, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    query = (
+        select(AcmeLog)
+        .options(selectinload(AcmeLog.domain))
+        .order_by(AcmeLog.created_at.desc())
+        .limit(100)
+    )
+    if status:
+        query = query.where(AcmeLog.status == status)
+    result = await db.execute(query)
+    logs = result.scalars().all()
+    return [
+        {
+            "id": log.id,
+            "domain": log.domain.domain if log.domain else None,
+            "action": log.action,
+            "status": log.status,
+            "message": log.message,
+            "detail": log.detail,
+            "created_at": log.created_at.isoformat(),
+        }
+        for log in logs
+    ]
+
+
+# ──────────────── 证书信息 ────────────────
+
+@router.get("/cert-info/{domain_id}")
+async def get_cert_info(domain_id: int, db: AsyncSession = Depends(get_db), _: bool = Depends(require_auth)):
+    """获取证书详细信息"""
+    from backend.acme_service import AcmeService
+    from backend.config import get_settings
+
+    result = await db.execute(select(Domain).where(Domain.id == domain_id))
+    domain = result.scalar_one_or_none()
+    if not domain:
+        raise HTTPException(404, "Domain not found")
+
+    result = await db.execute(select(AcmeConfig).where(AcmeConfig.id == 1))
+    config = result.scalar_one_or_none()
+    if not config:
+        config = AcmeConfig(id=1)
+
+    settings = get_settings()
+    service = AcmeService(config, settings.cert_dir)
+
+    info = service.get_cert_info(domain.domain)
+    need_renew, days_left = service.check_expiry(domain.domain)
+
+    return {
+        "domain": domain.domain,
+        "cert_info": info,
+        "need_renew": need_renew,
+        "days_left": days_left,
+    }
@@ -0,0 +1,144 @@
+from fastapi import APIRouter, Depends, HTTPException, Header
+from fastapi.responses import PlainTextResponse, FileResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from jinja2 import Environment, FileSystemLoader
+from pathlib import Path
+import os
+
+from backend.database import get_db
+from backend.models import Server, Domain, DeployLog
+from backend.config import get_settings
+
+router = APIRouter(tags=["client-api"])
+
+settings = get_settings()
+
+# Jinja2 环境，用于生成脚本
+template_dir = Path(__file__).parent.parent / "templates_cert"
+jinja_env = Environment(loader=FileSystemLoader(str(template_dir)))
+
+
+async def verify_token(
+    authorization: str = Header(...),
+    db: AsyncSession = Depends(get_db),
+):
+    """验证 Bearer Token，返回对应的 Server 对象"""
+    if not authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Invalid authorization header")
+    token = authorization[7:]
+    result = await db.execute(select(Server).where(Server.token == token))
+    server = result.scalar_one_or_none()
+    if not server:
+        raise HTTPException(status_code=401, detail="Invalid token")
+    return server
+
+
+@router.get("/version/{domain}")
+async def get_version(domain: str, db: AsyncSession = Depends(get_db)):
+    """返回当前证书版本号（无需认证，方便客户端轻量检查）"""
+    result = await db.execute(select(Domain).where(Domain.domain == domain))
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(status_code=404, detail="Domain not found")
+    return PlainTextResponse(d.version)
+
+
+@router.get("/cert/{domain}/fullchain")
+async def get_fullchain(
+    domain: str,
+    server: Server = Depends(verify_token),
+    db: AsyncSession = Depends(get_db),
+):
+    """下载 fullchain.pem"""
+    result = await db.execute(
+        select(Domain).where(Domain.domain == domain, Domain.server_id == server.id)
+    )
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(status_code=404, detail="Domain not found for this server")
+    cert_path = Path(settings.cert_dir) / domain / "fullchain.pem"
+    if not cert_path.exists():
+        raise HTTPException(status_code=404, detail="Certificate file not found")
+    return FileResponse(str(cert_path), media_type="application/x-pem-file", filename="fullchain.pem")
+
+
+@router.get("/cert/{domain}/private")
+async def get_private_key(
+    domain: str,
+    server: Server = Depends(verify_token),
+    db: AsyncSession = Depends(get_db),
+):
+    """下载 private.key"""
+    result = await db.execute(
+        select(Domain).where(Domain.domain == domain, Domain.server_id == server.id)
+    )
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(status_code=404, detail="Domain not found for this server")
+    key_path = Path(settings.cert_dir) / domain / "private.key"
+    if not key_path.exists():
+        raise HTTPException(status_code=404, detail="Private key file not found")
+    return FileResponse(str(key_path), media_type="application/x-pem-file", filename="private.key")
+
+
+@router.get("/script/{domain}")
+async def generate_script(
+    domain: str,
+    server_name: str,
+    db: AsyncSession = Depends(get_db),
+):
+    """根据 server_name 生成对应的部署脚本"""
+    # 查找服务器
+    result = await db.execute(select(Server).where(Server.name == server_name))
+    server = result.scalar_one_or_none()
+    if not server:
+        raise HTTPException(status_code=404, detail="Server not found")
+
+    # 查找域名配置
+    result = await db.execute(
+        select(Domain).where(Domain.domain == domain, Domain.server_id == server.id)
+    )
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(status_code=404, detail="Domain not found for this server")
+
+    # 选择模板
+    if server.platform == "windows":
+        template_name = "deploy-cert.ps1.j2"
+    else:
+        template_name = "deploy-cert.sh.j2"
+
+    tpl = jinja_env.get_template(template_name)
+    script = tpl.render(
+        domain=domain,
+        base_url=settings.base_url,
+        token=server.token,
+        cert_dir=d.cert_dir,
+        check_cmd=d.check_cmd,
+        reload_cmd=d.reload_cmd,
+    )
+
+    media_type = "text/plain" if server.platform == "windows" else "application/x-sh"
+    return PlainTextResponse(script, media_type=media_type)
+
+
+@router.post("/report/{domain}")
+async def report_deploy(
+    domain: str,
+    status: str,
+    message: str = "",
+    server: Server = Depends(verify_token),
+    db: AsyncSession = Depends(get_db),
+):
+    """客户端上报部署结果"""
+    result = await db.execute(
+        select(Domain).where(Domain.domain == domain, Domain.server_id == server.id)
+    )
+    d = result.scalar_one_or_none()
+    if not d:
+        raise HTTPException(status_code=404, detail="Domain not found for this server")
+
+    log = DeployLog(domain_id=d.id, server_id=server.id, status=status, message=message)
+    db.add(log)
+    return {"ok": True}