首次提交

2026-07-18 20:09:26 +08:00
commit 521ad3b635
48 changed files with 7199 additions and 0 deletions
@@ -0,0 +1,49 @@
+$ErrorActionPreference = "Stop"
+
+# === 由 CertCenter 生成 ===
+$Domain    = "{{ domain }}"
+$BaseUrl   = "{{ base_url }}"
+$Token     = "{{ token }}"
+$CertDir   = "{{ cert_dir }}"
+$CheckCmd  = "{{ check_cmd }}"
+$ReloadCmd = "{{ reload_cmd }}"
+# ===========================
+
+$TmpDir      = "$env:TEMP\cert-sync-$Domain"
+$VersionFile = "$CertDir\.version"
+
+New-Item -ItemType Directory -Force -Path $CertDir, $TmpDir | Out-Null
+$headers = @{ Authorization = "Bearer $Token" }
+
+# 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
+[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
+
+# 1. 检查版本
+$remote = (Invoke-WebRequest -Uri "$BaseUrl/api/version/$Domain" -Headers $headers -UseBasicParsing -SkipCertificateCheck).Content.Trim()
+$local  = if (Test-Path $VersionFile) { (Get-Content $VersionFile).Trim() } else { "0" }
+if ($remote -eq $local) { exit 0 }
+
+# 2. 下载证书
+Invoke-WebRequest -Uri "$BaseUrl/api/cert/$Domain/fullchain" -Headers $headers -OutFile "$TmpDir\fullchain.pem" -UseBasicParsing -SkipCertificateCheck
+Invoke-WebRequest -Uri "$BaseUrl/api/cert/$Domain/private"   -Headers $headers -OutFile "$TmpDir\private.key"   -UseBasicParsing -SkipCertificateCheck
+
+# 3. 备份旧证书
+Copy-Item "$CertDir\fullchain.pem" "$CertDir\fullchain.pem.bak" -ErrorAction SilentlyContinue
+Copy-Item "$CertDir\private.key"   "$CertDir\private.key.bak"   -ErrorAction SilentlyContinue
+
+# 4. 原子替换
+Move-Item "$TmpDir\fullchain.pem" "$CertDir\fullchain.pem" -Force
+Move-Item "$TmpDir\private.key"   "$CertDir\private.key"   -Force
+
+# 5. 校验 & 重载
+try {
+    Invoke-Expression $CheckCmd
+    $remote | Out-File -NoNewline -Encoding ascii $VersionFile
+    Invoke-Expression $ReloadCmd
+    Write-Host "[$(Get-Date -Format o)] updated: $Domain -> $remote"
+} catch {
+    Move-Item "$CertDir\fullchain.pem.bak" "$CertDir\fullchain.pem" -Force -ErrorAction SilentlyContinue
+    Move-Item "$CertDir\private.key.bak"   "$CertDir\private.key"   -Force -ErrorAction SilentlyContinue
+    Write-Error "[$(Get-Date -Format o)] FAILED: $Domain, rolled back"
+    exit 1
+}
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# === 由 CertCenter 生成 ===
+DOMAIN="{{ domain }}"
+BASE_URL="{{ base_url }}"
+TOKEN="{{ token }}"
+CERT_DIR="{{ cert_dir }}"
+CHECK_CMD="{{ check_cmd }}"
+RELOAD_CMD="{{ reload_cmd }}"
+# ===========================
+
+VERSION_URL="${BASE_URL}/api/version/${DOMAIN}"
+FULLCHAIN_URL="${BASE_URL}/api/cert/${DOMAIN}/fullchain"
+PRIVATE_URL="${BASE_URL}/api/cert/${DOMAIN}/private"
+TMP_DIR="/tmp/cert-sync-${DOMAIN}"
+VERSION_FILE="${CERT_DIR}/.version"
+
+mkdir -p "${CERT_DIR}" "${TMP_DIR}"
+auth=(-H "Authorization: Bearer ${TOKEN}")
+# -k 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
+curl_opts=(-fsSL -k --connect-timeout 5 --max-time 30)
+
+# 1. 检查版本
+REMOTE=$(curl "${curl_opts[@]}" --max-time 15 "${auth[@]}" "${VERSION_URL}")
+LOCAL=$(cat "${VERSION_FILE}" 2>/dev/null || echo "0")
+if [[ "${REMOTE}" == "${LOCAL}" ]]; then
+    exit 0
+fi
+
+# 2. 下载证书
+curl "${curl_opts[@]}" "${auth[@]}" "${FULLCHAIN_URL}" -o "${TMP_DIR}/fullchain.pem"
+curl "${curl_opts[@]}" "${auth[@]}" "${PRIVATE_URL}"  -o "${TMP_DIR}/private.key"
+chmod 600 "${TMP_DIR}/private.key"
+
+# 3. 备份旧证书
+cp -f "${CERT_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem.bak" 2>/dev/null || true
+cp -f "${CERT_DIR}/private.key"  "${CERT_DIR}/private.key.bak"  2>/dev/null || true
+
+# 4. 原子替换
+mv -f "${TMP_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem"
+mv -f "${TMP_DIR}/private.key"  "${CERT_DIR}/private.key"
+
+# 5. 校验 & 重载
+if ${CHECK_CMD}; then
+    echo "${REMOTE}" > "${VERSION_FILE}"
+    ${RELOAD_CMD}
+    echo "[$(date -Is)] updated: ${DOMAIN} -> ${REMOTE}"
+else
+    mv -f "${CERT_DIR}/fullchain.pem.bak" "${CERT_DIR}/fullchain.pem" 2>/dev/null || true
+    mv -f "${CERT_DIR}/private.key.bak"  "${CERT_DIR}/private.key"  2>/dev/null || true
+    echo "[$(date -Is)] FAILED: ${DOMAIN}, rolled back" >&2
+    exit 1
+fi