首次提交

2026-07-18 20:09:26 +08:00
commit 521ad3b635
48 changed files with 7199 additions and 0 deletions
@@ -0,0 +1,49 @@
+$ErrorActionPreference = "Stop"
+
+# === 由 CertCenter 生成 ===
+$Domain    = "{{ domain }}"
+$BaseUrl   = "{{ base_url }}"
+$Token     = "{{ token }}"
+$CertDir   = "{{ cert_dir }}"
+$CheckCmd  = "{{ check_cmd }}"
+$ReloadCmd = "{{ reload_cmd }}"
+# ===========================
+
+$TmpDir      = "$env:TEMP\cert-sync-$Domain"
+$VersionFile = "$CertDir\.version"
+
+New-Item -ItemType Directory -Force -Path $CertDir, $TmpDir | Out-Null
+$headers = @{ Authorization = "Bearer $Token" }
+
+# 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
+[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
+
+# 1. 检查版本
+$remote = (Invoke-WebRequest -Uri "$BaseUrl/api/version/$Domain" -Headers $headers -UseBasicParsing -SkipCertificateCheck).Content.Trim()
+$local  = if (Test-Path $VersionFile) { (Get-Content $VersionFile).Trim() } else { "0" }
+if ($remote -eq $local) { exit 0 }
+
+# 2. 下载证书
+Invoke-WebRequest -Uri "$BaseUrl/api/cert/$Domain/fullchain" -Headers $headers -OutFile "$TmpDir\fullchain.pem" -UseBasicParsing -SkipCertificateCheck
+Invoke-WebRequest -Uri "$BaseUrl/api/cert/$Domain/private"   -Headers $headers -OutFile "$TmpDir\private.key"   -UseBasicParsing -SkipCertificateCheck
+
+# 3. 备份旧证书
+Copy-Item "$CertDir\fullchain.pem" "$CertDir\fullchain.pem.bak" -ErrorAction SilentlyContinue
+Copy-Item "$CertDir\private.key"   "$CertDir\private.key.bak"   -ErrorAction SilentlyContinue
+
+# 4. 原子替换
+Move-Item "$TmpDir\fullchain.pem" "$CertDir\fullchain.pem" -Force
+Move-Item "$TmpDir\private.key"   "$CertDir\private.key"   -Force
+
+# 5. 校验 & 重载
+try {
+    Invoke-Expression $CheckCmd
+    $remote | Out-File -NoNewline -Encoding ascii $VersionFile
+    Invoke-Expression $ReloadCmd
+    Write-Host "[$(Get-Date -Format o)] updated: $Domain -> $remote"
+} catch {
+    Move-Item "$CertDir\fullchain.pem.bak" "$CertDir\fullchain.pem" -Force -ErrorAction SilentlyContinue
+    Move-Item "$CertDir\private.key.bak"   "$CertDir\private.key"   -Force -ErrorAction SilentlyContinue
+    Write-Error "[$(Get-Date -Format o)] FAILED: $Domain, rolled back"
+    exit 1
+}