首次提交

2026-07-18 20:09:26 +08:00
commit 521ad3b635
48 changed files with 7199 additions and 0 deletions
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# === 由 CertCenter 生成 ===
+DOMAIN="{{ domain }}"
+BASE_URL="{{ base_url }}"
+TOKEN="{{ token }}"
+CERT_DIR="{{ cert_dir }}"
+CHECK_CMD="{{ check_cmd }}"
+RELOAD_CMD="{{ reload_cmd }}"
+# ===========================
+
+VERSION_URL="${BASE_URL}/api/version/${DOMAIN}"
+FULLCHAIN_URL="${BASE_URL}/api/cert/${DOMAIN}/fullchain"
+PRIVATE_URL="${BASE_URL}/api/cert/${DOMAIN}/private"
+TMP_DIR="/tmp/cert-sync-${DOMAIN}"
+VERSION_FILE="${CERT_DIR}/.version"
+
+mkdir -p "${CERT_DIR}" "${TMP_DIR}"
+auth=(-H "Authorization: Bearer ${TOKEN}")
+# -k 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
+curl_opts=(-fsSL -k --connect-timeout 5 --max-time 30)
+
+# 1. 检查版本
+REMOTE=$(curl "${curl_opts[@]}" --max-time 15 "${auth[@]}" "${VERSION_URL}")
+LOCAL=$(cat "${VERSION_FILE}" 2>/dev/null || echo "0")
+if [[ "${REMOTE}" == "${LOCAL}" ]]; then
+    exit 0
+fi
+
+# 2. 下载证书
+curl "${curl_opts[@]}" "${auth[@]}" "${FULLCHAIN_URL}" -o "${TMP_DIR}/fullchain.pem"
+curl "${curl_opts[@]}" "${auth[@]}" "${PRIVATE_URL}"  -o "${TMP_DIR}/private.key"
+chmod 600 "${TMP_DIR}/private.key"
+
+# 3. 备份旧证书
+cp -f "${CERT_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem.bak" 2>/dev/null || true
+cp -f "${CERT_DIR}/private.key"  "${CERT_DIR}/private.key.bak"  2>/dev/null || true
+
+# 4. 原子替换
+mv -f "${TMP_DIR}/fullchain.pem" "${CERT_DIR}/fullchain.pem"
+mv -f "${TMP_DIR}/private.key"  "${CERT_DIR}/private.key"
+
+# 5. 校验 & 重载
+if ${CHECK_CMD}; then
+    echo "${REMOTE}" > "${VERSION_FILE}"
+    ${RELOAD_CMD}
+    echo "[$(date -Is)] updated: ${DOMAIN} -> ${REMOTE}"
+else
+    mv -f "${CERT_DIR}/fullchain.pem.bak" "${CERT_DIR}/fullchain.pem" 2>/dev/null || true
+    mv -f "${CERT_DIR}/private.key.bak"  "${CERT_DIR}/private.key"  2>/dev/null || true
+    echo "[$(date -Is)] FAILED: ${DOMAIN}, rolled back" >&2
+    exit 1
+fi