83 lines
3.5 KiB
Django/Jinja
83 lines
3.5 KiB
Django/Jinja
$ErrorActionPreference = "Stop"
|
|
|
|
function Log($msg) { Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $msg" }
|
|
|
|
# === 由 CertCenter 生成 ===
|
|
$Domain = "{{ domain }}"
|
|
$BaseUrl = "{{ base_url }}"
|
|
$Token = "{{ token }}"
|
|
$CertDir = "{{ cert_dir }}"
|
|
$CheckCmd = "{{ check_cmd }}"
|
|
$ReloadCmd = "{{ reload_cmd }}"
|
|
$ConfigId = "{{ acme_config_id }}"
|
|
# ===========================
|
|
|
|
$EncodedDomain = [System.Uri]::EscapeDataString($Domain)
|
|
$ConfigParam = if ($ConfigId) { "&acme_config_id=$ConfigId" } else { "" }
|
|
$TmpDir = "$env:TEMP\cert-sync-$($Domain -replace '[*\.]','_')"
|
|
$VersionFile = "$CertDir\.version"
|
|
|
|
New-Item -ItemType Directory -Force -Path $CertDir, $TmpDir | Out-Null
|
|
$headers = @{ Authorization = "Bearer $Token" }
|
|
|
|
# 跳过 TLS 证书验证（CertCenter 初期可能使用自签证书）
|
|
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
|
|
|
|
Log "开始同步证书: $Domain"
|
|
Log "配置目录: $CertDir, 配置ID: $(if ($ConfigId) { $ConfigId } else { '无' })"
|
|
|
|
# 1. 检查版本
|
|
Log "检查远程版本..."
|
|
try {
|
|
$remote = (Invoke-WebRequest -Uri "$BaseUrl/api/version?domain=$EncodedDomain$ConfigParam" -Headers $headers -UseBasicParsing -SkipCertificateCheck).Content.Trim()
|
|
} catch {
|
|
Log "错误: 无法获取远程版本 - $_"
|
|
exit 1
|
|
}
|
|
$local = if (Test-Path $VersionFile) { (Get-Content $VersionFile).Trim() } else { "0" }
|
|
Log "远程版本: $remote, 本地版本: $local"
|
|
if ($remote -eq $local) {
|
|
Log "版本一致，跳过更新"
|
|
exit 0
|
|
}
|
|
|
|
# 2. 下载证书
|
|
Log "版本不一致，开始下载证书..."
|
|
try {
|
|
Invoke-WebRequest -Uri "$BaseUrl/api/cert/fullchain?domain=$EncodedDomain$ConfigParam" -Headers $headers -OutFile "$TmpDir\fullchain.pem" -UseBasicParsing -SkipCertificateCheck
|
|
Invoke-WebRequest -Uri "$BaseUrl/api/cert/private?domain=$EncodedDomain$ConfigParam" -Headers $headers -OutFile "$TmpDir\private.key" -UseBasicParsing -SkipCertificateCheck
|
|
} catch {
|
|
Log "错误: 下载证书失败 - $_"
|
|
exit 1
|
|
}
|
|
Log "证书下载完成"
|
|
|
|
# 3. 备份旧证书
|
|
Copy-Item "$CertDir\fullchain.pem" "$CertDir\fullchain.pem.bak" -ErrorAction SilentlyContinue
|
|
Copy-Item "$CertDir\private.key" "$CertDir\private.key.bak" -ErrorAction SilentlyContinue
|
|
Log "旧证书已备份"
|
|
|
|
# 4. 原子替换
|
|
Move-Item "$TmpDir\fullchain.pem" "$CertDir\fullchain.pem" -Force
|
|
Move-Item "$TmpDir\private.key" "$CertDir\private.key" -Force
|
|
Log "证书文件已替换"
|
|
|
|
# 5. 校验 & 重载 & 上报
|
|
$HostName = $env:COMPUTERNAME
|
|
try {
|
|
Log "执行校验命令: $CheckCmd"
|
|
Invoke-Expression $CheckCmd
|
|
Log "校验通过，执行重载: $ReloadCmd"
|
|
$remote | Out-File -NoNewline -Encoding ascii $VersionFile
|
|
Invoke-Expression $ReloadCmd
|
|
Log "更新成功: $Domain -> v$remote"
|
|
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=success&hostname=$HostName&message=deployed+v$remote$ConfigParam" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
|
|
} catch {
|
|
Log "错误: 校验失败，回滚证书 - $_"
|
|
Move-Item "$CertDir\fullchain.pem.bak" "$CertDir\fullchain.pem" -Force -ErrorAction SilentlyContinue
|
|
Move-Item "$CertDir\private.key.bak" "$CertDir\private.key" -Force -ErrorAction SilentlyContinue
|
|
Log "已回滚到旧证书"
|
|
try { Invoke-WebRequest -Uri "$BaseUrl/api/report?domain=$EncodedDomain&status=failed&hostname=$HostName&message=check+failed+rolled+back$ConfigParam" -Headers $headers -Method POST -UseBasicParsing -SkipCertificateCheck | Out-Null } catch {}
|
|
exit 1
|
|
}
|