Skip to content

Commit 87f61b8

Browse files
jc21jc21
authored
Merge pull request #572 from jipjan/features/dns-cloudflare
Add DNS CloudFlare with wildcard support
2 parents 4bafc7f + a561605 commit 87f61b8

File tree

14 files changed

+324
-61
lines changed

14 files changed

+324
-61
lines changed

‎backend/internal/certificate.js‎

Lines changed: 111 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -141,36 +141,60 @@ const internalCertificate = {
141141
});
142142
})
143143
.then((in_use_result) => {
144-
// 3. Generate the LE config
145-
return internalNginx.generateLetsEncryptRequestConfig(certificate)
146-
.then(internalNginx.reload)
147-
.then(() => {
144+
// Is CloudFlare, no config needed, so skip 3 and 5.
145+
if (data.meta.cloudflare_use) {
146+
return internalNginx.reload().then(() => {
148147
// 4. Request cert
149-
return internalCertificate.requestLetsEncryptSsl(certificate);
150-
})
151-
.then(() => {
152-
// 5. Remove LE config
153-
return internalNginx.deleteLetsEncryptRequestConfig(certificate);
154-
})
155-
.then(internalNginx.reload)
156-
.then(() => {
157-
// 6. Re-instate previously disabled hosts
158-
return internalCertificate.enableInUseHosts(in_use_result);
159-
})
160-
.then(() => {
161-
return certificate;
148+
return internalCertificate.requestLetsEncryptCloudFlareDnsSsl(certificate, data.meta.cloudflare_token);
162149
})
163-
.catch((err) => {
164-
// In the event of failure, revert things and throw err back
165-
return internalNginx.deleteLetsEncryptRequestConfig(certificate)
166-
.then(() => {
167-
return internalCertificate.enableInUseHosts(in_use_result);
168-
})
169-
.then(internalNginx.reload)
170-
.then(() => {
171-
throw err;
172-
});
173-
});
150+
.then(internalNginx.reload)
151+
.then(() => {
152+
// 6. Re-instate previously disabled hosts
153+
return internalCertificate.enableInUseHosts(in_use_result);
154+
})
155+
.then(() => {
156+
return certificate;
157+
})
158+
.catch((err) => {
159+
// In the event of failure, revert things and throw err back
160+
return internalCertificate.enableInUseHosts(in_use_result)
161+
.then(internalNginx.reload)
162+
.then(() => {
163+
throw err;
164+
});
165+
});
166+
} else {
167+
// 3. Generate the LE config
168+
return internalNginx.generateLetsEncryptRequestConfig(certificate)
169+
.then(internalNginx.reload)
170+
.then(() => {
171+
// 4. Request cert
172+
return internalCertificate.requestLetsEncryptSsl(certificate);
173+
})
174+
.then(() => {
175+
// 5. Remove LE config
176+
return internalNginx.deleteLetsEncryptRequestConfig(certificate);
177+
})
178+
.then(internalNginx.reload)
179+
.then(() => {
180+
// 6. Re-instate previously disabled hosts
181+
return internalCertificate.enableInUseHosts(in_use_result);
182+
})
183+
.then(() => {
184+
return certificate;
185+
})
186+
.catch((err) => {
187+
// In the event of failure, revert things and throw err back
188+
return internalNginx.deleteLetsEncryptRequestConfig(certificate)
189+
.then(() => {
190+
return internalCertificate.enableInUseHosts(in_use_result);
191+
})
192+
.then(internalNginx.reload)
193+
.then(() => {
194+
throw err;
195+
});
196+
});
197+
}
174198
})
175199
.then(() => {
176200
// At this point, the letsencrypt cert should exist on disk.
@@ -747,6 +771,39 @@ const internalCertificate = {
747771
});
748772
},
749773

774+
/**
775+
* @param {Object} certificate the certificate row
776+
* @param {String} apiToken the cloudflare api token
777+
* @returns {Promise}
778+
*/
779+
requestLetsEncryptCloudFlareDnsSsl: (certificate, apiToken) => {
780+
logger.info('Requesting Let\'sEncrypt certificates via Cloudflare DNS for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
781+
782+
let tokenLoc = '~/cloudflare-token';
783+
let storeKey = 'echo "dns_cloudflare_api_token = ' + apiToken + '" > ' + tokenLoc;
784+
785+
let cmd =
786+
storeKey + ' && ' +
787+
certbot_command + ' certonly --non-interactive ' +
788+
'--cert-name "npm-' + certificate.id + '" ' +
789+
'--agree-tos ' +
790+
'--email "' + certificate.meta.letsencrypt_email + '" ' +
791+
'--domains "' + certificate.domain_names.join(',') + '" ' +
792+
'--dns-cloudflare --dns-cloudflare-credentials ' + tokenLoc +
793+
(le_staging ? ' --staging' : '')
794+
+ ' && rm ' + tokenLoc;
795+
796+
if (debug_mode) {
797+
logger.info('Command:', cmd);
798+
}
799+
800+
return utils.exec(cmd).then((result) => {
801+
logger.info(result);
802+
return result;
803+
});
804+
},
805+
806+
750807
/**
751808
* @param {Access} access
752809
* @param {Object} data
@@ -760,7 +817,9 @@ const internalCertificate = {
760817
})
761818
.then((certificate) => {
762819
if (certificate.provider === 'letsencrypt') {
763-
return internalCertificate.renewLetsEncryptSsl(certificate)
820+
let renewMethod = certificate.meta.cloudflare_use ? internalCertificate.renewLetsEncryptCloudFlareSsl : internalCertificate.renewLetsEncryptSsl;
821+
822+
return renewMethod(certificate)
764823
.then(() => {
765824
return internalCertificate.getCertificateInfoFromFile('/etc/letsencrypt/live/npm-' + certificate.id + '/fullchain.pem');
766825
})
@@ -814,6 +873,29 @@ const internalCertificate = {
814873
});
815874
},
816875

876+
/**
877+
* @param {Object} certificate the certificate row
878+
* @returns {Promise}
879+
*/
880+
renewLetsEncryptCloudFlareSsl: (certificate) => {
881+
logger.info('Renewing Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
882+
883+
let cmd = certbot_command + ' renew --non-interactive ' +
884+
'--cert-name "npm-' + certificate.id + '" ' +
885+
'--disable-hook-validation ' +
886+
(le_staging ? '--staging' : '');
887+
888+
if (debug_mode) {
889+
logger.info('Command:', cmd);
890+
}
891+
892+
return utils.exec(cmd)
893+
.then((result) => {
894+
logger.info(result);
895+
return result;
896+
});
897+
},
898+
817899
/**
818900
* @param {Object} certificate the certificate row
819901
* @param {Boolean} [throw_errors]
@@ -823,7 +905,6 @@ const internalCertificate = {
823905
logger.info('Revoking Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
824906

825907
let cmd = certbot_command + ' revoke --non-interactive ' +
826-
'--config "' + le_config + '" ' +
827908
'--cert-path "/etc/letsencrypt/live/npm-' + certificate.id + '/fullchain.pem" ' +
828909
'--delete-after-revoke ' +
829910
(le_staging ? '--staging' : '');

‎backend/schema/endpoints/certificates.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@
4141
},
4242
"letsencrypt_agree": {
4343
"type": "boolean"
44+
},
45+
"cloudflare_use": {
46+
"type": "boolean"
47+
},
48+
"cloudflare_token": {
49+
"type": "string"
4450
}
4551
}
4652
}

‎docker/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ ENV NODE_ENV=production
1717

1818
RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
1919
&& apk update \
20-
&& apk add python2 certbot jq \
20+
&& apk add python2 py-pip certbot jq \
21+
&& pip install certbot-dns-cloudflare \
2122
&& rm -rf /var/cache/apk/*
2223

2324
ENV NPM_BUILD_VERSION="${BUILD_VERSION}" NPM_BUILD_COMMIT="${BUILD_COMMIT}" NPM_BUILD_DATE="${BUILD_DATE}"

‎docker/dev/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ ENV S6_FIX_ATTRS_HIDDEN=1
77

88
RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
99
&& apk update \
10-
&& apk add python2 certbot jq \
10+
&& apk add python2 py-pip certbot jq \
11+
&& pip install certbot-dns-cloudflare \
1112
&& rm -rf /var/cache/apk/*
1213

1314
# Task

‎frontend/js/app/nginx/certificates/form.ejs‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,24 @@
2020
<input name="meta[letsencrypt_email]" type="email" class="form-control" placeholder="" value="<%- getLetsencryptEmail() %>" required>
2121
</div>
2222
</div>
23+
24+
<!-- CloudFlare -->
25+
<div class="col-sm-12 col-md-12">
26+
<div class="form-group">
27+
<label class="custom-switch">
28+
<input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
29+
<span class="custom-switch-indicator"></span>
30+
<span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
31+
</label>
32+
</div>
33+
</div>
34+
<div class="col-sm-12 col-md-12 cloudflare">
35+
<div class="form-group">
36+
<label class="form-label">CloudFlare DNS API Token <span class="form-required">*</span></label>
37+
<input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
38+
</div>
39+
</div>
40+
2341
<div class="col-sm-12 col-md-12">
2442
<div class="form-group">
2543
<label class="custom-switch">

‎frontend/js/app/nginx/certificates/form.js‎

Lines changed: 42 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,26 +20,59 @@ module.exports = Mn.View.extend({
2020
save: 'button.save',
2121
other_certificate: '#other_certificate',
2222
other_certificate_key: '#other_certificate_key',
23-
other_intermediate_certificate: '#other_intermediate_certificate'
23+
other_intermediate_certificate: '#other_intermediate_certificate',
24+
cloudflare_switch: 'input[name="meta[cloudflare_use]"]',
25+
cloudflare_token: 'input[name="meta[cloudflare_token]"',
26+
cloudflare: '.cloudflare'
2427
},
2528

2629
events: {
30+
'change @ui.cloudflare_switch': function() {
31+
let checked = this.ui.cloudflare_switch.prop('checked');
32+
if (checked) {
33+
this.ui.cloudflare_token.prop('required', 'required');
34+
this.ui.cloudflare.show();
35+
} else {
36+
this.ui.cloudflare_token.prop('required', false);
37+
this.ui.cloudflare.hide();
38+
}
39+
},
2740
'click @ui.save': function (e) {
2841
e.preventDefault();
2942

3043
if (!this.ui.form[0].checkValidity()) {
3144
$('<input type="submit">').hide().appendTo(this.ui.form).click().remove();
45+
$(this).removeClass('btn-loading');
3246
return;
3347
}
3448

3549
let view = this;
3650
let data = this.ui.form.serializeJSON();
3751
data.provider = this.model.get('provider');
3852

53+
54+
55+
let domain_err = false;
56+
if (!data.meta.cloudflare_use) {
57+
data.domain_names.split(',').map(function (name) {
58+
if (name.match(/\*/im)) {
59+
domain_err = true;
60+
}
61+
});
62+
}
63+
64+
if (domain_err) {
65+
alert('Cannot request Let\'s Encrypt Certificate for wildcard domains when not using CloudFlare DNS');
66+
return;
67+
}
68+
3969
// Manipulate
4070
if (typeof data.meta !== 'undefined' && typeof data.meta.letsencrypt_agree !== 'undefined') {
4171
data.meta.letsencrypt_agree = !!data.meta.letsencrypt_agree;
4272
}
73+
if (typeof data.meta !== 'undefined' && typeof data.meta.cloudflare_use !== 'undefined') {
74+
data.meta.cloudflare_use = !!data.meta.cloudflare_use;
75+
}
4376

4477
if (typeof data.domain_names === 'string' && data.domain_names) {
4578
data.domain_names = data.domain_names.split(',');
@@ -81,6 +114,7 @@ module.exports = Mn.View.extend({
81114
}
82115

83116
this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
117+
this.ui.save.addClass('btn-loading');
84118

85119
// compile file data
86120
let form_data = new FormData();
@@ -119,6 +153,7 @@ module.exports = Mn.View.extend({
119153
.catch(err => {
120154
alert(err.message);
121155
this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
156+
this.ui.save.removeClass('btn-loading');
122157
});
123158
}
124159
},
@@ -130,6 +165,10 @@ module.exports = Mn.View.extend({
130165

131166
getLetsencryptAgree: function () {
132167
return typeof this.meta.letsencrypt_agree !== 'undefined' ? this.meta.letsencrypt_agree : false;
168+
},
169+
170+
getCloudflareUse: function () {
171+
return typeof this.meta.cloudflare_use !== 'undefined' ? this.meta.cloudflare_use : false;
133172
}
134173
},
135174

@@ -144,8 +183,9 @@ module.exports = Mn.View.extend({
144183
text: input
145184
};
146185
},
147-
createFilter: /^(?:[^.*]+\.?)+[^.]$/
186+
createFilter: /^(?:[^.]+\.?)+[^.]$/
148187
});
188+
this.ui.cloudflare.hide();
149189
},
150190

151191
initialize: function (options) {

‎frontend/js/app/nginx/certificates/list/item.ejs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
</div>
2929
</td>
3030
<td>
31-
<%- i18n('ssl', provider) %>
31+
<%- i18n('ssl', provider) %><% if (meta.cloudflare_use) { %> - CloudFlare DNS<% } %>
3232
</td>
3333
<td class="<%- isExpired() ? 'text-danger' : '' %>">
3434
<%- formatDbDate(expires_on, 'Do MMMM YYYY, h:mm a') %>

‎frontend/js/app/nginx/dead/form.ejs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,23 @@
7373
</div>
7474
</div>
7575

76+
<!-- CloudFlare -->
77+
<div class="col-sm-12 col-md-12 letsencrypt">
78+
<div class="form-group">
79+
<label class="custom-switch">
80+
<input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
81+
<span class="custom-switch-indicator"></span>
82+
<span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
83+
</label>
84+
</div>
85+
</div>
86+
<div class="col-sm-12 col-md-12 cloudflare letsencrypt">
87+
<div class="form-group">
88+
<label class="form-label">CloudFlare DNS API Token <span class="form-required">*</span></label>
89+
<input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
90+
</div>
91+
</div>
92+
7693
<!-- Lets encrypt -->
7794
<div class="col-sm-12 col-md-12 letsencrypt">
7895
<div class="form-group">

0 commit comments

Comments
 (0)