diff --git a/community-edition/generate_script/hcce.yam b/community-edition/generate_script/hcce.yam index 46442274..358a73fe 100644 --- a/community-edition/generate_script/hcce.yam +++ b/community-edition/generate_script/hcce.yam @@ -447,7 +447,7 @@ spec: image: $Container_Dockerhub_Username/reticulum:$Container_Tag ports: - containerPort: 9100 - imagePullPolicy: IfNotPresent + imagePullPolicy: Always env: - name: POD_IP valueFrom: @@ -561,6 +561,8 @@ spec: value: "http://speelycaptor:5000" - name: turkeyCfg_STORAGE_QUOTA_GB value: "1000" + - name: ERL_MAX_PORTS + value: "1024" livenessProbe: httpGet: path: /health @@ -815,7 +817,7 @@ spec: containers: - name: hubs image: $Container_Dockerhub_Username/hubs:$Container_Tag - imagePullPolicy: IfNotPresent + imagePullPolicy: Always env: - name: turkeyCfg_thumbnail_server value: 'cors.$HUB_DOMAIN/nearspark' @@ -885,7 +887,7 @@ spec: containers: - name: spoke image: $Container_Dockerhub_Username/spoke:$Container_Tag - imagePullPolicy: IfNotPresent + imagePullPolicy: Always env: - name: turkeyCfg_thumbnail_server value: 'cors.$HUB_DOMAIN/nearspark' @@ -957,7 +959,7 @@ spec: image: $Container_Dockerhub_Username/nearspark:$Container_Tag ports: - containerPort: 5000 - imagePullPolicy: IfNotPresent + imagePullPolicy: Always --- apiVersion: v1 kind: Service @@ -1050,7 +1052,7 @@ spec: containers: - name: photomnemonic image: $Container_Dockerhub_Username/photomnemonic:$Container_Tag - imagePullPolicy: IfNotPresent + imagePullPolicy: Always --- apiVersion: v1 kind: Service @@ -1240,6 +1242,8 @@ spec: containers: - name: haproxy image: $Container_Dockerhub_Username/haproxy:$Container_Tag + command: ["sh", "-c", 'ulimit -n 524288 && /start.sh "$@"', "--"] + args: - --configmap=$Namespace/haproxy-config - --https-bind-port=4443 @@ -1381,3 +1385,36 @@ subjects: - kind: ServiceAccount name: haproxy-sa namespace: $Namespace + +--- + ############################################################################################## + ############################################ www-redirect ####################################### + ############################################################################################## + + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: www-redirect + namespace: $Namespace + annotations: + kubernetes.io/ingress.class: haproxy + haproxy.org/config-snippet: | + http-request redirect prefix location https://$HUB_DOMAIN/ code 301 + spec: + tls: + - hosts: + - www.$HUB_DOMAIN + secretName: cert-www.$HUB_DOMAIN + rules: + - host: www.$HUB_DOMAIN + http: + paths: + - path: / + pathType: Prefix + backend: + service: + # backend won't be used because of redirect annotation, + # but ingress requires one. + name: ret + port: + number: 4001 diff --git a/community-edition/package.json b/community-edition/package.json index 252cf2cc..e28fa8d0 100644 --- a/community-edition/package.json +++ b/community-edition/package.json @@ -10,7 +10,9 @@ "gen-ssl": "node ssl_script/index.js", "backup": "node backup_script/index.js", "restore-backup": "node restore_backup_script/index.js", - "test": "echo \"Error: no test specified\" && exit 1" + "test": "echo \"Error: no test specified\" && exit 1", + "check-ssl": "node ssl_script/check-cert.js", + "regen-ssl": "node ssl_script/regen-ssl.js" }, "keywords": [], "author": "", diff --git a/community-edition/ssl_script/check-cert.js b/community-edition/ssl_script/check-cert.js new file mode 100644 index 00000000..1a35cef4 --- /dev/null +++ b/community-edition/ssl_script/check-cert.js @@ -0,0 +1,52 @@ +const fs = require("fs"); +const { execSync } = require("child_process"); + +// Read hcce.yaml +const yaml = fs.readFileSync("hcce.yaml", "utf8"); + +// Extract HUB_DOMAIN +const match = yaml.match(/HUB_DOMAIN:\s*"?([^"\n]+)"?/); +if (!match) { + console.error("āŒ Could not find HUB_DOMAIN in hcce.yaml"); + process.exit(1); +} + +const baseDomain = match[1].trim(); +const domains = [baseDomain, `www.${baseDomain}`]; + +console.log(`šŸŒ Checking domains: ${domains.join(", ")}`); + +let shouldRenew = false; + +domains.forEach(domain => { + try { + const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -enddate`; + const output = execSync(cmd).toString(); + + const exp = output.split("=")[1].trim(); + const expDate = new Date(exp); + const now = new Date(); + const diff = Math.floor((expDate - now) / (1000 * 60 * 60 * 24)); + + console.log(`\nšŸ”¹ ${domain}`); + console.log(` šŸ“… Expires: ${exp}`); + console.log(` ā³ Days left: ${diff}`); + + if (diff < 20) { + console.log(` āš ļø Needs renewal soon`); + shouldRenew = true; + } + + } catch (err) { + console.log(`\nšŸ”¹ ${domain}`); + console.log(` āŒ Failed to check certificate`); + shouldRenew = true; + } +}); + +if (shouldRenew) { + console.log("\nšŸšØ One or more certs need attention"); + process.exit(2); +} else { + console.log("\nāœ… All certs look good"); +} diff --git a/community-edition/ssl_script/index.js b/community-edition/ssl_script/index.js index 00914863..0145283c 100644 --- a/community-edition/ssl_script/index.js +++ b/community-edition/ssl_script/index.js @@ -56,6 +56,7 @@ function main() { const template = utils.readTemplate("ssl_script", "cbb.yam"); const rootHubDomain = config.HUB_DOMAIN; generate_ssl(config, template, rootHubDomain); + generate_ssl(config, template, `www.${rootHubDomain}`); generate_ssl(config, template, `assets.${rootHubDomain}`); generate_ssl(config, template, `stream.${rootHubDomain}`); generate_ssl(config, template, `cors.${rootHubDomain}`); diff --git a/community-edition/ssl_script/regen-ssl.js b/community-edition/ssl_script/regen-ssl.js new file mode 100644 index 00000000..55d21885 --- /dev/null +++ b/community-edition/ssl_script/regen-ssl.js @@ -0,0 +1,88 @@ +const fs = require("fs"); +const { execSync } = require("child_process"); + +// ---- FLAGS ---- +const force = process.argv.includes("--force"); + +// ---- STEP 1: Get domain from hcce.yaml ---- +const yaml = fs.readFileSync("hcce.yaml", "utf8"); +const match = yaml.match(/HUB_DOMAIN:\s*"?([^"\n]+)"?/); + +if (!match) { + console.error("āŒ Could not find HUB_DOMAIN"); + process.exit(1); +} + +const baseDomain = match[1].trim(); +const domains = [baseDomain, `www.${baseDomain}`]; + +console.log(`šŸŒ Checking: ${domains.join(", ")}`); +if (force) console.log("āš ļø FORCE MODE ENABLED"); + +// ---- STEP 2: Check expiration ---- +let shouldRenew = false; + +domains.forEach(domain => { + try { + const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -enddate`; + const output = execSync(cmd).toString(); + + const exp = output.split("=")[1].trim(); + const diff = Math.floor((new Date(exp) - new Date()) / (1000 * 60 * 60 * 24)); + + console.log(`šŸ”¹ ${domain}: ${diff} days`); + + if (diff < 20 || force) { + shouldRenew = true; + } + + } catch (e) { + console.log(`āŒ Failed check for ${domain}`); + shouldRenew = true; + } +}); + +// ---- STEP 3: Exit if not needed ---- +if (!shouldRenew) { + console.log("āœ… Certs healthy. Skipping renewal."); + process.exit(0); +} + +console.log("šŸšØ Proceeding with SSL renewal..."); + +// ---- STEP 4: Enable default cert ---- +execSync( + `sed -i.bak 's/#- - - default-ssl-certificate+hcce\\/cert-hcce/- - - default-ssl-certificate+hcce\\/cert-hcce/' hcce.yaml` +); +execSync(`kubectl apply -f hcce.yaml`, { stdio: "inherit" }); + +// ---- STEP 5: Generate cert ---- +execSync(`npm run gen-ssl`, { stdio: "inherit" }); + +// ---- STEP 6: Disable default cert ---- +execSync( + `sed -i.bak 's/- - - default-ssl-certificate+hcce\\/cert-hcce/#- - - default-ssl-certificate+hcce\\/cert-hcce/' hcce.yaml` +); +execSync(`kubectl apply -f hcce.yaml`, { stdio: "inherit" }); + +// ---- STEP 7: Restart pods ---- +execSync(`kubectl rollout restart deployment -n hcce`, { stdio: "inherit" }); + +console.log("ā³ Waiting 20s..."); +execSync(`sleep 20`); + +// ---- STEP 8: Verify ---- +domains.forEach(domain => { + try { + const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -issuer -enddate`; + const output = execSync(cmd).toString(); + + console.log(`\nšŸ” ${domain}`); + console.log(output); + + } catch (e) { + console.log(`āŒ Verification failed for ${domain}`); + } +}); + +console.log("\nāœ… Done.");