Add SSL certificate checking and regeneration scripts

community-edition/generate_script/hcce.yam

@@ -447,7 +447,7 @@ spec:
         image: $Container_Dockerhub_Username/reticulum:$Container_Tag
         ports:
         - containerPort: 9100
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         env:
         - name: POD_IP
           valueFrom:
@@ -561,6 +561,8 @@ spec:
           value: "http://speelycaptor:5000"
         - name: turkeyCfg_STORAGE_QUOTA_GB
           value: "1000"
+        - name: ERL_MAX_PORTS
+          value: "1024"
         livenessProbe:
           httpGet:
             path: /health
@@ -815,7 +817,7 @@ spec:
       containers:
       - name: hubs
         image: $Container_Dockerhub_Username/hubs:$Container_Tag
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         env:
         - name: turkeyCfg_thumbnail_server
           value: 'cors.$HUB_DOMAIN/nearspark'
@@ -885,7 +887,7 @@ spec:
       containers:
       - name: spoke
         image: $Container_Dockerhub_Username/spoke:$Container_Tag
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         env:
         - name: turkeyCfg_thumbnail_server
           value: 'cors.$HUB_DOMAIN/nearspark'
@@ -957,7 +959,7 @@ spec:
         image: $Container_Dockerhub_Username/nearspark:$Container_Tag
         ports:
         - containerPort: 5000
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
 ---
 apiVersion: v1
 kind: Service
@@ -1050,7 +1052,7 @@ spec:
       containers:
       - name: photomnemonic
         image: $Container_Dockerhub_Username/photomnemonic:$Container_Tag
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
 ---
 apiVersion: v1
 kind: Service
@@ -1240,6 +1242,8 @@ spec:
       containers:
       - name: haproxy
         image: $Container_Dockerhub_Username/haproxy:$Container_Tag
+        command: ["sh", "-c", 'ulimit -n 524288 && /start.sh "$@"', "--"]
+
         args:
         - --configmap=$Namespace/haproxy-config
         - --https-bind-port=4443
@@ -1381,3 +1385,36 @@ subjects:
 - kind: ServiceAccount
   name: haproxy-sa
   namespace: $Namespace
+
+---
+  ##############################################################################################
+  ############################################ www-redirect #######################################
+  ##############################################################################################
+
+  apiVersion: networking.k8s.io/v1
+  kind: Ingress
+  metadata:
+    name: www-redirect
+    namespace: $Namespace
+    annotations:
+      kubernetes.io/ingress.class: haproxy
+      haproxy.org/config-snippet: |
+        http-request redirect prefix location https://$HUB_DOMAIN/ code 301
+  spec:
+    tls:
+      - hosts:
+          - www.$HUB_DOMAIN
+        secretName: cert-www.$HUB_DOMAIN
+    rules:
+      - host: www.$HUB_DOMAIN
+        http:
+          paths:
+            - path: /
+              pathType: Prefix
+              backend:
+                service:
+                  # backend won't be used because of redirect annotation,
+                  # but ingress requires one.
+                  name: ret
+                  port:
+                    number: 4001

community-edition/package.json

@@ -10,7 +10,9 @@
     "gen-ssl": "node ssl_script/index.js",
     "backup": "node backup_script/index.js",
     "restore-backup": "node restore_backup_script/index.js",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "check-ssl": "node ssl_script/check-cert.js",
+    "regen-ssl": "node ssl_script/regen-ssl.js"
   },
   "keywords": [],
   "author": "",

community-edition/ssl_script/check-cert.js

@@ -0,0 +1,52 @@
+const fs = require("fs");
+const { execSync } = require("child_process");
+
+// Read hcce.yaml
+const yaml = fs.readFileSync("hcce.yaml", "utf8");
+
+// Extract HUB_DOMAIN
+const match = yaml.match(/HUB_DOMAIN:\s*"?([^"\n]+)"?/);
+if (!match) {
+  console.error("❌ Could not find HUB_DOMAIN in hcce.yaml");
+  process.exit(1);
+}
+
+const baseDomain = match[1].trim();
+const domains = [baseDomain, `www.${baseDomain}`];
+
+console.log(`🌐 Checking domains: ${domains.join(", ")}`);
+
+let shouldRenew = false;
+
+domains.forEach(domain => {
+  try {
+    const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -enddate`;
+    const output = execSync(cmd).toString();
+
+    const exp = output.split("=")[1].trim();
+    const expDate = new Date(exp);
+    const now = new Date();
+    const diff = Math.floor((expDate - now) / (1000 * 60 * 60 * 24));
+
+    console.log(`\n🔹 ${domain}`);
+    console.log(`   📅 Expires: ${exp}`);
+    console.log(`   ⏳ Days left: ${diff}`);
+
+    if (diff < 20) {
+      console.log(`   ⚠️ Needs renewal soon`);
+      shouldRenew = true;
+    }
+
+  } catch (err) {
+    console.log(`\n🔹 ${domain}`);
+    console.log(`   ❌ Failed to check certificate`);
+    shouldRenew = true;
+  }
+});
+
+if (shouldRenew) {
+  console.log("\n🚨 One or more certs need attention");
+  process.exit(2);
+} else {
+  console.log("\n✅ All certs look good");
+}

community-edition/ssl_script/index.js

@@ -56,6 +56,7 @@ function main() {
     const template = utils.readTemplate("ssl_script", "cbb.yam");
     const rootHubDomain = config.HUB_DOMAIN;
     generate_ssl(config, template, rootHubDomain);
+    generate_ssl(config, template, `www.${rootHubDomain}`);
     generate_ssl(config, template, `assets.${rootHubDomain}`);
     generate_ssl(config, template, `stream.${rootHubDomain}`);
     generate_ssl(config, template, `cors.${rootHubDomain}`);

community-edition/ssl_script/regen-ssl.js

@@ -0,0 +1,88 @@
+const fs = require("fs");
+const { execSync } = require("child_process");
+
+// ---- FLAGS ----
+const force = process.argv.includes("--force");
+
+// ---- STEP 1: Get domain from hcce.yaml ----
+const yaml = fs.readFileSync("hcce.yaml", "utf8");
+const match = yaml.match(/HUB_DOMAIN:\s*"?([^"\n]+)"?/);
+
+if (!match) {
+  console.error("❌ Could not find HUB_DOMAIN");
+  process.exit(1);
+}
+
+const baseDomain = match[1].trim();
+const domains = [baseDomain, `www.${baseDomain}`];
+
+console.log(`🌐 Checking: ${domains.join(", ")}`);
+if (force) console.log("⚠️ FORCE MODE ENABLED");
+
+// ---- STEP 2: Check expiration ----
+let shouldRenew = false;
+
+domains.forEach(domain => {
+  try {
+    const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -enddate`;
+    const output = execSync(cmd).toString();
+
+    const exp = output.split("=")[1].trim();
+    const diff = Math.floor((new Date(exp) - new Date()) / (1000 * 60 * 60 * 24));
+
+    console.log(`🔹 ${domain}: ${diff} days`);
+
+    if (diff < 20 || force) {
+      shouldRenew = true;
+    }
+
+  } catch (e) {
+    console.log(`❌ Failed check for ${domain}`);
+    shouldRenew = true;
+  }
+});
+
+// ---- STEP 3: Exit if not needed ----
+if (!shouldRenew) {
+  console.log("✅ Certs healthy. Skipping renewal.");
+  process.exit(0);
+}
+
+console.log("🚨 Proceeding with SSL renewal...");
+
+// ---- STEP 4: Enable default cert ----
+execSync(
+  `sed -i.bak 's/#- - - default-ssl-certificate+hcce\\/cert-hcce/- - - default-ssl-certificate+hcce\\/cert-hcce/' hcce.yaml`
+);
+execSync(`kubectl apply -f hcce.yaml`, { stdio: "inherit" });
+
+// ---- STEP 5: Generate cert ----
+execSync(`npm run gen-ssl`, { stdio: "inherit" });
+
+// ---- STEP 6: Disable default cert ----
+execSync(
+  `sed -i.bak 's/- - - default-ssl-certificate+hcce\\/cert-hcce/#- - - default-ssl-certificate+hcce\\/cert-hcce/' hcce.yaml`
+);
+execSync(`kubectl apply -f hcce.yaml`, { stdio: "inherit" });
+
+// ---- STEP 7: Restart pods ----
+execSync(`kubectl rollout restart deployment -n hcce`, { stdio: "inherit" });
+
+console.log("⏳ Waiting 20s...");
+execSync(`sleep 20`);
+
+// ---- STEP 8: Verify ----
+domains.forEach(domain => {
+  try {
+    const cmd = `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -issuer -enddate`;
+    const output = execSync(cmd).toString();
+
+    console.log(`\n🔍 ${domain}`);
+    console.log(output);
+
+  } catch (e) {
+    console.log(`❌ Verification failed for ${domain}`);
+  }
+});
+
+console.log("\n✅ Done.");