From 014f83332cd21b388d0acad5919cfd710489a516 Mon Sep 17 00:00:00 2001 From: Joao Gilberto Magalhaes Date: Sun, 2 Jul 2023 00:15:38 -0500 Subject: [PATCH] Using Certbot auto-config --- src/functions/__init__.py | 43 ++++++++++++++++++++++++++++++++++ src/tests/test_containerenv.py | 22 +++++++++++------ 2 files changed, 58 insertions(+), 7 deletions(-) diff --git a/src/functions/__init__.py b/src/functions/__init__.py index 58bacf9..e595dd4 100644 --- a/src/functions/__init__.py +++ b/src/functions/__init__.py @@ -5,6 +5,7 @@ import time from datetime import datetime from multiprocessing import Process +import requests from OpenSSL import crypto @@ -27,12 +28,54 @@ class ContainerEnv: "EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy" env_vars["certbot"] = { + "autoconfig": os.getenv("EASYHAPROXY_CERTBOT_AUTOCONFIG", "letsencrypt"), "email": os.getenv("EASYHAPROXY_CERTBOT_EMAIL", ""), "server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", False), "eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""), "eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""), } + if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "": + if env_vars["certbot"]["autoconfig"] == "letsencrypt": + env_vars["certbot"]["server"] = "https://acme-v02.api.letsencrypt.org/directory" + + if env_vars["certbot"]["autoconfig"] == "letsencrypt_test": + env_vars["certbot"]["server"] = "https://acme-staging-v02.api.letsencrypt.org/directory" + + if env_vars["certbot"]["autoconfig"] == "buypass": + env_vars["certbot"]["server"] = "https://api.buypass.com/acme/directory" + + if env_vars["certbot"]["autoconfig"] == "buypass_test": + env_vars["certbot"]["server"] = "https://api.test4.buypass.no/acme/directory" + + if env_vars["certbot"]["autoconfig"] == "sslcom_rca": + env_vars["certbot"]["server"] = "https://acme.ssl.com/sslcom-dv-rsa" + + if env_vars["certbot"]["autoconfig"] == "sslcom_ecc": + env_vars["certbot"]["server"] = "https://acme.ssl.com/sslcom-dv-ecc" + + if env_vars["certbot"]["autoconfig"] == "google": + env_vars["certbot"]["server"] = "https://dv.acme-v02.api.pki.goog/directory" + + if env_vars["certbot"]["autoconfig"] == "google_test": + env_vars["certbot"]["server"] = "https://dv.acme-v02.test-api.pki.goog/directory" + + if env_vars["certbot"]["autoconfig"] == "zerossl": + url = "https://api.zerossl.com/acme/eab-credentials-email" + headers = {"Content-Type": "application/x-www-form-urlencoded"} + data = "email=" + env_vars["certbot"]["email"] + resp = requests.post(url, headers=headers, data=data).json() + + if resp["success"]: + env_vars["certbot"]["server"] = "https://acme.zerossl.com/v2/DV90" + env_vars["certbot"]["eab_kid"] = os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = resp["eab_kid"] + env_vars["certbot"]["eab_hmac_key"] = os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = resp["eab_hmac_key"] + else: + os.environ["EASYHAPROXY_CERTBOT_EMAIL"] = "" + Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "Could not obtain ZeroSSL credentials " + resp["error"]["type"]) + + os.environ['EASYHAPROXY_CERTBOT_SERVER'] = env_vars["certbot"]["server"] + return env_vars diff --git a/src/tests/test_containerenv.py b/src/tests/test_containerenv.py index 0347788..3c60928 100644 --- a/src/tests/test_containerenv.py +++ b/src/tests/test_containerenv.py @@ -8,7 +8,8 @@ def test_container_env_empty(): "customerrors": False, "ssl_mode": "default", "lookup_label": "easyhaproxy", - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -24,7 +25,8 @@ def test_container_env_customerrors(): "customerrors": True, "ssl_mode": "default", "lookup_label": "easyhaproxy", - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -40,7 +42,8 @@ def test_container_env_sslmode(): "customerrors": False, "ssl_mode": "strict", "lookup_label": "easyhaproxy", - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -57,7 +60,8 @@ def test_container_env_stats(): "customerrors": False, "ssl_mode": "default", "lookup_label": "easyhaproxy", - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -80,7 +84,8 @@ def test_container_env_stats_password(): "port": "1936" }, - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -103,7 +108,8 @@ def test_container_env_stats_password_2(): "password": "xyz", "port": "2101" }, - "certbot": {"eab_hmac_key": "", + "certbot": {"autoconfig": "letsencrypt", + "eab_hmac_key": "", "eab_kid": "", "email": "", "server": False} @@ -122,10 +128,11 @@ def test_container_env_certbot_email(): "ssl_mode": "default", "lookup_label": "easyhaproxy", "certbot": { + "autoconfig": "letsencrypt", 'eab_hmac_key': "", 'eab_kid': "", "email": "acme@example.org", - "server": False + "server": 'https://acme-v02.api.letsencrypt.org/directory' } } == ContainerEnv.read() finally: @@ -143,6 +150,7 @@ def test_container_env_certbot_full(): "ssl_mode": "default", "lookup_label": "easyhaproxy", "certbot": { + "autoconfig": "letsencrypt", "email": "acme@example.org", "server": "schema://url/a", 'eab_hmac_key': 'eab_hmac_key',