Start9/start-os
2
0
Fork 0
mirror of https://github.com/Start9Labs/start-os.git synced 2026-03-30 12:11:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes certificate directory mount

Browse Source
This commit is contained in:
Keagan McClelland
2021-10-06 16:50:05 -06:00
committed by Aiden McClelland
parent ec47437a07
commit e9e1f1608f
3 changed files with 46 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
appmgr/src/net/mod.rs
View File

@@ -32,7 +32,7 @@ pub struct NetController {
pub tor: TorController, pub tor: TorController,
#[cfg(feature = "avahi")] #[cfg(feature = "avahi")]
pub mdns: MdnsController, pub mdns: MdnsController,
nginx: NginxController, pub nginx: NginxController,
} }
impl NetController { impl NetController {
pub async fn init( pub async fn init(

75
appmgr/src/net/nginx.rs
View File

@@ -1,6 +1,7 @@
use std::borrow::Borrow;
use std::collections::BTreeMap; use std::collections::BTreeMap;
use std::net::Ipv4Addr; use std::net::Ipv4Addr;
use std::path::PathBuf; use std::path::{Path, PathBuf};
use futures::FutureExt; use futures::FutureExt;
use indexmap::IndexSet; use indexmap::IndexSet;
@@ -14,12 +15,19 @@ use crate::s9pk::manifest::PackageId;
use crate::util::{Invoke, Port}; use crate::util::{Invoke, Port};
use crate::{Error, ErrorKind, ResultExt}; use crate::{Error, ErrorKind, ResultExt};
pub struct NginxController(Mutex<NginxControllerInner>); pub struct NginxController {
nginx_root: PathBuf,
inner: Mutex<NginxControllerInner>,
}
impl NginxController { impl NginxController {
pub async fn init(nginx_root: PathBuf, db: SqlitePool) -> Result<Self, Error> { pub async fn init(nginx_root: PathBuf, db: SqlitePool) -> Result<Self, Error> {
Ok(NginxController(Mutex::new( Ok(NginxController {
NginxControllerInner::init(nginx_root, db).await?, inner: Mutex::new(NginxControllerInner::init(&nginx_root, db).await?),
))) nginx_root,
})
}
pub fn ssl_directory_for(&self, package: &PackageId) -> PathBuf {
self.nginx_root.join("ssl").join(package)
} }
pub async fn add<I: IntoIterator<Item = (InterfaceId, InterfaceMetadata)>>( pub async fn add<I: IntoIterator<Item = (InterfaceId, InterfaceMetadata)>>(
&self, &self,
@@ -27,22 +35,28 @@ impl NginxController {
ipv4: Ipv4Addr, ipv4: Ipv4Addr,
interfaces: I, interfaces: I,
) -> Result<(), Error> { ) -> Result<(), Error> {
self.0.lock().await.add(package, ipv4, interfaces).await self.inner
.lock()
.await
.add(&self.nginx_root, package, ipv4, interfaces)
.await
} }
pub async fn remove(&self, package: &PackageId) -> Result<(), Error> { pub async fn remove(&self, package: &PackageId) -> Result<(), Error> {
self.0.lock().await.remove(package).await self.inner
.lock()
.await
.remove(&self.nginx_root, package)
.await
} }
} }
pub struct NginxControllerInner { pub struct NginxControllerInner {
nginx_root: PathBuf,
interfaces: BTreeMap<PackageId, PackageNetInfo>, interfaces: BTreeMap<PackageId, PackageNetInfo>,
ssl_manager: SslManager, ssl_manager: SslManager,
} }
impl NginxControllerInner { impl NginxControllerInner {
async fn init(nginx_root: PathBuf, db: SqlitePool) -> Result<Self, Error> { async fn init(nginx_root: &Path, db: SqlitePool) -> Result<Self, Error> {
let inner = NginxControllerInner { let inner = NginxControllerInner {
nginx_root,
interfaces: BTreeMap::new(), interfaces: BTreeMap::new(),
ssl_manager: SslManager::init(db).await?, ssl_manager: SslManager::init(db).await?,
}; };
@@ -50,8 +64,8 @@ impl NginxControllerInner {
.ssl_manager .ssl_manager
.certificate_for(&get_hostname().await?) .certificate_for(&get_hostname().await?)
.await?; .await?;
let ssl_path_key = inner.nginx_root.join(format!("ssl/embassy_main.key.pem")); let ssl_path_key = nginx_root.join(format!("ssl/embassy_main.key.pem"));
let ssl_path_cert = inner.nginx_root.join(format!("ssl/embassy_main.cert.pem")); let ssl_path_cert = nginx_root.join(format!("ssl/embassy_main.cert.pem"));
futures::try_join!( futures::try_join!(
tokio::fs::write(&ssl_path_key, key.private_key_to_pem_pkcs8()?), tokio::fs::write(&ssl_path_key, key.private_key_to_pem_pkcs8()?),
tokio::fs::write( tokio::fs::write(
@@ -65,6 +79,7 @@ impl NginxControllerInner {
} }
async fn add<I: IntoIterator<Item = (InterfaceId, InterfaceMetadata)>>( async fn add<I: IntoIterator<Item = (InterfaceId, InterfaceMetadata)>>(
&mut self, &mut self,
nginx_root: &Path,
package: PackageId, package: PackageId,
ipv4: Ipv4Addr, ipv4: Ipv4Addr,
interfaces: I, interfaces: I,
@@ -84,14 +99,12 @@ impl NginxControllerInner {
// get ssl certificate chain // get ssl certificate chain
let (listen_args, ssl_certificate_line, ssl_certificate_key_line) = let (listen_args, ssl_certificate_line, ssl_certificate_key_line) =
if lan_port_config.ssl { if lan_port_config.ssl {
let package_path = self.nginx_root.join(format!("ssl/{}", package)); let package_path = nginx_root.join(format!("ssl/{}", package));
tokio::fs::create_dir_all(package_path).await?; tokio::fs::create_dir_all(package_path).await?;
let ssl_path_key = self let ssl_path_key =
.nginx_root nginx_root.join(format!("ssl/{}/{}.key.pem", package, id));
.join(format!("ssl/{}/{}.key.pem", package, id)); let ssl_path_cert =
let ssl_path_cert = self nginx_root.join(format!("ssl/{}/{}.cert.pem", package, id));
.nginx_root
.join(format!("ssl/{}/{}.cert.pem", package, id));
let (key, chain) = self.ssl_manager.certificate_for(&meta.dns_base).await?; let (key, chain) = self.ssl_manager.certificate_for(&meta.dns_base).await?;
// write nginx ssl certs // write nginx ssl certs
futures::try_join!( futures::try_join!(
@@ -127,9 +140,8 @@ impl NginxControllerInner {
) )
}; };
// write nginx configs // write nginx configs
let nginx_conf_path = self let nginx_conf_path =
.nginx_root nginx_root.join(format!("sites-available/{}_{}.conf", package, id));
.join(format!("sites-available/{}_{}.conf", package, id));
tokio::fs::write( tokio::fs::write(
&nginx_conf_path, &nginx_conf_path,
format!( format!(
@@ -144,9 +156,8 @@ impl NginxControllerInner {
) )
.await .await
.with_ctx(|_| (ErrorKind::Filesystem, nginx_conf_path.display().to_string()))?; .with_ctx(|_| (ErrorKind::Filesystem, nginx_conf_path.display().to_string()))?;
let sites_enabled_link_path = self let sites_enabled_link_path =
.nginx_root nginx_root.join(format!("sites-enabled/{}_{}.conf", package, id));
.join(format!("sites-enabled/{}_{}.conf", package, id));
if tokio::fs::metadata(&sites_enabled_link_path).await.is_ok() { if tokio::fs::metadata(&sites_enabled_link_path).await.is_ok() {
tokio::fs::remove_file(&sites_enabled_link_path).await?; tokio::fs::remove_file(&sites_enabled_link_path).await?;
} }
@@ -171,18 +182,16 @@ impl NginxControllerInner {
self.hup().await?; self.hup().await?;
Ok(()) Ok(())
} }
async fn remove(&mut self, package: &PackageId) -> Result<(), Error> { async fn remove(&mut self, nginx_root: &Path, package: &PackageId) -> Result<(), Error> {
let removed = self.interfaces.remove(package); let removed = self.interfaces.remove(package);
if let Some(net_info) = removed { if let Some(net_info) = removed {
for (id, _meta) in net_info.interfaces { for (id, _meta) in net_info.interfaces {
// remove ssl certificates and nginx configs // remove ssl certificates and nginx configs
let package_path = self.nginx_root.join(format!("ssl/{}", package)); let package_path = nginx_root.join(format!("ssl/{}", package));
let enabled_path = self let enabled_path =
.nginx_root nginx_root.join(format!("sites-enabled/{}_{}.conf", package, id));
.join(format!("sites-enabled/{}_{}.conf", package, id)); let available_path =
let available_path = self nginx_root.join(format!("sites-available/{}_{}.conf", package, id));
.nginx_root
.join(format!("sites-available/{}_{}.conf", package, id));
let _ = futures::try_join!( let _ = futures::try_join!(
tokio::fs::remove_dir_all(&package_path).map(|res| res tokio::fs::remove_dir_all(&package_path).map(|res| res
.with_ctx(|_| (ErrorKind::Filesystem, package_path.display().to_string()))), .with_ctx(|_| (ErrorKind::Filesystem, package_path.display().to_string()))),

9
appmgr/src/volume.rs
View File

@@ -212,12 +212,9 @@ impl Volume {
} else { } else {
path.as_ref() path.as_ref()
}), }),
Volume::Certificate { interface_id } => ctx Volume::Certificate { interface_id: _ } => {
.datadir ctx.net_controller.nginx.ssl_directory_for(pkg_id)
.join(PKG_VOLUME_DIR) }
.join(pkg_id)
.join("certificates")
.join(interface_id),
Volume::Backup { .. } => Path::new(BACKUP_DIR).join(pkg_id), Volume::Backup { .. } => Path::new(BACKUP_DIR).join(pkg_id),
} }
} }