Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls: Auto-migrate cert assets to new path (details in #3124)
Matthew Holt committed
Mar 7, 2020 at 10:42 UTC
4d18587192e4fffe5b34b714eaabcfc212914c1e
1 file changed
+128
-2
modules/caddytls/tls.go
+128
-2
@@ -18,7 +18,11 @@ import (
18
"crypto/tls"
19
"encoding/json"
20
"fmt"
21
+ "io/ioutil"
22
"net/http"
23
+ "os"
24
+ "path/filepath"
25
+ "strings"
26
"sync"
27
"time"
28
@@ -71,8 +75,6 @@ func (TLS) CaddyModule() caddy.ModuleInfo {
75
76
// Provision sets up the configuration for the TLS app.
77
func (t *TLS) Provision(ctx caddy.Context) error {
74
- // TODO: Move assets to the new folder structure!!
75
-
78
t.ctx = ctx
79
t.logger = ctx.Logger(t)
80
@@ -162,6 +164,14 @@ func (t *TLS) Provision(ctx caddy.Context) error {
164
}
165
}
166
167
+ // TODO: TEMPORARY UNTIL RELEASE CANDIDATES:
168
+ // MIGRATE MANAGED CERTIFICATE ASSETS TO NEW PATH
169
+ err = t.moveCertificates()
170
+ if err != nil {
171
+ t.logger.Error("migrating certificates", zap.Error(err))
172
+ }
173
+ // END TODO: TEMPORARY.
174
+
175
return nil
176
}
177
@@ -661,3 +671,119 @@ var (
671
)
672
673
const automateKey = "automate"
674
+
675
+// TODO: This is temporary until the release candidates
676
+// (beta 16 changed the storage path for certificates),
677
+// after which this function can be deleted
678
+func (t *TLS) moveCertificates() error {
679
+ log := t.logger.Named("automigrate")
680
+
681
+ oldAcmeDir := filepath.Join(caddy.AppDataDir(), "acme")
682
+
683
+ // if custom storage path was defined, use that instead
684
+ if fs, ok := t.ctx.Storage().(*certmagic.FileStorage); ok {
685
+ oldAcmeDir = fs.Path
686
+ }
687
+
688
+ oldAcmeCas, err := ioutil.ReadDir(oldAcmeDir)
689
+ if err != nil {
690
+ if os.IsNotExist(err) {
691
+ return nil
692
+ }
693
+ return fmt.Errorf("listing used ACME CAs: %v", err)
694
+ }
695
+
696
+ // get list of used CAs
697
+ var oldCANames []string
698
+ for _, fi := range oldAcmeCas {
699
+ if !fi.IsDir() {
700
+ continue
701
+ }
702
+ oldCANames = append(oldCANames, fi.Name())
703
+ }
704
+
705
+ for _, oldCA := range oldCANames {
706
+ // make new destination path
707
+ newCAName := oldCA
708
+ if strings.Contains(oldCA, "api.letsencrypt.org") {
709
+ newCAName += "-directory"
710
+ }
711
+ newBaseDir := filepath.Join(caddy.AppDataDir(), "certificates", newCAName)
712
+ err := os.MkdirAll(newBaseDir, 0700)
713
+ if err != nil {
714
+ return fmt.Errorf("making new certs directory: %v", err)
715
+ }
716
+
717
+ // list sites in old path
718
+ oldAcmeSitesDir := filepath.Join(oldAcmeDir, oldCA, "sites")
719
+ oldAcmeSites, err := ioutil.ReadDir(oldAcmeSitesDir)
720
+ if err != nil {
721
+ if os.IsNotExist(err) {
722
+ continue
723
+ }
724
+ return fmt.Errorf("listing sites: %v", err)
725
+ }
726
+
727
+ if len(oldAcmeSites) > 0 {
728
+ log.Warn("certificate storage path has changed; attempting one-time auto-migration",
729
+ zap.String("old_folder", oldAcmeSitesDir),
730
+ zap.String("new_folder", newBaseDir),
731
+ zap.String("details", "https://github.com/caddyserver/caddy/issues/2955"))
732
+ }
733
+
734
+ // for each site, move its folder and re-encode its metadata
735
+ for _, siteInfo := range oldAcmeSites {
736
+ if !siteInfo.IsDir() {
737
+ continue
738
+ }
739
+
740
+ // move the folder
741
+ oldPath := filepath.Join(oldAcmeSitesDir, siteInfo.Name())
742
+ newPath := filepath.Join(newBaseDir, siteInfo.Name())
743
+ log.Info("moving certificate assets",
744
+ zap.String("ca", oldCA),
745
+ zap.String("site", siteInfo.Name()),
746
+ zap.String("destination", newPath))
747
+ err = os.Rename(oldPath, newPath)
748
+ if err != nil {
749
+ log.Error("failed moving site to new path; skipping",
750
+ zap.String("old_path", oldPath),
751
+ zap.String("new_path", newPath),
752
+ zap.Error(err))
753
+ continue
754
+ }
755
+
756
+ // re-encode metadata file
757
+ metaFilePath := filepath.Join(newPath, siteInfo.Name()+".json")
758
+ metaContents, err := ioutil.ReadFile(metaFilePath)
759
+ if err != nil {
760
+ log.Error("could not read metadata file",
761
+ zap.String("filename", metaFilePath),
762
+ zap.Error(err))
763
+ continue
764
+ }
765
+ if len(metaContents) == 0 {
766
+ continue
767
+ }
768
+ cr := certmagic.CertificateResource{
769
+ SANs: []string{siteInfo.Name()},
770
+ IssuerData: json.RawMessage(metaContents),
771
+ }
772
+ newMeta, err := json.MarshalIndent(cr, "", "\t")
773
+ if err != nil {
774
+ log.Error("encoding new metadata file", zap.Error(err))
775
+ continue
776
+ }
777
+ err = ioutil.WriteFile(metaFilePath, newMeta, 0600)
778
+ if err != nil {
779
+ log.Error("writing new metadata file", zap.Error(err))
780
+ continue
781
+ }
782
+ }
783
+
784
+ // delete now-empty old sites dir (OK if fails)
785
+ os.Remove(oldAcmeSitesDir)
786
+ }
787
+
788
+ return nil
789
+}