Compare commits

..

No commits in common. "master" and "v0.6.1" have entirely different histories.

6 changed files with 294 additions and 490 deletions

2
.gitignore vendored
View File

@ -1,5 +1,3 @@
*delete-me*
# ---> Node
# Logs
logs

View File

@ -1,64 +1,3 @@
# [greenlock-manager-fs.js](https://git.rootprojects.org/root/greenlock-manager-fs.js)
# greenlock-manager-fs.js
A simple file-based management strategy for Greenlock v3
(to manage SSL certificates for sites)
## Install
```js
npm install --save greenlock-manager-fs@v3
```
## Usage
```js
npx greenlock init --manager greenlock-manager-fs --config-dir './greenlock.d'
```
Or, place this file in the root of your project:
`.greenlockrc`:
```json
{
"manager": { "module": "@greenlock/manager" },
"configDir": "./greenlock.d"
}
```
## Example config file
You might start your config file like this:
`./greenlock.d/config.json`:
```json
{
"subscriberEmail": "jon@example.com",
"agreeToTerms": true,
"sites": [
{
"subject": "example.com",
"altnames": ["example.com", "*.example.com"]
}
]
}
```
## CLI Management (coming soon)
We're going to be adding some tools to greenlock so that you can do
something like this to manage your sites and SSL certificates:
```js
npx greenlock defaults --subscriber-email jon@example.com --agree-to-terms true
```
```js
npx greenlock add --subject example.com --altnames example.com,*.example.com
```
```js
npx greenlock renew --all
```
A simple file-based management strategy for greenlock

View File

@ -1,8 +1,6 @@
'use strict';
var Manage = module.exports;
var doctor = {};
var sfs = require('safe-replace').create({ tmp: 'tmp', bak: 'bak' });
var promisify = require('util').promisify;
var fs = require('fs');
@ -13,434 +11,361 @@ var homedir = require('os').homedir();
var path = require('path');
var mkdirp = promisify(require('@root/mkdirp'));
// NOTE
// this is over-complicated to account for people
// doing weird things, and this just being a file system
// and wanting to be fairly sure it works and produces
// meaningful errors
// IMPORTANT
// For your use case you'll probably find a better example
// in greenlock-manager-test:
//
// npm install --save greenlock-manager-test
// npx greenlock-manager-init
//
Manage.create = function(CONF) {
if (!CONF) {
CONF = {};
Manage.create = function(opts) {
if (!opts) {
opts = {};
}
if (!CONF.configFile) {
CONF.configFile = '~/.config/greenlock/manager.json';
console.info('Greenlock Manager Config File: ' + CONF.configFile);
if (!opts.configFile) {
opts.configFile = '~/.config/greenlock/manager.json';
console.info('Greenlock Manager Config File: ' + opts.configFile);
}
CONF.configFile = CONF.configFile.replace('~/', homedir + '/');
opts.configFile = opts.configFile.replace('~/', homedir + '/');
var manage = {};
manage._txPromise = Promise.resolve();
// Note: all of these top-level methods are effectively mutexed
// You cannot call them from each other or they will deadlock
manage.defaults = manage.config = async function(conf) {
manage._txPromise = manage._txPromise.then(async function() {
var config = await Manage._getLatest(manage, CONF);
// act as a getter
manage.defaults = manage.config = function(conf) {
// get / set default site settings such as
// subscriberEmail, store, challenges, renewOffset, renewStagger
return Manage._getLatest(manage, opts).then(function(config) {
if (!conf) {
conf = JSON.parse(JSON.stringify(config.defaults));
conf = JSON.parse(JSON.stringify(config));
delete conf.sites;
return conf;
}
// act as a setter
// TODO set initial sites
if (conf.sites) {
throw new Error('cannot set sites as global config');
}
// TODO whitelist rather than blacklist?
if (
[
'subject',
'altnames',
'lastAttemptAt',
'expiresAt',
'issuedAt',
'renewAt'
].some(function(k) {
if (k in conf) {
throw new Error(
'`' + k + '` not allowed as a default setting'
);
}
})
) {
}
Object.keys(conf).forEach(function(k) {
// challenges are either both overwritten, or not set
// this is as it should be
config.defaults[k] = conf[k];
if (-1 !== ['sites', 'module', 'manager'].indexOf(k)) {
return;
}
if ('undefined' === typeof k) {
throw new Error(
"'" +
k +
"' should be set to a value, or `null`, but not left `undefined`"
);
}
if (null === k) {
delete config[k];
}
config[k] = conf[k];
});
return manage._save(config);
});
};
manage.add = function(args) {
manage._txPromise = manage._txPromise.then(function() {
// if the fs has changed since we last wrote, get the lastest from disk
return Manage._getLatest(manage, opts).then(function(config) {
// TODO move to Greenlock.add
var subscriberEmail = args.subscriberEmail;
var subject = args.subject || args.domain;
var primary = subject;
var altnames =
args.servernames || args.altnames || args.domains;
if ('string' !== typeof primary) {
if (!Array.isArray(altnames) || !altnames.length) {
throw new Error('there needs to be a subject');
}
primary = altnames.slice(0).sort()[0];
}
if (!Array.isArray(altnames) || !altnames.length) {
altnames = [primary];
}
primary = primary.toLowerCase();
altnames = altnames.map(function(name) {
return name.toLowerCase();
});
if (!config.sites) {
config.sites = {};
}
var site = config.sites[primary];
if (!site) {
site = config.sites[primary] = { altnames: [] };
}
// The goal is to make this decently easy to manage by hand without mistakes
// but also reasonably easy to error check and correct
// and to make deterministic auto-corrections
// TODO added, removed, moved (duplicate), changed
if (subscriberEmail) {
site.subscriberEmail = subscriberEmail;
}
site.subject = subject;
site.altnames = altnames;
if (!site.issuedAt) {
site.issuedAt = 0;
}
site.expiresAt = site.expiresAt || 0;
site.lastAttemptAt = site.lastAttemptAt || 0;
// re-add if this was deleted
site.deletedAt = 0;
if (
site.altnames
.slice(0)
.sort()
.join() !==
altnames
.slice(0)
.sort()
.join()
) {
site.expiresAt = 0;
site.issuedAt = 0;
}
// These should usually be empty, for most situations
if (args.customerEmail) {
site.customerEmail = args.customerEmail;
}
if (args.challenges) {
site.challenges = args.challenges;
}
if (args.store) {
site.store = args.store;
}
return manage._save(config).then(function() {
return JSON.parse(JSON.stringify(site));
});
});
});
return manage._txPromise;
};
manage.set = async function(args) {
manage._txPromise = manage._txPromise.then(async function() {
var config = await Manage._getLatest(manage, CONF);
manage._merge(config, config.sites[args.subject], args);
await manage._save(config);
return JSON.parse(JSON.stringify(config.sites[args.subject]));
});
return manage._txPromise;
manage.find = function(args) {
var some = _find(args);
if (!opts.find) {
return some;
}
// TODO function to always add
throw new Error('TODO: use the given find');
};
manage.get = async function(args) {
manage._txPromise = manage._txPromise.then(async function() {
var config = await Manage._getLatest(manage, CONF);
var site;
Object.keys(config.sites).some(function(k) {
// if subject is specified, don't return anything else
var _site = config.sites[k];
// altnames, servername, and wildname all get rolled into one
return _site.altnames.some(function(altname) {
if ([args.servername, args.wildname].includes(altname)) {
site = _site;
}
});
});
if (site && !site.deletedAt) {
return doctor.site(config.sites, site.subject);
}
return null;
});
return manage._txPromise;
};
manage._merge = function(config, current, args) {
if (!current || current.deletedAt) {
current = config.sites[args.subject] = {
subject: args.subject,
altnames: [],
renewAt: 1
};
}
current.renewAt = parseInt(args.renewAt || current.renewAt, 10) || 1;
var oldAlts;
var newAlts;
if (args.altnames) {
// copy as to not disturb order, which matters
oldAlts = current.altnames.slice(0).sort();
newAlts = args.altnames.slice(0).sort();
if (newAlts.join() !== oldAlts.join()) {
// this will cause immediate renewal
args.renewAt = 1;
current.altnames = args.altnames.slice(0);
}
}
Object.keys(args).forEach(function(k) {
if ('altnames' === k) {
return;
}
current[k] = args[k];
});
};
// no transaction promise here because it calls set
manage.find = async function(args) {
var ours = await _find(args);
if (!CONF.find) {
return ours;
}
// if the user has an overlay find function we'll do a diff
// between the managed state and the overlay, and choose
// what was found.
var theirs = await CONF.find(args);
var config = await Manage._getLatest(manage, CONF);
return _mergeFind(config, ours, theirs);
};
function _find(args) {
manage._txPromise = manage._txPromise.then(async function() {
var config = await Manage._getLatest(manage, CONF);
return Manage._getLatest(manage, opts).then(function(config) {
// i.e. find certs more than 30 days old
//args.issuedBefore = Date.now() - 30 * 24 * 60 * 60 * 1000;
// i.e. find certs more that will expire in less than 45 days
//args.expiresBefore = Date.now() + 45 * 24 * 60 * 60 * 1000;
var issuedBefore = args.issuedBefore || Infinity;
var issuedBefore = args.issuedBefore || 0;
var expiresBefore = args.expiresBefore || Infinity; //Date.now() + 21 * 24 * 60 * 60 * 1000;
var renewBefore = args.renewBefore || Infinity; //Date.now() + 21 * 24 * 60 * 60 * 1000;
// if there's anything to match, only return matches
// if there's nothing to match, return everything
var nameKeys = ['subject', 'altnames'];
var matchAll = !nameKeys.some(function(k) {
return k in args;
var altnames = (args.altnames || args.domains || []).slice(0);
if (args.servername && !altnames.includes(args.servername)) {
altnames.push(args.servername);
}
if (args.subject && !altnames.includes(args.subject)) {
altnames.push(args.subject);
}
// TODO match ANY domain on any cert
var sites = Object.keys(config.sites || {})
.filter(function(sub) {
var site = config.sites[sub];
if (
!site.deletedAt ||
site.expiresAt < expiresBefore ||
site.issuedAt < issuedBefore
) {
return (site.altnames || []).some(function(name) {
return altnames.includes(name);
});
var querynames = (args.altnames || []).slice(0);
var sites = Object.keys(config.sites)
.filter(function(subject) {
var site = config.sites[subject];
if (site.deletedAt) {
return false;
}
if (site.expiresAt >= expiresBefore) {
return false;
}
if (site.issuedAt >= issuedBefore) {
return false;
}
if (site.renewAt >= renewBefore) {
return false;
}
// after attribute filtering, before cert filtering
if (matchAll) {
return true;
}
// if subject is specified, don't return anything else
if (site.subject === args.subject) {
return true;
}
// altnames, servername, and wildname all get rolled into one
return site.altnames.some(function(altname) {
return querynames.includes(altname);
});
})
.map(function(name) {
return doctor.site(config.sites, name);
var site = config.sites[name];
return {
subject: site.subject,
altnames: site.altnames,
issuedAt: site.issuedAt,
expiresAt: site.expiresAt,
renewOffset: site.renewOffset,
renewStagger: site.renewStagger,
renewAt: site.renewAt,
subscriberEmail: site.subscriberEmail,
customerEmail: site.customerEmail,
challenges: site.challenges,
store: site.store
};
});
return sites;
});
}
manage.notify = opts.notify || _notify;
function _notify(ev, args) {
if (!args) {
args = ev;
ev = args.event;
delete args.event;
}
// TODO define message types
if (!manage._notify_notice) {
console.info(
'set greenlockOptions.notify to override the default logger'
);
manage._notify_notice = true;
}
switch (ev) {
case 'error':
/* falls through */
case 'warning':
console.error(
'Error%s:',
(' ' + (args.context || '')).trimRight()
);
console.error(args.message);
if (args.description) {
console.error(args.description);
}
if (args.code) {
console.error('code:', args.code);
}
break;
default:
if (/status/.test(ev)) {
console.info(
ev,
args.altname || args.subject || '',
args.status || ''
);
if (!args.status) {
console.info(args);
}
break;
}
console.info(
ev,
'(more info available: ' + Object.keys(args).join(' ') + ')'
);
}
}
manage.update = function(args) {
manage._txPromise = manage.txPromise.then(function() {
return Manage._getLatest(manage, opts).then(function(config) {
var site = config.sites[args.subject];
site.issuedAt = args.issuedAt;
site.expiresAt = args.expiresAt;
site.renewAt = args.renewAt;
// foo
});
});
return manage._txPromise;
}
function _mergeFind(config, ours, theirs) {
theirs.forEach(function(_newer) {
var hasCurrent = ours.some(function(_older) {
if (_newer.subject !== _older.subject) {
return false;
}
// BE SURE TO SET THIS UNDEFINED AFTERWARDS
_older._exists = true;
manage._merge(config, _older, _newer);
_newer = config.sites[_older.subject];
// handled the (only) match
return true;
});
if (hasCurrent) {
manage._merge(config, null, _newer);
}
});
// delete the things that are gone
ours.forEach(function(_older) {
if (!_older._exists) {
delete config.sites[_older.subject];
}
_older._exists = undefined;
});
manage._txPromise = manage._txPromise.then(async function() {
// kinda redundant to pull again, but whatever...
var config = await Manage._getLatest(manage, CONF);
await manage._save(config);
// everything was either added, updated, or not different
// hence, this is everything
var copy = JSON.parse(JSON.stringify(config.sites));
return Object.keys(copy).map(function(k) {
return copy[k];
});
});
return manage._txPromise;
}
};
manage.remove = function(args) {
if (!args.subject) {
throw new Error('should have a subject for sites to remove');
}
manage._txPromise = manage._txPromise.then(async function() {
var config = await Manage._getLatest(manage, CONF);
manage._txPromise = manage.txPromise.then(function() {
return Manage._getLatest(manage, opts).then(function(config) {
var site = config.sites[args.subject];
if (!site || site.deletedAt) {
return null;
if (!site) {
return {};
}
site.deletedAt = Date.now();
await manage._save(config);
return JSON.parse(JSON.stringify(site));
});
});
return manage._txPromise;
};
manage._lastStat = {
size: 0,
mtimeMs: 0
};
manage._config = {};
// (wrong type #1) specifically the wrong type (null)
manage._lastStat = { size: null, mtimeMs: null };
manage._save = async function(config) {
await mkdirp(path.dirname(CONF.configFile));
manage._save = function(config) {
return mkdirp(path.dirname(opts.configFile)).then(function() {
return sfs
.writeFileAsync(
opts.configFile,
// pretty-print the config file
var data = JSON.parse(JSON.stringify(config));
var sites = data.sites || {};
data.sites = Object.keys(sites).map(function(k) {
return sites[k];
});
await sfs.writeFileAsync(
CONF.configFile,
JSON.stringify(data, null, 2),
JSON.stringify(config, null, 2),
'utf8'
);
)
.then(function() {
// this file may contain secrets, so keep it safe
return chmodFile(CONF.configFile, parseInt('0600', 8))
return chmodFile(opts.configFile, parseInt('0600', 8))
.catch(function() {
/*ignore for Windows */
})
.then(async function() {
var stat = await statFile(CONF.configFile);
.then(function() {
return statFile(opts.configFile).then(function(
stat
) {
manage._lastStat.size = stat.size;
manage._lastStat.mtimeMs = stat.mtimeMs;
});
};
manage.init = async function(deps) {
// even though we don't need it
manage.request = deps.request;
return null;
});
});
});
};
return manage;
};
Manage._getLatest = function(MNG, CONF) {
return statFile(CONF.configFile)
.catch(async function(err) {
if ('ENOENT' !== err.code) {
Manage._getLatest = function(mng, opts) {
return statFile(opts.configFile)
.catch(function(err) {
if ('ENOENT' === err.code) {
return {
size: 0,
mtimeMs: 0
};
}
err.context = 'manager_read';
throw err;
}
await MNG._save(doctor.config());
// (wrong type #2) specifically the wrong type (bool)
return { size: false, mtimeMs: false };
})
.then(async function(stat) {
.then(function(stat) {
if (
stat.size === MNG._lastStat.size &&
stat.mtimeMs === MNG._lastStat.mtimeMs
stat.size === mng._lastStat.size &&
stat.mtimeMs === mng._lastStat.mtimeMs
) {
return MNG._config;
return mng._config;
}
var data = await readFile(CONF.configFile, 'utf8');
MNG._lastStat = stat;
MNG._config = JSON.parse(data);
return doctor.config(MNG._config);
return readFile(opts.configFile, 'utf8').then(function(data) {
mng._lastStat = stat;
mng._config = JSON.parse(data);
return mng._config;
});
});
};
// users muck up config files, so we try to handle it gracefully.
doctor.config = function(config) {
if (!config) {
config = {};
}
if (!config.defaults) {
config.defaults = {};
}
doctor.sites(config);
Object.keys(config).forEach(function(key) {
// .greenlockrc and greenlock.json shall merge as one
// and be called greenlock.json because calling it
// .greenlockrc seems to rub people the wrong way
if (['manager', 'defaults', 'routes', 'sites'].includes(key)) {
return;
}
config.defaults[key] = config[key];
delete config[key];
});
doctor.challenges(config.defaults);
return config;
};
doctor.sites = function(config) {
var sites = config.sites;
if (!sites) {
sites = {};
}
if (Array.isArray(config.sites)) {
sites = {};
config.sites.forEach(function(site) {
sites[site.subject] = site;
});
}
Object.keys(sites).forEach(function(k) {
doctor.site(sites, k);
});
config.sites = sites;
};
doctor.site = function(sconfs, subject) {
var site = sconfs[subject];
if (!site) {
delete sconfs[subject];
site = {};
}
if ('string' !== typeof site.subject) {
console.warn('warning: deleted malformed site from config file:');
console.warn(JSON.stringify(site));
delete sconfs[subject];
site.subject = 'greenlock-error.example.com';
}
if (!Array.isArray(site.altnames)) {
site.altnames = [site.subject];
}
if (!site.renewAt) {
site.renewAt = 1;
}
return site;
};
doctor.challenges = function(defaults) {
var challenges = defaults.challenges;
if (!challenges) {
challenges = {};
}
if (Array.isArray(defaults.challenges)) {
defaults.challenges.forEach(function(challenge) {
var typ = doctor.challengeType(challenge);
challenges[typ] = challenge;
});
}
Object.keys(challenges).forEach(function(k) {
doctor.challenge(challenges, k);
});
defaults.challenges = challenges;
if (!Object.keys(defaults.challenges).length) {
delete defaults.challenges;
}
};
doctor.challengeType = function(challenge) {
var typ = challenge.type;
if (!typ) {
if (/\bhttp-01\b/.test(challenge.module)) {
typ = 'http-01';
} else if (/\bdns-01\b/.test(challenge.module)) {
typ = 'dns-01';
} else if (/\btls-alpn-01\b/.test(challenge.module)) {
typ = 'tls-alpn-01';
} else {
typ = 'error-01';
}
}
delete challenge.type;
return typ;
};
doctor.challenge = function(chconfs, typ) {
var ch = chconfs[typ];
if (!ch) {
delete chconfs[typ];
}
return;
};

28
package-lock.json generated
View File

@ -1,6 +1,6 @@
{
"name": "greenlock-manager-fs",
"version": "3.1.1",
"version": "0.6.1",
"lockfileVersion": 1,
"requires": true,
"dependencies": {
@ -9,32 +9,6 @@
"resolved": "https://registry.npmjs.org/@root/mkdirp/-/mkdirp-1.0.0.tgz",
"integrity": "sha512-hxGAYUx5029VggfG+U9naAhQkoMSXtOeXtbql97m3Hi6/sQSRL/4khKZPyOF6w11glyCOU38WCNLu9nUcSjOfA=="
},
"@root/request": {
"version": "1.4.2",
"resolved": "https://registry.npmjs.org/@root/request/-/request-1.4.2.tgz",
"integrity": "sha512-J8FM4+SJuc7WRC+Jz17m+VT2lgI7HtatHhxN1F2ck5aIKUAxJEaR4u/gLBsgT60mVHevKCjKN0O8115UtJjwLw==",
"dev": true
},
"greenlock-manager-fs": {
"version": "3.0.5",
"resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.0.5.tgz",
"integrity": "sha512-r/q+tEFuDwklfzPfiGhcIrHuJxMrppC+EseESpu5f0DMokh+1iZVm9nGC/VE7/7GETdOYfEYhhQkmspsi8Gr/A==",
"dev": true,
"requires": {
"@root/mkdirp": "^1.0.0",
"safe-replace": "^1.1.0"
}
},
"greenlock-manager-test": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/greenlock-manager-test/-/greenlock-manager-test-3.1.1.tgz",
"integrity": "sha512-wZ+Oxn5qTEoN+VDd3Y+kBYZ8MlaLlhm40KwIwfyR90bj08IZpfzE7zGY8SwBEbIx0wNSo6ztDku4Y0gVgxxwCA==",
"dev": true,
"requires": {
"@root/request": "^1.4.1",
"greenlock-manager-fs": "^3.0.0"
}
},
"safe-replace": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.1.0.tgz",

View File

@ -1,18 +1,14 @@
{
"name": "greenlock-manager-fs",
"version": "3.1.1",
"version": "0.6.1",
"description": "A simple file-based management strategy for Greenlock",
"main": "manager.js",
"scripts": {
"test": "node tests"
},
"files": [
"*.js",
"lib"
],
"repository": {
"type": "git",
"url": "https://git.rootprojects.org/root/greenlock-manager-fs.js.git"
"url": "https://git.coolaj86.com/coolaj86/greenlock-manager-fs.js.git"
},
"keywords": [
"Greenlock",
@ -25,8 +21,5 @@
"dependencies": {
"@root/mkdirp": "^1.0.0",
"safe-replace": "^1.1.0"
},
"devDependencies": {
"greenlock-manager-test": "^3.1.1"
}
}

View File

@ -1,25 +0,0 @@
"use strict";
var Tester = require("greenlock-manager-test");
var Manager = require("../manager.js");
var config = {
configFile: "greenlock-manager-test.delete-me.json"
};
Tester.test(Manager, config)
.then(function(features) {
console.info("PASS");
console.info();
console.info("Optional Feature Support:");
features.forEach(function(feature) {
console.info(feature.supported ? "✓ (YES)" : "✘ (NO) ", feature.description);
});
console.info();
})
.catch(function(err) {
console.error("Oops, you broke it. Here are the details:");
console.error(err.stack);
console.error();
console.error("That's all I know.");
});