1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
// Package domains manages an app's public hostnames and TLS. Unlike other
// app config, a domain/cert change never touches the jail, so it skips
// Skiff's usual snapshot-and-restart safety net entirely.
package domains
import (
"context"
"fmt"
"io"
"os"
"skiff/internal/appmeta"
"skiff/internal/certbot"
"skiff/internal/layout"
"skiff/internal/nginx"
)
// Add registers hostname for app and syncs routing/TLS. Safe to retry: a
// DNS-not-ready cert failure just leaves the app on plain HTTP.
func Add(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string, primary bool) error {
meta, err := appmeta.Read(cfg.MetaPath(app))
if err != nil {
return fmt.Errorf("read app metadata: %w", err)
}
makePrimary := primary || len(meta.Domains) == 0
found := false
for i := range meta.Domains {
if meta.Domains[i].Hostname == hostname {
found = true
break
}
}
if makePrimary {
for i := range meta.Domains {
meta.Domains[i].Primary = meta.Domains[i].Hostname == hostname
}
}
if !found {
meta.Domains = append(meta.Domains, appmeta.Domain{Hostname: hostname, Primary: makePrimary})
}
if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
return fmt.Errorf("write app metadata: %w", err)
}
if err := syncCert(ctx, out, cfg, app, meta); err != nil {
return err
}
fmt.Fprintf(out, "==> %s added for %s\n", hostname, app)
return nil
}
// Remove deregisters hostname and updates routing only - unlike Add, it
// never calls certbot, so it can't fail or block on it. Removing the
// primary while others remain is refused - reassign primary first with
// `skiff domains add --primary`.
func Remove(ctx context.Context, out io.Writer, cfg layout.Config, app, hostname string) error {
meta, err := appmeta.Read(cfg.MetaPath(app))
if err != nil {
return fmt.Errorf("read app metadata: %w", err)
}
idx := -1
for i, d := range meta.Domains {
if d.Hostname == hostname {
idx = i
break
}
}
if idx == -1 {
return fmt.Errorf("%s is not registered for %s", hostname, app)
}
if meta.Domains[idx].Primary && len(meta.Domains) > 1 {
return fmt.Errorf("%s is %s's primary domain - reassign primary to another domain first (skiff domains add --primary <hostname>)", hostname, app)
}
meta.Domains = append(meta.Domains[:idx], meta.Domains[idx+1:]...)
if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
return fmt.Errorf("write app metadata: %w", err)
}
if len(meta.Domains) == 0 {
if err := nginx.Remove(ctx, out, cfg, app); err != nil {
return err
}
} else if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
return fmt.Errorf("nginx: %w", err)
}
fmt.Fprintf(out, "==> %s removed from %s\n", hostname, app)
return nil
}
// syncCert routes over plain HTTP first, so a newly added hostname is
// reachable for the HTTP-01 challenge, then requests/expands the cert and
// re-routes with TLS enabled for whatever it now covers.
func syncCert(ctx context.Context, out io.Writer, cfg layout.Config, app string, meta appmeta.Meta) error {
primary, ok := meta.PrimaryDomain()
if !ok {
return fmt.Errorf("%s has domains but none marked primary", app)
}
if err := nginx.EnsureRoute(ctx, out, cfg, app, meta); err != nil {
return fmt.Errorf("nginx: %w", err)
}
if err := os.MkdirAll(cfg.AcmeWebrootDir, 0755); err != nil {
return fmt.Errorf("create acme webroot: %w", err)
}
hostnames := make([]string, len(meta.Domains))
for i, d := range meta.Domains {
hostnames[i] = d.Hostname
}
fmt.Fprintln(out, "==> requesting certificate")
if err := certbot.Sync(ctx, out, cfg.AcmeWebrootDir, primary.Hostname, hostnames); err != nil {
return fmt.Errorf("certificate not issued (%w) - fix DNS and re-run this command", err)
}
meta.TLSDomains = hostnames
if err := appmeta.Write(cfg.MetaPath(app), meta); err != nil {
return fmt.Errorf("write app metadata: %w", err)
}
return nginx.EnsureRoute(ctx, out, cfg, app, meta)
}
|
