recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat: prepare restricted acme-dns renewal

Browse Source
This commit is contained in:
autonomic-bot
2026-08-31 17:08:15 +00:00
parent cb315f8ab4
commit 148d4c9381
4 changed files with 193 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runner/warm_reconcile.py
+25 -6
View File
@@ -24,6 +24,7 @@ Run as root on cc-ci (direct docker/volume access). CLI: `warm_reconcile.py <app
from __future__ import annotations
import hashlib
import json
import os
import re
@@ -37,12 +38,29 @@ from harness import abra, lifecycle, warmsnap # noqa: E402
# --------------------------------------------------------------------------- specs
CERT_DIR = "/var/lib/ci-certs/live"
def wildcard_secret_version(cert_dir: str = CERT_DIR) -> str:
"""Stable Swarm-secret version for the public certificate chain.
The certificate chain is public material, so its digest is safe to use as a
version label. The key is deliberately never read or hashed for logging.
"""
chain = os.path.join(cert_dir, "fullchain.pem")
if not os.path.isfile(chain):
raise RuntimeError(f"FATAL: wildcard certificate missing at {chain}")
with open(chain, "rb") as certificate:
digest = hashlib.sha256(certificate.read()).hexdigest()
return "v" + digest[:16]
def _traefik_setup(recipe: str, domain: str, version: str) -> None:
"""Per-app config for the traefik reverse-proxy reconcile — preserves EXACTLY what the prior
proxy.nix bash reconcile did (wildcard/file-provider mode serving the pre-issued cert as
ssl_cert/ssl_key swarm secrets; NO ACME). Uses the proven abra.env_set (newline-safe, unlike the
bash set_env that bit keycloak)."""
cert_dir = "/var/lib/ci-certs/live"
cert_dir = CERT_DIR
if not (
os.path.isfile(f"{cert_dir}/fullchain.pem") and os.path.isfile(f"{cert_dir}/privkey.pem")
):
@@ -56,14 +74,15 @@ def _traefik_setup(recipe: str, domain: str, version: str) -> None:
abra.env_set(domain, "DOMAIN", domain)
abra.env_set(domain, "LETS_ENCRYPT_ENV", "")
abra.env_set(domain, "WILDCARDS_ENABLED", "1")
abra.env_set(domain, "SECRET_WILDCARD_CERT_VERSION", "v1")
abra.env_set(domain, "SECRET_WILDCARD_KEY_VERSION", "v1")
secret_version = wildcard_secret_version(cert_dir)
abra.env_set(domain, "SECRET_WILDCARD_CERT_VERSION", secret_version)
abra.env_set(domain, "SECRET_WILDCARD_KEY_VERSION", secret_version)
abra.env_set(domain, "COMPOSE_FILE", '"compose.yml:compose.wildcard.yml"')
stack = lifecycle._stack_name(domain) # noqa: SLF001
have = set(lifecycle._docker_names("secret", stack)) # noqa: SLF001
def _has(name):
return any(s.endswith(f"_{name}_v1") for s in have)
return any(s.endswith(f"_{name}_{secret_version}") for s in have)
if not _has("ssl_cert"):
_run(
@@ -74,7 +93,7 @@ def _traefik_setup(recipe: str, domain: str, version: str) -> None:
"insert",
domain,
"ssl_cert",
"v1",
secret_version,
f"{cert_dir}/fullchain.pem",
"-f",
"-n",
@@ -91,7 +110,7 @@ def _traefik_setup(recipe: str, domain: str, version: str) -> None:
"insert",
domain,
"ssl_key",
"v1",
secret_version,
f"{cert_dir}/privkey.pem",
"-f",
"-n",