#!/usr/bin/env python3 """Clover host certificate worker. Runs in the isolated helper container.""" import argparse import datetime as dt import fcntl import hashlib import json import os from pathlib import Path import re import shutil import socket import subprocess import sys import time PROJECT = Path('/clover') HOST = Path('/host') ACME_IMAGE = 'certbot/certbot:v5.1.0' DOCKER = shutil.which('docker') or '/usr/bin/docker' NGINX_SITE = HOST / 'etc/nginx/conf.d/clover-panel.conf' RECOVERY = PROJECT / 'deploy/acme/recovery.json' STATUS = PROJECT / 'deploy/acme/status.json' def run(args, timeout=40, check=True, input_text=None): if args and args[0] == 'docker': args = [DOCKER, *args[1:]] result = subprocess.run(args, text=True, capture_output=True, timeout=timeout, input=input_text) if check and result.returncode: raise RuntimeError((result.stderr or result.stdout or '命令执行失败')[-2500:]) return result def atomic(path, text, mode=0o600): path.parent.mkdir(parents=True, exist_ok=True) temp = path.with_name(f'{path.name}.{os.getpid()}.{time.time_ns()}.tmp') temp.write_text(text, encoding='utf-8') temp.chmod(mode) os.replace(temp, path) def host_run(*args, timeout=40, check=True): # The helper already shares the host PID/network namespaces. nsenter --root # can be blocked by /proc hidepid/ptrace restrictions, so use the mounted host # filesystem to invoke systemd/nginx from their real root instead. return run(['chroot', str(HOST), *args], timeout=timeout, check=check) class Manager: def __init__(self): self.env = {} for line in (PROJECT / '.env').read_text(encoding='utf-8').splitlines(): if re.match(r'^[A-Z_][A-Z0-9_]*=', line): key, value = line.split('=', 1) self.env[key] = value.strip() self.data = PROJECT / 'deploy/acme' self.state = self.load(STATUS, {'mode': 'unconfigured', 'certificates': {}, 'autoRenew': False}) @staticmethod def load(path, fallback): try: return json.loads(path.read_text(encoding='utf-8')) except (FileNotFoundError, json.JSONDecodeError): return fallback def save(self): atomic(STATUS, json.dumps(self.state, ensure_ascii=False, indent=2)) def log(self, message): self.state['message'] = message self.state['updatedAt'] = dt.datetime.now(dt.timezone.utc).isoformat() self.save() print(message, flush=True) def host_name(self): host = self.env.get('PANEL_HOSTNAME', '').lower() if len(host) > 253 or not re.fullmatch(r'(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{1,62}', host): raise RuntimeError('请先在安装配置中填写有效的面板域名') return host def mail_host_name(self): host = self.env.get('MAIL_HOSTNAME', '').lower() if len(host) > 253 or not re.fullmatch(r'(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{1,62}', host): raise RuntimeError('请先在面板设置中填写有效的邮件主机名') return host def shared_nginx_mode(self): return self.env.get('CLOVER_SHARED_NGINX') == '1' or ( self.env.get('CLOVER_CADDY_SCHEME') == 'http' and not self.shared_caddy_mode()) def shared_caddy_mode(self): return self.env.get('CLOVER_SHARED_CADDY') == '1' def configure_host_caddy(self): if not self.shared_caddy_mode(): return result = run([ sys.executable, '/app/host-caddy.py', 'configure-env', '--host-root', '/host', '--env-file', str(PROJECT / '.env'), ], timeout=90, check=False) if result.returncode: raise RuntimeError((result.stderr or result.stdout or '宿主机 Caddy 配置失败').strip()[-1800:]) if result.stdout.strip(): self.log(result.stdout.strip()) def cert_dir(self, host): return self.data / 'live' / host def cert_valid_days(self, host): cert = self.cert_dir(host) / 'fullchain.pem' if not cert.exists(): return None result = run(['openssl', 'x509', '-in', str(cert), '-noout', '-enddate'], check=False) if result.returncode: return None match = re.search(r'notAfter=(.+)', result.stdout) if not match: return None expiry = dt.datetime.strptime(match.group(1), '%b %d %H:%M:%S %Y %Z').replace(tzinfo=dt.timezone.utc) return max(0, int((expiry - dt.datetime.now(dt.timezone.utc)).total_seconds() // 86400)) def certificate_info(self, host, installed=False): cert = self.cert_dir(host) / 'fullchain.pem' if not cert.is_file(): return {'host': host, 'installed': False, 'daysRemaining': None} result = run(['openssl', 'x509', '-in', str(cert), '-noout', '-startdate', '-enddate', '-issuer', '-subject', '-fingerprint', '-sha256'], check=False) if result.returncode: return {'host': host, 'installed': False, 'daysRemaining': None} fields = {} for line in result.stdout.splitlines(): if '=' in line: key, value = line.split('=', 1) fields[key.strip()] = value.strip() def as_iso(value): try: return dt.datetime.strptime(value, '%b %d %H:%M:%S %Y %Z').replace( tzinfo=dt.timezone.utc).isoformat() except ValueError: return None fingerprint = hashlib.sha256(cert.read_bytes()).hexdigest() valid_from = as_iso(fields.get('notBefore', '')) valid_to = as_iso(fields.get('notAfter', '')) expiry = dt.datetime.fromisoformat(valid_to) if valid_to else None days_remaining = int((expiry - dt.datetime.now(dt.timezone.utc)).total_seconds() // 86400) if expiry else None return { 'host': host, 'installed': installed and self.state.get('mailFingerprint') == fingerprint, 'daysRemaining': days_remaining, 'validFrom': valid_from, 'validTo': valid_to, 'issuer': fields.get('issuer', '').removeprefix('issuer='), 'subject': fields.get('subject', '').removeprefix('subject='), 'fingerprint': fields.get('sha256 Fingerprint', ''), } def served_cert_days(self, host): port = '443' if self.shared_caddy_mode() else self.env.get('CLOVER_HTTPS_PORT', '443') result = run(['openssl', 's_client', '-connect', f'127.0.0.1:{port}', '-servername', host, '-showcerts'], timeout=12, check=False) match = re.search(r'-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----', result.stdout + result.stderr, re.S) if not match: return None cert = run(['openssl', 'x509', '-noout', '-enddate', '-checkhost', host], input_text=match.group(0), check=False) if cert.returncode: return None end = re.search(r'notAfter=(.+)', cert.stdout) if not end: return None expiry = dt.datetime.strptime(end.group(1), '%b %d %H:%M:%S %Y %Z').replace(tzinfo=dt.timezone.utc) return max(0, int((expiry - dt.datetime.now(dt.timezone.utc)).total_seconds() // 86400)) def dns_check(self, host): try: records = {item[4][0] for item in socket.getaddrinfo(host, None, type=socket.SOCK_STREAM)} except OSError as error: raise RuntimeError(f'{host} DNS 查询失败：{error}') from error public_ip = self.env.get('CLOVER_VPS_IP', '').strip() if public_ip and public_ip not in records: raise RuntimeError(f'{host} 当前解析到 {", ".join(sorted(records))}，应解析到本机 {public_ip}，并关闭 Cloudflare 代理后再签发。') def listener(self, port): hex_port = f'{port:04X}' return run(['sh', '-c', f"grep -iE ':{hex_port} ' /proc/net/tcp /proc/net/tcp6"], check=False).stdout def wait_listener_clear(self, port, timeout=30): deadline = time.monotonic() + timeout while self.listener(port): if time.monotonic() >= deadline: return False time.sleep(1) return True def is_nginx_active(self): if host_run('/usr/bin/systemctl', 'is-active', '--quiet', 'nginx.service', check=False).returncode == 0: return True # aaPanel installs nginx under /www/server and registers a SysV unit. # systemd can mark that unit failed while its actual master still serves # traffic (for example, when an earlier graceful stop was checked too soon). config = self.host_nginx_config() if not config: return False try: pid = config['pidfile'].read_text(encoding='ascii').strip() if not re.fullmatch(r'\d+', pid): return False except OSError: return False if not self.listener(80) or not self.listener(443): return False # A newly written aaPanel vhost can reference a Clover certificate # before ACME has issued it. `nginx -T` then fails against disk even # though the already-running master still owns both public listeners. try: command = (Path('/proc') / pid / 'cmdline').read_bytes().replace(b'\0', b' ').decode('utf-8', 'replace') except OSError: return False return str(config['nginx_bin']) in command and str(config['configfile']) in command def nginx_service_action(self, action): if self.host_nginx_config(): unit = f'clover-nginx-{action}-{time.time_ns()}' return host_run('/usr/bin/systemd-run', f'--unit={unit}', '--wait', '--collect', '/etc/init.d/nginx', action, timeout=45, check=False) return host_run('/usr/bin/systemctl', action, 'nginx.service', timeout=45, check=False) @staticmethod def host_nginx_config(): try: script = (HOST / 'etc/init.d/nginx').read_text(encoding='utf-8', errors='replace') except OSError: return None values = {} for key in ('NAME', 'NGINX_BIN', 'CONFIGFILE', 'PIDFILE'): match = re.search(rf'^\s*{key}\s*=\s*["\']?([^\s"\']+)', script, re.M) if not match: return None values[key] = match.group(1) name = values['NAME'] for key in ('NGINX_BIN', 'CONFIGFILE', 'PIDFILE'): values[key] = values[key].replace('$NAME', name).replace('${NAME}', name) paths = { 'nginx_bin': Path('/' + values['NGINX_BIN'].lstrip('/')), 'configfile': Path('/' + values['CONFIGFILE'].lstrip('/')), 'pidfile': HOST / values['PIDFILE'].lstrip('/'), } binary_exists = (HOST / str(paths['nginx_bin']).lstrip('/')).is_file() config_exists = (HOST / str(paths['configfile']).lstrip('/')).is_file() return paths if binary_exists and config_exists else None def paused_services(self): return self.load(RECOVERY, {'services': []}).get('services', []) @staticmethod def aapanel_paths(): data = HOST / 'www/server/panel/data' return data / 'daemon_service.pl', data / 'daemon_service_lock.pl', data / 'mod_push_data/manual_flag.pl' def pause_aapanel_nginx_watchdog(self, recovery): daemon_file, lock_file, manual_file = self.aapanel_paths() try: services = json.loads(daemon_file.read_text(encoding='utf-8')) except (OSError, json.JSONDecodeError): return False if 'nginx' not in services: return False lock_file.parent.mkdir(parents=True, exist_ok=True) lock_file.touch(exist_ok=True) with lock_file.open('r+') as lock: fcntl.flock(lock, fcntl.LOCK_EX) try: existed = manual_file.exists() try: flags = json.loads(manual_file.read_text(encoding='utf-8')) if existed else {} except json.JSONDecodeError as error: raise RuntimeError('aaPanel 的 Nginx 守护标记不是有效 JSON；为避免覆盖其设置，已取消自动暂停。') from error if not isinstance(flags, dict): raise RuntimeError('aaPanel 的 Nginx 守护标记格式异常；为避免覆盖其设置，已取消自动暂停。') recovery['aapanelNginxFlag'] = { 'path': str(manual_file.relative_to(HOST)), 'existed': existed, 'value': flags.get('nginx'), } atomic(RECOVERY, json.dumps(recovery)) flags['nginx'] = 1 manual_file.parent.mkdir(parents=True, exist_ok=True) manual_file.write_text(json.dumps(flags), encoding='utf-8') self.nginx_service_action('stop') finally: fcntl.flock(lock, fcntl.LOCK_UN) return True def restore_aapanel_nginx_watchdog(self, recovery): saved = recovery.get('aapanelNginxFlag') if not saved: return daemon_file, lock_file, default_manual_file = self.aapanel_paths() manual_file = HOST / saved.get('path', str(default_manual_file.relative_to(HOST))) lock_file.touch(exist_ok=True) with lock_file.open('r+') as lock: fcntl.flock(lock, fcntl.LOCK_EX) try: try: flags = json.loads(manual_file.read_text(encoding='utf-8')) if manual_file.exists() else {} except json.JSONDecodeError as error: raise RuntimeError('aaPanel 的 Nginx 守护标记损坏，无法安全恢复。') from error if saved.get('existed'): if saved.get('value') is None: flags.pop('nginx', None) else: flags['nginx'] = saved['value'] manual_file.write_text(json.dumps(flags), encoding='utf-8') else: flags.pop('nginx', None) if flags: manual_file.write_text(json.dumps(flags), encoding='utf-8') else: manual_file.unlink(missing_ok=True) finally: fcntl.flock(lock, fcntl.LOCK_UN) def recover(self): recovery = self.load(RECOVERY, {'services': []}) services = recovery.get('services', []) errors = [] for service in reversed(services): if service == 'nginx': try: self.restore_aapanel_nginx_watchdog(recovery) except Exception as error: errors.append(str(error)) deadline = time.monotonic() + 30 restored = self.is_nginx_active() and self.listener(80) and self.listener(443) while time.monotonic() < deadline: if restored: break host_run('/usr/bin/systemctl', 'reset-failed', 'nginx.service', check=False) self.nginx_service_action('start') if self.is_nginx_active() and self.listener(80) and self.listener(443): restored = True break time.sleep(2) if not restored: errors.append('nginx 未能恢复；请执行 systemctl start nginx') else: self.log('nginx 已恢复') elif service == 'caddy': result = run(['docker', 'start', 'clover-caddy'], check=False) if result.returncode: errors.append('Caddy 未能恢复；请执行 docker start clover-caddy') else: self.log('Caddy 已恢复') atomic(RECOVERY, json.dumps({'services': [] if not errors else services, 'timerUnit': recovery.get('timerUnit'), 'timerServiceUnit': recovery.get('timerServiceUnit')})) if errors: raise RuntimeError('；'.join(errors)) timer_unit = recovery.get('timerUnit') or 'clover-nginx-recovery.timer' timer_service_unit = recovery.get('timerServiceUnit') or 'clover-nginx-recovery.service' host_run('/usr/bin/systemctl', 'stop', timer_unit, check=False) host_run('/usr/bin/systemctl', 'stop', timer_service_unit, check=False) host_run('/usr/bin/systemctl', 'reset-failed', timer_unit, timer_service_unit, check=False) def pause_nginx(self): # The helper can see host sockets, but its /proc view may not expose host # process names to `ss -p`. Rely on systemd's nginx state when owner data is # unavailable; after stopping nginx, verify that port 80 is actually free. owners = run(['ss', '-H', '-ltnp', 'sport = :80'], check=False).stdout nginx_active = self.is_nginx_active() has_owner_info = 'users:(' in owners if owners and has_owner_info and 'nginx' not in owners: raise RuntimeError('公网 80 被其他程序占用，不会自动停止它。请释放 80 端口后重试。') if owners and not nginx_active: raise RuntimeError('公网 80 被其他程序占用，不会自动停止它。请释放 80 端口后重试。') # When process details are hidden inside the helper, the active systemd unit # or a validated host nginx init script identifies the managed listener. # Stop it, then verify port 80 became free; if another listener remains, # the caller's finally block restores nginx. # A transient timer also restores nginx if this worker exits during ACME. if owners and nginx_active: unit = f'clover-nginx-recovery-{time.time_ns()}' timer_unit = unit + '.timer' timer_service_unit = unit + '.service' atomic(RECOVERY, json.dumps({'services': ['nginx'], 'timerUnit': timer_unit, 'timerServiceUnit': timer_service_unit})) host_run('/usr/bin/systemctl', 'stop', 'clover-nginx-recovery.timer', check=False) host_run('/usr/bin/systemctl', 'stop', 'clover-nginx-recovery.service', check=False) host_run('/usr/bin/systemctl', 'reset-failed', 'clover-nginx-recovery.timer', 'clover-nginx-recovery.service', check=False) host_run('/usr/bin/systemd-run', f'--unit={unit}', '--on-active=6m', '--timer-property=AccuracySec=1s', '/usr/bin/docker', 'exec', 'clover-certificate-helper', 'python3', '/app/certificates.py', 'recover') self.log('签发期间临时暂停 nginx；证书流程结束后会自动恢复（现有网站会短暂中断）') recovery = self.load(RECOVERY, {'services': ['nginx']}) if not self.pause_aapanel_nginx_watchdog(recovery): self.nginx_service_action('stop') if not self.wait_listener_clear(80): host_run('/usr/bin/systemctl', 'kill', '--signal=QUIT', 'nginx.service', check=False) if not self.wait_listener_clear(80): host_run('/usr/bin/systemctl', 'kill', '--signal=TERM', 'nginx.service', check=False) if not self.wait_listener_clear(80, timeout=15): raise RuntimeError('nginx 停止后 45 秒内 80 端口仍被占用；证书申请已取消。请检查其他监听程序。') if self.listener(80): raise RuntimeError('nginx 已暂停，但 80 端口仍被占用；未识别或停止其他程序。请先释放公网 80 端口。') def pause_caddy(self): status = run(['docker', 'inspect', '--format', '{{.State.Status}}', 'clover-caddy'], check=False).stdout.strip() if status != 'running': if self.listener(80): raise RuntimeError('公网 80 被其他程序占用。请释放端口后重试签发邮件证书。') return unit = f'clover-caddy-recovery-{time.time_ns()}' timer_unit = unit + '.timer' timer_service_unit = unit + '.service' atomic(RECOVERY, json.dumps({'services': ['caddy'], 'timerUnit': timer_unit, 'timerServiceUnit': timer_service_unit})) host_run('/usr/bin/systemctl', 'stop', 'clover-nginx-recovery.timer', check=False) host_run('/usr/bin/systemctl', 'stop', 'clover-nginx-recovery.service', check=False) host_run('/usr/bin/systemctl', 'reset-failed', 'clover-nginx-recovery.timer', 'clover-nginx-recovery.service', check=False) host_run('/usr/bin/systemd-run', f'--unit={unit}', '--on-active=6m', '--timer-property=AccuracySec=1s', '/usr/bin/docker', 'exec', 'clover-certificate-helper', 'python3', '/app/certificates.py', 'recover') self.log('签发邮件证书期间临时暂停 Caddy；完成后会自动恢复（面板会短暂中断）') run(['docker', 'stop', '--time', '20', 'clover-caddy'], timeout=30) if not self.wait_listener_clear(80): raise RuntimeError('Caddy 已暂停，但公网 80 仍被占用；请检查其他监听程序。') def pause_for_acme(self): if self.shared_nginx_mode(): self.pause_nginx() else: self.pause_caddy() def nginx_config(self, host): root_cert = f'{self.env["CLOVER_HOME"]}/deploy/acme/live/{host}/fullchain.pem' root_key = f'{self.env["CLOVER_HOME"]}/deploy/acme/live/{host}/privkey.pem' port = self.env.get('CLOVER_HTTP_PORT', '18080') nginx = self.host_nginx_config() if nginx: site = self.host_nginx_site_path(nginx) nginx_bin = nginx['nginx_bin'] nginx_config = nginx['configfile'] else: site = NGINX_SITE nginx_bin = Path('/usr/sbin/nginx') nginx_config = Path('/etc/nginx/nginx.conf') previous = site.read_text(encoding='utf-8') if site.exists() else None if previous and not previous.startswith('# Managed by Clover'): raise RuntimeError(f'{site.relative_to(HOST)} 已存在且不由 Clover 管理，拒绝覆盖。') sites = host_run(str(nginx_bin), '-T', '-c', str(nginx_config), check=False) for line in (sites.stdout + sites.stderr).splitlines(): if re.search(r'\bserver_name\s', line) and re.search(rf'(^|\s){re.escape(host)}(\s|;|$)', line) and (previous is None or line.strip() not in previous): raise RuntimeError(f'nginx 已有站点配置使用 {host}，请先移除重复 server_name 后再配置。') config = f'''# Managed by Clover certificate manager server {{ listen 80; server_name {host}; return 301 https://$host$request_uri; }} server {{ listen 443 ssl; server_name {host}; ssl_certificate {root_cert}; ssl_certificate_key {root_key}; location / {{ proxy_pass http://127.0.0.1:{port}; proxy_set_header Host $host; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Real-IP $remote_addr; }} }} ''' atomic(site, config, 0o644) check = host_run(str(nginx_bin), '-t', '-c', str(nginx_config), check=False) if check.returncode: if previous is None: site.unlink(missing_ok=True) else: atomic(site, previous, 0o644) raise RuntimeError('nginx 配置校验失败，已回滚 Clover 配置：' + (check.stderr or check.stdout)[-1200:]) loaded = host_run(str(nginx_bin), '-T', '-c', str(nginx_config), check=False) if loaded.returncode or '# Managed by Clover certificate manager' not in loaded.stdout + loaded.stderr: if previous is None: site.unlink(missing_ok=True) else: atomic(site, previous, 0o644) raise RuntimeError(f'nginx 没有加载 {site.relative_to(HOST)}；已回滚配置，请确认主配置 include 了该目录。') self.nginx_service_action('reload' if self.is_nginx_active() else 'start') @staticmethod def host_nginx_site_path(config): host_config = HOST / str(config['configfile']).lstrip('/') try: source = host_config.read_text(encoding='utf-8', errors='replace') except OSError as error: raise RuntimeError(f'无法读取 Nginx 主配置：{config["configfile"]}') from error uncommented = re.sub(r'(?m)#.*$', '', source) block = re.search(r'(?m)^\s*http\s*\{', uncommented) if not block: raise RuntimeError('Nginx 主配置中没有 http 配置段，无法安全加入面板反向代理。') opening = uncommented.find('{', block.start()) depth = 1 closing = opening + 1 while closing < len(uncommented) and depth: if uncommented[closing] == '{': depth += 1 elif uncommented[closing] == '}': depth -= 1 closing += 1 if depth: raise RuntimeError('Nginx http 配置段不完整，无法安全加入面板反向代理。') includes = re.findall(r'^\s*include\s+([^;]+);', uncommented[opening + 1:closing - 1], re.M) candidates = [] for include in includes: include = include.strip().strip('"\'') candidate = Path(include) if not candidate.is_absolute(): candidate = host_config.parent / candidate if '*' not in candidate.name or candidate.suffix != '.conf': continue candidates.append(candidate) if candidates: candidates.sort(key=lambda path: ( 0 if path.parent.name in {'conf.d', 'vhost', 'sites-enabled'} else 1, len(path.parts), )) return HOST / str(candidates[0].parent / 'clover-panel.conf').lstrip('/') raise RuntimeError('Nginx 主配置中没有可用的 *.conf 站点目录，无法安全加入面板反向代理。') def issue(self, force=False): host = self.host_name() self.dns_check(host) if not os.path.isfile(DOCKER) or not os.access(DOCKER, os.X_OK): raise RuntimeError(f'证书助手内缺少 Docker CLI（检查路径：{DOCKER}）。请重建证书助手镜像：docker compose build --no-cache certificate-helper && docker compose up -d certificate-helper') if self.shared_caddy_mode(): self.configure_host_caddy() self.log(f'宿主机 Caddy 正在为 {host} 申请/检查 HTTPS 证书…') deadline = time.monotonic() + 120 days = self.served_cert_days(host) while days is None and time.monotonic() < deadline: time.sleep(2) days = self.served_cert_days(host) if days is None: raise RuntimeError(f'宿主机 Caddy 尚未返回 {host} 的 TLS 证书。请确认 DNS 指向本机，公网 TCP 80/443 可达且 Cloudflare 代理已关闭。') self.state['mode'] = 'host-caddy' self.state['provider'] = '宿主机 Caddy' self.state.setdefault('certificates', {}) self.state['certificates']['panel'] = {'host': host, 'daysRemaining': days} self.state['autoRenew'] = True self.state['error'] = None self.log(f'{host} 面板证书由宿主机 Caddy 自动管理，剩余 {days} 天') return days = self.cert_valid_days(host) if days is not None and days > 30 and not force: self.log(f'证书有效期还有 {days} 天，无需续签') self.configure_panel_tls(host) return self.log(f'正在为 {host} 申请/续签证书；需要公网 TCP 80 可达，Cloudflare 代理需暂时关闭') if run(['docker', 'image', 'inspect', ACME_IMAGE], check=False).returncode: run(['docker', 'pull', ACME_IMAGE], timeout=300) try: self.pause_for_acme() self.run_certbot(host) finally: self.recover() self.configure_panel_tls(host) def run_certbot(self, host, webroot=False): home = self.env['CLOVER_HOME'] args = ['docker', 'run', '--rm', '--name', 'clover-acme-job', '--network', 'host', '-v', f'{home}/deploy/acme:/etc/letsencrypt'] if webroot: (PROJECT / 'deploy/acme/webroot').mkdir(parents=True, exist_ok=True) args.extend(['-v', f'{home}/deploy/acme/webroot:/var/www/certbot']) args.extend([ACME_IMAGE, 'certonly']) if webroot: args.extend(['--webroot', '--webroot-path', '/var/www/certbot']) else: args.extend(['--standalone', '--preferred-challenges', 'http']) args.extend(['--non-interactive', '--agree-tos', '--email', self.env['ACME_EMAIL'], '--cert-name', host, '-d', host, '--keep-until-expiring', '--no-random-sleep-on-renew']) run(args, timeout=360) def install_mail_certificate(self, host): cert = self.cert_dir(host) / 'fullchain.pem' key = self.cert_dir(host) / 'privkey.pem' if not cert.is_file() or not key.is_file(): raise RuntimeError(f'没有找到 {host} 的证书文件，无法安装到邮件服务。') fingerprint = hashlib.sha256(cert.read_bytes()).hexdigest() if self.state.get('mailFingerprint') == fingerprint: return False self.log('正在将邮件证书安装到 docker-mailserver 并重载邮件服务…') container_env = run(['docker', 'inspect', '--format', '{{range .Config.Env}}{{println .}}{{end}}', 'docker-mailserver']).stdout settings = dict(line.split('=', 1) for line in container_env.splitlines() if '=' in line) if settings.get('SSL_TYPE') != 'manual': raise RuntimeError('docker-mailserver 未配置 SSL_TYPE=manual，无法安装邮件证书。请先升级并重启邮件服务后重试。') cert_path = settings.get('SSL_CERT_PATH', '/tmp/docker-mailserver/ssl/mail.crt') key_path = settings.get('SSL_KEY_PATH', '/tmp/docker-mailserver/ssl/mail.key') if not cert_path.startswith('/tmp/docker-mailserver/') or not key_path.startswith('/tmp/docker-mailserver/'): raise RuntimeError('邮件证书路径不在 DMS 配置卷中；为避免重启后丢失证书，已取消安装。') for path in (cert_path, key_path): run(['docker', 'exec', 'docker-mailserver', 'mkdir', '-p', str(Path(path).parent)]) # Certbot's live/ entries are relative symlinks into archive/. Copying # the link itself leaves a dangling /tmp/archive/... path inside DMS. # Resolve both source links, and remove any stale destination symlink # before docker cp (otherwise Docker follows it into the missing archive). for path in (cert_path, key_path): run(['docker', 'exec', 'docker-mailserver', 'rm', '-f', path]) run(['docker', 'cp', str(cert.resolve(strict=True)), f'docker-mailserver:{cert_path}']) run(['docker', 'cp', str(key.resolve(strict=True)), f'docker-mailserver:{key_path}']) run(['docker', 'exec', 'docker-mailserver', 'chmod', '600', key_path]) run(['docker', 'restart', '--time', '60', 'docker-mailserver'], timeout=90) self.state['mailFingerprint'] = fingerprint self.state.setdefault('certificates', {})['mail'] = {'host': host, 'daysRemaining': self.cert_valid_days(host)} self.save() return True def issue_mail(self, force=False): host = self.mail_host_name() self.dns_check(host) if not os.path.isfile(DOCKER) or not os.access(DOCKER, os.X_OK): raise RuntimeError(f'证书助手内缺少 Docker CLI（检查路径：{DOCKER}）。请重建证书助手镜像。') if self.shared_caddy_mode(): self.configure_host_caddy() days = self.cert_valid_days(host) if days is not None and days > 30 and not force: self.log(f'{host} 证书有效期还有 {days} 天，无需续签') self.install_mail_certificate(host) return self.log(f'正在为邮件主机 {host} 申请/续签证书；需要公网 TCP 80 可达，Cloudflare 代理需暂时关闭') if run(['docker', 'image', 'inspect', ACME_IMAGE], check=False).returncode: run(['docker', 'pull', ACME_IMAGE], timeout=300) try: if self.shared_caddy_mode(): self.run_certbot(host, webroot=True) else: self.pause_for_acme() self.run_certbot(host) finally: self.recover() self.install_mail_certificate(host) self.log(f'邮件证书已安装到 docker-mailserver：{host}') def configure_panel_tls(self, host): self.nginx_config(host) days = self.cert_valid_days(host) self.state['mode'] = 'nginx' self.state['certificates']['panel'] = {'host': host, 'daysRemaining': days} self.state['autoRenew'] = True self.state['error'] = None self.log(f'{host} 证书已安装；自动续期已启用') def status(self): mail_host = self.env.get('MAIL_HOSTNAME', '') mail_info = self.certificate_info(mail_host, installed=True) if mail_host else None if self.shared_caddy_mode(): host = self.env.get('PANEL_HOSTNAME', '') days = self.served_cert_days(host) if host else None certificates = {'panel': {'host': host, 'daysRemaining': days}} if mail_info: certificates['mail'] = mail_info self.state.update({'mode': 'host-caddy', 'provider': '宿主机 Caddy', 'autoRenew': True, 'certificates': certificates}) if not self.state.get('running') and not self.state.get('message'): self.state['message'] = '面板证书由宿主机 Caddy 自动申请和续期。' print(json.dumps(self.state, ensure_ascii=False)) return if not self.shared_nginx_mode(): host = self.env.get('PANEL_HOSTNAME', '') days = self.served_cert_days(host) if host else None certificates = {'panel': {'host': host, 'daysRemaining': days}} if mail_info: certificates['mail'] = mail_info self.state.update({'mode': 'caddy', 'provider': 'Caddy', 'autoRenew': True, 'certificates': certificates}) if not self.state.get('running') and not self.state.get('message'): self.state['message'] = 'Caddy 自动申请和续期面板证书。' print(json.dumps(self.state, ensure_ascii=False)) return host = self.host_name() days = self.cert_valid_days(host) certificates = {'panel': {'host': host, 'daysRemaining': days}} if mail_info: certificates['mail'] = mail_info self.state['certificates'] = certificates self.state['autoRenew'] = self.state.get('mode') == 'nginx' print(json.dumps(self.state, ensure_ascii=False)) def install_timer(self): executable = '/usr/bin/docker exec clover-certificate-helper python3 /app/certificates.py renew' service = '[Unit]\nDescription=Clover panel certificate renewal\nAfter=docker.service network-online.target\n\n[Service]\nType=oneshot\nExecStart=' + executable + '\nTimeoutStartSec=8min\n' timer = '[Unit]\nDescription=Check Clover panel certificate twice daily\n\n[Timer]\nOnCalendar=*-*-* 03,15:00:00\nRandomizedDelaySec=1800\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n' atomic(HOST / 'etc/systemd/system/clover-certificates.service', service, 0o644) atomic(HOST / 'etc/systemd/system/clover-certificates.timer', timer, 0o644) host_run('/usr/bin/systemctl', 'daemon-reload') host_run('/usr/bin/systemctl', 'enable', '--now', 'clover-certificates.timer') def main(): parser = argparse.ArgumentParser() parser.add_argument('action', choices=['issue', 'issue-mail', 'renew', 'status', 'recover']) parser.add_argument('--force', action='store_true') args = parser.parse_args() manager = Manager() manager.data.mkdir(parents=True, exist_ok=True) if args.action == 'recover': manager.recover() return if args.action == 'status': manager.status() return with (manager.data / 'job.lock').open('a') as lock: try: fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB) except BlockingIOError as error: raise RuntimeError('已有证书任务正在执行，请稍后再试') from error manager.state['running'] = True manager.state['error'] = None manager.save() manager.log('证书任务开始…') try: manager.recover() if args.action == 'issue': manager.issue(force=args.force) elif args.action == 'issue-mail': manager.issue_mail(force=args.force) elif args.action == 'renew': if manager.shared_nginx_mode(): manager.issue() elif manager.shared_caddy_mode(): manager.configure_host_caddy() if manager.env.get('MAIL_HOSTNAME'): manager.issue_mail() manager.install_timer() except Exception as error: manager.state['error'] = str(error) manager.log('证书任务失败：' + str(error)) raise finally: manager.state['running'] = False manager.save() if __name__ == '__main__': try: main() except Exception as error: print('[证书] ' + str(error), file=sys.stderr, flush=True) sys.exit(1)