Sichere Caddy- und DNS-Stilllegung: app.py
This commit is contained in:
parent
2a71bf857f
commit
a324b136df
1 changed files with 153 additions and 0 deletions
153
app.py
153
app.py
|
|
@ -1458,6 +1458,159 @@ async def restore_iso_builder(dry_run: bool = Query(True), _=Depends(_verify)):
|
|||
return result
|
||||
|
||||
|
||||
CADDY_HOST = "root@46.225.230.72"
|
||||
CADDYFILE_PATH = "/app-config/caddy/Caddyfile"
|
||||
HETZNER_DNS_API = "https://api.hetzner.cloud/v1"
|
||||
|
||||
|
||||
def _validate_managed_hostname(hostname: str) -> str:
|
||||
hostname = hostname.strip().lower().rstrip(".")
|
||||
if not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+", hostname):
|
||||
raise HTTPException(400, "Invalid hostname")
|
||||
if not hostname.endswith(".sascha-lutz.de"):
|
||||
raise HTTPException(400, "Hostname is outside the managed zone")
|
||||
return hostname
|
||||
|
||||
|
||||
def _caddy_site_remove_command(hostname: str, dry_run: bool) -> str:
|
||||
script = '''import datetime, hashlib, json, os, re, subprocess, sys
|
||||
path = %r
|
||||
hostname = %r
|
||||
dry_run = %r
|
||||
|
||||
def digest(data):
|
||||
return hashlib.sha256(data.encode()).hexdigest()
|
||||
|
||||
def run(args):
|
||||
p = subprocess.run(args, text=True, capture_output=True, timeout=30)
|
||||
return {"rc": p.returncode, "stdout": p.stdout.strip()[-2000:], "stderr": p.stderr.strip()[-2000:]}
|
||||
|
||||
text = open(path, encoding="utf-8").read()
|
||||
pattern = re.compile(r"(?m)^[ \\t]*" + re.escape(hostname) + r"[ \\t]*\\{")
|
||||
match = pattern.search(text)
|
||||
result = {"hostname": hostname, "dry_run": dry_run, "found": bool(match), "before_sha256": digest(text)}
|
||||
if not match:
|
||||
print(json.dumps(result)); raise SystemExit(0)
|
||||
start = match.start(); depth = 0; end = None
|
||||
for idx in range(match.end() - 1, len(text)):
|
||||
if text[idx] == "{": depth += 1
|
||||
elif text[idx] == "}":
|
||||
depth -= 1
|
||||
if depth == 0:
|
||||
end = idx + 1
|
||||
while end < len(text) and text[end] in " \\t": end += 1
|
||||
while end < len(text) and text[end] == "\\n": end += 1
|
||||
break
|
||||
if end is None:
|
||||
result["error"] = "Unbalanced Caddy site block"; print(json.dumps(result)); raise SystemExit(2)
|
||||
result["line_start"] = text.count("\\n", 0, start) + 1
|
||||
result["line_end"] = text.count("\\n", 0, end) + 1
|
||||
if dry_run:
|
||||
print(json.dumps(result)); raise SystemExit(0)
|
||||
new = text[:start] + text[end:]
|
||||
backup = path + ".pre-outline-removal-" + datetime.datetime.now().strftime("%%Y%%m%%d-%%H%%M%%S")
|
||||
open(backup, "w", encoding="utf-8").write(text)
|
||||
with open(path, "w", encoding="utf-8") as f:
|
||||
f.write(new); f.flush(); os.fsync(f.fileno())
|
||||
result["backup"] = backup
|
||||
result["after_sha256"] = digest(new)
|
||||
validation = run(["docker", "exec", "caddy", "caddy", "validate", "--config", "/etc/caddy/Caddyfile"])
|
||||
result["validation"] = validation
|
||||
if validation["rc"] != 0:
|
||||
with open(path, "w", encoding="utf-8") as f:
|
||||
f.write(text); f.flush(); os.fsync(f.fileno())
|
||||
result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(3)
|
||||
host_sha = run(["sha256sum", path])
|
||||
container_sha = run(["docker", "exec", "caddy", "sha256sum", "/etc/caddy/Caddyfile"])
|
||||
result["host_container_hash_match"] = bool(host_sha["stdout"] and container_sha["stdout"] and host_sha["stdout"].split()[0] == container_sha["stdout"].split()[0])
|
||||
if not result["host_container_hash_match"]:
|
||||
with open(path, "w", encoding="utf-8") as f:
|
||||
f.write(text); f.flush(); os.fsync(f.fileno())
|
||||
result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(4)
|
||||
reload = run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"])
|
||||
result["reload"] = reload
|
||||
if reload["rc"] != 0:
|
||||
with open(path, "w", encoding="utf-8") as f:
|
||||
f.write(text); f.flush(); os.fsync(f.fileno())
|
||||
run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"])
|
||||
result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(5)
|
||||
container_text = run(["docker", "exec", "caddy", "sh", "-c", "cat /etc/caddy/Caddyfile"])
|
||||
result["hostname_absent"] = hostname not in container_text["stdout"]
|
||||
print(json.dumps(result))
|
||||
''' % (CADDYFILE_PATH, hostname, dry_run)
|
||||
encoded = base64.b64encode(script.encode()).decode()
|
||||
return f"python3 -c \"import base64;exec(base64.b64decode('{encoded}'))\""
|
||||
|
||||
|
||||
@app.delete("/caddy/site/{hostname}")
|
||||
async def caddy_site_remove(hostname: str, _=Depends(_verify), dry_run: bool = Query(True)):
|
||||
hostname = _validate_managed_hostname(hostname)
|
||||
rc, out, err = _ssh(CADDY_HOST, _caddy_site_remove_command(hostname, dry_run), timeout=90)
|
||||
try:
|
||||
result = json.loads(out)
|
||||
except Exception:
|
||||
raise HTTPException(502, (err or out or "Caddy removal returned no JSON")[-1000:])
|
||||
if rc != 0:
|
||||
raise HTTPException(502, result)
|
||||
_audit(f"/caddy/site/{hostname}", "DELETE", 200, f"dry_run={dry_run}")
|
||||
return result
|
||||
|
||||
|
||||
async def _hetzner_zone_and_rrsets(zone_name: str):
|
||||
token = _read("HETZNER_DNS_TOKEN")
|
||||
if not token:
|
||||
raise HTTPException(503, "HETZNER_DNS_TOKEN unavailable in Butler vault cache")
|
||||
headers = {"Authorization": f"Bearer {token}"}
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
zones_response = await client.get(f"{HETZNER_DNS_API}/zones", headers=headers, params={"name": zone_name})
|
||||
if zones_response.status_code != 200:
|
||||
raise HTTPException(502, f"Hetzner zones lookup failed: HTTP {zones_response.status_code}")
|
||||
zones = zones_response.json().get("zones", [])
|
||||
zone = next((item for item in zones if item.get("name") == zone_name), None)
|
||||
if not zone:
|
||||
raise HTTPException(404, "DNS zone not found")
|
||||
rr_response = await client.get(f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets", headers=headers)
|
||||
if rr_response.status_code != 200:
|
||||
raise HTTPException(502, f"Hetzner RRSet lookup failed: HTTP {rr_response.status_code}")
|
||||
return zone, rr_response.json().get("rrsets", []), headers
|
||||
|
||||
|
||||
@app.get("/dns/rrset/{zone_name}/{record_name}")
|
||||
async def dns_rrset_get(zone_name: str, record_name: str, _=Depends(_verify)):
|
||||
zone_name = zone_name.strip().lower().rstrip(".")
|
||||
hostname = _validate_managed_hostname(f"{record_name}.{zone_name}")
|
||||
record_name = hostname[: -(len(zone_name) + 1)]
|
||||
zone, rrsets, _headers = await _hetzner_zone_and_rrsets(zone_name)
|
||||
selected = [r for r in rrsets if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}]
|
||||
return {"zone": zone_name, "zone_id": zone.get("id"), "name": record_name, "rrsets": selected}
|
||||
|
||||
|
||||
@app.delete("/dns/rrset/{zone_name}/{record_name}")
|
||||
async def dns_rrset_delete(zone_name: str, record_name: str, _=Depends(_verify), dry_run: bool = Query(True)):
|
||||
zone_name = zone_name.strip().lower().rstrip(".")
|
||||
hostname = _validate_managed_hostname(f"{record_name}.{zone_name}")
|
||||
record_name = hostname[: -(len(zone_name) + 1)]
|
||||
zone, rrsets, headers = await _hetzner_zone_and_rrsets(zone_name)
|
||||
selected = [r for r in rrsets if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}]
|
||||
result = {"zone": zone_name, "zone_id": zone.get("id"), "name": record_name, "dry_run": dry_run, "rrsets": selected, "deleted": []}
|
||||
if dry_run or not selected:
|
||||
return result
|
||||
async with httpx.AsyncClient(timeout=30) as client:
|
||||
for rrset in selected:
|
||||
url = f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets/{record_name}/{rrset['type']}"
|
||||
response = await client.delete(url, headers=headers)
|
||||
if response.status_code not in {200, 204}:
|
||||
raise HTTPException(502, f"Hetzner RRSet delete failed for {rrset['type']}: HTTP {response.status_code}")
|
||||
result["deleted"].append(rrset["type"])
|
||||
verify_response = await client.get(f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets", headers=headers)
|
||||
remaining = verify_response.json().get("rrsets", []) if verify_response.status_code == 200 else selected
|
||||
result["remaining"] = [r for r in remaining if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}]
|
||||
if result["remaining"]:
|
||||
raise HTTPException(502, "RRSet read-back still contains deleted record")
|
||||
_audit(f"/dns/rrset/{zone_name}/{record_name}", "DELETE", 200, "deleted=" + ",".join(result["deleted"]))
|
||||
return result
|
||||
|
||||
|
||||
def _pve_auth():
|
||||
pv = _parse_kv("proxmox")
|
||||
return f"PVEAPIToken={pv.get('tokenid','')}={pv.get('secret','')}"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue