46 lines
2.0 KiB
Python
46 lines
2.0 KiB
Python
#!/usr/bin/python3
|
|
"""仅在临近到期时占用 443 续期，任何正常异常路径均恢复 Nginx。"""
|
|
|
|
import fcntl
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
|
|
ROOT = Path('/var/lib/smail-acme-tls')
|
|
DOMAINS = ('solit.cn', 'mail.solit.cn', 'smtp.solit.cn', 'imap.solit.cn', 'pop.solit.cn')
|
|
|
|
|
|
def main():
|
|
if os.geteuid() != 0:
|
|
raise RuntimeError('必须使用 root 执行证书续期')
|
|
with open('/run/smail-certificate-renew.lock', 'a') as lock:
|
|
fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
|
certificate = str(ROOT / 'certificates/solit.cn.crt')
|
|
subprocess.run(['openssl', 'x509', '-in', certificate, '-noout'], check=True)
|
|
due = subprocess.run(['openssl', 'x509', '-in', certificate, '-noout', '-checkend', '2592000'],
|
|
capture_output=True).returncode != 0
|
|
if due:
|
|
subprocess.run(['nginx', '-t'], check=True)
|
|
subprocess.run(['systemctl', 'is-active', '--quiet', 'nginx'], check=True)
|
|
command = ['/usr/local/libexec/smail-acme/lego', '--path', str(ROOT),
|
|
'--email', '', '--accept-tos', '--key-type', 'rsa2048', '--tls',
|
|
'--http-timeout', '20', '--cert.timeout', '30']
|
|
for domain in DOMAINS:
|
|
command.extend(['--domains', domain])
|
|
command.extend(['renew', '--days', '30', '--reuse-key', '--no-random-sleep'])
|
|
# systemd 的 ExecStopPost 另行覆盖进程被终止时的服务恢复。
|
|
try:
|
|
subprocess.run(['systemctl', 'stop', 'nginx'], check=True)
|
|
subprocess.run(command, check=True, timeout=150,
|
|
env={**os.environ, 'GOMEMLIMIT': '64MiB'})
|
|
finally:
|
|
subprocess.run(['systemctl', 'start', 'nginx'], check=True)
|
|
else:
|
|
print('证书有效期大于 30 天，本次不暂停 Web 服务')
|
|
subprocess.run(['/usr/local/libexec/smail-acme/deploy_certificate.py'], check=True)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|