Gmer4Lfe
c34224effa
Unraid already enforces CSRF on every POST via auto_prepend, but its injector is jQuery-only — the plugin's native fetch() calls carried no token and were being terminated before the endpoint ran, silently, because csrf_terminate exits with an empty body that r.json() swallows.
237 lines
12 KiB
PHP
237 lines
12 KiB
PHP
<?php
|
|
// ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
// PURPOSE
|
|
// Certificate status. Serves the cert panel four ways — the cached results of the last
|
|
// cert_monitor.sh run, the configured domain list, a live read of NPM's own certificate
|
|
// store, and an on-demand re-run of the monitor.
|
|
//
|
|
// OPERATIONAL MODEL
|
|
// Two independent sources of truth, deliberately kept separate. cert_monitor.sh checks the
|
|
// domains as they resolve from outside — the certificate a visitor actually receives. NPM's
|
|
// API reports what it holds internally. They disagree exactly when something is wrong: a
|
|
// renewed cert that was never reloaded, or a proxy host pointing at the wrong certificate.
|
|
// Collapsing them into one number would hide the only case worth catching.
|
|
//
|
|
// The default path serves cert_monitor.sh's cache and never checks anything itself. That
|
|
// script runs on the Sunday report schedule; the run action exists for when someone does
|
|
// not want to wait for it.
|
|
//
|
|
// DESIGN PRINCIPLES
|
|
// Thresholds come from master.conf, with shipped defaults.
|
|
// CERT_WARN_DAYS and CERT_CRIT_DAYS are read per request rather than baked in, so the
|
|
// page and the script that notifies agree on what "critical" means.
|
|
//
|
|
// No cache is answered with the domain list, not with an error.
|
|
// Before the first run there is nothing to report, so the configured domains are
|
|
// returned marked UNKN. The panel shows what is being watched rather than an empty
|
|
// state that looks like nothing is configured.
|
|
//
|
|
// Already expired sorts with critical, not past it.
|
|
// A negative day count is CRIT rather than a separate state, and the sort puts the
|
|
// smallest number first — so the most urgent certificate is always at the top.
|
|
//
|
|
// The run action returns the script's output alongside the fresh data.
|
|
// Capped at 30 lines. When a check fails, the reason is in that output and nowhere in
|
|
// the structured result.
|
|
//
|
|
// OPERATIONAL SAFEGUARDS
|
|
// The action is chosen from a fixed set, and everything else falls to the cached read.
|
|
// No part of the request names a script, a domain, or a file. The one script this
|
|
// endpoint can run is a hardcoded path.
|
|
//
|
|
// The script run is externally time-boxed.
|
|
// `timeout 180` wraps it — set_time_limit() does not cover exec() time on Linux, so
|
|
// PHP's own limit cannot end a check hung on an unresponsive domain. Exit 124 is
|
|
// reported as a timeout rather than a generic failure.
|
|
//
|
|
// A missing script is reported, not executed.
|
|
// file_exists() precedes exec(), so a partial deploy returns a named error rather than
|
|
// a shell failure surfacing as an empty result.
|
|
//
|
|
// Every threshold read has a default.
|
|
// ?: 30 and ?: 7 on the regex captures, so a master.conf mid-edit or missing the keys
|
|
// still yields coherent statuses instead of comparing every certificate against zero
|
|
// and reporting the whole estate critical.
|
|
//
|
|
// Missing or malformed expiry data is UNKN, never OK.
|
|
// A certificate whose expires_on is absent or unparseable yields a null day count and
|
|
// an explicit unknown status. Defaulting it to OK would silently drop a certificate out
|
|
// of monitoring — the one failure this panel exists to prevent.
|
|
//
|
|
// Every cache read degrades.
|
|
// json_decode with ?: fallbacks throughout, so a truncated cache file yields an empty
|
|
// result rather than a fatal.
|
|
//
|
|
// The NPM path reports its own transport failures.
|
|
// vv_npm_req() returns an _err key rather than throwing, and that is checked before the
|
|
// response is treated as a certificate list — so an unreachable NPM is reported as such
|
|
// instead of rendering as zero certificates.
|
|
//
|
|
// The run action is POST only, which is what places it behind Unraid's CSRF guard.
|
|
// The platform prepend validates the token on every POST and inspects no GET at all, so
|
|
// an action that executes a script must not be reachable by GET. The three read actions
|
|
// stay GET-reachable because they change nothing.
|
|
//
|
|
// REQUEST
|
|
// GET cached status, or the configured domains when no cache exists
|
|
// GET|POST ?action=npm live certificate list from NPM's API
|
|
// GET|POST ?action=domains configured domains and thresholds, no checks run
|
|
// POST action=run re-run cert_monitor.sh, then return its fresh cache
|
|
// (POST, so Unraid's CSRF guard applies)
|
|
//
|
|
// RESPONSE
|
|
// default {"ok":true,"checked_at","host","warn_days","crit_days","domains":[…]}
|
|
// npm {"ok":true,"certs":[{id,nice_name,domain_names,provider,expires,days,status}],
|
|
// "warn_days","crit_days"}
|
|
// domains {"ok":true,"host_id","domains":[…],"warn_days","crit_days"}
|
|
// run {"ok":true,"data":…,"output":[…],"rc":int}
|
|
// {"ok":false,"error":"NPM request failed"|"cert_monitor.sh not found"|"… timed out …"}
|
|
//
|
|
// DEPENDS ON
|
|
// include/config.php vv_detect_host(), vv_read_conf_raw(), STATE_DIR, SCRIPTS_DIR
|
|
// include/auth.php vv_npm_req()
|
|
// Monitors/cert_monitor.sh writes STATE_DIR/cert_status.json
|
|
// ═══════════════════════════════════════════════════════════════════════════════════════════════
|
|
header('Content-Type: application/json');
|
|
require_once dirname(__DIR__) . '/include/config.php';
|
|
require_once dirname(__DIR__) . '/include/auth.php';
|
|
|
|
$action = ($_SERVER['REQUEST_METHOD'] === 'POST')
|
|
? trim($_POST['action'] ?? '')
|
|
: trim($_GET['action'] ?? '');
|
|
|
|
$cacheFile = STATE_DIR . '/cert_status.json';
|
|
|
|
// ── Live NPM cert list ────────────────────────────────────────────────────────
|
|
if ($action === 'npm') {
|
|
$raw = vv_npm_req('GET', '/api/nginx/certificates');
|
|
if (!is_array($raw) || isset($raw['_err']))
|
|
die(json_encode(['ok' => false, 'error' => $raw['_err'] ?? 'NPM request failed']));
|
|
|
|
$master = vv_read_conf_raw('master.conf');
|
|
preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
|
|
preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
|
|
$warn = (int)($w[1] ?? 30);
|
|
$crit = (int)($c[1] ?? 7);
|
|
$now = time();
|
|
|
|
$certs = [];
|
|
foreach ($raw as $cert) {
|
|
$exp = !empty($cert['expires_on']) ? strtotime($cert['expires_on']) : false;
|
|
$days = $exp !== false ? (int)(($exp - $now) / 86400) : null;
|
|
$status = $days === null ? 'UNKN'
|
|
: ($days < 0 ? 'CRIT'
|
|
: ($days <= $crit ? 'CRIT'
|
|
: ($days <= $warn ? 'WARN' : 'OK')));
|
|
$certs[] = [
|
|
'id' => $cert['id'],
|
|
'nice_name' => $cert['nice_name'] ?? implode(', ', $cert['domain_names'] ?? []),
|
|
'domain_names'=> $cert['domain_names'] ?? [],
|
|
'provider' => $cert['provider'] ?? 'unknown',
|
|
'expires' => !empty($cert['expires_on']) ? substr($cert['expires_on'], 0, 10) : '',
|
|
'days' => $days,
|
|
'status' => $status,
|
|
];
|
|
}
|
|
usort($certs, fn($a, $b) => ($a['days'] ?? PHP_INT_MAX) <=> ($b['days'] ?? PHP_INT_MAX));
|
|
|
|
echo json_encode(['ok' => true, 'certs' => $certs, 'warn_days' => $warn, 'crit_days' => $crit]);
|
|
exit;
|
|
}
|
|
|
|
// ── Read configured domains (without running checks) ─────────────────────────
|
|
if ($action === 'domains') {
|
|
$hostId = vv_detect_host();
|
|
$hostIdUp = strtoupper($hostId);
|
|
$confRaw = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
|
|
$master = vv_read_conf_raw('master.conf');
|
|
|
|
// Extract CERT_WARN_DAYS / CERT_CRIT_DAYS from master
|
|
preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
|
|
preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
|
|
|
|
// Extract domains array from host conf
|
|
$domains = [];
|
|
if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
|
|
preg_match_all('/"([^"]+)"/', $dm[1], $dd);
|
|
$domains = $dd[1] ?? [];
|
|
}
|
|
|
|
echo json_encode([
|
|
'ok' => true,
|
|
'host_id' => $hostId,
|
|
'domains' => $domains,
|
|
'warn_days' => (int)($w[1] ?? 30),
|
|
'crit_days' => (int)($c[1] ?? 7),
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
// ── Run cert_monitor.sh now ───────────────────────────────────────────────────
|
|
if ($action === 'run') {
|
|
// POST only. This executes a script, and Unraid's CSRF prepend validates POSTs while
|
|
// ignoring GETs entirely — over GET it would run with no token check at all.
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
echo json_encode(['ok' => false, 'error' => 'POST only']);
|
|
exit;
|
|
}
|
|
$script = SCRIPTS_DIR . '/Monitors/cert_monitor.sh';
|
|
if (!file_exists($script)) {
|
|
echo json_encode(['ok' => false, 'error' => 'cert_monitor.sh not found']);
|
|
exit;
|
|
}
|
|
// set_time_limit() does not cover exec() time on Linux, so the bound has to be external —
|
|
// cert_monitor.sh reaches out to every configured domain and one unreachable host would
|
|
// otherwise hold a php-fpm worker open indefinitely.
|
|
set_time_limit(210);
|
|
exec('timeout 180 bash ' . escapeshellarg($script) . ' 2>&1', $out, $rc);
|
|
if ($rc === 124) {
|
|
echo json_encode(['ok' => false, 'error' => 'cert_monitor.sh timed out after 180s']);
|
|
exit;
|
|
}
|
|
// Read freshly written cache
|
|
$data = file_exists($cacheFile)
|
|
? (json_decode(file_get_contents($cacheFile), true) ?: null)
|
|
: null;
|
|
echo json_encode([
|
|
'ok' => true,
|
|
'data' => $data,
|
|
'output' => array_slice(array_filter(array_map('trim', $out)), 0, 30),
|
|
'rc' => $rc,
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
// ── Default: return cached status ─────────────────────────────────────────────
|
|
if (!file_exists($cacheFile)) {
|
|
// No cache yet — return configured domains so UI can show them unchecked
|
|
$hostId = vv_detect_host();
|
|
$hostIdUp = strtoupper($hostId);
|
|
$confRaw = ($hostId !== 'unknown') ? vv_read_conf_raw($hostId . '.conf') : '';
|
|
$master = vv_read_conf_raw('master.conf');
|
|
|
|
preg_match('/^\s*CERT_WARN_DAYS\s*=\s*(\d+)/m', $master, $w);
|
|
preg_match('/^\s*CERT_CRIT_DAYS\s*=\s*(\d+)/m', $master, $c);
|
|
$domains = [];
|
|
if (preg_match('/' . $hostIdUp . '_CERT_MONITOR_DOMAINS\s*=\s*\(([^)]*)\)/s', $confRaw, $dm)) {
|
|
preg_match_all('/"([^"]+)"/', $dm[1], $dd);
|
|
foreach ($dd[1] ?? [] as $d) {
|
|
$domains[] = ['domain' => $d, 'status' => 'UNKN', 'days' => null, 'expires' => ''];
|
|
}
|
|
}
|
|
|
|
echo json_encode([
|
|
'ok' => true,
|
|
'checked_at' => null,
|
|
'host' => $hostId !== 'unknown' ? strtoupper($hostId) : null,
|
|
'warn_days' => (int)($w[1] ?? 30),
|
|
'crit_days' => (int)($c[1] ?? 7),
|
|
'domains' => $domains,
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
$data = json_decode(file_get_contents($cacheFile), true) ?: [];
|
|
echo json_encode(array_merge(['ok' => true], $data));
|