fix

nginx copy/nginx-prod/Dockerfile

@@ -0,0 +1,15 @@
+FROM nginx
+RUN apt-get update
+RUN apt-get install certbot --yes
+RUN apt-get install python3-certbot-nginx python3-pip --yes
+RUN pip3 install --break-system-packages minio
+COPY ./config /etc/nginx
+COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY ./privkey.pem /etc/nginx/privkey.pem
+COPY prepare.py prepare.py
+COPY run.sh run.sh
+COPY refre.sh refre.sh
+ENV PYTHONUNBUFFERED=1
+RUN chmod 777 run.sh
+RUN chmod 777 refre.sh
+ENTRYPOINT ["./run.sh"]

nginx copy/nginx-prod/config/nginx.conf

@@ -0,0 +1,24 @@
+events {}
+
+http {
+    client_max_body_size 50m;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    server {
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
+    include ./hosts.conf;
+}

nginx copy/nginx-prod/fullchain.pem

@@ -0,0 +1,47 @@
+-----BEGIN CERTIFICATE-----
+MIIDhzCCAw6gAwIBAgISBXELtGOqEI5IsXNFUC7cue03MAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NTAeFw0yNTA1MzAyMTQ3MzZaFw0yNTA4MjgyMTQ3MzVaMBkxFzAVBgNVBAMMDiou
+c3ByaW50aHViLnJ1MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoS3M+thgeup/
+F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9azdDRAp+c2OlzJqJQC+ZefswCB
+2xvjNSoL2aOCAhswggIXMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEF
+BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUu+3qfzUyaCAb
+POu7GPUO6ZI2WfswHwYDVR0jBBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wMgYI
+KwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTUuaS5sZW5jci5vcmcv
+MBkGA1UdEQQSMBCCDiouc3ByaW50aHViLnJ1MBMGA1UdIAQMMAowCAYGZ4EMAQIB
+MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy81Ni5jcmww
+ggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sA
+OhQSdgosrLvIKgAAAZcjX78RAAAEAwBHMEUCIDNC6e7jNcTXW1bti1nkseruXw84
+b8dsVzBt96FtE4+aAiEAr7ugvtozhmp6JdkIEfdHKecym9TxcL1h43j6rbKU3d8A
+dQAaBP9J0FQdQK/2oMO/8djEZy9O7O4jQGiYaxdALtyJfQAAAZcjX8BoAAAEAwBG
+MEQCIDezeAIFZ25OWXVV9hmtzEE5ujP0IyFaLxebyXAflYZMAiAy09hFLQXapebE
+5YDtvqfmefapEsr4OaWyfusWjmeaiDAKBggqhkjOPQQDAwNnADBkAjAobO18Vk18
+BG7lBbXEQ0O8RYy+CEV/ef1ni2CBQp+MtmG/ZCWAbfEXFaj2WKng5Q0CMFRR9icx
+p6/tLUixnJfAusGudEtD5Leh2foPDT2jzgazaROaVFVTrCJMGcdgVukuPQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
+a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
+VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
+i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
+2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
+bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
+6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
+XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
+koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
+cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
+E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
+K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
+GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
+sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
+VQD9F6Na/+zmXCc=
+-----END CERTIFICATE-----

nginx copy/nginx-prod/prepare.py

@@ -0,0 +1,82 @@
+import os
+import sys
+from minio import Minio
+from urllib.request import urlopen
+from json import loads
+
+
+minio_client = Minio(
+    "minio.sprinthub.ru:9000",
+    access_key="serviceminioadmin",
+    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
+    secure=False,
+)
+
+
+def get(url):
+    with urlopen(url) as response:
+        data = response.read().decode("utf-8")
+        return loads(data)
+
+
+try:
+    response = get(
+        "http://configurator/api/v1/fetch?project=certupdater&stage=production"
+    )
+    hosts = response["configs"]["hosts"]
+except Exception as e:
+    print(f"Error fetching config: {e}", file=sys.stderr)
+    sys.exit(1)
+
+config = ""
+for host, params in hosts.items():
+    config += """
+        server {{
+            listen      443 ssl http2;
+            listen      [::]:443 ssl http2;
+            server_name {host};
+
+            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
+            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
+
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Referrer-Policy "no-refferer-when-downgrade" always;
+            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+            location / {{
+                resolver 127.0.0.11;
+                proxy_pass http://{target_host}:{port}$request_uri;
+            }}
+        }}\n\n
+    """.format(
+        host=host, target_host=params["host"], port=params["port"]
+    )
+    try:
+        fullchain = minio_client.get_object(
+            "certupdater", f"certificates/{host}/fullchain.pem"
+        )
+        privkey = minio_client.get_object(
+            "certupdater", f"certificates/{host}/privkey.pem"
+        )
+        try:
+            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
+        except OSError as e:
+            print(f"Error creating directory: {e}", file=sys.stderr)
+            continue
+
+        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
+            fp.write(fullchain.data)
+        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
+            fp.write(privkey.data)
+    except Exception as e:
+        print(f"Error processing host {host}: {e}", file=sys.stderr)
+        continue
+
+try:
+    with open("/etc/nginx/hosts.conf", "w") as fp:
+        fp.write(config)
+except Exception as e:
+    print(f"Error writing config file: {e}", file=sys.stderr)
+    sys.exit(1)

nginx copy/nginx-prod/privkey.pem

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIL0TAduonJLmbcDpRxDjSfa8bMIqLOh1KQcGQvAeQTIQoAoGCCqGSM49
+AwEHoUQDQgAEoS3M+thgeup/F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9az
+dDRAp+c2OlzJqJQC+ZefswCB2xvjNSoL2Q==
+-----END EC PRIVATE KEY-----

nginx copy/nginx-prod/refre.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+nginx -s reload

nginx copy/nginx-prod/run.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+/docker-entrypoint.sh nginx -g 'daemon off;'