|
| 1 | +package synologydsm |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "crypto/tls" |
| 6 | + "errors" |
| 7 | + "fmt" |
| 8 | + "log/slog" |
| 9 | + "time" |
| 10 | + |
| 11 | + "github.com/pquerna/otp/totp" |
| 12 | + "github.com/samber/lo" |
| 13 | + |
| 14 | + "github.com/certimate-go/certimate/pkg/core/deployer" |
| 15 | + dsmsdk "github.com/certimate-go/certimate/pkg/sdk3rd/synologydsm" |
| 16 | + xcert "github.com/certimate-go/certimate/pkg/utils/cert" |
| 17 | + xwait "github.com/certimate-go/certimate/pkg/utils/wait" |
| 18 | +) |
| 19 | + |
| 20 | +type DeployerConfig struct { |
| 21 | + // 群晖 DSM 服务地址。 |
| 22 | + ServerUrl string `json:"serverUrl"` |
| 23 | + // 群晖 DSM 用户名。 |
| 24 | + Username string `json:"username"` |
| 25 | + // 群晖 DSM 用户密码。 |
| 26 | + Password string `json:"password"` |
| 27 | + // 群晖 DSM 2FA TOTP 密钥。 |
| 28 | + TotpSecret string `json:"totpSecret,omitempty"` |
| 29 | + // 是否允许不安全的连接。 |
| 30 | + AllowInsecureConnections bool `json:"allowInsecureConnections,omitempty"` |
| 31 | + // 证书 ID 或描述。 |
| 32 | + // 选填。零值时表示新建证书；否则表示更新证书。 |
| 33 | + CertificateIdOrDescription string `json:"certificateIdOrDesc,omitempty"` |
| 34 | + // 是否设为默认证书。 |
| 35 | + IsDefault bool `json:"isDefault,omitempty"` |
| 36 | +} |
| 37 | + |
| 38 | +type Deployer struct { |
| 39 | + config *DeployerConfig |
| 40 | + logger *slog.Logger |
| 41 | + sdkClient *dsmsdk.Client |
| 42 | +} |
| 43 | + |
| 44 | +var _ deployer.Provider = (*Deployer)(nil) |
| 45 | + |
| 46 | +func NewDeployer(config *DeployerConfig) (*Deployer, error) { |
| 47 | + if config == nil { |
| 48 | + return nil, errors.New("the configuration of the deployer provider is nil") |
| 49 | + } |
| 50 | + |
| 51 | + client, err := createSDKClient(config.ServerUrl, config.AllowInsecureConnections) |
| 52 | + if err != nil { |
| 53 | + return nil, fmt.Errorf("could not create client: %w", err) |
| 54 | + } |
| 55 | + |
| 56 | + return &Deployer{ |
| 57 | + config: config, |
| 58 | + logger: slog.Default(), |
| 59 | + sdkClient: client, |
| 60 | + }, nil |
| 61 | +} |
| 62 | + |
| 63 | +func (d *Deployer) SetLogger(logger *slog.Logger) { |
| 64 | + if logger == nil { |
| 65 | + d.logger = slog.Default() |
| 66 | + } else { |
| 67 | + d.logger = logger |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +func (d *Deployer) Deploy(ctx context.Context, certPEM string, privkeyPEM string) (*deployer.DeployResult, error) { |
| 72 | + // 提取服务器证书和中间证书 |
| 73 | + serverCertPEM, intermediateCertPEM, err := xcert.ExtractCertificatesFromPEM(certPEM) |
| 74 | + if err != nil { |
| 75 | + return nil, fmt.Errorf("failed to extract certs: %w", err) |
| 76 | + } |
| 77 | + |
| 78 | + // 如果启用了 TOTP，则等到下一个时间窗口后生成 OTP 动态密码 |
| 79 | + var otpCode string |
| 80 | + if d.config.TotpSecret != "" { |
| 81 | + now := time.Now() |
| 82 | + wait := time.Duration(30-now.Unix()%30) * time.Second |
| 83 | + if wait > 0 { |
| 84 | + wait = wait + 1*time.Second |
| 85 | + d.logger.Info("waiting for the next TOTP time step ...", slog.Int("wait", int(wait.Seconds()))) |
| 86 | + xwait.DelayWithContext(ctx, wait) |
| 87 | + } |
| 88 | + |
| 89 | + now = time.Now() |
| 90 | + otpCodeStr, err := totp.GenerateCode(d.config.TotpSecret, now) |
| 91 | + if err != nil { |
| 92 | + return nil, fmt.Errorf("failed to generate TOTP code: %w", err) |
| 93 | + } |
| 94 | + |
| 95 | + otpCode = otpCodeStr |
| 96 | + } |
| 97 | + |
| 98 | + // 登录到群晖 DSM |
| 99 | + loginReq := &dsmsdk.LoginRequest{ |
| 100 | + Account: d.config.Username, |
| 101 | + Password: d.config.Password, |
| 102 | + OtpCode: otpCode, |
| 103 | + } |
| 104 | + loginResp, err := d.sdkClient.Login(loginReq) |
| 105 | + d.logger.Debug("sdk request 'SYNO.API.Auth:login'", slog.Any("request", loginReq), slog.Any("response", loginResp)) |
| 106 | + if err != nil { |
| 107 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.API.Auth:login': %w", err) |
| 108 | + } |
| 109 | + defer func() { |
| 110 | + logoutResp, _ := d.sdkClient.Logout() |
| 111 | + d.logger.Debug("sdk request 'SYNO.API.Auth:logout'", slog.Any("response", logoutResp)) |
| 112 | + }() |
| 113 | + |
| 114 | + // 如果原证书 ID 或描述为空，则创建证书；否则更新证书。 |
| 115 | + if d.config.CertificateIdOrDescription == "" { |
| 116 | + // 导入证书 |
| 117 | + importCertificateReq := &dsmsdk.ImportCertificateRequest{ |
| 118 | + ID: "", |
| 119 | + Description: fmt.Sprintf("certimate-%d", time.Now().UnixMilli()), |
| 120 | + Key: privkeyPEM, |
| 121 | + Cert: serverCertPEM, |
| 122 | + InterCert: intermediateCertPEM, |
| 123 | + AsDefault: d.config.IsDefault, |
| 124 | + } |
| 125 | + importCertificateResp, err := d.sdkClient.ImportCertificate(importCertificateReq) |
| 126 | + d.logger.Debug("sdk request 'SYNO.Core.Certificate:import'", slog.Any("request", importCertificateReq), slog.Any("response", importCertificateResp)) |
| 127 | + if err != nil { |
| 128 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.Core.Certificate:import': %w", err) |
| 129 | + } |
| 130 | + } else { |
| 131 | + // 查找证书列表，找到已有证书 |
| 132 | + var certInfo *dsmsdk.CertificateInfo |
| 133 | + listCertificatesResp, err := d.sdkClient.ListCertificates() |
| 134 | + d.logger.Debug("sdk request 'SYNO.Core.Certificate.CRT:list'", slog.Any("response", listCertificatesResp)) |
| 135 | + if err != nil { |
| 136 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.Core.Certificate.CRT:list': %w", err) |
| 137 | + } else { |
| 138 | + matchedCerts := lo.Filter(listCertificatesResp.Data.Certificates, func(certItem *dsmsdk.CertificateInfo, _ int) bool { |
| 139 | + return certItem.ID == d.config.CertificateIdOrDescription |
| 140 | + }) |
| 141 | + if len(matchedCerts) == 0 { |
| 142 | + matchedCerts = lo.Filter(listCertificatesResp.Data.Certificates, func(certItem *dsmsdk.CertificateInfo, _ int) bool { |
| 143 | + return certItem.Description == d.config.CertificateIdOrDescription |
| 144 | + }) |
| 145 | + } |
| 146 | + if len(matchedCerts) == 0 { |
| 147 | + return nil, fmt.Errorf("could not find certificate '%s'", d.config.CertificateIdOrDescription) |
| 148 | + } else { |
| 149 | + if len(matchedCerts) > 1 { |
| 150 | + d.logger.Warn("found several certificates matched '%s', using the first one") |
| 151 | + } |
| 152 | + certInfo = matchedCerts[0] |
| 153 | + } |
| 154 | + } |
| 155 | + |
| 156 | + // 导入证书 |
| 157 | + importCertificateReq := &dsmsdk.ImportCertificateRequest{ |
| 158 | + ID: certInfo.ID, |
| 159 | + Description: certInfo.Description, |
| 160 | + Key: privkeyPEM, |
| 161 | + Cert: serverCertPEM, |
| 162 | + InterCert: intermediateCertPEM, |
| 163 | + AsDefault: d.config.IsDefault || certInfo.IsDefault, |
| 164 | + } |
| 165 | + importCertificateResp, err := d.sdkClient.ImportCertificate(importCertificateReq) |
| 166 | + d.logger.Debug("sdk request 'SYNO.Core.Certificate:import'", slog.Any("request", importCertificateReq), slog.Any("response", importCertificateResp)) |
| 167 | + if err != nil { |
| 168 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.Core.Certificate:import': %w", err) |
| 169 | + } |
| 170 | + } |
| 171 | + |
| 172 | + if d.config.IsDefault { |
| 173 | + // 查找证书列表，找到默认证书 |
| 174 | + listCertificatesResp, err := d.sdkClient.ListCertificates() |
| 175 | + d.logger.Debug("sdk request 'SYNO.Core.Certificate.CRT:list'", slog.Any("response", listCertificatesResp)) |
| 176 | + if err != nil { |
| 177 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.Core.Certificate.CRT:list': %w", err) |
| 178 | + } else { |
| 179 | + var defaultCertId string |
| 180 | + for _, certItem := range listCertificatesResp.Data.Certificates { |
| 181 | + if certItem.IsDefault { |
| 182 | + defaultCertId = certItem.ID |
| 183 | + break |
| 184 | + } |
| 185 | + } |
| 186 | + |
| 187 | + if defaultCertId != "" { |
| 188 | + settings := make([]*dsmsdk.ServiceCertificateSetting, 0) |
| 189 | + for _, certItem := range listCertificatesResp.Data.Certificates { |
| 190 | + if certItem.ID == defaultCertId { |
| 191 | + continue |
| 192 | + } |
| 193 | + |
| 194 | + for _, service := range certItem.Services { |
| 195 | + settings = append(settings, &dsmsdk.ServiceCertificateSetting{ |
| 196 | + Service: service, |
| 197 | + CertID: defaultCertId, |
| 198 | + OldCertID: certItem.ID, |
| 199 | + }) |
| 200 | + } |
| 201 | + } |
| 202 | + |
| 203 | + // 应用到所有服务并重启 |
| 204 | + if len(settings) > 0 { |
| 205 | + setServiceCertificateReq := &dsmsdk.SetServiceCertificateRequest{ |
| 206 | + Settings: settings, |
| 207 | + } |
| 208 | + setServiceCertificateResp, err := d.sdkClient.SetServiceCertificate(setServiceCertificateReq) |
| 209 | + d.logger.Debug("sdk request 'SYNO.Core.Certificate.Service:set'", slog.Any("request", setServiceCertificateReq), slog.Any("response", setServiceCertificateResp)) |
| 210 | + if err != nil { |
| 211 | + return nil, fmt.Errorf("failed to execute sdk request 'SYNO.Core.Certificate.Service:set': %w", err) |
| 212 | + } |
| 213 | + } |
| 214 | + } |
| 215 | + } |
| 216 | + } |
| 217 | + |
| 218 | + return &deployer.DeployResult{}, nil |
| 219 | +} |
| 220 | + |
| 221 | +func createSDKClient(serverUrl string, skipTlsVerify bool) (*dsmsdk.Client, error) { |
| 222 | + client, err := dsmsdk.NewClient(serverUrl) |
| 223 | + if err != nil { |
| 224 | + return nil, err |
| 225 | + } |
| 226 | + |
| 227 | + if skipTlsVerify { |
| 228 | + client.SetTLSConfig(&tls.Config{InsecureSkipVerify: true}) |
| 229 | + } |
| 230 | + |
| 231 | + return client, nil |
| 232 | +} |
0 commit comments