288 lines
11 KiB
TypeScript
288 lines
11 KiB
TypeScript
import * as plugins from './smartacme.plugins.js';
|
|
import { SmartacmeCert } from './smartacme.classes.cert.js';
|
|
import { SmartacmeCertManager } from './smartacme.classes.certmanager.js';
|
|
import { SmartacmeCertMatcher } from './smartacme.classes.certmatcher.js';
|
|
import { commitinfo } from './00_commitinfo_data.js';
|
|
|
|
/**
|
|
* the options for the class @see SmartAcme
|
|
*/
|
|
export interface ISmartAcmeOptions {
|
|
accountPrivateKey?: string;
|
|
accountEmail: string;
|
|
mongoDescriptor: plugins.smartdata.IMongoDescriptor;
|
|
setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
|
|
removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
|
|
environment: 'production' | 'integration';
|
|
/**
|
|
* Optional retry/backoff configuration for transient failures
|
|
*/
|
|
retryOptions?: {
|
|
/** number of retry attempts */
|
|
retries?: number;
|
|
/** backoff multiplier */
|
|
factor?: number;
|
|
/** initial delay in milliseconds */
|
|
minTimeoutMs?: number;
|
|
/** maximum delay cap in milliseconds */
|
|
maxTimeoutMs?: number;
|
|
};
|
|
}
|
|
|
|
/**
|
|
* class SmartAcme
|
|
* can be used for setting up communication with an ACME authority
|
|
*
|
|
* ```ts
|
|
* const mySmartAcmeInstance = new SmartAcme({
|
|
* // see ISmartAcmeOptions for options
|
|
* })
|
|
* ```
|
|
*/
|
|
export class SmartAcme {
|
|
private options: ISmartAcmeOptions;
|
|
|
|
// the acme client
|
|
private client: plugins.acme.Client;
|
|
private smartdns = new plugins.smartdnsClient.Smartdns({});
|
|
public logger: plugins.smartlog.Smartlog;
|
|
|
|
// the account private key
|
|
private privateKey: string;
|
|
|
|
// challenge fullfillment
|
|
private setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
|
|
private removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
|
|
|
|
// certmanager
|
|
private certmanager: SmartacmeCertManager;
|
|
private certmatcher: SmartacmeCertMatcher;
|
|
// retry/backoff configuration (resolved with defaults)
|
|
private retryOptions: { retries: number; factor: number; minTimeoutMs: number; maxTimeoutMs: number };
|
|
// track pending DNS challenges for graceful shutdown
|
|
private pendingChallenges: plugins.tsclass.network.IDnsChallenge[] = [];
|
|
|
|
constructor(optionsArg: ISmartAcmeOptions) {
|
|
this.options = optionsArg;
|
|
this.logger = plugins.smartlog.Smartlog.createForCommitinfo(commitinfo);
|
|
// enable console output for structured logging
|
|
this.logger.enableConsole();
|
|
// initialize retry/backoff options
|
|
this.retryOptions = {
|
|
retries: optionsArg.retryOptions?.retries ?? 3,
|
|
factor: optionsArg.retryOptions?.factor ?? 2,
|
|
minTimeoutMs: optionsArg.retryOptions?.minTimeoutMs ?? 1000,
|
|
maxTimeoutMs: optionsArg.retryOptions?.maxTimeoutMs ?? 30000,
|
|
};
|
|
}
|
|
|
|
/**
|
|
* starts the instance
|
|
* ```ts
|
|
* await myCloudlyInstance.start() // does not support options
|
|
* ```
|
|
*/
|
|
public async start() {
|
|
this.privateKey =
|
|
this.options.accountPrivateKey || (await plugins.acme.forge.createPrivateKey()).toString();
|
|
this.setChallenge = this.options.setChallenge;
|
|
this.removeChallenge = this.options.removeChallenge;
|
|
|
|
// CertMangaer
|
|
this.certmanager = new SmartacmeCertManager(this, {
|
|
mongoDescriptor: this.options.mongoDescriptor,
|
|
});
|
|
await this.certmanager.init();
|
|
|
|
// CertMatcher
|
|
this.certmatcher = new SmartacmeCertMatcher();
|
|
|
|
// ACME Client
|
|
this.client = new plugins.acme.Client({
|
|
directoryUrl: (() => {
|
|
if (this.options.environment === 'production') {
|
|
return plugins.acme.directory.letsencrypt.production;
|
|
} else {
|
|
return plugins.acme.directory.letsencrypt.staging;
|
|
}
|
|
})(),
|
|
accountKey: this.privateKey,
|
|
});
|
|
|
|
/* Register account */
|
|
await this.client.createAccount({
|
|
termsOfServiceAgreed: true,
|
|
contact: [`mailto:${this.options.accountEmail}`],
|
|
});
|
|
// Setup graceful shutdown handlers
|
|
process.on('SIGINT', () => this.handleSignal('SIGINT'));
|
|
process.on('SIGTERM', () => this.handleSignal('SIGTERM'));
|
|
}
|
|
|
|
public async stop() {
|
|
await this.certmanager.smartdataDb.close();
|
|
}
|
|
/** Retry helper with exponential backoff */
|
|
private async retry<T>(operation: () => Promise<T>, operationName: string = 'operation'): Promise<T> {
|
|
let attempt = 0;
|
|
let delay = this.retryOptions.minTimeoutMs;
|
|
while (true) {
|
|
try {
|
|
return await operation();
|
|
} catch (err) {
|
|
attempt++;
|
|
if (attempt > this.retryOptions.retries) {
|
|
await this.logger.log('error', `Operation ${operationName} failed after ${attempt} attempts`, err);
|
|
throw err;
|
|
}
|
|
await this.logger.log('warn', `Operation ${operationName} failed on attempt ${attempt}, retrying in ${delay}ms`, err);
|
|
await plugins.smartdelay.delayFor(delay);
|
|
delay = Math.min(delay * this.retryOptions.factor, this.retryOptions.maxTimeoutMs);
|
|
}
|
|
}
|
|
}
|
|
/** Clean up pending challenges and shut down */
|
|
private async handleShutdown(): Promise<void> {
|
|
for (const challenge of [...this.pendingChallenges]) {
|
|
try {
|
|
await this.removeChallenge(challenge);
|
|
await this.logger.log('info', 'Removed pending challenge during shutdown', challenge);
|
|
} catch (err) {
|
|
await this.logger.log('error', 'Failed to remove pending challenge during shutdown', err);
|
|
}
|
|
}
|
|
this.pendingChallenges = [];
|
|
await this.stop();
|
|
}
|
|
/** Handle process signals for graceful shutdown */
|
|
private handleSignal(sig: string): void {
|
|
this.logger.log('info', `Received signal ${sig}, shutting down gracefully`);
|
|
this.handleShutdown()
|
|
.then(() => process.exit(0))
|
|
.catch((err) => {
|
|
this.logger.log('error', 'Error during shutdown', err).then(() => process.exit(1));
|
|
});
|
|
}
|
|
|
|
/**
|
|
* gets a certificate
|
|
* it runs through the following steps
|
|
*
|
|
* * look in the database
|
|
* * if in the database and still valid return it
|
|
* * if not in the database announce it
|
|
* * then get it from letsencrypt
|
|
* * store it
|
|
* * remove it from the pending map (which it go onto by announcing it)
|
|
* * retrieve it from the databse and return it
|
|
*
|
|
* @param domainArg
|
|
*/
|
|
public async getCertificateForDomain(domainArg: string): Promise<SmartacmeCert> {
|
|
const certDomainName = this.certmatcher.getCertificateDomainNameByDomainName(domainArg);
|
|
const retrievedCertificate = await this.certmanager.retrieveCertificate(certDomainName);
|
|
|
|
if (
|
|
!retrievedCertificate &&
|
|
(await this.certmanager.interestMap.checkInterest(certDomainName))
|
|
) {
|
|
const existingCertificateInterest = this.certmanager.interestMap.findInterest(certDomainName);
|
|
const certificate = existingCertificateInterest.interestFullfilled;
|
|
return certificate;
|
|
} else if (retrievedCertificate && !retrievedCertificate.shouldBeRenewed()) {
|
|
return retrievedCertificate;
|
|
} else if (retrievedCertificate && retrievedCertificate.shouldBeRenewed()) {
|
|
await retrievedCertificate.delete();
|
|
}
|
|
|
|
// lets make sure others get the same interest
|
|
const currentDomainInterst = await this.certmanager.interestMap.addInterest(certDomainName);
|
|
|
|
/* Place new order with retry */
|
|
const order = await this.retry(() => this.client.createOrder({
|
|
identifiers: [
|
|
{ type: 'dns', value: certDomainName },
|
|
{ type: 'dns', value: `*.${certDomainName}` },
|
|
],
|
|
}), 'createOrder');
|
|
|
|
/* Get authorizations and select challenges */
|
|
const authorizations = await this.retry(() => this.client.getAuthorizations(order), 'getAuthorizations');
|
|
|
|
for (const authz of authorizations) {
|
|
await this.logger.log('debug', 'Authorization received', authz);
|
|
const fullHostName: string = `_acme-challenge.${authz.identifier.value}`;
|
|
const dnsChallenge = authz.challenges.find((challengeArg) => {
|
|
return challengeArg.type === 'dns-01';
|
|
});
|
|
// process.exit(1);
|
|
const keyAuthorization: string = await this.client.getChallengeKeyAuthorization(dnsChallenge);
|
|
// prepare DNS challenge record and track for cleanup
|
|
const challengeRecord: plugins.tsclass.network.IDnsChallenge = { hostName: fullHostName, challenge: keyAuthorization };
|
|
this.pendingChallenges.push(challengeRecord);
|
|
|
|
try {
|
|
/* Satisfy challenge */
|
|
await this.retry(() => this.setChallenge(challengeRecord), 'setChallenge');
|
|
await plugins.smartdelay.delayFor(30000);
|
|
await this.retry(() => this.smartdns.checkUntilAvailable(fullHostName, 'TXT', keyAuthorization, 100, 5000), 'dnsCheckUntilAvailable');
|
|
await this.logger.log('info', 'Cooling down extra 60 seconds for DNS regional propagation');
|
|
await plugins.smartdelay.delayFor(60000);
|
|
|
|
/* Verify that challenge is satisfied */
|
|
await this.retry(() => this.client.verifyChallenge(authz, dnsChallenge), 'verifyChallenge');
|
|
|
|
/* Notify ACME provider that challenge is satisfied */
|
|
await this.retry(() => this.client.completeChallenge(dnsChallenge), 'completeChallenge');
|
|
|
|
/* Wait for ACME provider to respond with valid status */
|
|
await this.retry(() => this.client.waitForValidStatus(dnsChallenge), 'waitForValidStatus');
|
|
} finally {
|
|
/* Clean up challenge response */
|
|
try {
|
|
await this.retry(() => this.removeChallenge(challengeRecord), 'removeChallenge');
|
|
} catch (err) {
|
|
await this.logger.log('error', 'Error removing DNS challenge', err);
|
|
} finally {
|
|
// remove from pending list
|
|
this.pendingChallenges = this.pendingChallenges.filter(c => c !== challengeRecord);
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Finalize order */
|
|
const [key, csr] = await plugins.acme.forge.createCsr({
|
|
commonName: `*.${certDomainName}`,
|
|
altNames: [certDomainName],
|
|
});
|
|
|
|
await this.retry(() => this.client.finalizeOrder(order, csr), 'finalizeOrder');
|
|
const cert = await this.retry(() => this.client.getCertificate(order), 'getCertificate');
|
|
|
|
/* Done */
|
|
|
|
await this.certmanager.storeCertificate({
|
|
id: plugins.smartunique.shortId(),
|
|
domainName: certDomainName,
|
|
privateKey: key.toString(),
|
|
publicKey: cert.toString(),
|
|
csr: csr.toString(),
|
|
created: Date.now(),
|
|
validUntil:
|
|
Date.now() +
|
|
plugins.smarttime.getMilliSecondsFromUnits({
|
|
days: 90,
|
|
}),
|
|
});
|
|
|
|
const newCertificate = await this.certmanager.retrieveCertificate(certDomainName);
|
|
currentDomainInterst.fullfillInterest(newCertificate);
|
|
currentDomainInterst.destroy();
|
|
return newCertificate;
|
|
}
|
|
|
|
public async getAllCertificates(): Promise<SmartacmeCert[]> {
|
|
return SmartacmeCert.getInstances({});
|
|
}
|
|
}
|