tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Allow Nginx traversal only to isolated ACME webroot

Browse Source
This commit is contained in:
hellcat 2026-10-13 20:00:56 +08:00
parent 67f1c93e02
commit 1b8472112c
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
scripts/gateway-admin-proxy/deploy.py
View File

@ -55,7 +55,9 @@ def main():
os.umask(0o077)
subprocess.run(['nginx', '-t'], check=True, capture_output=True)
state_path = pathlib.Path('/var/lib/gateway-admin-proxy/state.json')
state_path.parent.mkdir(parents=True, mode=0o700, exist_ok=True)
# Workers need traversal to the ACME webroot; private state stays 0600.
state_path.parent.mkdir(parents=True, mode=0o711, exist_ok=True)
state_path.parent.chmod(0o711)
old_state = json.loads(state_path.read_text()) if state_path.exists() else {'files': {}}
if old_state.get('role', args.role) != args.role:
parser.error('Deployment role differs from existing state')
@ -123,6 +125,7 @@ def main():
temp.chmod(modes[str(path)])
os.replace(temp, path)
pathlib.Path(render.ACME).mkdir(parents=True, mode=0o755, exist_ok=True)
pathlib.Path(render.ACME).chmod(0o755)
subprocess.run(['nginx', '-t'], check=True, capture_output=True)
subprocess.run(['systemctl', 'reload', 'nginx'], check=True)
except Exception: