29 lines
1.2 KiB
Python
29 lines
1.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Authorized extension: add dynamic CF trust only to the original gateway vhosts."""
|
|
import pathlib
|
|
import re
|
|
import subprocess
|
|
|
|
p = pathlib.Path('/etc/nginx/conf.d/g1.gembox-sub.com.conf')
|
|
include = 'include /etc/nginx/dpl-cloudflare-realip.conf;'
|
|
assert pathlib.Path('/etc/nginx/dpl-cloudflare-realip.conf').is_file()
|
|
old = p.read_text()
|
|
if include in old:
|
|
print('Original gateway already uses dynamic Cloudflare ranges')
|
|
raise SystemExit
|
|
pattern = r'(?m)^(\s*server_name\s+fu101\.gembox-sub\.com\s*;)$'
|
|
new, count = re.subn(pattern, lambda m: m.group(0) + '\n ' + include, old)
|
|
assert 1 <= count <= 2, 'Unexpected vhost structure; inspect manually'
|
|
backup = pathlib.Path('/root/codex-backups/dpl-gateway-20261011/original-before-ip-sync.conf')
|
|
assert not backup.exists(), 'Backup exists; inspect previous attempt'
|
|
backup.write_text(old)
|
|
backup.chmod(0o600)
|
|
p.write_text(new)
|
|
try:
|
|
subprocess.run(['nginx', '-t'], check=True)
|
|
subprocess.run(['systemctl', 'reload', 'nginx'], check=True)
|
|
except Exception:
|
|
p.write_text(old)
|
|
raise
|
|
print(f'Original gateway Cloudflare trust synchronized in {count} vhosts; no containers restarted')
|