37 lines
1.9 KiB
Python
37 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Move only the newly issued DPL certificate out of the old global renewal hooks."""
|
|
import pathlib
|
|
import shutil
|
|
|
|
domain = "c2.deeplink-subscribe.com"
|
|
old = pathlib.Path("/etc/letsencrypt")
|
|
new = pathlib.Path("/etc/dpl-letsencrypt")
|
|
renewal = old / "renewal" / (domain + ".conf")
|
|
if not renewal.exists():
|
|
assert (new / "renewal" / (domain + ".conf")).exists(), "No DPL renewal registration"
|
|
print("DPL certificate already isolated")
|
|
raise SystemExit
|
|
text = renewal.read_text()
|
|
assert "authenticator = webroot" in text
|
|
assert "https://acme-v02.api.letsencrypt.org/directory" in text
|
|
account = next(line.split("=", 1)[1].strip() for line in text.splitlines() if line.startswith("account ="))
|
|
assert account.isalnum()
|
|
new.mkdir(mode=0o700, exist_ok=True)
|
|
for folder in ("live", "archive", "renewal", "accounts"):
|
|
(new / folder).mkdir(mode=0o700, exist_ok=True)
|
|
for folder in ("live", "archive"):
|
|
assert (old / folder / domain).is_dir()
|
|
assert not (new / folder / domain).exists(), "Partial migration; inspect before retry"
|
|
account_relative = pathlib.Path("accounts/acme-v02.api.letsencrypt.org/directory") / account
|
|
shutil.copytree(old / account_relative, new / account_relative, dirs_exist_ok=True)
|
|
backup = pathlib.Path("/root/codex-backups/dpl-gateway-20261011/certificate-before-isolation")
|
|
backup.mkdir(mode=0o700, exist_ok=True)
|
|
shutil.copy2(renewal, backup / renewal.name)
|
|
for folder in ("live", "archive"):
|
|
shutil.move(str(old / folder / domain), str(new / folder / domain))
|
|
(new / "renewal" / renewal.name).write_text(text.replace("/etc/letsencrypt/", "/etc/dpl-letsencrypt/"))
|
|
(new / "renewal" / renewal.name).chmod(0o600)
|
|
renewal.unlink() # Only the new DPL registration; old certificates and hooks stay intact.
|
|
assert (new / "live" / domain / "fullchain.pem").is_file()
|
|
print("DPL certificate isolated from original gateway renewal hooks")
|