mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/1Panel-dev/1Panel.git
synced 2026-09-21 00:24:12 +08:00
612e67e4cc
The auto-renew flow in obtainSSL returned early when OpenResty was not installed or `nginx -s reload` failed, skipping reloadSystemSSL. The new certificate was persisted to the DB and written into website Nginx configs, but the panel's own server.crt / server.key on disk and the in-memory constant.CertStore were left pointing at the old material. Because the cert was now fresh, subsequent cron ticks did not retry the renewal, so the panel kept serving the stale cert until a user manually re-applied it from 面板设置 → SSL. Two changes: 1. agent/app/service/website_ssl.go reloadSystemSSL is now called unconditionally after a successful renewal, regardless of whether OpenResty is present or nginx reload succeeded. The function already short-circuits for non-panel SSLs, so this is safe. 2. agent/app/service/website_ssl.go + agent/cron/job/ssl.go Add SyncSystemSSL, invoked at the start of every renew cron tick. It compares the panel's on-disk cert/key with the WebsiteSSL row referenced by the SSLID setting and rewrites the files + notifies core when they diverge. This recovers existing installs that are already in the "DB ahead of disk" state and self-heals any future drift introduced by transient failures. https://github.com/1Panel-dev/1Panel/issues/12472
62 lines
2.0 KiB
Go
62 lines
2.0 KiB
Go
package job
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/1Panel-dev/1Panel/agent/app/dto/request"
|
|
"github.com/1Panel-dev/1Panel/agent/app/repo"
|
|
"github.com/1Panel-dev/1Panel/agent/app/service"
|
|
"github.com/1Panel-dev/1Panel/agent/constant"
|
|
"github.com/1Panel-dev/1Panel/agent/global"
|
|
"github.com/1Panel-dev/1Panel/agent/utils/common"
|
|
)
|
|
|
|
type ssl struct {
|
|
}
|
|
|
|
func NewSSLJob() *ssl {
|
|
return &ssl{}
|
|
}
|
|
|
|
func (ssl *ssl) Run() {
|
|
sslRepo := repo.NewISSLRepo()
|
|
sslService := service.NewIWebsiteSSLService()
|
|
sslList, _ := sslRepo.List()
|
|
nyc, _ := time.LoadLocation(common.LoadTimeZoneByCmd())
|
|
global.LOG.Info("The scheduled certificate update task is currently in progress ...")
|
|
// Recover from any prior renewal whose reloadSystemSSL was skipped
|
|
// (e.g. nginx reload failure left DB ahead of the on-disk panel cert).
|
|
service.SyncSystemSSL()
|
|
now := time.Now().Add(10 * time.Second)
|
|
for _, s := range sslList {
|
|
if !s.AutoRenew || s.Provider == "manual" || s.Provider == "dnsManual" || s.Status == "applying" {
|
|
continue
|
|
}
|
|
expireDate := s.ExpireDate.In(nyc)
|
|
sub := expireDate.Sub(now)
|
|
if s.IsIp && sub.Hours() < 72 || !s.IsIp && sub.Hours() < 720 {
|
|
global.LOG.Infof("Update the SSL certificate for the [%s] domain", s.PrimaryDomain)
|
|
if s.Provider == constant.SelfSigned {
|
|
caService := service.NewIWebsiteCAService()
|
|
if _, err := caService.ObtainSSL(request.WebsiteCAObtain{
|
|
ID: s.CaID,
|
|
SSLID: s.ID,
|
|
Renew: true,
|
|
Unit: "year",
|
|
Time: 10,
|
|
}); err != nil {
|
|
global.LOG.Errorf("Failed to update the SSL certificate for the [%s] domain , err:%s", s.PrimaryDomain, err.Error())
|
|
continue
|
|
}
|
|
} else {
|
|
if err := sslService.AutoRenewSSL(s.ID); err != nil {
|
|
global.LOG.Errorf("Failed to update the SSL certificate for the [%s] domain , err:%s", s.PrimaryDomain, err.Error())
|
|
continue
|
|
}
|
|
}
|
|
global.LOG.Infof("The SSL certificate for the [%s] domain has been successfully updated", s.PrimaryDomain)
|
|
}
|
|
}
|
|
global.LOG.Info("The scheduled certificate update task has completed")
|
|
}
|