feat: add TLS certificate management functionality

- Implemented TLS certificate model and service for managing certificates. - Added API endpoints for creating, importing, listing, and deleting TLS certificates. - Enhanced proxy route configuration to support HTTPS with certificate selection. - Updated frontend to include TLS certificate management UI with manual and file import options. - Added validation for HTTPS routes to ensure certificates are selected. - Implemented tests for TLS certificate creation and proxy route validation.
2026-10-05 23:26:38 +08:00 · 2026-03-10 10:44:29 +08:00
parent ca2c7f6e27
commit 2cbaf95eae
25 changed files with 1384 additions and 81 deletions
@@ -9,9 +9,14 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
 	"strings"
+
+	"atsflare-agent/internal/protocol"
 )

+const CertDirPlaceholder = "__ATSF_CERT_DIR__"
+
 type Executor interface {
 	Test(ctx context.Context) error
 	Reload(ctx context.Context) error
@@ -60,6 +65,8 @@ type DockerExecutor struct {
 	ContainerName  string
 	Image          string
 	RouteConfigDir string
+	CertDir        string
+	NginxCertDir   string
 	Runner         CommandRunner
 }

@@ -71,6 +78,8 @@ func (e *DockerExecutor) Test(ctx context.Context) error {
 		"--rm",
 		"-v",
 		fmt.Sprintf("%s:/etc/nginx/conf.d", e.RouteConfigDir),
+		"-v",
+		fmt.Sprintf("%s:%s", e.CertDir, e.NginxCertDir),
 		e.Image,
 		"nginx",
 		"-t",
@@ -124,6 +133,7 @@ func (e *DockerExecutor) runContainer(ctx context.Context) error {
 		"-p", "80:80",
 		"-p", "443:443",
 		"-v", fmt.Sprintf("%s:/etc/nginx/conf.d", e.RouteConfigDir),
+		"-v", fmt.Sprintf("%s:%s", e.CertDir, e.NginxCertDir),
 		e.Image,
 	}
 	runOutput, runErr := e.Runner.Run(ctx, e.DockerBinary, runArgs...)
@@ -135,28 +145,33 @@ func (e *DockerExecutor) runContainer(ctx context.Context) error {

 type Manager struct {
 	RouteConfigPath string
+	CertDir         string
+	NginxCertDir    string
 	Executor        Executor
 }

-func (m *Manager) Apply(ctx context.Context, content string) error {
-	backupPath, hadExisting, err := m.backup()
+func (m *Manager) Apply(ctx context.Context, content string, supportFiles []protocol.SupportFile) error {
+	backup, err := m.backup()
 	if err != nil {
 		return err
 	}
-	if err = os.WriteFile(m.RouteConfigPath, []byte(content), 0o644); err != nil {
+	if err = m.writeSupportFiles(supportFiles); err != nil {
+		_ = m.restore(backup)
+		return err
+	}
+	renderedContent := m.renderConfig(content)
+	if err = os.WriteFile(m.RouteConfigPath, []byte(renderedContent), 0o644); err != nil {
+		_ = m.restore(backup)
 		return err
 	}
 	if err = m.Executor.Test(ctx); err != nil {
-		_ = m.restore(backupPath, hadExisting)
+		_ = m.restore(backup)
 		return err
 	}
 	if err = m.Executor.Reload(ctx); err != nil {
-		_ = m.restore(backupPath, hadExisting)
+		_ = m.restore(backup)
 		return err
 	}
-	if backupPath != "" {
-		_ = os.Remove(backupPath)
-	}
 	return nil
 }

@@ -178,8 +193,15 @@ func (m *Manager) CurrentChecksum() (string, error) {
 		}
 		return "", err
 	}
-	sum := sha256.Sum256(data)
-	return hex.EncodeToString(sum[:]), nil
+	normalized := string(data)
+	if m.NginxCertDir != "" {
+		normalized = strings.ReplaceAll(normalized, m.NginxCertDir, CertDirPlaceholder)
+	}
+	files, err := m.readSupportFiles()
+	if err != nil {
+		return "", err
+	}
+	return bundleChecksum(normalized, files), nil
 }

 type ExecutorOptions struct {
@@ -188,6 +210,8 @@ type ExecutorOptions struct {
 	ContainerName   string
 	Image           string
 	RouteConfigPath string
+	CertDir         string
+	NginxCertDir    string
 }

 func NewExecutor(options ExecutorOptions) Executor {
@@ -202,46 +226,167 @@ func NewExecutor(options ExecutorOptions) Executor {
 	if absDir, err := filepath.Abs(routeConfigDir); err == nil {
 		routeConfigDir = absDir
 	}
+	certDir := options.CertDir
+	if absDir, err := filepath.Abs(certDir); err == nil {
+		certDir = absDir
+	}
 	return &DockerExecutor{
 		DockerBinary:   options.DockerBinary,
 		ContainerName:  options.ContainerName,
 		Image:          options.Image,
 		RouteConfigDir: routeConfigDir,
+		CertDir:        certDir,
+		NginxCertDir:   options.NginxCertDir,
 		Runner:         runner,
 	}
 }

-func (m *Manager) backup() (string, bool, error) {
-	if m.RouteConfigPath == "" {
-		return "", false, errors.New("route config path 不能为空")
-	}
-	if err := os.MkdirAll(filepath.Dir(m.RouteConfigPath), 0o755); err != nil {
-		return "", false, err
-	}
-	data, err := os.ReadFile(m.RouteConfigPath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return "", false, nil
-		}
-		return "", false, err
-	}
-	backupPath := m.RouteConfigPath + ".bak"
-	if err = os.WriteFile(backupPath, data, 0o644); err != nil {
-		return "", false, err
-	}
-	return backupPath, true, nil
+type backupState struct {
+	RouteExisted bool
+	RouteData    []byte
+	Files        []protocol.SupportFile
 }

-func (m *Manager) restore(backupPath string, hadExisting bool) error {
-	if hadExisting {
-		data, err := os.ReadFile(backupPath)
-		if err != nil {
+func (m *Manager) backup() (*backupState, error) {
+	if m.RouteConfigPath == "" {
+		return nil, errors.New("route config path 不能为空")
+	}
+	if err := os.MkdirAll(filepath.Dir(m.RouteConfigPath), 0o755); err != nil {
+		return nil, err
+	}
+	if err := os.MkdirAll(m.CertDir, 0o755); err != nil {
+		return nil, err
+	}
+	state := &backupState{}
+	data, err := os.ReadFile(m.RouteConfigPath)
+	if err == nil {
+		state.RouteExisted = true
+		state.RouteData = data
+	} else if !os.IsNotExist(err) {
+		return nil, err
+	}
+	files, err := m.readSupportFiles()
+	if err != nil {
+		return nil, err
+	}
+	state.Files = files
+	return state, nil
+}
+
+func (m *Manager) restore(state *backupState) error {
+	if state == nil {
+		return nil
+	}
+	if state.RouteExisted {
+		if err := os.WriteFile(m.RouteConfigPath, state.RouteData, 0o644); err != nil {
 			return err
 		}
-		return os.WriteFile(m.RouteConfigPath, data, 0o644)
-	}
-	if err := os.Remove(m.RouteConfigPath); err != nil && !os.IsNotExist(err) {
+	} else if err := os.Remove(m.RouteConfigPath); err != nil && !os.IsNotExist(err) {
 		return err
 	}
+	if err := os.RemoveAll(m.CertDir); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.MkdirAll(m.CertDir, 0o755); err != nil {
+		return err
+	}
+	for _, file := range state.Files {
+		targetPath := filepath.Join(m.CertDir, filepath.Clean(file.Path))
+		if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
+			return err
+		}
+		if err := os.WriteFile(targetPath, []byte(file.Content), 0o600); err != nil {
+			return err
+		}
+	}
 	return nil
 }
+
+func (m *Manager) writeSupportFiles(supportFiles []protocol.SupportFile) error {
+	if err := os.RemoveAll(m.CertDir); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err := os.MkdirAll(m.CertDir, 0o755); err != nil {
+		return err
+	}
+	for _, file := range supportFiles {
+		targetPath := filepath.Join(m.CertDir, filepath.Clean(file.Path))
+		if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
+			return err
+		}
+		if err := os.WriteFile(targetPath, []byte(file.Content), 0o600); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (m *Manager) readSupportFiles() ([]protocol.SupportFile, error) {
+	if m.CertDir == "" {
+		return nil, nil
+	}
+	if _, err := os.Stat(m.CertDir); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	files := make([]protocol.SupportFile, 0)
+	err := filepath.Walk(m.CertDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		relativePath, err := filepath.Rel(m.CertDir, path)
+		if err != nil {
+			return err
+		}
+		files = append(files, protocol.SupportFile{
+			Path:    filepath.ToSlash(relativePath),
+			Content: string(data),
+		})
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	sort.Slice(files, func(i int, j int) bool {
+		return files[i].Path < files[j].Path
+	})
+	return files, nil
+}
+
+func (m *Manager) renderConfig(content string) string {
+	if m.NginxCertDir == "" {
+		return content
+	}
+	return strings.ReplaceAll(content, CertDirPlaceholder, m.NginxCertDir)
+}
+
+func checksum(content string) string {
+	sum := sha256.Sum256([]byte(content))
+	return hex.EncodeToString(sum[:])
+}
+
+func bundleChecksum(renderedConfig string, supportFiles []protocol.SupportFile) string {
+	files := append([]protocol.SupportFile(nil), supportFiles...)
+	sort.Slice(files, func(i int, j int) bool {
+		return files[i].Path < files[j].Path
+	})
+	var builder strings.Builder
+	builder.WriteString(renderedConfig)
+	builder.WriteString("\n--support-files--\n")
+	for _, file := range files {
+		builder.WriteString(file.Path)
+		builder.WriteString("\n")
+		builder.WriteString(file.Content)
+		builder.WriteString("\n")
+	}
+	return checksum(builder.String())
+}
@@ -3,10 +3,13 @@ package nginx
 import (
 	"context"
 	"errors"
+	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
+
+	"atsflare-agent/internal/protocol"
 )

 type runCall struct {
@@ -19,6 +22,11 @@ type fakeRunner struct {
 	runFn func(name string, args ...string) ([]byte, error)
 }

+type fakeExecutor struct {
+	testErr   error
+	reloadErr error
+}
+
 func (r *fakeRunner) Run(ctx context.Context, name string, args ...string) ([]byte, error) {
 	r.calls = append(r.calls, runCall{name: name, args: append([]string{}, args...)})
 	if r.runFn != nil {
@@ -27,6 +35,18 @@ func (r *fakeRunner) Run(ctx context.Context, name string, args ...string) ([]by
 	return nil, nil
 }

+func (e *fakeExecutor) Test(ctx context.Context) error {
+	return e.testErr
+}
+
+func (e *fakeExecutor) Reload(ctx context.Context) error {
+	return e.reloadErr
+}
+
+func (e *fakeExecutor) EnsureRuntime(ctx context.Context, recreate bool) error {
+	return nil
+}
+
 func TestPathExecutorCommands(t *testing.T) {
 	runner := &fakeRunner{}
 	executor := &PathExecutor{
@@ -74,6 +94,8 @@ func TestDockerExecutorStartsContainerWhenMissing(t *testing.T) {
 		ContainerName:  "atsflare-nginx",
 		Image:          "nginx:stable-alpine",
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
+		CertDir:        filepath.Clean("/tmp/certs"),
+		NginxCertDir:   "/etc/nginx/atsflare-certs",
 		Runner:         runner,
 	}

@@ -103,6 +125,8 @@ func TestDockerExecutorStartsStoppedContainer(t *testing.T) {
 		ContainerName:  "atsflare-nginx",
 		Image:          "nginx:stable-alpine",
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
+		CertDir:        filepath.Clean("/tmp/certs"),
+		NginxCertDir:   "/etc/nginx/atsflare-certs",
 		Runner:         runner,
 	}

@@ -138,6 +162,8 @@ func TestDockerExecutorRecreatesContainerOnStartup(t *testing.T) {
 		ContainerName:  "atsflare-nginx",
 		Image:          "nginx:stable-alpine",
 		RouteConfigDir: filepath.Clean("/tmp/routes"),
+		CertDir:        filepath.Clean("/tmp/certs"),
+		NginxCertDir:   "/etc/nginx/atsflare-certs",
 		Runner:         runner,
 	}

@@ -161,6 +187,8 @@ func TestNewExecutorUsesAbsoluteDockerMountPath(t *testing.T) {
 		ContainerName:   "atsflare-nginx",
 		Image:           "nginx:stable-alpine",
 		RouteConfigPath: "./data/etc/nginx/conf.d/atsflare_routes.conf",
+		CertDir:         "./data/etc/nginx/certs",
+		NginxCertDir:    "/etc/nginx/atsflare-certs",
 	})

 	dockerExecutor, ok := executor.(*DockerExecutor)
@@ -174,3 +202,81 @@ func TestNewExecutorUsesAbsoluteDockerMountPath(t *testing.T) {
 		t.Fatalf("unexpected route config dir: %s", dockerExecutor.RouteConfigDir)
 	}
 }
+
+func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
+	tempDir := t.TempDir()
+	manager := &Manager{
+		RouteConfigPath: filepath.Join(tempDir, "routes.conf"),
+		CertDir:         filepath.Join(tempDir, "certs"),
+		NginxCertDir:    "/etc/nginx/atsflare-certs",
+		Executor:        &fakeExecutor{},
+	}
+
+	err := manager.Apply(context.Background(), "ssl_certificate __ATSF_CERT_DIR__/1.crt;", []protocol.SupportFile{
+		{Path: "1.crt", Content: "cert-data"},
+		{Path: "1.key", Content: "key-data"},
+	})
+	if err != nil {
+		t.Fatalf("Apply failed: %v", err)
+	}
+
+	routeData, err := os.ReadFile(manager.RouteConfigPath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if !strings.Contains(string(routeData), "/etc/nginx/atsflare-certs/1.crt") {
+		t.Fatalf("expected placeholder replacement in route config, got %s", string(routeData))
+	}
+	certData, err := os.ReadFile(filepath.Join(manager.CertDir, "1.crt"))
+	if err != nil {
+		t.Fatalf("failed to read cert file: %v", err)
+	}
+	if string(certData) != "cert-data" {
+		t.Fatalf("unexpected cert file content: %s", string(certData))
+	}
+}
+
+func TestManagerRollbackRestoresSupportFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	routePath := filepath.Join(tempDir, "routes.conf")
+	certDir := filepath.Join(tempDir, "certs")
+	if err := os.MkdirAll(certDir, 0o755); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(routePath, []byte("old-route"), 0o644); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(certDir, "1.crt"), []byte("old-cert"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+	manager := &Manager{
+		RouteConfigPath: routePath,
+		CertDir:         certDir,
+		NginxCertDir:    "/etc/nginx/atsflare-certs",
+		Executor: &fakeExecutor{
+			testErr: errors.New("nginx test failed"),
+		},
+	}
+
+	err := manager.Apply(context.Background(), "new-route", []protocol.SupportFile{
+		{Path: "1.crt", Content: "new-cert"},
+	})
+	if err == nil {
+		t.Fatal("expected Apply to fail")
+	}
+
+	routeData, err := os.ReadFile(routePath)
+	if err != nil {
+		t.Fatalf("failed to read route config: %v", err)
+	}
+	if string(routeData) != "old-route" {
+		t.Fatalf("expected route rollback, got %s", string(routeData))
+	}
+	certData, err := os.ReadFile(filepath.Join(certDir, "1.crt"))
+	if err != nil {
+		t.Fatalf("failed to read cert file: %v", err)
+	}
+	if string(certData) != "old-cert" {
+		t.Fatalf("expected cert rollback, got %s", string(certData))
+	}
+}