mirror of
https://github.com/usual2970/certimate.git
synced 2025-06-11 15:09:51 +00:00
feat: implement more Deployer
This commit is contained in:
parent
bde51d8d38
commit
0b9312b549
@ -34,7 +34,7 @@ type HuaweiCloudELBDeployerConfig struct {
|
|||||||
// 证书 ID。
|
// 证书 ID。
|
||||||
// 部署资源类型为 [DEPLOY_RESOURCE_CERTIFICATE] 时必填。
|
// 部署资源类型为 [DEPLOY_RESOURCE_CERTIFICATE] 时必填。
|
||||||
CertificateId string `json:"certificateId,omitempty"`
|
CertificateId string `json:"certificateId,omitempty"`
|
||||||
// 负载均衡实例 ID。
|
// 负载均衡器 ID。
|
||||||
// 部署资源类型为 [DEPLOY_RESOURCE_LOADBALANCER] 时必填。
|
// 部署资源类型为 [DEPLOY_RESOURCE_LOADBALANCER] 时必填。
|
||||||
LoadbalancerId string `json:"loadbalancerId,omitempty"`
|
LoadbalancerId string `json:"loadbalancerId,omitempty"`
|
||||||
// 负载均衡监听 ID。
|
// 负载均衡监听 ID。
|
||||||
|
@ -0,0 +1,198 @@
|
|||||||
|
package tencentcloudcdn
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
xerrors "github.com/pkg/errors"
|
||||||
|
tcCdn "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdn/v20180606"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
|
||||||
|
tcSsl "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ssl/v20191205"
|
||||||
|
"golang.org/x/exp/slices"
|
||||||
|
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/deployer"
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/uploader"
|
||||||
|
providerSsl "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/tencentcloud-ssl"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TencentCloudCDNDeployerConfig struct {
|
||||||
|
// 腾讯云 SecretId。
|
||||||
|
SecretId string `json:"secretId"`
|
||||||
|
// 腾讯云 SecretKey。
|
||||||
|
SecretKey string `json:"secretKey"`
|
||||||
|
// 加速域名(支持泛域名)。
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type TencentCloudCDNDeployer struct {
|
||||||
|
config *TencentCloudCDNDeployerConfig
|
||||||
|
logger deployer.Logger
|
||||||
|
sdkClients *tencentCloudCDNDeployerSdkClients
|
||||||
|
sslUploader uploader.Uploader
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ deployer.Deployer = (*TencentCloudCDNDeployer)(nil)
|
||||||
|
|
||||||
|
type tencentCloudCDNDeployerSdkClients struct {
|
||||||
|
ssl *tcSsl.Client
|
||||||
|
cdn *tcCdn.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(config *TencentCloudCDNDeployerConfig) (*TencentCloudCDNDeployer, error) {
|
||||||
|
return NewWithLogger(config, deployer.NewNilLogger())
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewWithLogger(config *TencentCloudCDNDeployerConfig, logger deployer.Logger) (*TencentCloudCDNDeployer, error) {
|
||||||
|
if config == nil {
|
||||||
|
return nil, errors.New("config is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
if logger == nil {
|
||||||
|
return nil, errors.New("logger is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
clients, err := createSdkClients(config.SecretId, config.SecretKey)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create sdk clients")
|
||||||
|
}
|
||||||
|
|
||||||
|
uploader, err := providerSsl.New(&providerSsl.TencentCloudSSLUploaderConfig{
|
||||||
|
SecretId: config.SecretId,
|
||||||
|
SecretKey: config.SecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create ssl uploader")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TencentCloudCDNDeployer{
|
||||||
|
logger: logger,
|
||||||
|
config: config,
|
||||||
|
sdkClients: clients,
|
||||||
|
sslUploader: uploader,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCDNDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
|
||||||
|
// 上传证书到 SSL
|
||||||
|
upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to upload certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("certificate file uploaded", upres)
|
||||||
|
|
||||||
|
// 获取待部署的 CDN 实例
|
||||||
|
// 如果是泛域名,根据证书匹配 CDN 实例
|
||||||
|
instanceIds := make([]string, 0)
|
||||||
|
if strings.HasPrefix(d.config.Domain, "*.") {
|
||||||
|
domains, err := d.getDomainsByCertificateId(upres.CertId)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
instanceIds = domains
|
||||||
|
} else {
|
||||||
|
instanceIds = append(instanceIds, d.config.Domain)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 跳过已部署的 CDN 实例
|
||||||
|
if len(instanceIds) > 0 {
|
||||||
|
deployedDomains, err := d.getDeployedDomainsByCertificateId(upres.CertId)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
temp := make([]string, 0)
|
||||||
|
for _, instanceId := range instanceIds {
|
||||||
|
if !slices.Contains(deployedDomains, instanceId) {
|
||||||
|
temp = append(temp, instanceId)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
instanceIds = temp
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(instanceIds) == 0 {
|
||||||
|
d.logger.Appendt("已部署过或没有要部署的 CDN 实例")
|
||||||
|
} else {
|
||||||
|
// 证书部署到 CDN 实例
|
||||||
|
// REF: https://cloud.tencent.com/document/product/400/91667
|
||||||
|
deployCertificateInstanceReq := tcSsl.NewDeployCertificateInstanceRequest()
|
||||||
|
deployCertificateInstanceReq.CertificateId = common.StringPtr(upres.CertId)
|
||||||
|
deployCertificateInstanceReq.ResourceType = common.StringPtr("cdn")
|
||||||
|
deployCertificateInstanceReq.Status = common.Int64Ptr(1)
|
||||||
|
deployCertificateInstanceReq.InstanceIdList = common.StringPtrs(instanceIds)
|
||||||
|
deployCertificateInstanceResp, err := d.sdkClients.ssl.DeployCertificateInstance(deployCertificateInstanceReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'ssl.DeployCertificateInstance'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已部署证书到云资源实例", deployCertificateInstanceResp.Response)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &deployer.DeployResult{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCDNDeployer) getDomainsByCertificateId(cloudCertId string) ([]string, error) {
|
||||||
|
// 获取证书中的可用域名
|
||||||
|
// REF: https://cloud.tencent.com/document/product/228/42491
|
||||||
|
describeCertDomainsReq := tcCdn.NewDescribeCertDomainsRequest()
|
||||||
|
describeCertDomainsReq.CertId = common.StringPtr(cloudCertId)
|
||||||
|
describeCertDomainsReq.Product = common.StringPtr("cdn")
|
||||||
|
describeCertDomainsResp, err := d.sdkClients.cdn.DescribeCertDomains(describeCertDomainsReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'cdn.DescribeCertDomains'")
|
||||||
|
}
|
||||||
|
|
||||||
|
domains := make([]string, 0)
|
||||||
|
if describeCertDomainsResp.Response.Domains == nil {
|
||||||
|
for _, domain := range describeCertDomainsResp.Response.Domains {
|
||||||
|
domains = append(domains, *domain)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return domains, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCDNDeployer) getDeployedDomainsByCertificateId(cloudCertId string) ([]string, error) {
|
||||||
|
// 根据证书查询关联 CDN 域名
|
||||||
|
// REF: https://cloud.tencent.com/document/product/400/62674
|
||||||
|
describeDeployedResourcesReq := tcSsl.NewDescribeDeployedResourcesRequest()
|
||||||
|
describeDeployedResourcesReq.CertificateIds = common.StringPtrs([]string{cloudCertId})
|
||||||
|
describeDeployedResourcesReq.ResourceType = common.StringPtr("cdn")
|
||||||
|
describeDeployedResourcesResp, err := d.sdkClients.ssl.DescribeDeployedResources(describeDeployedResourcesReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'cdn.DescribeDeployedResources'")
|
||||||
|
}
|
||||||
|
|
||||||
|
domains := make([]string, 0)
|
||||||
|
if describeDeployedResourcesResp.Response.DeployedResources != nil {
|
||||||
|
for _, deployedResource := range describeDeployedResourcesResp.Response.DeployedResources {
|
||||||
|
for _, resource := range deployedResource.Resources {
|
||||||
|
domains = append(domains, *resource)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return domains, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSdkClients(secretId, secretKey string) (*tencentCloudCDNDeployerSdkClients, error) {
|
||||||
|
credential := common.NewCredential(secretId, secretKey)
|
||||||
|
|
||||||
|
sslClient, err := tcSsl.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
cdnClient, err := tcCdn.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &tencentCloudCDNDeployerSdkClients{
|
||||||
|
ssl: sslClient,
|
||||||
|
cdn: cdnClient,
|
||||||
|
}, nil
|
||||||
|
}
|
@ -0,0 +1,75 @@
|
|||||||
|
package tencentcloudcdn_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/tencentcloud-cdn"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
fInputCertPath string
|
||||||
|
fInputKeyPath string
|
||||||
|
fSecretId string
|
||||||
|
fSecretKey string
|
||||||
|
fDomain string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
argsPrefix := "CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_"
|
||||||
|
|
||||||
|
flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
|
||||||
|
flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
|
||||||
|
flag.StringVar(&fSecretId, argsPrefix+"SECRETID", "", "")
|
||||||
|
flag.StringVar(&fSecretKey, argsPrefix+"SECRETKEY", "", "")
|
||||||
|
flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shell command to run this test:
|
||||||
|
|
||||||
|
go test -v tencentcloud_cdn_test.go -args \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_INPUTCERTPATH="/path/to/your-input-cert.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_INPUTKEYPATH="/path/to/your-input-key.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_SECRETID="your-secret-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_SECRETKEY="your-secret-key" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_DOMAIN="example.com"
|
||||||
|
*/
|
||||||
|
func Test(t *testing.T) {
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
t.Run("Deploy", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCDNDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
}
|
@ -0,0 +1,14 @@
|
|||||||
|
package tencentcloudclb
|
||||||
|
|
||||||
|
type DeployResourceType string
|
||||||
|
|
||||||
|
const (
|
||||||
|
// 资源类型:通过 SSL 服务部署到云资源实例。
|
||||||
|
DEPLOY_RESOURCE_USE_SSLDEPLOY = DeployResourceType("ssl-deploy")
|
||||||
|
// 资源类型:部署到指定负载均衡器。
|
||||||
|
DEPLOY_RESOURCE_LOADBALANCER = DeployResourceType("loadbalancer")
|
||||||
|
// 资源类型:部署到指定监听器。
|
||||||
|
DEPLOY_RESOURCE_LISTENER = DeployResourceType("listener")
|
||||||
|
// 资源类型:部署到指定转发规则域名。
|
||||||
|
DEPLOY_RESOURCE_RULEDOMAIN = DeployResourceType("ruledomain")
|
||||||
|
)
|
@ -0,0 +1,305 @@
|
|||||||
|
package tencentcloudclb
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
xerrors "github.com/pkg/errors"
|
||||||
|
tcClb "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/clb/v20180317"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
|
||||||
|
tcSsl "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ssl/v20191205"
|
||||||
|
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/deployer"
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/uploader"
|
||||||
|
providerSsl "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/tencentcloud-ssl"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TencentCloudCLBDeployerConfig struct {
|
||||||
|
// 腾讯云 SecretId。
|
||||||
|
SecretId string `json:"secretId"`
|
||||||
|
// 腾讯云 SecretKey。
|
||||||
|
SecretKey string `json:"secretKey"`
|
||||||
|
// 腾讯云地域。
|
||||||
|
Region string `json:"region"`
|
||||||
|
// 部署资源类型。
|
||||||
|
ResourceType DeployResourceType `json:"resourceType"`
|
||||||
|
// 负载均衡器 ID。
|
||||||
|
// 部署资源类型为 [DEPLOY_RESOURCE_SSLDEPLOY]、[DEPLOY_RESOURCE_LOADBALANCER]、[DEPLOY_RESOURCE_RULEDOMAIN] 时必填。
|
||||||
|
LoadbalancerId string `json:"loadbalancerId,omitempty"`
|
||||||
|
// 负载均衡监听 ID。
|
||||||
|
// 部署资源类型为 [DEPLOY_RESOURCE_SSLDEPLOY]、[DEPLOY_RESOURCE_LOADBALANCER]、[DEPLOY_RESOURCE_LISTENER]、[DEPLOY_RESOURCE_RULEDOMAIN] 时必填。
|
||||||
|
ListenerId string `json:"listenerId,omitempty"`
|
||||||
|
// SNI 域名或七层转发规则域名(支持泛域名)。
|
||||||
|
// 部署资源类型为 [DEPLOY_RESOURCE_SSLDEPLOY] 时选填;部署资源类型为 [DEPLOY_RESOURCE_RULEDOMAIN] 时必填。
|
||||||
|
Domain string `json:"domain,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type TencentCloudCLBDeployer struct {
|
||||||
|
config *TencentCloudCLBDeployerConfig
|
||||||
|
logger deployer.Logger
|
||||||
|
sdkClients *wSdkClients
|
||||||
|
sslUploader uploader.Uploader
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ deployer.Deployer = (*TencentCloudCLBDeployer)(nil)
|
||||||
|
|
||||||
|
type wSdkClients struct {
|
||||||
|
ssl *tcSsl.Client
|
||||||
|
clb *tcClb.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(config *TencentCloudCLBDeployerConfig) (*TencentCloudCLBDeployer, error) {
|
||||||
|
return NewWithLogger(config, deployer.NewNilLogger())
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewWithLogger(config *TencentCloudCLBDeployerConfig, logger deployer.Logger) (*TencentCloudCLBDeployer, error) {
|
||||||
|
if config == nil {
|
||||||
|
return nil, errors.New("config is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
if logger == nil {
|
||||||
|
return nil, errors.New("logger is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
clients, err := createSdkClients(config.SecretId, config.SecretKey, config.Region)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create sdk clients")
|
||||||
|
}
|
||||||
|
|
||||||
|
uploader, err := providerSsl.New(&providerSsl.TencentCloudSSLUploaderConfig{
|
||||||
|
SecretId: config.SecretId,
|
||||||
|
SecretKey: config.SecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create ssl uploader")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TencentCloudCLBDeployer{
|
||||||
|
logger: logger,
|
||||||
|
config: config,
|
||||||
|
sdkClients: clients,
|
||||||
|
sslUploader: uploader,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
|
||||||
|
// 上传证书到 SSL
|
||||||
|
upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to upload certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("certificate file uploaded", upres)
|
||||||
|
|
||||||
|
// 根据部署资源类型决定部署方式
|
||||||
|
switch d.config.ResourceType {
|
||||||
|
case DEPLOY_RESOURCE_USE_SSLDEPLOY:
|
||||||
|
if err := d.deployToInstanceUseSsl(ctx, upres.CertId); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
case DEPLOY_RESOURCE_LOADBALANCER:
|
||||||
|
if err := d.deployToLoadbalancer(ctx, upres.CertId); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
case DEPLOY_RESOURCE_LISTENER:
|
||||||
|
if err := d.deployToListener(ctx, upres.CertId); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
case DEPLOY_RESOURCE_RULEDOMAIN:
|
||||||
|
if err := d.deployToRuleDomain(ctx, upres.CertId); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
default:
|
||||||
|
return nil, fmt.Errorf("unsupported resource type: %s", d.config.ResourceType)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &deployer.DeployResult{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) deployToInstanceUseSsl(ctx context.Context, cloudCertId string) error {
|
||||||
|
if d.config.LoadbalancerId == "" {
|
||||||
|
return errors.New("config `loadbalancerId` is required")
|
||||||
|
}
|
||||||
|
if d.config.ListenerId == "" {
|
||||||
|
return errors.New("config `listenerId` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 证书部署到 CLB 实例
|
||||||
|
// REF: https://cloud.tencent.com/document/product/400/91667
|
||||||
|
deployCertificateInstanceReq := tcSsl.NewDeployCertificateInstanceRequest()
|
||||||
|
deployCertificateInstanceReq.CertificateId = common.StringPtr(cloudCertId)
|
||||||
|
deployCertificateInstanceReq.ResourceType = common.StringPtr("clb")
|
||||||
|
deployCertificateInstanceReq.Status = common.Int64Ptr(1)
|
||||||
|
if d.config.Domain == "" {
|
||||||
|
// 未开启 SNI,只需指定到监听器
|
||||||
|
deployCertificateInstanceReq.InstanceIdList = common.StringPtrs([]string{fmt.Sprintf("%s|%s", d.config.LoadbalancerId, d.config.ListenerId)})
|
||||||
|
} else {
|
||||||
|
// 开启 SNI,需指定到域名(支持泛域名)
|
||||||
|
deployCertificateInstanceReq.InstanceIdList = common.StringPtrs([]string{fmt.Sprintf("%s|%s|%s", d.config.LoadbalancerId, d.config.ListenerId, d.config.Domain)})
|
||||||
|
}
|
||||||
|
deployCertificateInstanceResp, err := d.sdkClients.ssl.DeployCertificateInstance(deployCertificateInstanceReq)
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Wrap(err, "failed to execute sdk request 'ssl.DeployCertificateInstance'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已部署证书到云资源实例", deployCertificateInstanceResp.Response)
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) deployToLoadbalancer(ctx context.Context, cloudCertId string) error {
|
||||||
|
if d.config.LoadbalancerId == "" {
|
||||||
|
return errors.New("config `loadbalancerId` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
listenerIds := make([]string, 0)
|
||||||
|
|
||||||
|
// 查询监听器列表
|
||||||
|
// REF: https://cloud.tencent.com/document/api/214/30686
|
||||||
|
describeListenersReq := tcClb.NewDescribeListenersRequest()
|
||||||
|
describeListenersReq.LoadBalancerId = common.StringPtr(d.config.LoadbalancerId)
|
||||||
|
describeListenersResp, err := d.sdkClients.clb.DescribeListeners(describeListenersReq)
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Wrap(err, "failed to execute sdk request 'clb.DescribeListeners'")
|
||||||
|
} else {
|
||||||
|
if describeListenersResp.Response.Listeners != nil {
|
||||||
|
for _, listener := range describeListenersResp.Response.Listeners {
|
||||||
|
if listener.Protocol == nil || (*listener.Protocol != "HTTPS" && *listener.Protocol != "TCP_SSL" && *listener.Protocol != "QUIC") {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
listenerIds = append(listenerIds, *listener.ListenerId)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已查询到负载均衡器下的监听器", listenerIds)
|
||||||
|
|
||||||
|
// 批量更新监听器证书
|
||||||
|
if len(listenerIds) > 0 {
|
||||||
|
var errs []error
|
||||||
|
|
||||||
|
for _, listenerId := range listenerIds {
|
||||||
|
if err := d.modifyListenerCertificate(ctx, d.config.LoadbalancerId, listenerId, cloudCertId); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(errs) > 0 {
|
||||||
|
return errors.Join(errs...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) deployToListener(ctx context.Context, cloudCertId string) error {
|
||||||
|
if d.config.LoadbalancerId == "" {
|
||||||
|
return errors.New("config `loadbalancerId` is required")
|
||||||
|
}
|
||||||
|
if d.config.ListenerId == "" {
|
||||||
|
return errors.New("config `listenerId` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 更新监听器证书
|
||||||
|
if err := d.modifyListenerCertificate(ctx, d.config.LoadbalancerId, d.config.ListenerId, cloudCertId); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) deployToRuleDomain(ctx context.Context, cloudCertId string) error {
|
||||||
|
if d.config.LoadbalancerId == "" {
|
||||||
|
return errors.New("config `loadbalancerId` is required")
|
||||||
|
}
|
||||||
|
if d.config.ListenerId == "" {
|
||||||
|
return errors.New("config `listenerId` is required")
|
||||||
|
}
|
||||||
|
if d.config.Domain == "" {
|
||||||
|
return errors.New("config `domain` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 修改负载均衡七层监听器转发规则的域名级别属性
|
||||||
|
// REF: https://cloud.tencent.com/document/api/214/38092
|
||||||
|
modifyDomainAttributesReq := tcClb.NewModifyDomainAttributesRequest()
|
||||||
|
modifyDomainAttributesReq.LoadBalancerId = common.StringPtr(d.config.LoadbalancerId)
|
||||||
|
modifyDomainAttributesReq.ListenerId = common.StringPtr(d.config.ListenerId)
|
||||||
|
modifyDomainAttributesReq.Domain = common.StringPtr(d.config.Domain)
|
||||||
|
modifyDomainAttributesReq.Certificate = &tcClb.CertificateInput{
|
||||||
|
SSLMode: common.StringPtr("UNIDIRECTIONAL"),
|
||||||
|
CertId: common.StringPtr(cloudCertId),
|
||||||
|
}
|
||||||
|
modifyDomainAttributesResp, err := d.sdkClients.clb.ModifyDomainAttributes(modifyDomainAttributesReq)
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Wrap(err, "failed to execute sdk request 'clb.ModifyDomainAttributes'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已修改七层监听器转发规则的域名级别属性", modifyDomainAttributesResp.Response)
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCLBDeployer) modifyListenerCertificate(ctx context.Context, cloudLoadbalancerId, cloudListenerId, cloudCertId string) error {
|
||||||
|
// 查询监听器列表
|
||||||
|
// REF: https://cloud.tencent.com/document/api/214/30686
|
||||||
|
describeListenersReq := tcClb.NewDescribeListenersRequest()
|
||||||
|
describeListenersReq.LoadBalancerId = common.StringPtr(cloudLoadbalancerId)
|
||||||
|
describeListenersReq.ListenerIds = common.StringPtrs([]string{cloudListenerId})
|
||||||
|
describeListenersResp, err := d.sdkClients.clb.DescribeListeners(describeListenersReq)
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Wrap(err, "failed to execute sdk request 'clb.DescribeListeners'")
|
||||||
|
}
|
||||||
|
if len(describeListenersResp.Response.Listeners) == 0 {
|
||||||
|
return errors.New("listener not found")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已查询到监听器属性", describeListenersResp.Response)
|
||||||
|
|
||||||
|
// 修改监听器属性
|
||||||
|
// REF: https://cloud.tencent.com/document/product/214/30681
|
||||||
|
modifyListenerReq := tcClb.NewModifyListenerRequest()
|
||||||
|
modifyListenerReq.LoadBalancerId = common.StringPtr(cloudLoadbalancerId)
|
||||||
|
modifyListenerReq.ListenerId = common.StringPtr(cloudListenerId)
|
||||||
|
modifyListenerReq.Certificate = &tcClb.CertificateInput{CertId: common.StringPtr(cloudCertId)}
|
||||||
|
if describeListenersResp.Response.Listeners[0].Certificate != nil && describeListenersResp.Response.Listeners[0].Certificate.SSLMode != nil {
|
||||||
|
modifyListenerReq.Certificate.SSLMode = describeListenersResp.Response.Listeners[0].Certificate.SSLMode
|
||||||
|
modifyListenerReq.Certificate.CertCaId = describeListenersResp.Response.Listeners[0].Certificate.CertCaId
|
||||||
|
} else {
|
||||||
|
modifyListenerReq.Certificate.SSLMode = common.StringPtr("UNIDIRECTIONAL")
|
||||||
|
}
|
||||||
|
modifyListenerResp, err := d.sdkClients.clb.ModifyListener(modifyListenerReq)
|
||||||
|
if err != nil {
|
||||||
|
return xerrors.Wrap(err, "failed to execute sdk request 'clb.ModifyListener'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已修改监听器属性", modifyListenerResp.Response)
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSdkClients(secretId, secretKey, region string) (*wSdkClients, error) {
|
||||||
|
credential := common.NewCredential(secretId, secretKey)
|
||||||
|
|
||||||
|
// 注意虽然官方文档中地域无需指定,但实际需要部署到 CLB 时必传
|
||||||
|
sslClient, err := tcSsl.NewClient(credential, region, profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
clbClient, err := tcClb.NewClient(credential, region, profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &wSdkClients{
|
||||||
|
ssl: sslClient,
|
||||||
|
clb: clbClient,
|
||||||
|
}, nil
|
||||||
|
}
|
@ -0,0 +1,199 @@
|
|||||||
|
package tencentcloudclb_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/tencentcloud-clb"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
fInputCertPath string
|
||||||
|
fInputKeyPath string
|
||||||
|
fSecretId string
|
||||||
|
fSecretKey string
|
||||||
|
fRegion string
|
||||||
|
fLoadbalancerId string
|
||||||
|
fListenerId string
|
||||||
|
fDomain string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
argsPrefix := "CERTIMATE_DEPLOYER_TENCENTCLOUDCDN_"
|
||||||
|
|
||||||
|
flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
|
||||||
|
flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
|
||||||
|
flag.StringVar(&fSecretId, argsPrefix+"SECRETID", "", "")
|
||||||
|
flag.StringVar(&fSecretKey, argsPrefix+"SECRETKEY", "", "")
|
||||||
|
flag.StringVar(&fRegion, argsPrefix+"REGION", "", "")
|
||||||
|
flag.StringVar(&fLoadbalancerId, argsPrefix+"LOADBALANCERID", "", "")
|
||||||
|
flag.StringVar(&fListenerId, argsPrefix+"LISTENERID", "", "")
|
||||||
|
flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shell command to run this test:
|
||||||
|
|
||||||
|
go test -v tencentcloud_clb_test.go -args \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_INPUTCERTPATH="/path/to/your-input-cert.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_INPUTKEYPATH="/path/to/your-input-key.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_SECRETID="your-secret-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_SECRETKEY="your-secret-key" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_REGION="ap-guangzhou" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_LOADBALANCERID="your-clb-lb-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_LISTENERID="your-clb-lbl-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCLB_DOMAIN="example.com"
|
||||||
|
*/
|
||||||
|
func Test(t *testing.T) {
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
t.Run("Deploy_UseSslDeploy", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("REGION: %v", fRegion),
|
||||||
|
fmt.Sprintf("LOADBALANCERID: %v", fLoadbalancerId),
|
||||||
|
fmt.Sprintf("LISTENERID: %v", fListenerId),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCLBDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Region: fRegion,
|
||||||
|
ResourceType: provider.DEPLOY_RESOURCE_USE_SSLDEPLOY,
|
||||||
|
LoadbalancerId: fLoadbalancerId,
|
||||||
|
ListenerId: fListenerId,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Deploy_ToLoadbalancer", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("REGION: %v", fRegion),
|
||||||
|
fmt.Sprintf("LOADBALANCERID: %v", fLoadbalancerId),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCLBDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Region: fRegion,
|
||||||
|
ResourceType: provider.DEPLOY_RESOURCE_LOADBALANCER,
|
||||||
|
LoadbalancerId: fLoadbalancerId,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Deploy_ToListener", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("REGION: %v", fRegion),
|
||||||
|
fmt.Sprintf("LOADBALANCERID: %v", fLoadbalancerId),
|
||||||
|
fmt.Sprintf("LISTENERID: %v", fListenerId),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCLBDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Region: fRegion,
|
||||||
|
ResourceType: provider.DEPLOY_RESOURCE_LISTENER,
|
||||||
|
LoadbalancerId: fLoadbalancerId,
|
||||||
|
ListenerId: fListenerId,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Deploy_ToRuleDomain", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("REGION: %v", fRegion),
|
||||||
|
fmt.Sprintf("LOADBALANCERID: %v", fLoadbalancerId),
|
||||||
|
fmt.Sprintf("LISTENERID: %v", fListenerId),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCLBDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Region: fRegion,
|
||||||
|
ResourceType: provider.DEPLOY_RESOURCE_RULEDOMAIN,
|
||||||
|
LoadbalancerId: fLoadbalancerId,
|
||||||
|
ListenerId: fListenerId,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
}
|
@ -0,0 +1,115 @@
|
|||||||
|
package tencentcloudcdn
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
xerrors "github.com/pkg/errors"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
|
||||||
|
tcSsl "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ssl/v20191205"
|
||||||
|
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/deployer"
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/uploader"
|
||||||
|
providerSsl "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/tencentcloud-ssl"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TencentCloudCOSDeployerConfig struct {
|
||||||
|
// 腾讯云 SecretId。
|
||||||
|
SecretId string `json:"secretId"`
|
||||||
|
// 腾讯云 SecretKey。
|
||||||
|
SecretKey string `json:"secretKey"`
|
||||||
|
// 腾讯云地域。
|
||||||
|
Region string `json:"region"`
|
||||||
|
// 存储桶名。
|
||||||
|
Bucket string `json:"bucket"`
|
||||||
|
// 自定义域名(不支持泛域名)。
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type TencentCloudCOSDeployer struct {
|
||||||
|
config *TencentCloudCOSDeployerConfig
|
||||||
|
logger deployer.Logger
|
||||||
|
sdkClient *tcSsl.Client
|
||||||
|
sslUploader uploader.Uploader
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ deployer.Deployer = (*TencentCloudCOSDeployer)(nil)
|
||||||
|
|
||||||
|
func New(config *TencentCloudCOSDeployerConfig) (*TencentCloudCOSDeployer, error) {
|
||||||
|
return NewWithLogger(config, deployer.NewNilLogger())
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewWithLogger(config *TencentCloudCOSDeployerConfig, logger deployer.Logger) (*TencentCloudCOSDeployer, error) {
|
||||||
|
if config == nil {
|
||||||
|
return nil, errors.New("config is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
if logger == nil {
|
||||||
|
return nil, errors.New("logger is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
client, err := createSdkClient(config.SecretId, config.SecretKey, config.Region)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create sdk clients")
|
||||||
|
}
|
||||||
|
|
||||||
|
uploader, err := providerSsl.New(&providerSsl.TencentCloudSSLUploaderConfig{
|
||||||
|
SecretId: config.SecretId,
|
||||||
|
SecretKey: config.SecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create ssl uploader")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TencentCloudCOSDeployer{
|
||||||
|
logger: logger,
|
||||||
|
config: config,
|
||||||
|
sdkClient: client,
|
||||||
|
sslUploader: uploader,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudCOSDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
|
||||||
|
if d.config.Bucket == "" {
|
||||||
|
return nil, errors.New("config `bucket` is required")
|
||||||
|
}
|
||||||
|
if d.config.Domain == "" {
|
||||||
|
return nil, errors.New("config `domain` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 上传证书到 SSL
|
||||||
|
upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to upload certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("certificate file uploaded", upres)
|
||||||
|
|
||||||
|
// 证书部署到 COS 实例
|
||||||
|
// REF: https://cloud.tencent.com/document/product/400/91667
|
||||||
|
deployCertificateInstanceReq := tcSsl.NewDeployCertificateInstanceRequest()
|
||||||
|
deployCertificateInstanceReq.CertificateId = common.StringPtr(upres.CertId)
|
||||||
|
deployCertificateInstanceReq.ResourceType = common.StringPtr("cos")
|
||||||
|
deployCertificateInstanceReq.Status = common.Int64Ptr(1)
|
||||||
|
deployCertificateInstanceReq.InstanceIdList = common.StringPtrs([]string{fmt.Sprintf("%s#%s#%s", d.config.Region, d.config.Bucket, d.config.Domain)})
|
||||||
|
deployCertificateInstanceResp, err := d.sdkClient.DeployCertificateInstance(deployCertificateInstanceReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'ssl.DeployCertificateInstance'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已部署证书到云资源实例", deployCertificateInstanceResp.Response)
|
||||||
|
|
||||||
|
return &deployer.DeployResult{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSdkClient(secretId, secretKey, region string) (*tcSsl.Client, error) {
|
||||||
|
credential := common.NewCredential(secretId, secretKey)
|
||||||
|
client, err := tcSsl.NewClient(credential, region, profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return client, nil
|
||||||
|
}
|
@ -0,0 +1,85 @@
|
|||||||
|
package tencentcloudcdn_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/tencentcloud-cos"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
fInputCertPath string
|
||||||
|
fInputKeyPath string
|
||||||
|
fSecretId string
|
||||||
|
fSecretKey string
|
||||||
|
fRegion string
|
||||||
|
fBucket string
|
||||||
|
fDomain string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
argsPrefix := "CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_"
|
||||||
|
|
||||||
|
flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
|
||||||
|
flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
|
||||||
|
flag.StringVar(&fSecretId, argsPrefix+"SECRETID", "", "")
|
||||||
|
flag.StringVar(&fSecretKey, argsPrefix+"SECRETKEY", "", "")
|
||||||
|
flag.StringVar(&fRegion, argsPrefix+"REGION", "", "")
|
||||||
|
flag.StringVar(&fBucket, argsPrefix+"BUCKET", "", "")
|
||||||
|
flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shell command to run this test:
|
||||||
|
|
||||||
|
go test -v tencentcloud_cos_test.go -args \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_INPUTCERTPATH="/path/to/your-input-cert.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_INPUTKEYPATH="/path/to/your-input-key.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_SECRETID="your-secret-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_SECRETKEY="your-secret-key" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_REGION="ap-guangzhou" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_BUCKET="your-cos-bucket" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDCOS_DOMAIN="example.com"
|
||||||
|
*/
|
||||||
|
func Test(t *testing.T) {
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
t.Run("Deploy", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("REGION: %v", fRegion),
|
||||||
|
fmt.Sprintf("BUCKET: %v", fBucket),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudCOSDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Region: fRegion,
|
||||||
|
Bucket: fBucket,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
}
|
@ -0,0 +1,158 @@
|
|||||||
|
package tencentcloudecdn
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
xerrors "github.com/pkg/errors"
|
||||||
|
tcCdn "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cdn/v20180606"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
|
||||||
|
tcSsl "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ssl/v20191205"
|
||||||
|
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/deployer"
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/uploader"
|
||||||
|
providerSsl "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/tencentcloud-ssl"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TencentCloudECDNDeployerConfig struct {
|
||||||
|
// 腾讯云 SecretId。
|
||||||
|
SecretId string `json:"secretId"`
|
||||||
|
// 腾讯云 SecretKey。
|
||||||
|
SecretKey string `json:"secretKey"`
|
||||||
|
// 加速域名(支持泛域名)。
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type TencentCloudECDNDeployer struct {
|
||||||
|
config *TencentCloudECDNDeployerConfig
|
||||||
|
logger deployer.Logger
|
||||||
|
sdkClients *wSdkClients
|
||||||
|
sslUploader uploader.Uploader
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ deployer.Deployer = (*TencentCloudECDNDeployer)(nil)
|
||||||
|
|
||||||
|
type wSdkClients struct {
|
||||||
|
ssl *tcSsl.Client
|
||||||
|
cdn *tcCdn.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(config *TencentCloudECDNDeployerConfig) (*TencentCloudECDNDeployer, error) {
|
||||||
|
return NewWithLogger(config, deployer.NewNilLogger())
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewWithLogger(config *TencentCloudECDNDeployerConfig, logger deployer.Logger) (*TencentCloudECDNDeployer, error) {
|
||||||
|
if config == nil {
|
||||||
|
return nil, errors.New("config is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
if logger == nil {
|
||||||
|
return nil, errors.New("logger is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
clients, err := createSdkClients(config.SecretId, config.SecretKey)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create sdk clients")
|
||||||
|
}
|
||||||
|
|
||||||
|
uploader, err := providerSsl.New(&providerSsl.TencentCloudSSLUploaderConfig{
|
||||||
|
SecretId: config.SecretId,
|
||||||
|
SecretKey: config.SecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create ssl uploader")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TencentCloudECDNDeployer{
|
||||||
|
logger: logger,
|
||||||
|
config: config,
|
||||||
|
sdkClients: clients,
|
||||||
|
sslUploader: uploader,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudECDNDeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
|
||||||
|
// 上传证书到 SSL
|
||||||
|
upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to upload certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("certificate file uploaded", upres)
|
||||||
|
|
||||||
|
// 获取待部署的 CDN 实例
|
||||||
|
// 如果是泛域名,根据证书匹配 CDN 实例
|
||||||
|
instanceIds := make([]string, 0)
|
||||||
|
if strings.HasPrefix(d.config.Domain, "*.") {
|
||||||
|
domains, err := d.getDomainsByCertificateId(upres.CertId)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
instanceIds = domains
|
||||||
|
} else {
|
||||||
|
instanceIds = append(instanceIds, d.config.Domain)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(instanceIds) == 0 {
|
||||||
|
d.logger.Appendt("已部署过或没有要部署的 ECDN 实例")
|
||||||
|
} else {
|
||||||
|
// 证书部署到 ECDN 实例
|
||||||
|
// REF: https://cloud.tencent.com/document/product/400/91667
|
||||||
|
deployCertificateInstanceReq := tcSsl.NewDeployCertificateInstanceRequest()
|
||||||
|
deployCertificateInstanceReq.CertificateId = common.StringPtr(upres.CertId)
|
||||||
|
deployCertificateInstanceReq.ResourceType = common.StringPtr("ecdn")
|
||||||
|
deployCertificateInstanceReq.Status = common.Int64Ptr(1)
|
||||||
|
deployCertificateInstanceReq.InstanceIdList = common.StringPtrs(instanceIds)
|
||||||
|
deployCertificateInstanceResp, err := d.sdkClients.ssl.DeployCertificateInstance(deployCertificateInstanceReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'ssl.DeployCertificateInstance'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已部署证书到云资源实例", deployCertificateInstanceResp.Response)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &deployer.DeployResult{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudECDNDeployer) getDomainsByCertificateId(cloudCertId string) ([]string, error) {
|
||||||
|
// 获取证书中的可用域名
|
||||||
|
// REF: https://cloud.tencent.com/document/product/228/42491
|
||||||
|
describeCertDomainsReq := tcCdn.NewDescribeCertDomainsRequest()
|
||||||
|
describeCertDomainsReq.CertId = common.StringPtr(cloudCertId)
|
||||||
|
describeCertDomainsReq.Product = common.StringPtr("ecdn")
|
||||||
|
describeCertDomainsResp, err := d.sdkClients.cdn.DescribeCertDomains(describeCertDomainsReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'cdn.DescribeCertDomains'")
|
||||||
|
}
|
||||||
|
|
||||||
|
domains := make([]string, 0)
|
||||||
|
if describeCertDomainsResp.Response.Domains == nil {
|
||||||
|
for _, domain := range describeCertDomainsResp.Response.Domains {
|
||||||
|
domains = append(domains, *domain)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return domains, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSdkClients(secretId, secretKey string) (*wSdkClients, error) {
|
||||||
|
credential := common.NewCredential(secretId, secretKey)
|
||||||
|
|
||||||
|
sslClient, err := tcSsl.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
cdnClient, err := tcCdn.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &wSdkClients{
|
||||||
|
ssl: sslClient,
|
||||||
|
cdn: cdnClient,
|
||||||
|
}, nil
|
||||||
|
}
|
@ -0,0 +1,75 @@
|
|||||||
|
package tencentcloudecdn_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/tencentcloud-ecdn"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
fInputCertPath string
|
||||||
|
fInputKeyPath string
|
||||||
|
fSecretId string
|
||||||
|
fSecretKey string
|
||||||
|
fDomain string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
argsPrefix := "CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_"
|
||||||
|
|
||||||
|
flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
|
||||||
|
flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
|
||||||
|
flag.StringVar(&fSecretId, argsPrefix+"SECRETID", "", "")
|
||||||
|
flag.StringVar(&fSecretKey, argsPrefix+"SECRETKEY", "", "")
|
||||||
|
flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shell command to run this test:
|
||||||
|
|
||||||
|
go test -v tencentcloud_ecdn_test.go -args \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_INPUTCERTPATH="/path/to/your-input-cert.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_INPUTKEYPATH="/path/to/your-input-key.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_SECRETID="your-secret-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_SECRETKEY="your-secret-key" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDECDN_DOMAIN="example.com"
|
||||||
|
*/
|
||||||
|
func Test(t *testing.T) {
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
t.Run("Deploy", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudECDNDeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
}
|
@ -0,0 +1,124 @@
|
|||||||
|
package tencentcloudeteo
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
|
||||||
|
xerrors "github.com/pkg/errors"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
||||||
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
|
||||||
|
tcSsl "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ssl/v20191205"
|
||||||
|
tcTeo "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo/v20220901"
|
||||||
|
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/deployer"
|
||||||
|
"github.com/usual2970/certimate/internal/pkg/core/uploader"
|
||||||
|
providerSsl "github.com/usual2970/certimate/internal/pkg/core/uploader/providers/tencentcloud-ssl"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TencentCloudTEODeployerConfig struct {
|
||||||
|
// 腾讯云 SecretId。
|
||||||
|
SecretId string `json:"secretId"`
|
||||||
|
// 腾讯云 SecretKey。
|
||||||
|
SecretKey string `json:"secretKey"`
|
||||||
|
// 站点 ID。
|
||||||
|
ZoneId string `json:"zoneId"`
|
||||||
|
// 加速域名(不支持泛域名)。
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type TencentCloudTEODeployer struct {
|
||||||
|
config *TencentCloudTEODeployerConfig
|
||||||
|
logger deployer.Logger
|
||||||
|
sdkClients *wSdkClients
|
||||||
|
sslUploader uploader.Uploader
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ deployer.Deployer = (*TencentCloudTEODeployer)(nil)
|
||||||
|
|
||||||
|
type wSdkClients struct {
|
||||||
|
ssl *tcSsl.Client
|
||||||
|
teo *tcTeo.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(config *TencentCloudTEODeployerConfig) (*TencentCloudTEODeployer, error) {
|
||||||
|
return NewWithLogger(config, deployer.NewNilLogger())
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewWithLogger(config *TencentCloudTEODeployerConfig, logger deployer.Logger) (*TencentCloudTEODeployer, error) {
|
||||||
|
if config == nil {
|
||||||
|
return nil, errors.New("config is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
if logger == nil {
|
||||||
|
return nil, errors.New("logger is nil")
|
||||||
|
}
|
||||||
|
|
||||||
|
clients, err := createSdkClients(config.SecretId, config.SecretKey)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create sdk clients")
|
||||||
|
}
|
||||||
|
|
||||||
|
uploader, err := providerSsl.New(&providerSsl.TencentCloudSSLUploaderConfig{
|
||||||
|
SecretId: config.SecretId,
|
||||||
|
SecretKey: config.SecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to create ssl uploader")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &TencentCloudTEODeployer{
|
||||||
|
logger: logger,
|
||||||
|
config: config,
|
||||||
|
sdkClients: clients,
|
||||||
|
sslUploader: uploader,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *TencentCloudTEODeployer) Deploy(ctx context.Context, certPem string, privkeyPem string) (*deployer.DeployResult, error) {
|
||||||
|
if d.config.ZoneId == "" {
|
||||||
|
return nil, xerrors.New("config `zoneId` is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
// 上传证书到 SSL
|
||||||
|
upres, err := d.sslUploader.Upload(ctx, certPem, privkeyPem)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to upload certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("certificate file uploaded", upres)
|
||||||
|
|
||||||
|
// 配置域名证书
|
||||||
|
// REF: https://cloud.tencent.com/document/product/1552/80764
|
||||||
|
modifyHostsCertificateReq := tcTeo.NewModifyHostsCertificateRequest()
|
||||||
|
modifyHostsCertificateReq.ZoneId = common.StringPtr(d.config.ZoneId)
|
||||||
|
modifyHostsCertificateReq.Mode = common.StringPtr("sslcert")
|
||||||
|
modifyHostsCertificateReq.Hosts = common.StringPtrs([]string{d.config.Domain})
|
||||||
|
modifyHostsCertificateReq.ServerCertInfo = []*tcTeo.ServerCertInfo{{CertId: common.StringPtr(upres.CertId)}}
|
||||||
|
modifyHostsCertificateResp, err := d.sdkClients.teo.ModifyHostsCertificate(modifyHostsCertificateReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, xerrors.Wrap(err, "failed to execute sdk request 'teo.ModifyHostsCertificate'")
|
||||||
|
}
|
||||||
|
|
||||||
|
d.logger.Appendt("已配置域名证书", modifyHostsCertificateResp.Response)
|
||||||
|
|
||||||
|
return &deployer.DeployResult{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSdkClients(secretId, secretKey string) (*wSdkClients, error) {
|
||||||
|
credential := common.NewCredential(secretId, secretKey)
|
||||||
|
|
||||||
|
sslClient, err := tcSsl.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
teoClient, err := tcTeo.NewClient(credential, "", profile.NewClientProfile())
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &wSdkClients{
|
||||||
|
ssl: sslClient,
|
||||||
|
teo: teoClient,
|
||||||
|
}, nil
|
||||||
|
}
|
@ -0,0 +1,80 @@
|
|||||||
|
package tencentcloudeteo_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
provider "github.com/usual2970/certimate/internal/pkg/core/deployer/providers/tencentcloud-teo"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
fInputCertPath string
|
||||||
|
fInputKeyPath string
|
||||||
|
fSecretId string
|
||||||
|
fSecretKey string
|
||||||
|
fZoneId string
|
||||||
|
fDomain string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
argsPrefix := "CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_"
|
||||||
|
|
||||||
|
flag.StringVar(&fInputCertPath, argsPrefix+"INPUTCERTPATH", "", "")
|
||||||
|
flag.StringVar(&fInputKeyPath, argsPrefix+"INPUTKEYPATH", "", "")
|
||||||
|
flag.StringVar(&fSecretId, argsPrefix+"SECRETID", "", "")
|
||||||
|
flag.StringVar(&fSecretKey, argsPrefix+"SECRETKEY", "", "")
|
||||||
|
flag.StringVar(&fZoneId, argsPrefix+"ZONEID", "", "")
|
||||||
|
flag.StringVar(&fDomain, argsPrefix+"DOMAIN", "", "")
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
Shell command to run this test:
|
||||||
|
|
||||||
|
go test -v tencentcloud_cdn_test.go -args \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_INPUTCERTPATH="/path/to/your-input-cert.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_INPUTKEYPATH="/path/to/your-input-key.pem" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_SECRETID="your-secret-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_SECRETKEY="your-secret-key" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_ZONEID="your-zone-id" \
|
||||||
|
--CERTIMATE_DEPLOYER_TENCENTCLOUDETEO_DOMAIN="example.com"
|
||||||
|
*/
|
||||||
|
func Test(t *testing.T) {
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
t.Run("Deploy", func(t *testing.T) {
|
||||||
|
t.Log(strings.Join([]string{
|
||||||
|
"args:",
|
||||||
|
fmt.Sprintf("INPUTCERTPATH: %v", fInputCertPath),
|
||||||
|
fmt.Sprintf("INPUTKEYPATH: %v", fInputKeyPath),
|
||||||
|
fmt.Sprintf("SECRETID: %v", fSecretId),
|
||||||
|
fmt.Sprintf("SECRETKEY: %v", fSecretKey),
|
||||||
|
fmt.Sprintf("ZONEID: %v", fZoneId),
|
||||||
|
fmt.Sprintf("DOMAIN: %v", fDomain),
|
||||||
|
}, "\n"))
|
||||||
|
|
||||||
|
deployer, err := provider.New(&provider.TencentCloudTEODeployerConfig{
|
||||||
|
SecretId: fSecretId,
|
||||||
|
SecretKey: fSecretKey,
|
||||||
|
ZoneId: fZoneId,
|
||||||
|
Domain: fDomain,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
fInputCertData, _ := os.ReadFile(fInputCertPath)
|
||||||
|
fInputKeyData, _ := os.ReadFile(fInputKeyPath)
|
||||||
|
res, err := deployer.Deploy(context.Background(), string(fInputCertData), string(fInputKeyData))
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("err: %+v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
t.Logf("ok: %v", res)
|
||||||
|
})
|
||||||
|
}
|
@ -17,9 +17,9 @@ import (
|
|||||||
|
|
||||||
type VolcEngineLiveDeployerConfig struct {
|
type VolcEngineLiveDeployerConfig struct {
|
||||||
// 火山引擎 AccessKey。
|
// 火山引擎 AccessKey。
|
||||||
AccessKey string `json:"accessKeyId"`
|
AccessKey string `json:"accessKey"`
|
||||||
// 火山引擎 SecretKey。
|
// 火山引擎 SecretKey。
|
||||||
SecretKey string `json:"secretAccessKey"`
|
SecretKey string `json:"secretKey"`
|
||||||
// 加速域名(支持泛域名)。
|
// 加速域名(支持泛域名)。
|
||||||
Domain string `json:"domain"`
|
Domain string `json:"domain"`
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user