feat: custom certificate

apps/api/src/routes/api/v1/index.ts

@@ -1,6 +1,9 @@
 import { FastifyPluginAsync } from 'fastify';
 import { checkUpdate, login, showDashboard, update, resetQueue, getCurrentUser, cleanupManually, restartCoolify } from './handlers';
 import { GetCurrentUser } from './types';
+import pump from 'pump'
+import fs from 'fs'
+import { asyncExecShell, encrypt, errorHandler, prisma } from '../../../lib/common';
 
 export interface Update {
 	Body: { latestVersion: string }

apps/api/src/routes/api/v1/settings/handlers.ts

@@ -1,8 +1,9 @@
 import { promises as dns } from 'dns';
+import { X509Certificate } from 'node:crypto';
 
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import { checkDomainsIsValidInDNS, decrypt, encrypt, errorHandler, getDomain, isDNSValid, isDomainConfigured, listSettings, prisma } from '../../../../lib/common';
-import { CheckDNS, CheckDomain, DeleteDomain, DeleteSSHKey, SaveSettings, SaveSSHKey } from './types';
+import { CheckDNS, CheckDomain, DeleteDomain, DeleteSSHKey, OnlyIdInBody, SaveSettings, SaveSSHKey } from './types';
 
 
 export async function listAllSettings(request: FastifyRequest) {
@@ -16,8 +17,16 @@ export async function listAllSettings(request: FastifyRequest) {
                 unencryptedKeys.push({ id: key.id, name: key.name, privateKey: decrypt(key.privateKey), createdAt: key.createdAt })
             }
         }
+        const certificates = await prisma.certificate.findMany({ where: { team: { every: { id: teamId } } } })
+        let cns = [];
+        for (const certificate of certificates) {
+            const x509 = new X509Certificate(certificate.cert);
+            cns.push({ commonName: x509.subject.split('\n').find((s) => s.startsWith('CN=')).replace('CN=', ''), id: certificate.id, createdAt: certificate.createdAt })
+        }
+
         return {
             settings,
+            certificates: cns,
             sshKeys: unencryptedKeys
         }
     } catch ({ status, message }) {
@@ -118,7 +127,7 @@ export async function saveSSHKey(request: FastifyRequest<SaveSSHKey>, reply: Fas
         return errorHandler({ status, message })
     }
 }
-export async function deleteSSHKey(request: FastifyRequest<DeleteSSHKey>, reply: FastifyReply) {
+export async function deleteSSHKey(request: FastifyRequest<OnlyIdInBody>, reply: FastifyReply) {
     try {
         const { id } = request.body;
         await prisma.sshKey.delete({ where: { id } })
@@ -126,4 +135,14 @@ export async function deleteSSHKey(request: FastifyRequest<DeleteSSHKey>, reply:
     } catch ({ status, message }) {
         return errorHandler({ status, message })
     }
+}
+
+export async function deleteCertificates(request: FastifyRequest<OnlyIdInBody>, reply: FastifyReply) {
+    try {
+        const { id } = request.body;
+        await prisma.certificate.delete({ where: { id } })
+        return reply.code(201).send()
+    } catch ({ status, message }) {
+        return errorHandler({ status, message })
+    }
 }

apps/api/src/routes/api/v1/settings/index.ts

@@ -1,21 +1,58 @@
 import { FastifyPluginAsync } from 'fastify';
-import { checkDNS, checkDomain, deleteDomain, deleteSSHKey, listAllSettings, saveSettings, saveSSHKey } from './handlers';
-import { CheckDNS, CheckDomain, DeleteDomain, DeleteSSHKey, SaveSettings, SaveSSHKey } from './types';
+import { X509Certificate } from 'node:crypto';
+
+import { encrypt, errorHandler, prisma } from '../../../../lib/common';
+import { checkDNS, checkDomain, deleteCertificates, deleteDomain, deleteSSHKey, getCertificates, listAllSettings, saveSettings, saveSSHKey } from './handlers';
+import { CheckDNS, CheckDomain, DeleteDomain, DeleteSSHKey, OnlyIdInBody, SaveSettings, SaveSSHKey } from './types';
 
 
 const root: FastifyPluginAsync = async (fastify): Promise<void> => {
-    fastify.addHook('onRequest', async (request) => {
-        return await request.jwtVerify()
-    })
-    fastify.get('/', async (request) => await listAllSettings(request));
-    fastify.post<SaveSettings>('/', async (request, reply) => await saveSettings(request, reply));
-    fastify.delete<DeleteDomain>('/', async (request, reply) => await deleteDomain(request, reply));
+	fastify.addHook('onRequest', async (request) => {
+		return await request.jwtVerify()
+	})
+	fastify.get('/', async (request) => await listAllSettings(request));
+	fastify.post<SaveSettings>('/', async (request, reply) => await saveSettings(request, reply));
+	fastify.delete<DeleteDomain>('/', async (request, reply) => await deleteDomain(request, reply));
 
-    fastify.get<CheckDNS>('/check', async (request) => await checkDNS(request));
-    fastify.post<CheckDomain>('/check', async (request) => await checkDomain(request));
+	fastify.get<CheckDNS>('/check', async (request) => await checkDNS(request));
+	fastify.post<CheckDomain>('/check', async (request) => await checkDomain(request));
 
-    fastify.post<SaveSSHKey>('/sshKey', async (request, reply) => await saveSSHKey(request, reply));
-    fastify.delete<DeleteSSHKey>('/sshKey', async (request, reply) => await deleteSSHKey(request, reply));
+	fastify.post<SaveSSHKey>('/sshKey', async (request, reply) => await saveSSHKey(request, reply));
+	fastify.delete<OnlyIdInBody>('/sshKey', async (request, reply) => await deleteSSHKey(request, reply));
+
+	fastify.post('/upload', async (request) => {
+		try {
+			const teamId = request.user.teamId;
+			const certificates = await prisma.certificate.findMany({})
+			let cns = [];
+			for (const certificate of certificates) {
+				const x509 = new X509Certificate(certificate.cert);
+				cns.push(x509.subject.split('\n').find((s) => s.startsWith('CN=')).replace('CN=', ''))
+			}
+			const parts = await request.files()
+			let key = null
+			let cert = null
+			for await (const part of parts) {
+				const name = part.fieldname
+				if (name === 'key') key = (await part.toBuffer()).toString()
+				if (name === 'cert') cert = (await part.toBuffer()).toString()
+			}
+			const x509 = new X509Certificate(cert);
+			const cn = x509.subject.split('\n').find((s) => s.startsWith('CN=')).replace('CN=', '')
+			if (cns.includes(cn)) {
+				throw {
+					message: `A certificate with ${cn} common name already exists.`
+				}
+			}
+			await prisma.certificate.create({ data: { cert, key: encrypt(key), team: { connect: { id: teamId } } } })
+			return { message: 'Certificated uploaded' }
+		} catch ({ status, message }) {
+			return errorHandler({ status, message });
+		}
+
+	});
+	fastify.delete<OnlyIdInBody>('/certificate', async (request, reply) => await deleteCertificates(request, reply))
+	// fastify.get('/certificates', async (request) => await getCertificates(request))
 };
 
 export default root;

apps/api/src/routes/api/v1/settings/types.ts

@@ -41,4 +41,9 @@ export interface DeleteSSHKey {
     Body: {
        id: string
     }
+}
+export interface OnlyIdInBody {
+    Body: {
+        id: string
+     }
 }

apps/api/src/routes/webhooks/traefik/handlers.ts

@@ -178,7 +178,19 @@ function configureMiddleware(
 
 export async function traefikConfiguration(request, reply) {
 	try {
+		const sslpath = '/etc/traefik/acme/custom';
+		const certificates = await prisma.certificate.findMany()
+		let parsedCertificates = []
+		for (const certificate of certificates) {
+			parsedCertificates.push({
+				certFile: `${sslpath}/${certificate.id}-cert.pem`,
+				keyFile: `${sslpath}/${certificate.id}-key.pem`
+			})
+		}
 		const traefik = {
+			tls: {
+				certificates: parsedCertificates
+			},
 			http: {
 				routers: {},
 				services: {},