RubyGems - apartment_acme_client - Versions diffs - 0.0.1 - Mend

apartment_acme_client 0.0.1

Files changed (33) hide show

checksums.yaml +7 -0
data/MIT-LICENSE +20 -0
data/README.md +305 -0
data/Rakefile +29 -0
data/app/assets/config/apartment_acme_client_manifest.js +2 -0
data/app/assets/javascripts/apartment_acme_client/application.js +13 -0
data/app/assets/stylesheets/apartment_acme_client/application.css +15 -0
data/app/controllers/apartment_acme_client/application_controller.rb +5 -0
data/app/controllers/apartment_acme_client/verifications_controller.rb +5 -0
data/app/helpers/apartment_acme_client/application_helper.rb +4 -0
data/app/jobs/apartment_acme_client/application_job.rb +4 -0
data/app/mailers/apartment_acme_client/application_mailer.rb +6 -0
data/app/models/apartment_acme_client/application_record.rb +5 -0
data/app/models/apartment_acme_client/verifier.rb +38 -0
data/app/views/layouts/apartment_acme_client/application.html.erb +14 -0
data/config/routes.rb +3 -0
data/lib/apartment_acme_client.rb +61 -0
data/lib/apartment_acme_client/acme_client/proxy.rb +14 -0
data/lib/apartment_acme_client/acme_client/real_client.rb +56 -0
data/lib/apartment_acme_client/certificate_storage/proxy.rb +15 -0
data/lib/apartment_acme_client/certificate_storage/s3.rb +74 -0
data/lib/apartment_acme_client/domain_checker.rb +21 -0
data/lib/apartment_acme_client/encryption.rb +134 -0
data/lib/apartment_acme_client/engine.rb +5 -0
data/lib/apartment_acme_client/file_manipulation/proxy.rb +13 -0
data/lib/apartment_acme_client/file_manipulation/real.rb +37 -0
data/lib/apartment_acme_client/nginx_configuration/proxy.rb +13 -0
data/lib/apartment_acme_client/nginx_configuration/real.rb +128 -0
data/lib/apartment_acme_client/railtie.rb +8 -0
data/lib/apartment_acme_client/renewal_service.rb +22 -0
data/lib/apartment_acme_client/version.rb +3 -0
data/lib/tasks/encryption.rake +21 -0
metadata +208 -0

data/app/views/layouts/apartment_acme_client/application.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Apartment acme client</title>
+  <%= stylesheet_link_tag    "apartment_acme_client/application", media: "all" %>
+  <%= javascript_include_tag "apartment_acme_client/application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+<%= yield %>
+</body>
+</html>

data/config/routes.rb ADDED Viewed

@@ -0,0 +1,3 @@
+ApartmentAcmeClient::Engine.routes.draw do
+  get '/verify', to: "verifications#verify"
+end

data/lib/apartment_acme_client.rb ADDED Viewed

@@ -0,0 +1,61 @@
+require "apartment_acme_client/version"
+require "apartment_acme_client/domain_checker"
+require "apartment_acme_client/encryption"
+require "apartment_acme_client/renewal_service"
+require "apartment_acme_client/engine"
+require "apartment_acme_client/acme_client/proxy"
+require "apartment_acme_client/acme_client/real_client"
+require "apartment_acme_client/certificate_storage/proxy"
+require "apartment_acme_client/certificate_storage/s3"
+require "apartment_acme_client/nginx_configuration/proxy"
+require "apartment_acme_client/nginx_configuration/real"
+require "apartment_acme_client/file_manipulation/proxy"
+require "apartment_acme_client/file_manipulation/real"
+require 'apartment_acme_client/railtie' if defined?(Rails)
+module ApartmentAcmeClient
+  # A callback method which lists the possible domains to be checked
+  # We will verify each of them before requesting a certificate from Let's Encrypt for all of them
+  mattr_accessor :domains_to_check
+  def self.domains_to_check
+    if @@domains_to_check.respond_to?(:call)
+      @@domains_to_check.call
+    else
+      @@domains_to_check
+    end
+  end
+  # The base domain, a domain which is always going to be accessible.
+  # because we need a common domain to be used on each request.
+  # if not defined, the first 'domain_to_check' which succeeds will be used
+  mattr_accessor :common_name
+  # Directory where to store the challenge files, Must be accessible via the internet
+  mattr_accessor :public_folder # Rails.root.join('public')
+  # Directory where to store certificates locally
+  # must persist between deployments, so that nginx can reference it permanently
+  mattr_accessor :certificate_storage_folder # Rails.root.join("public", "system")
+  # for s3 storage
+  mattr_accessor :aws_region # Rails.application.secrets.aws_region
+  mattr_accessor :aws_bucket # Rails.application.secrets.aws_bucket
+  # For use in the nginx configuration
+  mattr_accessor :socket_path # = "/tmp/unicorn-application.socket"
+  mattr_accessor :nginx_config_path # "/etc/nginx/conf.d/site.conf"
+  # If your server stops responding 200 OK to http connections (ie: when all connections are forced-ssl)
+  # you must verify new subdomains over https instead of http
+  mattr_accessor :verify_over_https
+  # For Testing/injection purposes
+  mattr_accessor :acme_client_class
+  mattr_accessor :certificate_storage_class
+  mattr_accessor :file_manipulation_class
+  mattr_accessor :nginx_configuration_class
+  mattr_accessor :lets_encrypt_test_server_enabled
+end

data/lib/apartment_acme_client/acme_client/proxy.rb ADDED Viewed

@@ -0,0 +1,14 @@
+module ApartmentAcmeClient
+  module AcmeClient
+    class Proxy
+      def self.singleton(options = {})
+        base_class.new(options)
+      end
+      def self.base_class
+        # allow overriding the AcmeClient
+        ApartmentAcmeClient.acme_client_class || AcmeClient::RealClient
+      end
+    end
+  end
+end

data/lib/apartment_acme_client/acme_client/real_client.rb ADDED Viewed

@@ -0,0 +1,56 @@
+require 'acme-client'
+module ApartmentAcmeClient
+  module AcmeClient
+    class RealClient
+      def initialize(private_key:)
+        @client = Acme::Client.new(
+          private_key: private_key,
+          endpoint: server_endpoint,
+        )
+      end
+      def register(email)
+        # If the private key is not known to the server, we need to register it for the first time.
+        registration = @client.register(contact: "mailto:#{email}")
+        # You may need to agree to the terms of service (that's up the to the server to require it or not but boulder does by default)
+        registration.agree_terms
+        true
+      end
+      def authorize(domain:)
+        @client.authorize(domain: domain)
+      end
+      # Create a Certificate for our new set of domain names
+      # returns that certificate
+      def request_certificate(common_name:, domains:)
+        # We're going to need a certificate signing request. If not explicitly
+        # specified, the first name listed becomes the common name.
+        csr = Acme::Client::CertificateRequest.new(common_name: common_name, names: domains)
+        # We can now request a certificate. You can pass anything that returns
+        # a valid DER encoded CSR when calling to_der on it. For example an
+        # OpenSSL::X509::Request should work too.
+        certificate = @client.new_certificate(csr) # => #<Acme::Client::Certificate ....>
+        certificate
+      end
+      private
+      def server_endpoint
+        # We need an ACME server to talk to, see github.com/letsencrypt/boulder
+        # WARNING: This endpoint is the production endpoint, which is rate limited and will produce valid certificates.
+        # You should probably use the staging endpoint for all your experimentation:
+        if ApartmentAcmeClient.lets_encrypt_test_server_enabled
+          'https://acme-staging.api.letsencrypt.org/'
+        else
+          'https://acme-v01.api.letsencrypt.org/'
+        end
+      end
+    end
+  end
+end

data/lib/apartment_acme_client/certificate_storage/proxy.rb ADDED Viewed

@@ -0,0 +1,15 @@
+module ApartmentAcmeClient
+  module CertificateStorage
+    TEST_PREFIX = "test_".freeze
+    class Proxy
+      def self.singleton
+        base_class.new
+      end
+      def self.base_class
+        ApartmentAcmeClient.certificate_storage_class || CertificateStorage::S3
+      end
+    end
+  end
+end

data/lib/apartment_acme_client/certificate_storage/s3.rb ADDED Viewed

@@ -0,0 +1,74 @@
+require 'aws-sdk-s3'
+module ApartmentAcmeClient
+  module CertificateStorage
+    class S3
+      def initialize
+        @base_prefix = if ApartmentAcmeClient::lets_encrypt_test_server_enabled
+          TEST_PREFIX
+        else
+          ""
+        end
+      end
+      ENCRYPTION_S3_NAME = 'server_encryption_client_private_key.der'.freeze
+      def store_certificate(certificate)
+        # Save the certificate and the private key to files
+        File.write(cert_path("privkey.pem"), certificate.request.private_key.to_pem)
+        File.write(cert_path("cert.pem"), certificate.to_pem)
+        File.write(cert_path("chain.pem"), certificate.chain_to_pem)
+        File.write(cert_path("fullchain.pem"), certificate.fullchain_to_pem)
+        store_s3_file(derived_filename("privkey.pem"), certificate.request.private_key.to_pem)
+        store_s3_file(derived_filename("cert.pem"), certificate.to_pem)
+        store_s3_file(derived_filename("chain.pem"), certificate.chain_to_pem)
+        store_s3_file(derived_filename("fullchain.pem"), certificate.fullchain_to_pem)
+      end
+      # do we have a certificate on this server?
+      # We cannot start nginx when it is pointing at a non-existing certificate,
+      # so we need to check
+      def cert_exists?
+        File.exist?(cert_path("privkey.pem"))
+      end
+      def private_key
+        s3_object = s3_file(private_key_s3_filename)
+        return nil unless s3_object.exists?
+        s3_object.get.body.read
+      end
+      # saves a private key to s3
+      def save_private_key(private_key)
+        store_s3_file(private_key_s3_filename, private_key.to_der)
+      end
+      private
+      def private_key_s3_filename
+        derived_filename(ENCRYPTION_S3_NAME)
+      end
+      def derived_filename(filename)
+        "#{@base_prefix}#{filename}"
+      end
+      def store_s3_file(filename, file_contents)
+        object = s3_file(filename)
+        object.put(body: file_contents)
+      end
+      def cert_path(filename)
+        File.join(ApartmentAcmeClient.certificate_storage_folder, derived_filename(filename))
+      end
+      def s3_file(filename)
+        s3 = Aws::S3::Resource.new(region: ApartmentAcmeClient.aws_region)
+        object = s3.bucket(ApartmentAcmeClient.aws_bucket).object(filename)
+        object
+      end
+    end
+  end
+end

data/lib/apartment_acme_client/domain_checker.rb ADDED Viewed

@@ -0,0 +1,21 @@
+module ApartmentAcmeClient
+  class DomainChecker
+    # returns an array containing 2 lists:
+    # successful domains
+    # rejected domains (those which don't appear properly configured in DNS)
+    def accessible_domains
+      possible_domains = ApartmentAcmeClient.domains_to_check
+      domains = []
+      rejected_domains = []
+      possible_domains.each do |domain|
+        if ApartmentAcmeClient::Verifier.new(domain).properly_configured?
+          domains << domain
+        else
+          rejected_domains << domain
+        end
+      end
+      [domains, rejected_domains]
+    end
+  end
+end

data/lib/apartment_acme_client/encryption.rb ADDED Viewed

@@ -0,0 +1,134 @@
+require 'openssl'
+# Initially, the system is only accessible via subdomain.example.com
+# But, as we add more Conventions, we want to be able to access those also,
+# thus we will need:
+# - a.subdomain.example.com
+# - b.subdomain.example.com
+# - c.subdomain.example.com
+#
+# Also, each convention may add an "alias" for their convention, like:
+# - www.naucc.com
+# - french-convention.unicycle.fr
+#
+# Steps to make this work:
+# 1) When a new Convention is created, or a new alias is added, configure nginx
+#    so that it responds to that domain request
+#    `rake update_nginx_config` (writes a new nginx.conf and restarts nginx)
+#
+# 2) Register the new domain with letsencrypt
+#    `rake renew_and_update_certificate`
+#
+# Manage the encryption of the website (https).
+module ApartmentAcmeClient
+  class Encryption
+    def initialize
+      @certificate_storage = ApartmentAcmeClient::CertificateStorage::Proxy.singleton
+    end
+    # Largely based on https://github.com/unixcharles/acme-client documentation
+    def register_new(email)
+      raise StandardError.new("Private key already exists") unless @certificate_storage.private_key.nil?
+      private_key = create_private_key
+      # Initialize the client
+      new_client = ApartmentAcmeClient::AcmeClient::Proxy.singleton(
+        private_key: private_key,
+      )
+      new_client.register(email)
+      @certificate_storage.save_private_key(private_key)
+    end
+    def authorize_domains(domains)
+      successful_domains = domains.select {|domain| authorize_domain(domain) }
+      successful_domains
+    end
+    # authorizes a domain with letsencrypt server
+    # returns true on success, false otherwise.
+    #
+    # from https://github.com/unixcharles/acme-client/tree/master#authorize-for-domain
+    def authorize_domain(domain)
+      authorization = client.authorize(domain: domain)
+      # This example is using the http-01 challenge type. Other challenges are dns-01 or tls-sni-01.
+      challenge = authorization.http01
+      # The http-01 method will require you to respond to a HTTP request.
+      # You can retrieve the challenge token
+      challenge.token # => "some_token"
+      # You can retrieve the expected path for the file.
+      challenge.filename # => ".well-known/acme-challenge/:some_token"
+      # You can generate the body of the expected response.
+      challenge.file_content # => 'string token and JWK thumbprint'
+      # You are not required to send a Content-Type. This method will return the right Content-Type should you decide to include one.
+      challenge.content_type
+      # Save the file. We'll create a public directory to serve it from, and inside it we'll create the challenge file.
+      FileUtils.mkdir_p(File.join(ApartmentAcmeClient.public_folder, File.dirname(challenge.filename)))
+      # We'll write the content of the file
+      full_challenge_filename = File.join(ApartmentAcmeClient.public_folder, challenge.filename)
+      File.write(full_challenge_filename, challenge.file_content)
+      # Optionally save the challenge for use at another time (eg: by a background job processor)
+      #  File.write('challenge', challenge.to_h.to_json)
+      # The challenge file can be served with a Ruby webserver.
+      # You can run a webserver in another console for that purpose. You may need to forward ports on your router.
+      #
+      # $ ruby -run -e httpd public -p 8080 --bind-address 0.0.0.0
+      # Load a saved challenge. This is only required if you need to reuse a saved challenge as outlined above.
+      #  challenge = client.challenge_from_hash(JSON.parse(File.read('challenge')))
+      # Once you are ready to serve the confirmation request you can proceed.
+      challenge.request_verification # => true
+      success = false
+      10.times do
+        if challenge.verify_status == 'valid' # may be 'pending' initially
+          success = true
+          break
+        end
+        # Wait a bit for the server to make the request, or just blink. It should be fast.
+        sleep(1)
+      end
+      File.delete(full_challenge_filename)
+      success
+    end
+    def request_certificate(common_name:, domains:)
+      client.request_certificate(common_name: common_name, domains: domains)
+    end
+    private
+    def client
+      @client ||= ApartmentAcmeClient::AcmeClient::Proxy.singleton(
+        private_key: private_key,
+      )
+    end
+    # Returns a private key
+    def private_key
+      private_key = @certificate_storage.private_key
+      return nil unless private_key
+      OpenSSL::PKey::RSA.new(private_key)
+    end
+    def create_private_key
+      OpenSSL::PKey::RSA.new(4096)
+    end
+  end
+end

data/lib/apartment_acme_client/engine.rb ADDED Viewed

@@ -0,0 +1,5 @@
+module ApartmentAcmeClient
+  class Engine < ::Rails::Engine
+    isolate_namespace ApartmentAcmeClient
+  end
+end

data/lib/apartment_acme_client/file_manipulation/proxy.rb ADDED Viewed

@@ -0,0 +1,13 @@
+module ApartmentAcmeClient
+  module FileManipulation
+    class Proxy
+      def self.singleton
+        base_class.new
+      end
+      def self.base_class
+        ApartmentAcmeClient.file_manipulation_class || FileManipulation::Real
+      end
+    end
+  end
+end

data/lib/apartment_acme_client/file_manipulation/real.rb ADDED Viewed

@@ -0,0 +1,37 @@
+require "open3"
+module ApartmentAcmeClient
+  module FileManipulation
+    class Real
+      def copy_file(from, to)
+        run_command("sudo cp #{from} #{to}")
+      end
+      def restart_service(service)
+        run_command("sudo service #{service} restart")
+      end
+      private
+      def run_command(command)
+        Open3.popen3(command) do |_stdin, stdout, stderr, wait_thr|
+          stdout_lines = stdout.read
+          # puts "stdout is:" + stdout_lines
+          # to watch the output as it runs:
+          # while line = stdout.gets
+          #   puts line
+          # end
+          stderr_lines = stderr.read
+          # puts "stderr is:" + stderr_lines
+          exit_status = wait_thr.value
+          unless exit_status.success?
+            abort "FAILED !!! #{command}"
+          end
+        end
+      end
+    end
+  end
+end