potluck-nginx 0.0.7 → 0.0.8

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: potluck-nginx
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.0.8
 platform: ruby
 authors:
 - Nate Pickens
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-07 00:00:00.000000000 Z
+date: 2025-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: potluck
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.7
+        version: 0.0.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.7
+        version: 0.0.8
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -42,25 +41,32 @@ dependencies:
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 5.11.2
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.0
+        version: '5.24'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.11.2
-    - - "<"
+        version: '5.24'
+- !ruby/object:Gem::Dependency
+  name: minitest-reporters
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.0
+        version: '1.7'
 description: An extension to the Potluck gem that provides control over the Nginx
   process and its configuration files from Ruby.
-email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -69,17 +75,15 @@ files:
 - README.md
 - VERSION
 - lib/potluck/nginx.rb
-- lib/potluck/nginx/ssl.rb
-- lib/potluck/nginx/util.rb
+- lib/potluck/nginx/nginx_config.rb
 - lib/potluck/nginx/version.rb
 homepage: https://github.com/npickens/potluck/tree/master/potluck-nginx
 licenses:
 - MIT
 metadata:
-  allowed_push_host: https://rubygems.org
-  homepage_uri: https://github.com/npickens/potluck/tree/master/potluck-nginx
-  source_code_uri: https://github.com/npickens/potluck/tree/master/potluck-nginx
-post_install_message:
+  bug_tracker_uri: https://github.com/npickens/potluck/issues
+  documentation_uri: https://github.com/npickens/potluck/blob/0.0.8/potluck-nginx/README.md
+  source_code_uri: https://github.com/npickens/potluck/tree/0.0.8/potluck-nginx
 rdoc_options: []
 require_paths:
 - lib
@@ -87,15 +91,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.8
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.0.0
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.6.6
 specification_version: 4
 summary: A Ruby manager for Nginx.
 test_files: []

data/lib/potluck/nginx/ssl.rb

@@ -1,134 +0,0 @@
-# frozen_string_literal: true
-
-require('time')
-
-module Potluck
-  class Nginx < Service
-    ##
-    # SSL-specific configuration for Nginx. Provides self-signed certificate generation for use in
-    # developemnt.
-    #
-    class SSL
-      # Reference: https://ssl-config.mozilla.org/#server=nginx&config=intermediate&guideline=5.6
-      DEFAULT_CONFIG = {
-        'ssl_ciphers' => 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM'\
-          '-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:D'\
-          'HE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384',
-        'ssl_prefer_server_ciphers' => 'off',
-        'ssl_protocols' => 'TLSv1.2 TLSv1.3',
-        'ssl_session_cache' => 'shared:SSL:10m',
-        'ssl_session_tickets' => 'off',
-        'ssl_session_timeout' => '1d',
-        'add_header' => {
-          repeat: true,
-          'Strict-Transport-Security' => '\'max-age=31536000; includeSubDomains\' always',
-        }.freeze,
-      }.freeze
-
-      CERT_DAYS = 365
-      CERT_RENEW_DAYS = 14
-
-      attr_reader(:csr_file, :key_file, :crt_file, :dhparam_file, :config)
-
-      ##
-      # Creates a new instance. Providing no SSL files will cue generation of a self-signed certificate.
-      #
-      # * +nginx+ - Nginx instance.
-      # * +dir+ - Directory where SSL files are located or should be written to.
-      # * +host+ - Name of the host for determining file names and generating a self-signed certificate.
-      # * +crt_file+ - Path to the CRT file (optional).
-      # * +key_file+ - Path to the KEY file (optional).
-      # * +dhparam_file+ - Path to the DH parameters file (optional).
-      # * +config+ - Nginx configuration hash (optional).
-      #
-      def initialize(nginx, dir, host, crt_file: nil, key_file: nil, dhparam_file: nil, config: {})
-        @nginx = nginx
-        @dir = dir
-        @host = host
-
-        @auto_generated = !crt_file && !key_file && !dhparam_file
-
-        if !@auto_generated && (!crt_file || !key_file || !dhparam_file)
-          raise(ArgumentError, 'Must supply values for all three or none: crt_file, key_file, dhparam_file')
-        end
-
-        @csr_file = File.join(@dir, "#{@host}.csr").freeze
-        @crt_file = crt_file || File.join(@dir, "#{@host}.crt").freeze
-        @key_file = key_file || File.join(@dir, "#{@host}.key").freeze
-        @dhparam_file = dhparam_file || File.join(@dir, 'dhparam.pem').freeze
-
-        @config = Util.deep_merge({
-          'ssl_certificate' => @crt_file,
-          'ssl_certificate_key' => @key_file,
-          'ssl_dhparam' => @dhparam_file,
-          'ssl_stapling' => ('on' unless @auto_generated),
-          'ssl_stapling_verify' => ('on' unless @auto_generated),
-        }, DEFAULT_CONFIG, config)
-      end
-
-      ##
-      # If SSL files were passed to SSL.new, does nothing. Otherwise checks if auto-generated SSL files
-      # exist and generates them if not. If they do exist, the expiration for the certificate is checked and
-      # the certificate regenerated if the expiration date is soon or in the past.
-      #
-      def ensure_files
-        return if !@auto_generated || (
-          File.exist?(@csr_file) &&
-          File.exist?(@key_file) &&
-          File.exist?(@crt_file) &&
-          File.exist?(@dhparam_file) &&
-          (Time.parse(
-            @nginx.run("openssl x509 -enddate -noout -in #{@crt_file}").sub('notAfter=', '')
-          ) - Time.now) >= CERT_RENEW_DAYS * 24 * 60 * 60
-        )
-
-        @nginx.log('Generating SSL files...')
-
-        @nginx.run("openssl genrsa -out #{@key_file} 4096", capture_stderr: false)
-        @nginx.run("openssl req -out #{@csr_file} -key #{@key_file} -new -sha256 -config /dev/stdin <<< "\
-          "'#{openssl_config}'", capture_stderr: false)
-        @nginx.run("openssl x509 -in #{@csr_file} -out #{@crt_file} -signkey #{@key_file} -days "\
-          "#{CERT_DAYS} -req -sha256 -extensions req_ext -extfile /dev/stdin <<< '#{openssl_config}'",
-          capture_stderr: false)
-        @nginx.run("openssl dhparam -out #{@dhparam_file} 2048", capture_stderr: false)
-
-        if IS_MACOS
-          @nginx.log('Adding cert to keychain...')
-
-          @nginx.run(
-            "sudo security delete-certificate -t -c #{@host} 2>&1 || "\
-            "sudo security delete-certificate -c #{@host} 2>&1 || :"
-          )
-
-          @nginx.run("sudo security add-trusted-cert -d -r trustRoot -k "\
-            "/Library/Keychains/System.keychain #{@crt_file}")
-        end
-      end
-
-      private
-
-      ##
-      # OpenSSL configuration content used when auto-generating an SSL certificate.
-      #
-      def openssl_config
-        <<~EOS
-          [ req ]
-          prompt             = no
-          default_bits       = 4096
-          distinguished_name = req_distinguished_name
-          req_extensions     = req_ext
-
-          [ req_distinguished_name ]
-          commonName          = #{@host}
-
-          [ req_ext ]
-          subjectAltName = @alt_names
-
-          [alt_names]
-          DNS.1 = #{@host}
-          DNS.2 = *.#{@host}
-        EOS
-      end
-    end
-  end
-end

data/lib/potluck/nginx/util.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-module Potluck
-  class Nginx < Service
-    ##
-    # Utility methods for Nginx class.
-    #
-    class Util
-      ##
-      # Merges N hashes by merging nested hashes rather than overwriting them as is the case with
-      # <tt>Hash#merge</tt>.
-      #
-      # * +hashes+ - Hashes to deep merge.
-      # * +arrays+ - True if arrays should be merged rather than overwritten (optional, default: false).
-      #
-      # Example:
-      #
-      #   h1 = {hello: {item1: 'world'}}
-      #   h2 = {hello: {item2: 'friend'}}
-      #
-      #   Util.deep_merge(h1, h2)
-      #   # => {hello: {item1: 'world', item2: 'friend'}}
-      #
-      # By default only hashes are merged and arrays are still overwritten as they are with
-      # <tt>Hash#merge</tt>. Passing <tt>arrays: true</tt> will result in arrays being merged similarly to
-      # hashes. Example:
-      #
-      #   h1 = {hello: {item1: ['world']}}
-      #   h2 = {hello: {item1: ['friend']}}
-      #
-      #   Util.deep_merge(h1, h2, arrays: true)
-      #   # => {hello: {item1: ['world', 'friend']}}
-      #
-      def self.deep_merge(*hashes, arrays: false)
-        hash = hashes[0].dup
-
-        hashes[1..-1].each do |other_hash|
-          other_hash.each do |key, other_value|
-            this_value = hash[key]
-
-            if this_value.kind_of?(Hash) && other_value.kind_of?(Hash)
-              hash[key] = deep_merge(this_value, other_value, arrays: arrays)
-            elsif arrays && this_value.kind_of?(Array)
-              hash[key] |= Array(other_value)
-            else
-              hash[key] = other_value
-            end
-          end
-        end
-
-        hash
-      end
-    end
-  end
-end