@stacksjs/buddy 0.70.285 → 0.70.286

package/dist/commands/deploy.js

@@ -147,26 +147,65 @@ fi
 # list already inside it and skips names that have no certificate file of
 # their own. Adding a name takes an acme:issue for the union of the names
 # already on the certificate plus this one.
+#
+# --cert-name pins where that union lands. Without it tlsx names the output
+# after the FIRST --domains entry, and $CURRENT is read back from the
+# certificate, where openssl prints the SANs sorted. So the union was written
+# to whichever hostname sorted first (autodiscover.chrisbreuer.me, on the box
+# this was found on) while the mail server went on reading the untouched
+# mail.stacksjs.com.crt. The issuance succeeded, the deploy reported success,
+# and the certificate was correct - just not in the file anyone was serving.
+#
+# Nothing is appended to the scheduled renewal script, deliberately. The
+# renewal renews mail.stacksjs.com.crt using the SAN list inside that file, so
+# a name added here is renewed by construction. The previous code tried to
+# splice the hostname into that script's --domains list with
+#   sed -i "s|acme:renew -d "|..."
+# whose quotes close before the | in the JS template literal, leaving sed the
+# unterminated expression 's|acme:renew -d ' and a shell pipe. That aborted the
+# whole mail step. Adding names there was never necessary and, until tlsx
+# renewed in place, was actively harmful: each extra name made the renewal open
+# another certificate file, and two files sharing a CN meant one overwrote the
+# other.
 CERTFILE=/etc/bun-gateway/certs/mail.stacksjs.com.crt
-RENEW=/opt/mail/renew-mail-cert.sh
 if [ -n "$DOMAIN" ] && [ -f "$CERTFILE" ] && [ -d /opt/tlsx ]; then
   MAILHOSTNAME="mail.$DOMAIN"
+  CERTNAME=$(basename "$CERTFILE" .crt)
+  CERTKEY=/etc/bun-gateway/certs/mail.stacksjs.com.key
   CURRENT=$(openssl x509 -in "$CERTFILE" -noout -text 2>/dev/null | grep -A1 'Subject Alternative Name' | tail -1 | tr -d ' ' | sed 's/DNS://g')
   case ",$CURRENT," in
     *",$MAILHOSTNAME,"*) : ;;
     *)
       ALL="$CURRENT,$MAILHOSTNAME"
-      if (cd /opt/tlsx && /usr/local/bin/bun run packages/tlsx/bin/cli.ts acme:issue -d "$ALL" --method http-01 --webroot /var/www/acme-challenge --dir /etc/bun-gateway/certs --prod) >/tmp/.mailtenant-cert 2>&1; then
-        install -m 644 /etc/bun-gateway/certs/mail.stacksjs.com.crt /etc/letsencrypt/live/mail.stacksjs.com/fullchain.pem
-        install -m 640 -g mail-server /etc/bun-gateway/certs/mail.stacksjs.com.key /etc/letsencrypt/live/mail.stacksjs.com/privkey.pem
-        systemctl restart mail || true
-        # Keep the scheduled renewal issuing the same set, or the name drops
-        # off the certificate at the next renewal.
-        [ -f "$RENEW" ] && ! grep -q "$MAILHOSTNAME" "$RENEW" && sed -i "s|acme:renew -d "|acme:renew -d "$MAILHOSTNAME,|" "$RENEW" 2>/dev/null
-        echo "CERTHOST:$MAILHOSTNAME"
+      # acme:issue overwrites the certificate in place, so keep a copy: this is
+      # a certificate other tenants are served from, and a partial result must
+      # not be what they get.
+      SAFE=$(mktemp -d)
+      cp -a "$CERTFILE" "$SAFE/cert" 2>/dev/null || true
+      cp -a "$CERTKEY" "$SAFE/key" 2>/dev/null || true
+      if (cd /opt/tlsx && /usr/local/bin/bun run packages/tlsx/bin/cli.ts acme:issue -d "$ALL" --cert-name "$CERTNAME" --method http-01 --webroot /var/www/acme-challenge --dir /etc/bun-gateway/certs --prod) >/tmp/.mailtenant-cert 2>&1; then
+        # Verify rather than assume. The old code reported CERTHOST on a zero
+        # exit alone, which is how an issuance that wrote somewhere else was
+        # reported as "added to the mail certificate" for weeks.
+        UPDATED=$(openssl x509 -in "$CERTFILE" -noout -text 2>/dev/null | grep -A1 'Subject Alternative Name' | tail -1 | tr -d ' ' | sed 's/DNS://g')
+        MISSING=
+        for n in $(echo "$ALL" | tr ',' ' '); do
+          case ",$UPDATED," in *",$n,"*) : ;; *) MISSING="$MISSING $n" ;; esac
+        done
+        if [ -n "$MISSING" ]; then
+          [ -f "$SAFE/cert" ] && cp -a "$SAFE/cert" "$CERTFILE"
+          [ -f "$SAFE/key" ] && cp -a "$SAFE/key" "$CERTKEY"
+          echo "CERTFAIL:issued certificate does not carry$MISSING - previous certificate kept"
+        else
+          install -m 644 "$CERTFILE" /etc/letsencrypt/live/mail.stacksjs.com/fullchain.pem
+          install -m 640 -g mail-server "$CERTKEY" /etc/letsencrypt/live/mail.stacksjs.com/privkey.pem
+          systemctl restart mail || true
+          echo "CERTHOST:$MAILHOSTNAME"
+        fi
       else
         echo "CERTFAIL:$(tail -c 200 /tmp/.mailtenant-cert | tr '\\n' ' ')"
       fi
+      rm -rf "$SAFE"
       rm -f /tmp/.mailtenant-cert
       ;;
   esac

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.285",
+  "version": "0.70.286",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -95,53 +95,53 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/actions": "^0.70.285",
-    "@stacksjs/ai": "^0.70.285",
-    "@stacksjs/alias": "^0.70.285",
-    "@stacksjs/arrays": "^0.70.285",
-    "@stacksjs/auth": "^0.70.285",
-    "@stacksjs/build": "^0.70.285",
-    "@stacksjs/cache": "^0.70.285",
-    "@stacksjs/cli": "^0.70.285",
+    "@stacksjs/actions": "^0.70.286",
+    "@stacksjs/ai": "^0.70.286",
+    "@stacksjs/alias": "^0.70.286",
+    "@stacksjs/arrays": "^0.70.286",
+    "@stacksjs/auth": "^0.70.286",
+    "@stacksjs/build": "^0.70.286",
+    "@stacksjs/cache": "^0.70.286",
+    "@stacksjs/cli": "^0.70.286",
     "@stacksjs/clapp": "^0.2.12",
-    "@stacksjs/cloud": "^0.70.285",
-    "@stacksjs/collections": "^0.70.285",
-    "@stacksjs/config": "^0.70.285",
-    "@stacksjs/database": "^0.70.285",
-    "@stacksjs/desktop-build": "^0.70.285",
-    "@stacksjs/dns": "^0.70.285",
-    "@stacksjs/email": "^0.70.285",
-    "@stacksjs/enums": "^0.70.285",
-    "@stacksjs/error-handling": "^0.70.285",
-    "@stacksjs/events": "^0.70.285",
-    "@stacksjs/git": "^0.70.285",
+    "@stacksjs/cloud": "^0.70.286",
+    "@stacksjs/collections": "^0.70.286",
+    "@stacksjs/config": "^0.70.286",
+    "@stacksjs/database": "^0.70.286",
+    "@stacksjs/desktop-build": "^0.70.286",
+    "@stacksjs/dns": "^0.70.286",
+    "@stacksjs/email": "^0.70.286",
+    "@stacksjs/enums": "^0.70.286",
+    "@stacksjs/error-handling": "^0.70.286",
+    "@stacksjs/events": "^0.70.286",
+    "@stacksjs/git": "^0.70.286",
     "@stacksjs/gitit": "^0.2.5",
-    "@stacksjs/health": "^0.70.285",
+    "@stacksjs/health": "^0.70.286",
     "@stacksjs/dnsx": "^0.2.3",
     "@stacksjs/httx": "^0.1.10",
-    "@stacksjs/image": "^0.70.285",
-    "@stacksjs/lint": "^0.70.285",
-    "@stacksjs/logging": "^0.70.285",
-    "@stacksjs/notifications": "^0.70.285",
-    "@stacksjs/objects": "^0.70.285",
-    "@stacksjs/orm": "^0.70.285",
-    "@stacksjs/path": "^0.70.285",
-    "@stacksjs/skills": "^0.70.285",
-    "@stacksjs/payments": "^0.70.285",
-    "@stacksjs/realtime": "^0.70.285",
-    "@stacksjs/router": "^0.70.285",
+    "@stacksjs/image": "^0.70.286",
+    "@stacksjs/lint": "^0.70.286",
+    "@stacksjs/logging": "^0.70.286",
+    "@stacksjs/notifications": "^0.70.286",
+    "@stacksjs/objects": "^0.70.286",
+    "@stacksjs/orm": "^0.70.286",
+    "@stacksjs/path": "^0.70.286",
+    "@stacksjs/skills": "^0.70.286",
+    "@stacksjs/payments": "^0.70.286",
+    "@stacksjs/realtime": "^0.70.286",
+    "@stacksjs/router": "^0.70.286",
     "@stacksjs/rpx": "^0.11.42",
-    "@stacksjs/search-engine": "^0.70.285",
-    "@stacksjs/security": "^0.70.285",
-    "@stacksjs/server": "^0.70.285",
-    "@stacksjs/storage": "^0.70.285",
-    "@stacksjs/strings": "^0.70.285",
-    "@stacksjs/testing": "^0.70.285",
-    "@stacksjs/tunnel": "^0.70.285",
-    "@stacksjs/types": "^0.70.285",
-    "@stacksjs/ui": "^0.70.285",
-    "@stacksjs/utils": "^0.70.285",
-    "@stacksjs/validation": "^0.70.285",
+    "@stacksjs/search-engine": "^0.70.286",
+    "@stacksjs/security": "^0.70.286",
+    "@stacksjs/server": "^0.70.286",
+    "@stacksjs/storage": "^0.70.286",
+    "@stacksjs/strings": "^0.70.286",
+    "@stacksjs/testing": "^0.70.286",
+    "@stacksjs/tunnel": "^0.70.286",
+    "@stacksjs/types": "^0.70.286",
+    "@stacksjs/ui": "^0.70.286",
+    "@stacksjs/utils": "^0.70.286",
+    "@stacksjs/validation": "^0.70.286",
     "@stacksjs/ts-cloud": "^0.7.103",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",