fix

nginx/nginx-prod/Dockerfile

@@ -2,7 +2,7 @@ FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages requests minio
+RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
 COPY ./fullchain.pem /etc/nginx/fullchain.pem
 COPY ./privkey.pem /etc/nginx/privkey.pem

nginx/nginx-prod/config/nginx.conf

@@ -8,6 +8,17 @@ http {
         '' close;
     }
 
+    server {
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
     include ./hosts.conf;
-    include ./sprinthub.conf;
 }

nginx/nginx-prod/config/sprinthub.conf

@@ -1,96 +0,0 @@
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name gitea.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:3000/;
-        }
-    }

nginx/nginx-prod/prepare.py

@@ -1,6 +1,8 @@
-from requests import get
 import os
+import sys
 from minio import Minio
+from urllib.request import urlopen
+from json import loads
 
 
 minio_client = Minio(
@@ -11,9 +13,20 @@ minio_client = Minio(
 )
 
 
-hosts = get(
+def get(url):
+    with urlopen(url) as response:
+        data = response.read().decode("utf-8")
+        return loads(data)
+
+
+try:
+    response = get(
         "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-).json()["configs"]["hosts"]
+    )
+    hosts = response["configs"]["hosts"]
+except Exception as e:
+    print(f"Error fetching config: {e}", file=sys.stderr)
+    sys.exit(1)
 
 config = ""
 for host, params in hosts.items():
@@ -40,18 +53,30 @@ for host, params in hosts.items():
     """.format(
         host=host, target_host=params["host"], port=params["port"]
     )
+    try:
         fullchain = minio_client.get_object(
             "certupdater", f"certificates/{host}/fullchain.pem"
         )
-    privkey = minio_client.get_object("certupdater", f"certificates/{host}/privkey.pem")
+        privkey = minio_client.get_object(
+            "certupdater", f"certificates/{host}/privkey.pem"
+        )
         try:
-        os.mkdir(f"/etc/nginx/{host}")
+            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-    except FileExistsError:
+        except OSError as e:
-        ...
+            print(f"Error creating directory: {e}", file=sys.stderr)
+            continue
+
         with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
             fp.write(fullchain.data)
         with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
             fp.write(privkey.data)
+    except Exception as e:
+        print(f"Error processing host {host}: {e}", file=sys.stderr)
+        continue
 
-with open("/etc/nginx/hosts.conf", "w") as fp:
+try:
+    with open("/etc/nginx/hosts.conf", "w") as fp:
         fp.write(config)
+except Exception as e:
+    print(f"Error writing config file: {e}", file=sys.stderr)
+    sys.exit(1)