Add TLS feature with Caddy

2026-10-21 09:13:59 +01:00
parent 1462067e72
commit ed4a6f3ec8
109 changed files with 6374 additions and 156 deletions
@@ -0,0 +1,117 @@
+import type {
+    BUN_SQLITE_WGUI_CLIENT_ROUTES,
+    BUN_SQLITE_WGUI_TLS_CERTIFICATES,
+} from "@/db/types/db";
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { TableType } from "@/src/types";
+import { TlsData } from "@/src/data/tls-data";
+import grabCaddyStatus from "../caddy/grab-caddy-status";
+import grabCertDirNames from "../caddy/grab-cert-dir-names";
+import readAcmeEnv from "./read-acme-env";
+import readCertificateExpiry from "./read-certificate-expiry";
+
+export default async function grabTlsStatus() {
+    const certificates_res = await BunSQLite.select<
+        BUN_SQLITE_WGUI_TLS_CERTIFICATES,
+        TableType
+    >({
+        table: "tls_certificates",
+        query: {
+            order: { field: "hostname", strategy: "ASC" },
+        },
+    });
+
+    const routes_res = await BunSQLite.select<
+        BUN_SQLITE_WGUI_CLIENT_ROUTES,
+        TableType
+    >({
+        table: "client_routes",
+    });
+
+    const acme_env = readAcmeEnv();
+    const now = Date.now();
+    const renew_before = TlsData.RenewBeforeDays * 24 * 60 * 60 * 1000;
+
+    const certificates = (certificates_res.payload || []).map(
+        (certificate) => {
+            const expires_at = readCertificateExpiry({
+                cert_path: certificate.cert_path,
+            });
+
+            let status = certificate.status || "missing";
+
+            if (expires_at) {
+                if (expires_at <= now) {
+                    status = "error";
+                } else if (expires_at - now <= renew_before) {
+                    status = "expiring";
+                } else if (status != "issuing") {
+                    status = "active";
+                }
+            }
+
+            return {
+                ...certificate,
+                hostname: certificate.hostname?.trim().toLowerCase(),
+                expires_at: expires_at || certificate.expires_at || null,
+                status,
+                has_certificate: Boolean(expires_at),
+            };
+        },
+    );
+
+    const known_hostnames = new Set(
+        certificates
+            .map((certificate) => certificate.hostname)
+            .filter(Boolean),
+    );
+
+    for (let i = 0; i < (routes_res.payload || []).length; i++) {
+        const route = routes_res.payload?.[i];
+        const hostname = route?.hostname?.trim().toLowerCase();
+
+        if (!hostname || known_hostnames.has(hostname)) {
+            continue;
+        }
+
+        const { CERT_FILE, KEY_FILE } = grabCertDirNames({ hostname });
+
+        certificates.push({
+            hostname,
+            provider: "letsencrypt",
+            challenge: "dns-01",
+            cert_path: CERT_FILE,
+            key_path: KEY_FILE,
+            status: "missing",
+            auto_renew: 1,
+            expires_at: null,
+            has_certificate: false,
+        });
+
+        known_hostnames.add(hostname);
+    }
+
+    certificates.sort((a, b) =>
+        (a.hostname || "").localeCompare(b.hostname || ""),
+    );
+
+    return {
+        caddy: grabCaddyStatus(),
+        certificates,
+        acme: {
+            env_path: acme_env.exists ? `/etc/wgui/acme.env` : null,
+            env_exists: acme_env.exists,
+            provider:
+                acme_env.values.ACME_DNS_PROVIDER ||
+                TlsData.DefaultDnsProvider ||
+                null,
+            email_configured: Boolean(acme_env.values.ACME_EMAIL),
+            credential_keys: acme_env.keys.filter(
+                (key) =>
+                    key != "ACME_EMAIL" && key != "ACME_DNS_PROVIDER",
+            ),
+            staging: TlsData.AcmeStaging,
+        },
+        https_port: TlsData.CaddyHttpsPort,
+    };
+}