mteehan
dc96e15643
- Add lib/state.py: in-memory state store with subsystem collectors (firewall, dnsmasq, nginx, acme, wireguard) - Refactor all handlers: read from state on GET, call refresh_state() after mutations instead of invoking subprocesses per request - daemon/server.py: add refresh_state(), /status/all, /status/refresh; populate state at startup - webui/api/certs.py: async step-by-step ACME issuance (validate, issue with request_id, poll status) replacing blocking endpoint - webui/server.py: render pages from state instead of direct lib calls - Update templates, JS for async cert issuance with polling UI - Update tests for state-based mocking; add test_state.py - Fix SIM105 lint issue (contextlib.suppress) - Add TODO.md with certificate issuance issue tracking Resolves: WebUI 30s timeout freeze during cert issuance (Problem 1)
140 lines
4.6 KiB
Python
140 lines
4.6 KiB
Python
"""ACME certificate management API blueprint.
|
|
|
|
Exposed at /api/certs/* and delegates to vacuum-walld.
|
|
"""
|
|
|
|
import logging
|
|
|
|
from flask import Blueprint, request
|
|
|
|
from daemon.client import BadRequest, NotFound, delete, get, post
|
|
from webui.api.common import _error, _ok
|
|
|
|
logger = logging.getLogger(__name__)
|
|
bp = Blueprint("certs", __name__)
|
|
|
|
|
|
@bp.route("/list", methods=["GET"])
|
|
def list_certs_bp():
|
|
try:
|
|
return _ok(get("/acme/list"))
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to list certificates: %s", exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/<domain>", methods=["GET"])
|
|
def cert_details(domain: str):
|
|
try:
|
|
return _ok(get("/acme/info", {"domain": domain}))
|
|
except NotFound as exc:
|
|
logger.info("Cert for '%s' not found: %s", domain, exc)
|
|
return _error(str(exc), 404)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to get cert info for '%s': %s", domain, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/validate", methods=["POST"])
|
|
def validate():
|
|
body = request.get_json(silent=True) or {}
|
|
domain = body.get("domain", "").strip()
|
|
if not domain:
|
|
return _error("'domain' is required", 400)
|
|
try:
|
|
result = post("/acme/validate", {"domain": domain})
|
|
return _ok(result)
|
|
except BadRequest as exc:
|
|
logger.info("Validation rejected: %s", exc)
|
|
return _error(str(exc), 400)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to validate cert for '%s': %s", domain, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/issue/start", methods=["POST"])
|
|
def issue_start():
|
|
body = request.get_json(silent=True) or {}
|
|
domain = body.get("domain", "").strip()
|
|
if not domain:
|
|
return _error("'domain' is required", 400)
|
|
email = body.get("email", "").strip() or None
|
|
webroot = body.get("webroot")
|
|
try:
|
|
logger.info("Certificate issuance requested for '%s' via API", domain)
|
|
result = post(
|
|
"/acme/issue", {"domain": domain, "webroot": webroot, "email": email}
|
|
)
|
|
logger.info(
|
|
"Certificate issuance started for '%s' (id=%s)",
|
|
domain,
|
|
result.get("request_id"),
|
|
)
|
|
return _ok(result)
|
|
except BadRequest as exc:
|
|
logger.info("Cert issue for '%s' rejected: %s", domain, exc)
|
|
return _error(str(exc), 400)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to start cert issue for '%s': %s", domain, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/issue/<request_id>", methods=["GET"])
|
|
def issue_status(request_id: str):
|
|
try:
|
|
result = get("/acme/issue/status", {"id": request_id})
|
|
return _ok(result)
|
|
except NotFound as exc:
|
|
logger.info("Issuance request '%s' not found: %s", request_id, exc)
|
|
return _error(str(exc), 404)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to get issuance status for '%s': %s", request_id, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/<domain>/renew", methods=["POST"])
|
|
def renew_bp(domain: str):
|
|
try:
|
|
logger.info("Certificate renewal requested for '%s' via API", domain)
|
|
post("/acme/renew", {"domain": domain})
|
|
logger.info("Certificate renewed for '%s'", domain)
|
|
return _ok(None)
|
|
except BadRequest as exc:
|
|
logger.info("Cert renew for '%s' rejected: %s", domain, exc)
|
|
return _error(str(exc), 400)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to renew cert for '%s': %s", domain, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/<domain>", methods=["DELETE"])
|
|
def remove_bp(domain: str):
|
|
try:
|
|
delete("/acme/remove", {"domain": domain})
|
|
logger.info("Certificate removed for '%s' via API", domain)
|
|
return _ok(None)
|
|
except NotFound as exc:
|
|
logger.info("Cert '%s' not found: %s", domain, exc)
|
|
return _error(str(exc), 404)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to remove cert '%s': %s", domain, exc)
|
|
return _error(str(exc), 500)
|
|
|
|
|
|
@bp.route("/email", methods=["POST"])
|
|
def set_email_bp():
|
|
body = request.get_json(silent=True) or {}
|
|
email = body.get("email", "").strip()
|
|
if not email:
|
|
return _error("'email' is required", 400)
|
|
try:
|
|
post("/acme/email", {"email": email})
|
|
logger.info("ACME email set via API: %s", email)
|
|
return _ok({"email": email})
|
|
except BadRequest as exc:
|
|
logger.info("ACME email set rejected: %s", exc)
|
|
return _error(str(exc), 400)
|
|
except RuntimeError as exc:
|
|
logger.error("Failed to set ACME email: %s", exc)
|
|
return _error(str(exc), 500)
|