117 lines
3.8 KiB
Python
117 lines
3.8 KiB
Python
#!/usr/bin/env python3
|
|
"""Add exposedgays.com to Cloudflare tunnel remote ingress + verify DNS."""
|
|
import json
|
|
import re
|
|
import time
|
|
import urllib.error
|
|
import urllib.request
|
|
import paramiko
|
|
|
|
PASS = "Bbt9115xty9176!"
|
|
ACCOUNT = "2599c23bbb1255dbb73e8d34b4115fda"
|
|
TUNNEL_ID = "03079a26-f14c-4622-b463-ba54a24f7472"
|
|
HOSTS = ["exposedgays.com", "www.exposedgays.com"]
|
|
RULES = [
|
|
{
|
|
"hostname": "exposedgays.com",
|
|
"service": "https://localhost:443",
|
|
"originRequest": {"noTLSVerify": True},
|
|
},
|
|
{
|
|
"hostname": "www.exposedgays.com",
|
|
"service": "https://localhost:443",
|
|
"originRequest": {"noTLSVerify": True},
|
|
},
|
|
]
|
|
|
|
|
|
def get_token():
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("10.10.0.1", username="admin", password=PASS, timeout=15)
|
|
_, o, e = c.exec_command("cat /usr/local/etc/wan-dns-failover.env", timeout=30)
|
|
o.channel.recv_exit_status()
|
|
text = (o.read() + e.read()).decode()
|
|
c.close()
|
|
return re.search(r"CLOUDFLARE_API_TOKEN=([^\s\"']+)", text).group(1)
|
|
|
|
|
|
def cf(token, path, method="GET", data=None):
|
|
req = urllib.request.Request(
|
|
f"https://api.cloudflare.com/client/v4{path}",
|
|
data=json.dumps(data).encode() if data is not None else None,
|
|
method=method,
|
|
headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
|
|
)
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=60) as r:
|
|
return r.status, json.load(r)
|
|
except urllib.error.HTTPError as e:
|
|
return e.code, json.loads(e.read().decode())
|
|
|
|
|
|
def ssh_run(cmd, timeout=90):
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("10.10.0.10", username="localadministrator", password=PASS, timeout=30)
|
|
_, o, e = c.exec_command(cmd, timeout=timeout)
|
|
o.channel.recv_exit_status()
|
|
out = (o.read() + e.read()).decode(errors="replace")
|
|
c.close()
|
|
return out
|
|
|
|
|
|
def merge_ingress(ingress):
|
|
hostnames = {i.get("hostname") for i in ingress if i.get("hostname")}
|
|
changed = False
|
|
for rule in RULES:
|
|
if rule["hostname"] not in hostnames:
|
|
catch = next((i for i, x in enumerate(ingress) if not x.get("hostname")), len(ingress))
|
|
ingress.insert(catch, rule)
|
|
hostnames.add(rule["hostname"])
|
|
changed = True
|
|
print("added", rule["hostname"])
|
|
return ingress, changed
|
|
|
|
|
|
def main():
|
|
token = get_token()
|
|
|
|
code, body = cf(token, f"/accounts/{ACCOUNT}/cfd_tunnel/{TUNNEL_ID}/configurations")
|
|
print(f"GET tunnel config HTTP {code}")
|
|
if not body.get("result"):
|
|
print(body.get("errors"))
|
|
return 1
|
|
|
|
ingress = body["result"].get("config", {}).get("ingress", [])
|
|
present = [i.get("hostname") for i in ingress if i.get("hostname") in HOSTS]
|
|
print("exposedgays in remote ingress:", present)
|
|
|
|
ingress, changed = merge_ingress(ingress)
|
|
if changed:
|
|
put_code, put = cf(
|
|
token,
|
|
f"/accounts/{ACCOUNT}/cfd_tunnel/{TUNNEL_ID}/configurations",
|
|
"PUT",
|
|
{"config": {"ingress": ingress, "warp-routing": {"enabled": False}}},
|
|
)
|
|
print(f"PUT HTTP {put_code} success={put.get('success')} errors={put.get('errors')}")
|
|
if not put.get("success"):
|
|
return 1
|
|
print(ssh_run(f"echo '{PASS}' | sudo -S systemctl restart cloudflared"))
|
|
time.sleep(8)
|
|
|
|
print("\n=== verify ===")
|
|
print(
|
|
ssh_run(
|
|
"systemctl is-active cloudflared; "
|
|
"dig @1.1.1.1 www.exposedgays.com CNAME +short; "
|
|
"curl -sSI --max-time 20 https://www.exposedgays.com/ | head -12; "
|
|
"curl -sSL --max-time 20 https://www.exposedgays.com/ | head -c 250"
|
|
)
|
|
)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main()) |