Mirrors/dokku
1
0
Fork 0
mirror of https://github.com/dokku/dokku.git synced 2026-08-29 10:08:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: expose certs-set and certs-remove plugin triggers

Browse Source 
Adds `certs-set` and `certs-remove` plugin triggers so other plugins can install or remove an app's SSL cert/key pair without shelling out to the `dokku certs:add` / `dokku certs:remove` subcommands. Shared implementations live as `fn-certs-set` and `fn-certs-remove` in `plugins/certs/internal-functions`, with the subcommands and the new triggers calling `verify_app_name` before delegating.
This commit is contained in:
Jose Diaz-Gonzalez
2026-05-12 18:37:06 -04:00
parent 12c00b57fc
commit 460d92e21c
7 changed files with 154 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
docs/development/plugin-triggers.md
View File

@@ -411,6 +411,42 @@ elif [[ "$KEY_TYPE" == "key" ]]; then
fi
```
### `certs-remove`
- Description: Removes the SSL cert/key pair from an app and fires the `post-certs-remove` and `post-domains-update` triggers. Fails if no app-specific SSL endpoint is defined.
- Invoked by:
- Arguments: `$APP`
- Example:
```shell
#!/usr/bin/env bash
# Removes the SSL endpoint for an app
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
APP="$1"
dokku certs:remove "$APP"
```
### `certs-set`
- Description: Installs an SSL cert/key pair onto an app and fires the `post-certs-update` and `post-domains-update` triggers. `$CRT_FILE` and `$KEY_FILE` must be paths to readable PEM-encoded files.
- Invoked by:
- Arguments: `$APP $CRT_FILE $KEY_FILE`
- Example:
```shell
#!/usr/bin/env bash
# Installs a cert/key pair for an app
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
APP="$1"; CRT_FILE="$2"; KEY_FILE="$3"
dokku certs:add "$APP" "$CRT_FILE" "$KEY_FILE"
```
### `check-deploy`
- Description: Allows you to run checks on a deploy before Dokku allows the container to handle requests.

16
plugins/certs/certs-remove Executable file
View File

@@ -0,0 +1,16 @@
#!/usr/bin/env bash
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions"
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
trigger-certs-certs-remove() {
declare desc="removes the SSL cert/key pair from an app"
declare trigger="certs-remove"
declare APP="$1"
verify_app_name "$APP"
fn-certs-remove "$APP"
}
trigger-certs-certs-remove "$@"

16
plugins/certs/certs-set Executable file
View File

@@ -0,0 +1,16 @@
#!/usr/bin/env bash
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions"
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
trigger-certs-certs-set() {
declare desc="installs an SSL cert/key pair onto an app"
declare trigger="certs-set"
declare APP="$1" CRT_FILE="$2" KEY_FILE="$3"
verify_app_name "$APP"
fn-certs-set "$APP" "$CRT_FILE" "$KEY_FILE"
}
trigger-certs-certs-set "$@"

42
plugins/certs/internal-functions
View File

@@ -4,6 +4,48 @@ source "$PLUGIN_AVAILABLE_PATH/certs/functions"
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
fn-certs-set() {
declare desc="installs an SSL cert/key pair onto an app"
declare APP="$1" CRT_FILE="$2" KEY_FILE="$3"
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
if [[ -z "$CRT_FILE" ]] || [[ -z "$KEY_FILE" ]]; then
dokku_log_fail "Both CRT and KEY file paths are required"
fi
if [[ ! -r "$CRT_FILE" ]]; then
dokku_log_fail "CRT file specified not found, please check file paths"
fi
if [[ ! -r "$KEY_FILE" ]]; then
dokku_log_fail "KEY file specified not found, please check file paths"
fi
mkdir -p "$APP_SSL_PATH"
rm -f "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
cp "$CRT_FILE" "$APP_SSL_PATH/server.crt"
cp "$KEY_FILE" "$APP_SSL_PATH/server.key"
chmod 750 "$APP_SSL_PATH"
chmod 640 "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
plugn trigger post-certs-update "$APP"
plugn trigger post-domains-update "$APP"
}
fn-certs-remove() {
declare desc="removes the SSL cert/key pair from an app"
declare APP="$1"
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
if [[ ! -d "$APP_SSL_PATH" ]]; then
dokku_log_fail "An app-specific SSL endpoint is not defined"
fi
dokku_log_info1 "Removing SSL endpoint from $APP"
rm -rf "$APP_SSL_PATH"
plugn trigger post-certs-remove "$APP"
plugn trigger post-domains-update "$APP"
}
cmd-certs-report() {
declare desc="displays an ssl report for one or more apps"
declare cmd="certs:report"

15
plugins/certs/subcommands/add
View File

@@ -3,6 +3,7 @@ set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions"
is_tar_import() {
declare desc="determines if we have STDIN open in an attempt to detect a streamed tar import"
@@ -35,7 +36,6 @@ cmd-certs-set() {
declare APP="$1" CRT_FILE="$2" KEY_FILE="$3"
verify_app_name "$APP"
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
if is_file_import "$CRT_FILE" "$KEY_FILE"; then
# importing from file
@@ -53,7 +53,7 @@ cmd-certs-set() {
elif [[ $CRT_FILE_COUNT -gt 1 ]]; then
dokku_log_fail "Tar archive contains more than one .crt file"
else
local CRT_FILE=$CRT_FILE_SEARCH
CRT_FILE=$CRT_FILE_SEARCH
fi
local KEY_FILE_SEARCH=$(find . -not -path '*/\.*' -type f | grep ".key$")
@@ -63,20 +63,13 @@ cmd-certs-set() {
elif [[ $KEY_FILE_COUNT -gt 1 ]]; then
dokku_log_fail "Tar archive contains more than one .key file"
else
local KEY_FILE=$KEY_FILE_SEARCH
KEY_FILE=$KEY_FILE_SEARCH
fi
else
dokku_log_fail "Tar archive containing server.crt and server.key expected on stdin"
fi
mkdir -p "$APP_SSL_PATH"
rm -f "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
cp "$CRT_FILE" "$APP_SSL_PATH/server.crt"
cp "$KEY_FILE" "$APP_SSL_PATH/server.key"
chmod 750 "$APP_SSL_PATH"
chmod 640 "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
plugn trigger post-certs-update "$APP"
plugn trigger post-domains-update "$APP"
fn-certs-set "$APP" "$CRT_FILE" "$KEY_FILE"
}
cmd-certs-set "$@"

12
plugins/certs/subcommands/remove
View File

@@ -2,6 +2,7 @@
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions"
cmd-certs-remove() {
declare desc="removes SSL cert/key from specified app"
@@ -10,16 +11,7 @@ cmd-certs-remove() {
declare APP="$1"
verify_app_name "$APP"
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
if [[ -d "$APP_SSL_PATH" ]]; then
dokku_log_info1 "Removing SSL endpoint from $APP"
rm -rf "$APP_SSL_PATH"
plugn trigger post-certs-remove "$APP"
plugn trigger post-domains-update "$APP"
else
dokku_log_fail "An app-specific SSL endpoint is not defined"
fi
fn-certs-remove "$APP"
}
cmd-certs-remove "$@"

38
tests/unit/certs.bats
View File

@@ -131,6 +131,44 @@ teardown() {
assert_success
}
@test "(certs) certs-set plugin trigger" {
run /bin/bash -c "plugn trigger certs-set $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
echo "output: $output"
echo "status: $status"
assert_success
[[ -f "$DOKKU_ROOT/$TEST_APP/tls/server.crt" ]]
[[ -f "$DOKKU_ROOT/$TEST_APP/tls/server.key" ]]
}
@test "(certs) certs-set plugin trigger missing key file" {
run /bin/bash -c "plugn trigger certs-set $TEST_APP $BATS_TMPDIR/tls/server.crt /nonexistent/server.key"
echo "output: $output"
echo "status: $status"
assert_failure
assert_output_contains "KEY file specified not found"
}
@test "(certs) certs-remove plugin trigger" {
run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "plugn trigger certs-remove $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
[[ ! -d "$DOKKU_ROOT/$TEST_APP/tls" ]]
}
@test "(certs) certs-remove plugin trigger without endpoint" {
run /bin/bash -c "plugn trigger certs-remove $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_failure
assert_output_contains "An app-specific SSL endpoint is not defined"
}
@test "(certs) certs:show" {
run /bin/bash -c "dokku certs:show fake-app-name 2>&1"
echo "output: $output"