YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

[muc subdomain] add to domain's certificate the alt subdomain muc

Browse source
This commit is contained in:
Gabriel 2021-02-04 20:21:49 +01:00
parent 3bbc93d54b
commit 4432d28c09
2 changed files with 19 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
data/templates/nginx/server.tpl.conf
View file

@ -6,7 +6,7 @@ map $http_upgrade $connection_upgrade {
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
server_name {{ domain }} xmpp-upload.{{ domain }}; server_name {{ domain }} xmpp-upload.{{ domain }} muc.{{ domain }};
access_by_lua_file /usr/share/ssowat/access.lua; access_by_lua_file /usr/share/ssowat/access.lua;

31
src/yunohost/certificate.py
View file

@ -659,34 +659,39 @@ def _prepare_certificate_signing_request(domain, key_file, output_folder):
csr.get_subject().CN = domain csr.get_subject().CN = domain
from yunohost.domain import domain_list from yunohost.domain import domain_list
# For "parent" domains, include xmpp-upload and muc subdomains in subject
# For "parent" domains, include xmpp-upload subdomain in subject alternate names # alternate names
if domain in domain_list(exclude_subdomains=True)["domains"]: if domain in domain_list(exclude_subdomains=True)["domains"]:
subdomain = "xmpp-upload." + domain
xmpp_records = ( xmpp_records = (
Diagnoser.get_cached_report( Diagnoser.get_cached_report(
"dnsrecords", item={"domain": domain, "category": "xmpp"} "dnsrecords", item={"domain": domain, "category": "xmpp"}
).get("data") ).get("data")
or {} or {}
) )
if xmpp_records.get("CNAME:xmpp-upload") == "OK": sanlist = []
for sub in ('xmpp-upload', 'muc'):
subdomain = sub + "." + domain
if xmpp_records.get("CNAME:" + sub) == "OK":
sanlist.append(("DNS:" + subdomain))
else:
logger.warning(
m18n.n(
"certmanager_warning_subdomain_dns_record",
subdomain=subdomain,
domain=domain,
)
)
if sanlist:
csr.add_extensions( csr.add_extensions(
[ [
crypto.X509Extension( crypto.X509Extension(
"subjectAltName".encode("utf8"), "subjectAltName".encode("utf8"),
False, False,
("DNS:" + subdomain).encode("utf8"), (", ".join(sanlist)).encode("utf-8"),
) )
] ]
) )
else:
logger.warning(
m18n.n(
"certmanager_warning_subdomain_dns_record",
subdomain=subdomain,
domain=domain,
)
)
# Set the key # Set the key
with open(key_file, "rt") as f: with open(key_file, "rt") as f: