qcloud-ssl-cdn/main.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# author: 'zfb'
# time: 2020-12-02 15:56
from api import cdn, ecdn, ssl, tools
import config

def run_config_ssl(id, key, cer_file, key_file):
    '''上传SSl证书到腾讯云SSL证书管理，返回新证书的id
    '''
    cert_info = {
        # Let's Encrypt 是通过中级 CA 机构颁发的证书，拿到的证书文件包含
        # whuzfb.cn.cer    ca.cer
        # 需要人为地将服务器证书与中间证书拼接在一起（acme.sh已经进行拼接）
        # fullchain.cer
        "cer": tools.read_file(cer_file),
        "key": tools.read_file(key_file),
        "type": "CA"
    }
    ssl_client = ssl.get_ssl_client_instance(id, key)
    cert_list = ssl.get_cert_list(ssl_client)
    for cert in cert_list:
        # 获取每个证书的id
        cert_id = cert.CertificateId
        # 获取每个证书的信息
        # if domain == ssl.get_cert_info(ssl_client, cert_id).Domain:
        #     # 删除证书
        #     # delete_cert(client, cert_id)
        #     # break
        #     print(cert_id)
    # 上传证书，获取新证书的id
    id = ssl.upload_cert(ssl_client, cert_info)
    if len(id)>0:
        return id
    else:
        exit("获取新证书id失败")


def run_config_cdn(id, key, domain, cert_id):
    '''该函数实现为CDN更新ssl证书的功能
    '''
    cdn_client = cdn.get_cdn_client_instance(id, key)
    cdns = cdn.get_cdn_detail_info(cdn_client)
    https = None
    for _cdn in cdns:
        if _cdn.Domain == domain:
            https = _cdn.Https
            break
    print(https)
    # generate_https(https)
    cdn.update_cdn_ssl(cdn_client, domain, cert_id)

def https_options_enabler(id, key, domain, http2, hsts, age, hsts_subdomain, ocsp):
    '''开启HTTPS配置中的部分选项
    '''
    cdn_client = cdn.get_cdn_client_instance(id, key)
    cdn.update_cdn_https_options(cdn_client, domain, http2, hsts, age, hsts_subdomain, ocsp)

def delete_old_ssls(id, key, cdn_domain, ignore_id):
    '''删除某个CDN的，除ignore_id以外的所有ssl证书
    '''
    ssl_client = ssl.get_ssl_client_instance(id, key)
    cert_list = ssl.get_cert_list(ssl_client)
    for cert in cert_list:
        cert_id = cert.CertificateId
        # 刚上传的这个证书不删除
        if cert_id == ignore_id:
            continue
        cert_info = ssl.get_cert_info(ssl_client, cert_id)
        cert_domain_and_alt_name = [cert_info.Domain] + cert_info.SubjectAltName
        matched = False
        # 判断域名匹配
        for cert_name in cert_domain_and_alt_name:
            if cert_name:
                # 判断主域名或多域名
                if cert_name == cdn_domain:
                    matched = True
                    break
                # 判断泛域名 m=['*','example.cn']
                m = cert_name.split('.', 1)
                n = cdn_domain.split('.', 1)
                if m[0] == "*" and m[1] == n[1]:
                    matched = True
                    break
        # 根据结果删除证书
        if matched:
            ssl.delete_cert(ssl_client, cert_id)


def run_config_ecdn(id, key, domain, cert_id):
    '''全站加速网络：为指定域名的CDN更新SSL证书
    '''
    ecdn_client = ecdn.get_ecdn_client_instance(id, key)
    ecdn.get_ecdn_basic_info(ecdn_client)
    cdns = ecdn.get_ecdn_detail_info(ecdn_client)
    ecdn.update_ecdn_ssl(ecdn_client, domain, cert_id)


def run_url_push(id, key, domain, urls_file):
    '''为CDN推送预热URL
    '''
    from time import sleep
    from os.path import isfile
    urls = []
    try:
        urls = tools.get_sitemap_urls("https://{}/sitemap.xml".format(domain))
    except Exception as e:
        print(repr(e))
    if isfile(urls_file):
        urls = urls + tools.get_urls_from_file(urls_file)
    cdn_client = cdn.get_cdn_client_instance(id, key)
    cdn_region = cdn.get_cdn_basic_info(cdn_client, domain)[0].Area
    # 预热URL支持area为global的参数，但是为了方便统计用量配额，手动分开刷新
    if cdn_region == 'global':
        cdn_region = ['mainland', 'overseas']
    else:
        cdn_region = [cdn_region]
    info = cdn.get_cdn_url_push_info(cdn_client)
    # 统计预热url数量
    cnt = 0
    # 根据加速域名配置的区域进行预热
    for i in info:
        if i.Area in cdn_region:
            grp_size = i.Batch
            available = i.Available
            print("正在对区域{0}进行url预热，剩余配额{1}条".format(i.Area, available))
            new_urls = tools.resize_url_list(urls, grp_size)
            for url_grp in new_urls:
                res = cdn.update_cdn_url_push(cdn_client, url_grp, i.Area)
                if res:
                    cnt = cnt + len(url_grp)
                    sleep(0.1)
                else:
                    break
    print("成功预热{}个URL".format(cnt))


def run_purge_url(id, key, domain, urls_file):
    '''为CDN推送刷新URL
    '''
    from time import sleep
    from os.path import isfile
    urls = []
    try:
        urls = tools.get_sitemap_urls("https://{}/sitemap.xml".format(domain))
    except Exception as e:
        print(repr(e))
    if isfile(urls_file):
        urls = urls + tools.get_urls_from_file(urls_file)
    cdn_client = cdn.get_cdn_client_instance(id, key)
    cdn_region = cdn.get_cdn_basic_info(cdn_client, domain)[0].Area
    # 刷新URL不支持area为global的参数
    if cdn_region == 'global':
        cdn_region = ['mainland', 'overseas']
    else:
        cdn_region = [cdn_region]
    info = cdn.get_cdn_purge_url_info(cdn_client)
    # 统计刷新url数量
    cnt = 0
    # 根据加速域名配置的区域进行刷新
    for i in info:
        if i.Area in cdn_region:
            grp_size = i.Batch
            available = i.Available
            print("正在对区域{0}进行url刷新，剩余配额{1}条".format(i.Area, available))
            new_urls = tools.resize_url_list(urls, grp_size)
            for url_grp in new_urls:
                res = cdn.update_cdn_purge_url(cdn_client, url_grp, i.Area)
                if res:
                    cnt = cnt + len(url_grp)
                    sleep(0.1)
                else:
                    break
    print("成功刷新{}个URL".format(cnt))


if __name__ == "__main__":
    SECRETID = config.SECRETID
    SECRETKEY = config.SECRETKEY
    # 泛域名证书
    if config.UPLOAD_SSL:
        cert_id = run_config_ssl(SECRETID, SECRETKEY, config.CER_FILE, config.KEY_FILE)
    else:
        cert_id = config.CERT_ID
    for my_domain in config.CDN_DOMAIN:
        if config.UPDATE_SSL:
            run_config_cdn(SECRETID, SECRETKEY, my_domain, cert_id)
        if config.ENABLE_HSTS or config.ENABLE_OCSP or config.ENABLE_HTTP2:
            https_options_enabler(SECRETID, SECRETKEY, my_domain, config.ENABLE_HTTP2, config.ENABLE_HSTS,
                                  config.HSTS_TIMEOUT_AGE, config.HSTS_INCLUDE_SUBDOMAIN, config.ENABLE_OCSP)
        if config.DELETE_OLD_CERTS:
            delete_old_ssls(SECRETID, SECRETKEY, my_domain, cert_id)
        if config.PUSH_URL:
            run_url_push(SECRETID, SECRETKEY, my_domain, config.URLS_FILE)
        if config.PURGE_URL:
            run_purge_url(SECRETID, SECRETKEY, my_domain, config.URLS_FILE)
        # ecdn是全球加速服务，与CDN不同，本账号没有开通该功能
        # run_config_ecdn(SECRETID, SECRETKEY, my_domain, cert_id)
    print("成功执行本次CDN更新任务！")