YANG JIANKUAN
5326c572a2
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。 完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。 验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
59 lines
2.6 KiB
Markdown
59 lines
2.6 KiB
Markdown
# Centralized wildcard certs (fleet option)
|
|
|
|
`03-sign-wildcard-cert.sh` signs the wildcard **on the box** — simplest for a single node.
|
|
For a fleet you may prefer to sign every wildcard on **one** host and push to the rest, so
|
|
the Cloudflare DNS token lives in exactly one place and renewals are centralized.
|
|
|
|
## Model
|
|
|
|
```
|
|
one signer host (acme.sh + CF token)
|
|
┌───────────────────────────────────┐
|
|
│ acme.sh --dns dns_cf │ issues *.nodeA.example.com,
|
|
│ --reloadcmd distribute.sh │ *.nodeB.example.com, …
|
|
└───────────────┬───────────────────┘
|
|
│ scp fullchain+key on every renew
|
|
┌─────────────┼─────────────┐
|
|
nodeA nodeB nodeC (BT cert dirs + nginx reload)
|
|
```
|
|
|
|
## Signer setup (once)
|
|
|
|
```bash
|
|
export CF_Token='<token>'
|
|
acme.sh --set-default-ca --server letsencrypt
|
|
acme.sh --issue --dns dns_cf -d nodeA.example.com -d '*.nodeA.example.com' --keylength ec-256
|
|
```
|
|
|
|
## Distribution reloadcmd
|
|
|
|
A small script the signer runs after each renewal — for each target it scp's the cert into
|
|
the aaPanel cert dirs and reloads nginx. Register it once:
|
|
|
|
```bash
|
|
acme.sh --install-cert -d nodeA.example.com --ecc --reloadcmd "/root/acme-deploy/distribute.sh"
|
|
```
|
|
|
|
`distribute.sh` (sketch — adapt hosts/sites to yours; **no real hosts here**):
|
|
|
|
```bash
|
|
TARGETS=(
|
|
"<nodeA_ip>:root:nodeA.example.com,<cover>.nodeA.example.com,<xui>.nodeA.example.com,<panel>.nodeA.example.com"
|
|
)
|
|
SRC=/root/.acme.sh/nodeA.example.com_ecc
|
|
for entry in "${TARGETS[@]}"; do
|
|
host="${entry%%:*}"; rest="${entry#*:}"; user="${rest%%:*}"; sites="${rest#*:}"
|
|
scp -o BatchMode=yes "$SRC/fullchain.cer" "$user@$host:/tmp/.fc.pem"
|
|
scp -o BatchMode=yes "$SRC/nodeA.example.com.key" "$user@$host:/tmp/.pk.pem"
|
|
ssh "$user@$host" "IFS=,; for s in \$sites; do d=/www/server/panel/vhost/cert/\$s; mkdir -p \$d;
|
|
install -m 644 /tmp/.fc.pem \$d/fullchain.pem; install -m 600 /tmp/.pk.pem \$d/privkey.pem; done;
|
|
rm -f /tmp/.fc.pem /tmp/.pk.pem; /www/server/nginx/sbin/nginx -s reload"
|
|
done
|
|
```
|
|
|
|
## Trust + notes
|
|
|
|
- Put the signer's SSH **public** key in each target's `authorized_keys`; the signer needs write to the BT cert dirs + nginx reload only.
|
|
- To add a region to an existing wildcard, `--issue` again with the extra `-d` names (SAN change requires a re-issue, not `--renew`), then extend `TARGETS`.
|
|
- Keep the CF token on the signer only; targets never see it.
|