120 lines
4.0 KiB
Python
120 lines
4.0 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""
|
|
在远程服务器 159.75.81.121 上为 risk.aiformat.cn 自动化配置 SSL / HTTPS
|
|
"""
|
|
import paramiko
|
|
import time
|
|
|
|
SERVER_IP = "159.75.81.121"
|
|
SSH_PORT = 22
|
|
SSH_USER = "root"
|
|
SSH_PASS = "sp-cc123"
|
|
DOMAIN = "risk.aiformat.cn"
|
|
|
|
def run_remote_cmd(ssh, cmd):
|
|
print(f"\n🚀 [远程命令] {cmd}")
|
|
stdin, stdout, stderr = ssh.exec_command(cmd)
|
|
out = stdout.read().decode('utf-8', errors='ignore')
|
|
err = stderr.read().decode('utf-8', errors='ignore')
|
|
if out:
|
|
print(f"[STDOUT]\n{out.strip()}")
|
|
if err:
|
|
print(f"[STDERR]\n{err.strip()}")
|
|
return out, err
|
|
|
|
def setup_https():
|
|
print(f"🔌 正在连接服务器 {SERVER_IP}...")
|
|
ssh = paramiko.SSHClient()
|
|
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
try:
|
|
ssh.connect(SERVER_IP, port=SSH_PORT, username=SSH_USER, password=SSH_PASS, timeout=15)
|
|
print("✅ SSH 连接成功！")
|
|
except Exception as e:
|
|
print(f"❌ SSH 连接失败: {e}")
|
|
return
|
|
|
|
# 1. 安装 certbot 与 python3-certbot-nginx
|
|
install_certbot_cmd = """
|
|
if command -v apt-get &> /dev/null; then
|
|
apt-get update -y && apt-get install -y certbot python3-certbot-nginx
|
|
elif command -v yum &> /dev/null; then
|
|
yum install -y certbot python3-certbot-nginx
|
|
fi
|
|
"""
|
|
run_remote_cmd(ssh, install_certbot_cmd)
|
|
|
|
# 2. 尝试使用 Certbot 自动申请 Let's Encrypt 证书并配置 Nginx
|
|
certbot_cmd = f"certbot --nginx -d {DOMAIN} --non-interactive --agree-tos -m admin@aiformat.cn --redirect"
|
|
out, err = run_remote_cmd(ssh, certbot_cmd)
|
|
|
|
# 检查签发是否成功
|
|
if "Congratulations" in out or "Successfully received certificate" in out or "Certificate" in out:
|
|
print("🎉 Let's Encrypt SSL 证书签发并自动配置成功！")
|
|
else:
|
|
print("⚠️ Certbot 签发 Let's Encrypt 证书受阻，正在创建自签名 SSL 证书作为安全保障方案...")
|
|
|
|
# 创建自签名证书放置在 /etc/ssl/risk.aiformat.cn/
|
|
create_self_signed = f"""
|
|
mkdir -p /etc/ssl/{DOMAIN}
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
|
-keyout /etc/ssl/{DOMAIN}/server.key \
|
|
-out /etc/ssl/{DOMAIN}/server.crt \
|
|
-subj "/C=CN/ST=Fujian/L=Xiamen/O=RiskSystem/CN={DOMAIN}"
|
|
"""
|
|
run_remote_cmd(ssh, create_self_signed)
|
|
|
|
# 写入兼容 SSL 的 Nginx 配置
|
|
nginx_ssl_conf = f"""server {{
|
|
listen 80;
|
|
server_name {DOMAIN};
|
|
return 301 https://$host$request_uri;
|
|
}}
|
|
|
|
server {{
|
|
listen 443 ssl http2;
|
|
server_name {DOMAIN};
|
|
|
|
ssl_certificate /etc/ssl/{DOMAIN}/server.crt;
|
|
ssl_certificate_key /etc/ssl/{DOMAIN}/server.key;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
|
location / {{
|
|
proxy_pass http://127.0.0.1:8501;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 86400;
|
|
}}
|
|
|
|
location /_stcore/stream {{
|
|
proxy_pass http://127.0.0.1:8501/_stcore/stream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
}}
|
|
}}
|
|
"""
|
|
create_nginx_cmd = f"cat << 'EOF' > /etc/nginx/conf.d/risk.aiformat.cn.conf\n{nginx_ssl_conf}\nEOF"
|
|
run_remote_cmd(ssh, create_nginx_cmd)
|
|
|
|
# 3. 检查 Nginx 语法并重载
|
|
run_remote_cmd(ssh, "nginx -t && systemctl reload nginx")
|
|
time.sleep(2)
|
|
|
|
# 4. 验证 HTTPS 连通性
|
|
run_remote_cmd(ssh, f"curl -k -I https://127.0.0.1/ -H 'Host: {DOMAIN}'")
|
|
|
|
ssh.close()
|
|
print("\n✅ HTTPS 配置流程完成！")
|
|
print(f"🔒 安全访问链接: https://{DOMAIN}")
|
|
|
|
if __name__ == "__main__":
|
|
setup_https()
|