mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
Andras Bacsai
a2cd6351b2
- Regenerate SSL Certificates now writes server.crt/server.key for every engine except MongoDB, which keeps the combined server.pem. Before, the button always wrote server.pem, so Postgres, MySQL, MariaDB, Redis, KeyDB and Dragonfly failed to start after a regenerate. - The certificate renewal job uses the same rule, so MongoDB no longer switches to server.crt/server.key on renewal and fails on restart. - Starting an SSL database writes the CA that signs its certificate to /data/coolify/ssl/coolify-ca.crt, so a stale CA file (for example one written by another server entry for the same host) no longer causes "certificate signature failure". - Saving a custom CA certificate that does not match the stored CA private key is rejected. - The CA file write commands live in SslHelper::caCertificateFileCommands(). Fixes #10388 Fixes #6771 Fixes #11926
34 lines
990 B
PHP
34 lines
990 B
PHP
<?php
|
|
|
|
namespace Database\Seeders;
|
|
|
|
use App\Helpers\SslHelper;
|
|
use App\Models\Server;
|
|
use Illuminate\Database\Seeder;
|
|
|
|
class CaSslCertSeeder extends Seeder
|
|
{
|
|
public function run()
|
|
{
|
|
Server::chunk(200, function ($servers) {
|
|
foreach ($servers as $server) {
|
|
$existingCaCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
|
|
|
|
if (! $existingCaCert) {
|
|
$caCert = SslHelper::generateSslCertificate(
|
|
commonName: 'Coolify CA Certificate',
|
|
serverId: $server->id,
|
|
isCaCertificate: true,
|
|
validityDays: 10 * 365
|
|
);
|
|
} else {
|
|
$caCert = $existingCaCert;
|
|
}
|
|
$commands = SslHelper::caCertificateFileCommands($caCert->ssl_certificate);
|
|
|
|
remote_process($commands, $server);
|
|
}
|
|
});
|
|
}
|
|
}
|