frontends: restore standalone standby certificates

Amp-Thread-ID: https://ampcode.com/threads/T-019fc408-6e41-73fe-826d-d47b0408981b
Co-authored-by: Amp <amp@ampcode.com>

3 files changed, 16 insertions, 30 deletions

diff --git a/frontends/Rexfile b/frontends/Rexfile
index 3dd3c43..21c2f58 100644
--- a/frontends/Rexfile
+++ b/frontends/Rexfile
@@ -296,21 +296,13 @@ task 'acme',
   group => 'frontends',
   sub {
     file '/etc/acme-client.conf',
-      content => template(
-        './etc/acme-client.conf.tpl',
-        acme_hosts => \@acme_hosts,
-        f3s_hosts  => \@f3s_hosts
-      ),
+      content => template( './etc/acme-client.conf.tpl', acme_hosts => \@acme_hosts ),
       owner   => 'root',
       group   => 'wheel',
       mode    => '644';
 
     file '/usr/local/bin/acme.sh',
-      content => template(
-        './scripts/acme.sh.tpl',
-        acme_hosts => \@acme_hosts,
-        f3s_hosts  => \@f3s_hosts
-      ),
+      content => template( './scripts/acme.sh.tpl', acme_hosts => \@acme_hosts ),
       owner   => 'root',
       group   => 'wheel',
       mode    => '744';
diff --git a/frontends/etc/acme-client.conf.tpl b/frontends/etc/acme-client.conf.tpl
index 727e7fe..144f800 100644
--- a/frontends/etc/acme-client.conf.tpl
+++ b/frontends/etc/acme-client.conf.tpl
@@ -28,13 +28,9 @@ authority buypass-test {
      # Skip ipv4/ipv6 subdomains - they're included as SANs in parent cert
      next if $host =~ /^(ipv4|ipv6)\./;
 -%>
-<%   # Public DNS publishes www for every service. f3s hosts use the primary
-     # certificate for standby too (unlike other hosts, they do not get a
-     # separate standby certificate/keypair).
+<%   # Public DNS publishes www for every service. Standby names resolve to
+     # the other frontend, so they need their own certificate/keypair.
      my @alt_names = ("www.$host");
-     if (grep { $_ eq $host } @$f3s_hosts) {
-         push @alt_names, "standby.$host";
-     }
      for my $sub_host (@$acme_hosts) {
          if ($sub_host =~ /^(ipv4|ipv6)\.\Q$host\E$/) {
              push @alt_names, $sub_host;
@@ -48,14 +44,12 @@ domain <%= $host %> {
 	domain full chain certificate "/etc/ssl/<%= $host %>.fullchain.pem"
 	sign with letsencrypt
 }
-<% unless (grep { $_ eq $host } @$f3s_hosts) { -%>
 domain standby.<%= $host %> {
 	domain key "/etc/ssl/private/standby.<%= $host %>.key"
 	domain full chain certificate "/etc/ssl/standby.<%= $host %>.fullchain.pem"
 	sign with letsencrypt
 }
 <% } -%>
-<% } -%>
 
 # Current server's FQDN (blowfish.buetow.org or fishfinger.buetow.org)
 # Each server only has its own cert, no www/standby variants for server hostnames
diff --git a/frontends/scripts/acme.sh.tpl b/frontends/scripts/acme.sh.tpl
index dd613fc..c7b4d9e 100644
--- a/frontends/scripts/acme.sh.tpl
+++ b/frontends/scripts/acme.sh.tpl
@@ -16,13 +16,17 @@ ensure_placeholder_cert () {
     fi
 }
 
-alias_cert () {
-    source=$1
-    alias=$2
+prepare_standby_cert () {
+    host=$1
 
-    ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.crt"
-    ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.fullchain.pem"
-    ln -sf "/etc/ssl/private/$source.key" "/etc/ssl/private/$alias.key"
+    # Migrate aliases created by the short-lived shared-SAN configuration.
+    # acme-client must never write a standalone certificate through a symlink
+    # to the primary keypair.
+    if [ -L "/etc/ssl/$host.fullchain.pem" ] \
+        || [ -L "/etc/ssl/private/$host.key" ]; then
+        rm -f "/etc/ssl/$host.crt" "/etc/ssl/$host.fullchain.pem" \
+            "/etc/ssl/private/$host.key"
+    fi
 }
 
 handle_cert () {
@@ -57,13 +61,9 @@ handle_cert <%= $host %>
 if [ $? -eq 0 ]; then
     has_update=yes
 fi
-<% if (grep { $_ eq $host } @$f3s_hosts) { -%>
-# f3s standby names are SANs on the primary certificate. relayd selects a
-# keypair by SNI name, so provide filename aliases for that shared certificate.
-alias_cert <%= $host %> standby.<%= $host %>
-<% } -%>
 <% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org'
-           or grep { $_ eq $host } @$f3s_hosts) { -%>
+           or $host =~ /^(ipv4|ipv6)\./) { -%>
+prepare_standby_cert standby.<%= $host %>
 handle_cert standby.<%= $host %>
 if [ $? -eq 0 ]; then
     has_update=yes