lib/gitlab/lets_encrypt/client.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

# frozen_string_literal: true

module Gitlab
  module LetsEncrypt
    class Client
      PRODUCTION_DIRECTORY_URL = 'https://acme-v02.api.letsencrypt.org/directory'
      STAGING_DIRECTORY_URL = 'https://acme-staging-v02.api.letsencrypt.org/directory'

      def new_order(domain_name)
        ensure_account

        acme_order = acme_client.new_order(identifiers: [domain_name])

        ::Gitlab::LetsEncrypt::Order.new(acme_order)
      end

      def load_order(url)
        ensure_account

        # rubocop: disable CodeReuse/ActiveRecord
        ::Gitlab::LetsEncrypt::Order.new(acme_client.order(url: url))
        # rubocop: enable CodeReuse/ActiveRecord
      end

      def load_challenge(url)
        ensure_account

        ::Gitlab::LetsEncrypt::Challenge.new(acme_client.challenge(url: url))
      end

      def terms_of_service_url
        acme_client.terms_of_service
      end

      def enabled?
        return false unless Feature.enabled?(:pages_auto_ssl)

        Gitlab::CurrentSettings.lets_encrypt_terms_of_service_accepted
      end

      private

      def acme_client
        @acme_client ||= ::Acme::Client.new(private_key: private_key, directory: acme_api_directory_url)
      end

      def private_key
        @private_key ||= OpenSSL::PKey.read(Gitlab::CurrentSettings.lets_encrypt_private_key || generate_private_key)
      end

      def admin_email
        Gitlab::CurrentSettings.lets_encrypt_notification_email
      end

      def contact
        "mailto:#{admin_email}"
      end

      def ensure_account
        raise 'Acme integration is disabled' unless enabled?

        @acme_account ||= acme_client.new_account(contact: contact, terms_of_service_agreed: true)
      end

      def acme_api_directory_url
        if Rails.env.production?
          PRODUCTION_DIRECTORY_URL
        else
          STAGING_DIRECTORY_URL
        end
      end

      def generate_private_key
        application_settings = Gitlab::CurrentSettings.current_application_settings
        application_settings.with_lock do
          unless application_settings.lets_encrypt_private_key
            application_settings.update(lets_encrypt_private_key: OpenSSL::PKey::RSA.new(4096).to_pem)
          end

          application_settings.lets_encrypt_private_key
        end
      end
    end
  end
end