SyncSystemSSL reconciles the panel certificate on disk with the WebsiteSSL row referenced by the SSLID setting. When they differ (typically because a previous renewal's reloadSystemSSL was skipped by a transient nginx reload failure or because the panel was restarted between the DB save and the file
()
| 338 | // store. Safe to call on every renewal cron tick: it is a no-op when SSL is |
| 339 | // not enabled, when SSLID does not resolve, or when the cert already matches. |
| 340 | func SyncSystemSSL() { |
| 341 | if !global.IsMaster { |
| 342 | return |
| 343 | } |
| 344 | systemSSLEnable, sslID := GetSystemSSL() |
| 345 | if !systemSSLEnable { |
| 346 | return |
| 347 | } |
| 348 | websiteSSL, err := websiteSSLRepo.GetFirst(repo.WithByID(sslID)) |
| 349 | if err != nil { |
| 350 | return |
| 351 | } |
| 352 | if strings.TrimSpace(websiteSSL.Pem) == "" || strings.TrimSpace(websiteSSL.PrivateKey) == "" { |
| 353 | return |
| 354 | } |
| 355 | certPath := path.Join(global.Dir.DataDir, "secret/server.crt") |
| 356 | keyPath := path.Join(global.Dir.DataDir, "secret/server.key") |
| 357 | diskCert, _ := os.ReadFile(certPath) |
| 358 | diskKey, _ := os.ReadFile(keyPath) |
| 359 | if strings.TrimSpace(string(diskCert)) == strings.TrimSpace(websiteSSL.Pem) && |
| 360 | strings.TrimSpace(string(diskKey)) == strings.TrimSpace(websiteSSL.PrivateKey) { |
| 361 | return |
| 362 | } |
| 363 | global.LOG.Infof("panel SSL on disk diverged from DB (SSLID=%d, domain=%s), syncing", websiteSSL.ID, websiteSSL.PrimaryDomain) |
| 364 | fileOp := files.NewFileOp() |
| 365 | if err := fileOp.WriteFile(certPath, strings.NewReader(websiteSSL.Pem), 0600); err != nil { |
| 366 | global.LOG.Errorf("sync panel SSL: write cert failed: %s", err.Error()) |
| 367 | return |
| 368 | } |
| 369 | if err := fileOp.WriteFile(keyPath, strings.NewReader(websiteSSL.PrivateKey), 0600); err != nil { |
| 370 | global.LOG.Errorf("sync panel SSL: write key failed: %s", err.Error()) |
| 371 | return |
| 372 | } |
| 373 | if err := req_helper.PostLocalCore("/core/settings/ssl/reload"); err != nil { |
| 374 | global.LOG.Errorf("sync panel SSL: notify core failed: %s", err.Error()) |
| 375 | return |
| 376 | } |
| 377 | global.LOG.Info("panel SSL synced from DB to disk") |
| 378 | } |
| 379 | |
| 380 | func (w WebsiteSSLService) ObtainSSL(apply request.WebsiteSSLApply) error { |
| 381 | return w.obtainSSL(apply.ID, false) |
nothing calls this directly
no test coverage detected