deploy-SSL-certificates-to-Tomcat-applications.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 部署SSL证书至Tomcat应用。
  en: Deploy SSL certificates to Tomcat applications.
Parameters:
  SolutionName:
    Type: String
    Default: 部署SSL证书至Tomcat应用
  CommonName:
    Type: String
    Default: http-to-https
  ZoneId:
    Type: String
    AssociationProperty: 'ALIYUN::ECS::Instance::ZoneId'
    AssociationPropertyMetadata:
      AutoSelectFirst: true
    Label:
      en: Availability Zone
      zh-cn: 可用区
  InstanceType:
    Type: String
    AssociationProperty: 'ALIYUN::ECS::Instance::InstanceType'
    AssociationPropertyMetadata:
      InstanceChargeType: PostPaid
      SystemDiskCategory: cloud_essd
      ZoneId: ${ZoneId}
    Label:
      en: Instance Type
      zh-cn: 实例规格
    Default: ecs.c6.large
  InstancePassword:
    NoEcho: true
    Type: String
    Description:
      en: >-
        Server login password, Length 8-30, must contain three(Capital letters,
        lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special
        symbol in)
      zh-cn: >-
        服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
        中的特殊符号）
    Label:
      en: Instance Password
      zh-cn: 实例密码
    ConstraintDescription:
      en: >-
        Length 8-30, must contain three(Capital letters, lowercase letters,
        numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: '长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;''<>,.?/ 中的特殊符号）'
    AssociationProperty: 'ALIYUN::ECS::Instance::Password'
    Default: null
  CertificateId:
    AssociationProperty: ALIYUN::CAS::Certificate::CertificateId
    Type: String
    Label:
      en: SSL Certificate Id
      zh-cn: SSL证书
    Description:
      en: If you select a certificate for a wildcard domain name, such as *.example.com, by default the certificate will be deployed to the domain name whose host is recorded as www:http://www.example.com. If www host records have been configured on the DNS, disable the records first. Otherwise, the resource stack fails to be created because the DNS resolution records already exist.
      zh-cn: 如果您选择通配符域名的证书，如*.example.com，默认会将证书部署到主机记录为www的域名上，即：http://www.example.com，如果您在DNS上已配置www主机记录，请您先禁用该记录，否则会由于DNS解析记录已存在导致资源栈创建失败。
Resources:
  Vpc:
    Type: 'ALIYUN::ECS::VPC'
    Properties:
      CidrBlock: 192.168.0.0/16
      VpcName:
        Fn::Sub: ${CommonName}-vpc
  VSwitch:
    Type: 'ALIYUN::ECS::VSwitch'
    Properties:
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
      ZoneId:
        Ref: ZoneId
      VSwitchName:
        Fn::Sub: ${CommonName}-vsw
  SecurityGroup:
    Type: 'ALIYUN::ECS::SecurityGroup'
    Properties:
      VpcId:
        Ref: Vpc
      SecurityGroupName:
        Fn::Sub: ${CommonName}-sg
      SecurityGroupIngress:
        - PortRange: 443/443
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - PortRange: 80/80
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
  EcsInstance:
    Type: 'ALIYUN::ECS::InstanceGroup'
    Properties:
      VpcId:
        Ref: Vpc
      ZoneId:
        Ref: ZoneId
      VSwitchId:
        Ref: VSwitch
      SecurityGroupId:
        Ref: SecurityGroup
      ImageId: aliyun_3_9_x64_20G_alibase_
      InstanceName:
        Fn::Sub: ${CommonName}-ecs
      InstanceType:
        Ref: InstanceType
      SystemDiskCategory: cloud_essd
      MaxAmount: 1
      InternetMaxBandwidthOut: 5
      Password:
        Ref: InstancePassword
  InstallTomcat:
    Type: 'ALIYUN::ECS::RunCommand'
    Properties:
      InstanceIds:
        Fn::GetAtt:
          - EcsInstance
          - InstanceIds
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub: |-
          #!/bin/bash
          
          # script exit code:
          # 0 - success
          # 1 - unsupported system
          # 2 - network not available
          # 3 - failed install Tomcat
          
          # 环境变量配置
          export PATH=/usr/local/bin:$PATH
          
          # 网络检查地址
          NETWORK_CHECk_ADDR="help-static-aliyun-doc.aliyuncs.com"
          
          function unsupported_system() {
              log_fatal 1 "Unsupported System: $1"
          }
          
          function log_info() {
              printf "%s [INFO] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
          }
          
          function log_error() {
              printf "%s [ERROR] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
          }
          
          function log_fatal() {
              printf "\n========================================================================\n"
              printf "%s [FATAL] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$2"
              printf "\n========================================================================\n"
              exit $1
          }
          
          function debug_exec(){
              local cmd="$@"
              log_info "$cmd"
              eval "$cmd"
              ret=$?
              echo ""
              log_info "$cmd, exit code: $ret"
              return $ret
          }
          
          function check_network_available() {
              log_info "ping $NETWORK_CHECk_ADDR ..."
              if ! debug_exec ping -c 4 $NETWORK_CHECk_ADDR; then
                  log_fatal 2 "Could not connect to https://$NETWORK_CHECk_ADDR"
              fi
          }
          
          function set_ros_flag() {
              log_info "set ros flag to .ros.provision"
              echo "$(date '+%Y-%m-%d %H:%M:%S') [${ALIYUN::StackId}] [${SolutionName}]" >> .ros.provision
          }
          
          log_info "System Information:"
          if ! lsb_release -a; then
              unsupported_system
          fi;
          echo ""
          
          log_info "download example"
          curl -fsSL https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/install-script/install-ssl-certificate/install-ssl-for-tomcat.sh | bash
          set_ros_flag
  DomainRecord:
    Type: 'ALIYUN::DNS::DomainRecord'
    Properties:
      Type: A
      RR:
        Fn::Select:
          - '0'
          - Fn::Split:
              - .
              - Fn::GetJsonValue:
                  - DomainName
                  - Fn::GetAtt:
                      - DomainName
                      - Outputs
      DomainName:
        Fn::Join:
          - .
          - Fn::Select:
            - '1:'
            - Fn::Split:
                - .
                - Fn::GetJsonValue:
                    - DomainName
                    - Fn::GetAtt:
                        - DomainName
                        - Outputs
      Value:
        Fn::Select:
          - 0
          - Fn::GetAtt:
              - EcsInstance
              - PublicIps
  User:
    Type: ALIYUN::RAM::User
    Properties:
      UserName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
      PolicyAttachments:
        System:
          - AliyunYundunCertReadOnlyAccess
  AccessKey:
    Type: ALIYUN::RAM::AccessKey
    Properties:
      UserName:
        Ref: User
  Service:
    Type: ALIYUN::FC::Service
    Properties:
      ServiceName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
  Function:
    Type: ALIYUN::FC::Function
    Properties:
      ServiceName:
        Fn::GetAtt:
          - Service
          - ServiceName
      FunctionName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
      Handler: index.handler
      Runtime: python3.9
      Code:
        SourceCode:
          Fn::Sub: |-
            #!/usr/bin/env python
            # coding=utf-8
            import json, time, urllib.request
            from aliyunsdkcore.client import AcsClient
            from aliyunsdkcore.request import CommonRequest
            from aliyunsdkcore.auth.credentials import AccessKeyCredential 
            def handler(event, context):
              event = json.loads(event)
              creds = context.credentials
              r_ps = event['ResourceProperties']

              credentials = AccessKeyCredential("${AccessKey.AccessKeyId}", "${AccessKey.AccessKeySecret}")
              client = AcsClient(region_id=context.region, credential=credentials)


              if event['RequestType'] != 'Delete':
                request = CommonRequest()
                request.set_accept_format('json')
                request.set_domain('cas.aliyuncs.com')
                request.set_method('POST')
                request.set_protocol_type('https') # https | http
                request.set_version('2020-04-07')
                request.set_action_name('GetUserCertificateDetail')

                request.add_query_param('CertId', "${CertificateId}")

                response = client.do_action(request)
                response = json.loads(response)

              result = {
                    'RequestId': event['RequestId'],
                    'LogicalResourceId': event['LogicalResourceId'],
                    'StackId': event['StackId'],
                    'Status': 'SUCCESS',
                    'PhysicalResourceId': 'MyCustomResourceId',
                    'Data': {}
                }
              if event['RequestType'] != 'Delete':
                  domain_name = response.get('Common')
                  if domain_name.startswith('*.') or domain_name.startswith('www.'):
                      domain_list = domain_name.split('.')
                      result['Data'] = {
                          "DomainName": 'www.' + '.'.join(domain_list[1:]),
                          "DomainPrefix": "www."
                        }
                    else:
                      result['Data'] = {
                          "DomainName": '@.' + domain_name,
                          "DomainPrefix": ""
                        }
              headers = {'Content-type': 'application/json', 'Accept': 'application/json','Date': time.strftime('%a, %d %b %Y %X GMT', time.gmtime()), 'User-Agent': 'MyCustomUserAgent'}
              req = urllib.request.Request(event['ResponseURL'], data=json.dumps(result).encode('utf-8'), headers=headers)
              urllib.request.urlopen(req)
  DomainName:
    Type: Custom::DomainName
    Properties:
      ServiceToken:
        Fn::GetAtt:
          - Function
          - ARN
      Timeout: 60
  SSLConfig:
    Type: 'ALIYUN::ECS::RunCommand'
    DependsOn: InstallTomcat
    Properties:
      InstanceIds:
        Fn::GetAtt:
          - EcsInstance
          - InstanceIds
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub:
          - |
            #!/bin/bash
            function log_info() {
                printf "%s [INFO] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
            }
            
            function log_error() {
                printf "%s [ERROR] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
            }
            
            function log_fatal() {
                printf "\n========================================================================\n"
                printf "%s [FATAL] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$2"
                printf "\n========================================================================\n"
                exit $1
            }
            
            function debug_exec(){
                local cmd="$@"
                log_info "$cmd"
                eval "$cmd"
                ret=$?
                echo ""
                log_info "$cmd, exit code: $ret"
                return $ret
            }
            
            function check_ros_flag() {
                log_info "check ros flag in .ros.provision."
                if [ ! -f .ros.provision ]; then
                    log_fatal 1 ".ros.provision file is not exist, instance not deployed Tomcat by ROS"
                else
                    name=`tail -n 1 .ros.provision | grep -oP '\[.*?\]\s*\K\[.*?\]' | tr -d '[]'`
                    if [ "$name" != "${SolutionName}" ]; then
                        log_fatal 2 "solution name $name in .ros.provision is not ${SolutionName}."
                    fi
                fi
            }
            
            cat << EOF > /root/get_user_certificate.py
            #!/usr/bin/env python
            #coding=utf-8
            
            import os
            import json
            from aliyunsdkcore.client import AcsClient
            from aliyunsdkcore.request import CommonRequest
            from aliyunsdkcore.auth.credentials import AccessKeyCredential
            from aliyunsdkcore.auth.credentials import StsTokenCredential
            
            credentials = AccessKeyCredential("${AccessKey.AccessKeyId}", "${AccessKey.AccessKeySecret}")
            
            client = AcsClient(region_id='${ALIYUN::Region}', credential=credentials)
            
            request = CommonRequest()
            request.set_accept_format('json')
            request.set_domain('cas.aliyuncs.com')
            request.set_method('POST')
            request.set_protocol_type('https') # https | http
            request.set_version('2020-04-07')
            request.set_action_name('GetUserCertificateDetail')
            
            request.add_query_param('CertId', ${CertificateId})
            
            response = client.do_action(request)
            response = json.loads(response)
            cert = response.get('Cert')
            if cert:
              with open('/root/key/public_key.pem', 'w') as f:
                f.write(cert)
            key = response.get('Key')
            if key:
              with open('/root/key/private_key.key', 'w') as f:
                f.write(key)
            EOF
            
            cat << EOF > /root/modify_server_xml.py
            #!/usr/bin/env python
            #coding=utf-8
            import xml.etree.ElementTree as ET
            import sys
            import argparse
            parser = argparse.ArgumentParser(description='Modify server.xml to add a new SSL Connector.')
            parser.add_argument('server_xml_path', help='Path to the server.xml file')
            parser.add_argument('pfx_file_path', help='Path to the PFX file')
            parser.add_argument('pfx_password', help='Password for the PFX file')
        
            args = parser.parse_args()
            tree = ET.parse(args.server_xml_path)
            root = tree.getroot()
            
            new_connector = ET.Element('Connector')
            new_connector.set('port', '443')
            new_connector.set('protocol', 'org.apache.coyote.http11.Http11NioProtocol')
            new_connector.set('maxThreads', '150')
            new_connector.set('SSLEnabled', 'true')
            new_connector.set('maxParameterCount', '1000')
            
            ssl_host_config = ET.SubElement(new_connector, 'SSLHostConfig')
            
            certificate = ET.SubElement(ssl_host_config, 'Certificate')
            certificate.set('certificateKeystoreFile', args.pfx_file_path)
            certificate.set('certificateKeystorePassword', args.pfx_password)
            certificate.set('type', 'RSA')
            
            service = root.find('.//Service')
            if service is not None:
                service.append(new_connector)
            
            tree.write(args.server_xml_path, encoding='utf-8', xml_declaration=True)
            EOF
            
            function download_and_check_cert_file() {
                log_info "down load and check zip file."
                sudo yum update -y
                sudo yum install -y python3 python3-pip
                sudo pip3 install aliyun-python-sdk-core
                mkdir -p /root/key/ && cd /root/key/
                python3 /root/get_user_certificate.py
            
                
                domain_name=$(echo "${DomainName}" | sed 's/^@\.//')
                openssl pkcs12 -export -out "$domain_name.pfx" -inkey private_key.key -in public_key.pem -passout pass:$PfxPassword
                
                PFX_FILE=`ls *.pfx`
            
                if [ -z "$PFX_FILE" ]; then
                    log_fatal 5 "there are no files ending in .pem." 
                fi  
            }
            
            check_ros_flag
            
            domain_name=$(echo "${DomainName}" | sed 's/^@\.//')
            PfxPassword="PfxPassword"
            PfxFilePath="/root/key/$domain_name.pfx"
            download_and_check_cert_file
            
            python3 /root/modify_server_xml.py  $HOME/apache-tomcat-9.0.98/conf/server.xml $PfxFilePath $PfxPassword
                        
            nohup $HOME/apache-tomcat-9.0.98/bin/catalina.sh run > $HOME/app.log 2>&1 &
            
            sleep 10
            cd $HOME
            APP_FILE=`ls *.log`
            if [ -z "$APP_FILE" ]; then
                log_fatal 5 "there are no files ending in .log ." 
            fi
            
            if grep -q 'org\.apache\.catalina\.startup\.Catalina\.start Server startup in \[[0-9]*\] milliseconds' "$APP_FILE"; then
                log_info "deploy SSL certificates to Tomcat applications success."
                exit 0
            else
                log_fatal 5 "deploy SSL certificates to Tomcat applications failed."
                exit 1
            fi
          - DomainName:
              Fn::GetJsonValue:
                - DomainName
                - Fn::GetAtt:
                    - DomainName
                    - Outputs
Outputs:
  WebDomainForHttps:
    Description:
      zh-cn: 安全的 Web 访问地址。
      en: Secure web access address.
    Value:
      Fn::Sub:
        - 'https://${DomainPrefix}${DomainName}/test-tomcat/index.html'
        - DomainName:
            Fn::Join:
              - .
              - Fn::Select:
                  - '1:'
                  - Fn::Split:
                      - .
                      - Fn::GetJsonValue:
                          - DomainName
                          - Fn::GetAtt:
                              - DomainName
                              - Outputs
          DomainPrefix:
            Fn::GetJsonValue:
              - DomainPrefix
              - Fn::GetAtt:
                  - DomainName
                  - Outputs

  EcsLoginAddress:
    Description:
      zh-cn: ECS登录地址。
      en: Ecs login address.
    Value:
      'Fn::Sub':
        - >-
          https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=${Region}&instanceId=${InstanceId}
        - InstanceId:
            'Fn::Select':
              - 0
              - 'Fn::GetAtt':
                  - EcsInstance
                  - InstanceIds
          Region:
            Ref: 'ALIYUN::Region'
Metadata:
  'ALIYUN::ROS::Interface':
    ParameterGroups:
      - Parameters:
          - ZoneId
          - InstanceType
          - InstancePassword
          - CertificateId
    TemplateTags:
      - acs:technical-solution:internet-application-development:部署SSL证书至Tomcat应用-tech_solu_208
    Hidden:
      - CommonName
      - SolutionName