deploy-SSL-certificates-to-SpringBoot-applications.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 部署SSL证书至Spring Boot应用。
  en: Deploy SSL certificates to Spring Boot applications.
Parameters:
  SolutionName:
    Type: String
    Default: 部署SSL证书至SpringBoot应用
  CommonName:
    Type: String
    Default: http-to-https
  ZoneId:
    Type: String
    AssociationProperty: 'ALIYUN::ECS::Instance::ZoneId'
    AssociationPropertyMetadata:
      AutoSelectFirst: true
    Label:
      en: Availability Zone
      zh-cn: 可用区
  InstanceType:
    Type: String
    AssociationProperty: 'ALIYUN::ECS::Instance::InstanceType'
    AssociationPropertyMetadata:
      InstanceChargeType: PostPaid
      SystemDiskCategory: cloud_essd
      ZoneId: ${ZoneId}
    Label:
      en: Instance Type
      zh-cn: 实例规格
    Default: ecs.c6.large
  InstancePassword:
    NoEcho: true
    Type: String
    Description:
      en: >-
        Server login password, Length 8-30, must contain three(Capital letters,
        lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special
        symbol in)
      zh-cn: >-
        服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
        中的特殊符号）
    Label:
      en: Instance Password
      zh-cn: 实例密码
    ConstraintDescription:
      en: >-
        Length 8-30, must contain three(Capital letters, lowercase letters,
        numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: '长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;''<>,.?/ 中的特殊符号）'
    AssociationProperty: 'ALIYUN::ECS::Instance::Password'
    Default: null
  CertificateId:
    AssociationProperty: ALIYUN::CAS::Certificate::CertificateId
    Type: String
    Label:
      en: SSL Certificate Id
      zh-cn: SSL证书
    Description:
      en: If you select a certificate for a wildcard domain name, such as *.example.com, by default the certificate will be deployed to the domain name whose host is recorded as www:http://www.example.com. If www host records have been configured on the DNS, disable the records first. Otherwise, the resource stack fails to be created because the DNS resolution records already exist.
      zh-cn: 如果您选择通配符域名的证书，如*.example.com，默认会将证书部署到主机记录为www的域名上，即：http://www.example.com，如果您在DNS上已配置www主机记录，请您先禁用该记录，否则会由于DNS解析记录已存在导致资源栈创建失败。
Resources:
  Vpc:
    Type: 'ALIYUN::ECS::VPC'
    Properties:
      CidrBlock: 192.168.0.0/16
      VpcName:
        Fn::Sub: ${CommonName}-vpc
  VSwitch:
    Type: 'ALIYUN::ECS::VSwitch'
    Properties:
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
      ZoneId:
        Ref: ZoneId
      VSwitchName:
        Fn::Sub: ${CommonName}-vsw
  SecurityGroup:
    Type: 'ALIYUN::ECS::SecurityGroup'
    Properties:
      VpcId:
        Ref: Vpc
      SecurityGroupName:
        Fn::Sub: ${CommonName}-sg
      SecurityGroupIngress:
        - PortRange: 443/443
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - PortRange: 80/80
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
  EcsInstance:
    Type: 'ALIYUN::ECS::InstanceGroup'
    Properties:
      VpcId:
        Ref: Vpc
      ZoneId:
        Ref: ZoneId
      VSwitchId:
        Ref: VSwitch
      SecurityGroupId:
        Ref: SecurityGroup
      ImageId: aliyun_3_9_x64_20G_alibase_
      InstanceName:
        Fn::Sub: ${CommonName}-ecs
      InstanceType:
        Ref: InstanceType
      SystemDiskCategory: cloud_essd
      MaxAmount: 1
      InternetMaxBandwidthOut: 5
      Password:
        Ref: InstancePassword
  DomainRecord:
    Type: 'ALIYUN::DNS::DomainRecord'
    Properties:
      Type: A
      RR:
        Fn::Select:
          - '0'
          - Fn::Split:
              - .
              - Fn::GetJsonValue:
                  - DomainName
                  - Fn::GetAtt:
                      - DomainName
                      - Outputs
      DomainName:
        Fn::Join:
          - .
          - Fn::Select:
            - '1:'
            - Fn::Split:
                - .
                - Fn::GetJsonValue:
                    - DomainName
                    - Fn::GetAtt:
                        - DomainName
                        - Outputs
      Value:
        Fn::Select:
          - 0
          - Fn::GetAtt:
              - EcsInstance
              - PublicIps
  User:
    Type: ALIYUN::RAM::User
    Properties:
      UserName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
      PolicyAttachments:
        System:
          - AliyunYundunCertReadOnlyAccess
  AccessKey:
    Type: ALIYUN::RAM::AccessKey
    Properties:
      UserName:
        Ref: User
  Service:
    Type: ALIYUN::FC::Service
    Properties:
      ServiceName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
  Function:
    Type: ALIYUN::FC::Function
    Properties:
      ServiceName:
        Fn::GetAtt:
          - Service
          - ServiceName
      FunctionName:
        Fn::Sub: create_by_document-${ALIYUN::StackId}
      Handler: index.handler
      Runtime: python3.9
      Code:
        SourceCode:
          Fn::Sub: |-
            #!/usr/bin/env python
            # coding=utf-8
            import json, time, urllib.request
            from aliyunsdkcore.client import AcsClient
            from aliyunsdkcore.request import CommonRequest
            from aliyunsdkcore.auth.credentials import AccessKeyCredential 
            def handler(event, context):
              event = json.loads(event)
              creds = context.credentials
              r_ps = event['ResourceProperties']

              credentials = AccessKeyCredential("${AccessKey.AccessKeyId}", "${AccessKey.AccessKeySecret}")
              client = AcsClient(region_id=context.region, credential=credentials)


              if event['RequestType'] != 'Delete':
                request = CommonRequest()
                request.set_accept_format('json')
                request.set_domain('cas.aliyuncs.com')
                request.set_method('POST')
                request.set_protocol_type('https') # https | http
                request.set_version('2020-04-07')
                request.set_action_name('GetUserCertificateDetail')

                request.add_query_param('CertId', "${CertificateId}")

                response = client.do_action(request)
                response = json.loads(response)

              result = {
                    'RequestId': event['RequestId'],
                    'LogicalResourceId': event['LogicalResourceId'],
                    'StackId': event['StackId'],
                    'Status': 'SUCCESS',
                    'PhysicalResourceId': 'MyCustomResourceId',
                    'Data': {}
                }
              if event['RequestType'] != 'Delete':
                  domain_name = response.get('Common')
                  if domain_name:
                    if domain_name.startswith('*.') or domain_name.startswith('www.'):
                      domain_list = domain_name.split('.')
                      result['Data'] = {
                          "DomainName": 'www.' + '.'.join(domain_list[1:]),
                          "DomainPrefix": "www."
                        }
                    else:
                      result['Data'] = {
                          "DomainName": '@.' + domain_name,
                          "DomainPrefix": ""
                        }
              headers = {'Content-type': 'application/json', 'Accept': 'application/json','Date': time.strftime('%a, %d %b %Y %X GMT', time.gmtime()), 'User-Agent': 'MyCustomUserAgent'}
              req = urllib.request.Request(event['ResponseURL'], data=json.dumps(result).encode('utf-8'), headers=headers)
              urllib.request.urlopen(req)
  DomainName:
    Type: Custom::DomainName
    Properties:
      ServiceToken:
        Fn::GetAtt:
          - Function
          - ARN
      Timeout: 60
  SSLConfig:
    Type: 'ALIYUN::ECS::RunCommand'
    Properties:
      InstanceIds:
        Fn::GetAtt:
          - EcsInstance
          - InstanceIds
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub:
          - |
            #!/bin/bash
            
            # 环境变量配置
            export PATH=/usr/local/bin:$PATH
            
            function log_info() {
                printf "%s [INFO] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
            }
            
            function log_error() {
                printf "%s [ERROR] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1"
            }
            
            function log_fatal() {
                printf "\n========================================================================\n"
                printf "%s [FATAL] %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$2"
                printf "\n========================================================================\n"
                exit $1
            }
            
            function set_ros_flag() {
              log_info "set ros flag to .ros.provision"
              echo "$(date '+%Y-%m-%d %H:%M:%S') [${ALIYUN::StackId}] [${SolutionName}]" >> .ros.provision
            }
            
            cat << EOF > /root/get_user_certificate.py
            #!/usr/bin/env python
            #coding=utf-8
            
            import os
            import json
            from aliyunsdkcore.client import AcsClient
            from aliyunsdkcore.request import CommonRequest
            from aliyunsdkcore.auth.credentials import AccessKeyCredential
            from aliyunsdkcore.auth.credentials import StsTokenCredential
            
            credentials = AccessKeyCredential("${AccessKey.AccessKeyId}", "${AccessKey.AccessKeySecret}")
            
            client = AcsClient(region_id='${ALIYUN::Region}', credential=credentials)
            
            request = CommonRequest()
            request.set_accept_format('json')
            request.set_domain('cas.aliyuncs.com')
            request.set_method('POST')
            request.set_protocol_type('https') # https | http
            request.set_version('2020-04-07')
            request.set_action_name('GetUserCertificateDetail')
            
            request.add_query_param('CertId', ${CertificateId})
            
            response = client.do_action(request)
            response = json.loads(response)
            cert = response.get('Cert')
            if cert:
              with open('/root/key/public_key.pem', 'w') as f:
                f.write(cert)
            key = response.get('Key')
            if key:
              with open('/root/key/private_key.key', 'w') as f:
                f.write(key)
            EOF
            
            function download_and_check_cert_file() {
                log_info "down load and check zip file."
                sudo yum update -y
                sudo yum install -y java-21-alibaba-dragonwell-devel
                sudo yum install -y python3 python3-pip
                sudo pip3 install aliyun-python-sdk-core
                mkdir -p /root/key/ && cd /root/key/   
                python3 /root/get_user_certificate.py
                
                domain_name=$(echo "${DomainName}" | sed 's/^@\.//')
                openssl pkcs12 -export -out "$domain_name.pfx" -inkey private_key.key -in public_key.pem -passout pass:$Password
                keytool -importkeystore -srckeystore $domain_name.pfx -srcstoretype PKCS12 -destkeystore $domain_name.jks -deststoretype JKS -deststorepass $Password -srcstorepass $Password
                JKS_FILE=`ls *.jks`
            
                if [ -z "$JKS_FILE" ]; then
                    log_fatal 5 "there are no files ending in .jks." 
                fi  
            }
            set_ros_flag
            
            domain_name=$(echo "${DomainName}" | sed 's/^@\.//')
            Password="JksPassword"
            JksFilePath="/root/key/$domain_name.jks"
            download_and_check_cert_file
            
            cat << EOF >> ~/.bash_profile
            export SPRING_SERVER_SSL_KEY_STORE_PASSWORD=$Password
            export SPRING_SERVER_SSL_KEY_STORE=$JksFilePath
            EOF
            
            source ~/.bash_profile
            
            curl -fsSL https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/install-script/install-ssl-certificate/install-ssl-for-springboot.sh | bash

          - DomainName:
              Fn::GetJsonValue:
                - DomainName
                - Fn::GetAtt:
                    - DomainName
                    - Outputs
Outputs:
  WebDomainForHttps:
    Description:
      zh-cn: 安全的 Web 访问地址。
      en: Secure web access address.
    Value:
      Fn::Sub:
        - 'https://${DomainPrefix}${DomainName}'
        - DomainName:
            Fn::Join:
              - .
              - Fn::Select:
                  - '1:'
                  - Fn::Split:
                      - .
                      - Fn::GetJsonValue:
                          - DomainName
                          - Fn::GetAtt:
                              - DomainName
                              - Outputs
          DomainPrefix:
            Fn::GetJsonValue:
              - DomainPrefix
              - Fn::GetAtt:
                  - DomainName
                  - Outputs

  EcsLoginAddress:
    Description:
      zh-cn: ECS登录地址。
      en: Ecs login address.
    Value:
      'Fn::Sub':
        - >-
          https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=${Region}&instanceId=${InstanceId}
        - InstanceId:
            'Fn::Select':
              - 0
              - 'Fn::GetAtt':
                  - EcsInstance
                  - InstanceIds
          Region:
            Ref: 'ALIYUN::Region'
Metadata:
  'ALIYUN::ROS::Interface':
    ParameterGroups:
      - Parameters:
          - ZoneId
          - InstanceType
          - InstancePassword
          - CertificateId
    TemplateTags:
      - acs:technical-solution:internet-application-development:部署SSL证书至SpringBoot应用-tech_solu_207
    Hidden:
      - CommonName
      - SolutionName