From 0003443c776db6d7daf390bcfc91e06626eb648d Mon Sep 17 00:00:00 2001 From: Hemachandar Date: Wed, 4 Feb 2026 19:23:27 +0530 Subject: [PATCH 1/3] Create rule in SSL task --- src/Appwrite/Platform/Tasks/SSL.php | 88 +++++++++++++++++++++++++---- 1 file changed, 78 insertions(+), 10 deletions(-) diff --git a/src/Appwrite/Platform/Tasks/SSL.php b/src/Appwrite/Platform/Tasks/SSL.php index 651cb4de11..9ba8d65dd9 100644 --- a/src/Appwrite/Platform/Tasks/SSL.php +++ b/src/Appwrite/Platform/Tasks/SSL.php @@ -4,7 +4,12 @@ namespace Appwrite\Platform\Tasks; use Appwrite\Event\Certificate; use Utopia\CLI\Console; +use Utopia\Database\Database; use Utopia\Database\Document; +use Utopia\Database\Helpers\ID; +use Utopia\Database\Query; +use Utopia\Database\Validator\Authorization; +use Utopia\Domains\Domain; use Utopia\Platform\Action; use Utopia\System\System; use Utopia\Validator\Boolean; @@ -22,22 +27,85 @@ class SSL extends Action $this ->desc('Validate server certificates') ->param('domain', System::getEnv('_APP_DOMAIN', ''), new Hostname(), 'Domain to generate certificate for. If empty, main domain will be used.', true) - ->param('skip-check', true, new Boolean(true), 'If DNS and renew check should be skipped. Defaults to true, and when true, all jobs will result in certificate generation attempt.', true) + ->param('skip-check', 'true', new Boolean(true), 'If DNS and renew check should be skipped. Defaults to true, and when true, all jobs will result in certificate generation attempt.', true) + ->inject('console') + ->inject('dbForPlatform') ->inject('queueForCertificates') + ->inject('authorization') ->callback($this->action(...)); } - public function action(string $domain, bool|string $skipCheck, Certificate $queueForCertificates): void + public function action(string $domain, bool|string $skipCheck, Document $console, Database $dbForPlatform, Certificate $queueForCertificates, Authorization $authorization): void { - $skipCheck = \strval($skipCheck) === 'true'; + $domain = new Domain(!empty($domain) ? $domain : ''); + if (!$domain->isKnown() || $domain->isTest()) { + Console::error('Domain is not known or is a test domain: ' . $domain->get()); + return; + } - Console::success('Scheduling a job to issue a TLS certificate for domain: ' . $domain); + $authorization->skip(function () use ($skipCheck, $console, $dbForPlatform, $domain, $queueForCertificates) { + $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5'; + $skipCheck = \strval($skipCheck) === 'true'; - $queueForCertificates - ->setDomain(new Document([ - 'domain' => $domain - ])) - ->setSkipRenewCheck($skipCheck) - ->trigger(); + $rule = $isMd5 + ? $dbForPlatform->getDocument('rules', md5($domain->get())) + : $dbForPlatform->findOne('rules', [ + Query::equal('domain', [$domain->get()]), + ]); + + if (!$rule->isEmpty()) { + Console::warning('Rule ' . $rule->getId() . ' already exists for domain: ' . $domain->get()); + return; + } + + $owner = ''; + + // Mark owner as Appwrite if its appwrite-owned domain + $appwriteDomains = []; + $appwriteDomainEnvs = [ + System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', ''), + System::getEnv('_APP_DOMAIN_FUNCTIONS', ''), + System::getEnv('_APP_DOMAIN_SITES', ''), + ]; + foreach ($appwriteDomainEnvs as $appwriteDomainEnv) { + foreach (\explode(',', $appwriteDomainEnv) as $appwriteDomain) { + if (empty($appwriteDomain)) { + continue; + } + $appwriteDomains[] = $appwriteDomain; + } + } + + foreach ($appwriteDomains as $appwriteDomain) { + if (\str_ends_with($domain->get(), $appwriteDomain)) { + $owner = 'Appwrite'; + break; + } + } + + $ruleId = $isMd5 ? md5($domain->get()) : ID::unique(); + $rule = $dbForPlatform->createDocument('rules', new Document([ + '$id' => $ruleId, + 'domain' => $domain->get(), + 'type' => 'api', + 'status' => RULE_STATUS_CERTIFICATE_GENERATING, + 'projectId' => $console->getId(), + 'projectInternalId' => $console->getSequence(), + 'search' => implode(' ', [$ruleId, $domain->get()]), + 'owner' => $owner, + 'region' => $console->getAttribute('region') + ])); + + Console::success('Rule ' . $rule->getId() . ' created for domain: ' . $domain->get()); + + $queueForCertificates + ->setDomain(new Document([ + 'domain' => $domain->get() + ])) + ->setSkipRenewCheck($skipCheck) + ->trigger(); + + Console::success('Scheduled a job to issue a TLS certificate for domain: ' . $domain->get()); + }); } } From a30f12cd66b42525339329361f637c2f498f7ed7 Mon Sep 17 00:00:00 2001 From: Hemachandar Date: Wed, 4 Feb 2026 19:31:00 +0530 Subject: [PATCH 2/3] tiny --- src/Appwrite/Platform/Tasks/SSL.php | 106 +++++++++++++--------------- 1 file changed, 51 insertions(+), 55 deletions(-) diff --git a/src/Appwrite/Platform/Tasks/SSL.php b/src/Appwrite/Platform/Tasks/SSL.php index 9ba8d65dd9..514e2b670a 100644 --- a/src/Appwrite/Platform/Tasks/SSL.php +++ b/src/Appwrite/Platform/Tasks/SSL.php @@ -8,7 +8,6 @@ use Utopia\Database\Database; use Utopia\Database\Document; use Utopia\Database\Helpers\ID; use Utopia\Database\Query; -use Utopia\Database\Validator\Authorization; use Utopia\Domains\Domain; use Utopia\Platform\Action; use Utopia\System\System; @@ -31,11 +30,10 @@ class SSL extends Action ->inject('console') ->inject('dbForPlatform') ->inject('queueForCertificates') - ->inject('authorization') ->callback($this->action(...)); } - public function action(string $domain, bool|string $skipCheck, Document $console, Database $dbForPlatform, Certificate $queueForCertificates, Authorization $authorization): void + public function action(string $domain, bool|string $skipCheck, Document $console, Database $dbForPlatform, Certificate $queueForCertificates): void { $domain = new Domain(!empty($domain) ? $domain : ''); if (!$domain->isKnown() || $domain->isTest()) { @@ -43,69 +41,67 @@ class SSL extends Action return; } - $authorization->skip(function () use ($skipCheck, $console, $dbForPlatform, $domain, $queueForCertificates) { - $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5'; - $skipCheck = \strval($skipCheck) === 'true'; + $skipCheck = \strval($skipCheck) === 'true'; + $isMd5 = System::getEnv('_APP_RULES_FORMAT') === 'md5'; - $rule = $isMd5 - ? $dbForPlatform->getDocument('rules', md5($domain->get())) - : $dbForPlatform->findOne('rules', [ - Query::equal('domain', [$domain->get()]), - ]); + $rule = $isMd5 + ? $dbForPlatform->getDocument('rules', md5($domain->get())) + : $dbForPlatform->findOne('rules', [ + Query::equal('domain', [$domain->get()]), + ]); - if (!$rule->isEmpty()) { - Console::warning('Rule ' . $rule->getId() . ' already exists for domain: ' . $domain->get()); - return; - } + if (!$rule->isEmpty()) { + Console::warning('Rule ' . $rule->getId() . ' already exists for domain: ' . $domain->get()); + return; + } - $owner = ''; + $owner = ''; - // Mark owner as Appwrite if its appwrite-owned domain - $appwriteDomains = []; - $appwriteDomainEnvs = [ - System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', ''), - System::getEnv('_APP_DOMAIN_FUNCTIONS', ''), - System::getEnv('_APP_DOMAIN_SITES', ''), - ]; - foreach ($appwriteDomainEnvs as $appwriteDomainEnv) { - foreach (\explode(',', $appwriteDomainEnv) as $appwriteDomain) { - if (empty($appwriteDomain)) { - continue; - } - $appwriteDomains[] = $appwriteDomain; + // Mark owner as Appwrite if its appwrite-owned domain + $appwriteDomains = []; + $appwriteDomainEnvs = [ + System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', ''), + System::getEnv('_APP_DOMAIN_FUNCTIONS', ''), + System::getEnv('_APP_DOMAIN_SITES', ''), + ]; + foreach ($appwriteDomainEnvs as $appwriteDomainEnv) { + foreach (\explode(',', $appwriteDomainEnv) as $appwriteDomain) { + if (empty($appwriteDomain)) { + continue; } + $appwriteDomains[] = $appwriteDomain; } + } - foreach ($appwriteDomains as $appwriteDomain) { - if (\str_ends_with($domain->get(), $appwriteDomain)) { - $owner = 'Appwrite'; - break; - } + foreach ($appwriteDomains as $appwriteDomain) { + if (\str_ends_with($domain->get(), $appwriteDomain)) { + $owner = 'Appwrite'; + break; } + } - $ruleId = $isMd5 ? md5($domain->get()) : ID::unique(); - $rule = $dbForPlatform->createDocument('rules', new Document([ - '$id' => $ruleId, - 'domain' => $domain->get(), - 'type' => 'api', - 'status' => RULE_STATUS_CERTIFICATE_GENERATING, - 'projectId' => $console->getId(), - 'projectInternalId' => $console->getSequence(), - 'search' => implode(' ', [$ruleId, $domain->get()]), - 'owner' => $owner, - 'region' => $console->getAttribute('region') - ])); + $ruleId = $isMd5 ? md5($domain->get()) : ID::unique(); + $rule = $dbForPlatform->createDocument('rules', new Document([ + '$id' => $ruleId, + 'domain' => $domain->get(), + 'type' => 'api', + 'status' => RULE_STATUS_CERTIFICATE_GENERATING, + 'projectId' => $console->getId(), + 'projectInternalId' => $console->getSequence(), + 'search' => implode(' ', [$ruleId, $domain->get()]), + 'owner' => $owner, + 'region' => $console->getAttribute('region') + ])); - Console::success('Rule ' . $rule->getId() . ' created for domain: ' . $domain->get()); + Console::info('Rule ' . $rule->getId() . ' created for domain: ' . $domain->get()); - $queueForCertificates - ->setDomain(new Document([ - 'domain' => $domain->get() - ])) - ->setSkipRenewCheck($skipCheck) - ->trigger(); + $queueForCertificates + ->setDomain(new Document([ + 'domain' => $domain->get() + ])) + ->setSkipRenewCheck($skipCheck) + ->trigger(); - Console::success('Scheduled a job to issue a TLS certificate for domain: ' . $domain->get()); - }); + Console::success('Scheduled a job to issue a TLS certificate for domain: ' . $domain->get()); } } From 45e74d7b3db615b8050e27f4b62a673b1aefda4a Mon Sep 17 00:00:00 2001 From: Hemachandar Date: Fri, 6 Feb 2026 00:14:15 +0530 Subject: [PATCH 3/3] rule --- src/Appwrite/Platform/Tasks/SSL.php | 79 +++++++++++++++-------------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/src/Appwrite/Platform/Tasks/SSL.php b/src/Appwrite/Platform/Tasks/SSL.php index 514e2b670a..699a09972e 100644 --- a/src/Appwrite/Platform/Tasks/SSL.php +++ b/src/Appwrite/Platform/Tasks/SSL.php @@ -50,51 +50,54 @@ class SSL extends Action Query::equal('domain', [$domain->get()]), ]); - if (!$rule->isEmpty()) { - Console::warning('Rule ' . $rule->getId() . ' already exists for domain: ' . $domain->get()); - return; - } + if ($rule->isEmpty()) { + $owner = ''; - $owner = ''; - - // Mark owner as Appwrite if its appwrite-owned domain - $appwriteDomains = []; - $appwriteDomainEnvs = [ - System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', ''), - System::getEnv('_APP_DOMAIN_FUNCTIONS', ''), - System::getEnv('_APP_DOMAIN_SITES', ''), - ]; - foreach ($appwriteDomainEnvs as $appwriteDomainEnv) { - foreach (\explode(',', $appwriteDomainEnv) as $appwriteDomain) { - if (empty($appwriteDomain)) { - continue; + // Mark owner as Appwrite if its appwrite-owned domain + $appwriteDomains = []; + $appwriteDomainEnvs = [ + System::getEnv('_APP_DOMAIN_FUNCTIONS_FALLBACK', ''), + System::getEnv('_APP_DOMAIN_FUNCTIONS', ''), + System::getEnv('_APP_DOMAIN_SITES', ''), + ]; + foreach ($appwriteDomainEnvs as $appwriteDomainEnv) { + foreach (\explode(',', $appwriteDomainEnv) as $appwriteDomain) { + if (empty($appwriteDomain)) { + continue; + } + $appwriteDomains[] = $appwriteDomain; } - $appwriteDomains[] = $appwriteDomain; } - } - foreach ($appwriteDomains as $appwriteDomain) { - if (\str_ends_with($domain->get(), $appwriteDomain)) { - $owner = 'Appwrite'; - break; + foreach ($appwriteDomains as $appwriteDomain) { + if (\str_ends_with($domain->get(), $appwriteDomain)) { + $owner = 'Appwrite'; + break; + } } + + $ruleId = $isMd5 ? md5($domain->get()) : ID::unique(); + $rule = $dbForPlatform->createDocument('rules', new Document([ + '$id' => $ruleId, + 'domain' => $domain->get(), + 'type' => 'api', + 'status' => RULE_STATUS_CERTIFICATE_GENERATING, + 'projectId' => $console->getId(), + 'projectInternalId' => $console->getSequence(), + 'search' => implode(' ', [$ruleId, $domain->get()]), + 'owner' => $owner, + 'region' => $console->getAttribute('region') + ])); + + Console::info('Rule ' . $rule->getId() . ' created for domain: ' . $domain->get()); + } else { + $rule = $dbForPlatform->updateDocument('rules', $rule->getId(), new Document([ + 'status' => RULE_STATUS_CERTIFICATE_GENERATING, + ])); + + Console::info('Updated existing rule ' . $rule->getId() . ' for domain: ' . $domain->get()); } - $ruleId = $isMd5 ? md5($domain->get()) : ID::unique(); - $rule = $dbForPlatform->createDocument('rules', new Document([ - '$id' => $ruleId, - 'domain' => $domain->get(), - 'type' => 'api', - 'status' => RULE_STATUS_CERTIFICATE_GENERATING, - 'projectId' => $console->getId(), - 'projectInternalId' => $console->getSequence(), - 'search' => implode(' ', [$ruleId, $domain->get()]), - 'owner' => $owner, - 'region' => $console->getAttribute('region') - ])); - - Console::info('Rule ' . $rule->getId() . ' created for domain: ' . $domain->get()); - $queueForCertificates ->setDomain(new Document([ 'domain' => $domain->get()