81 lines
3.2 KiB
Python
Executable file
81 lines
3.2 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
import argparse
|
|
import ipaddress
|
|
import json
|
|
import sys
|
|
import urllib.parse
|
|
import urllib.request
|
|
|
|
|
|
def request(method, base, path, token, payload=None):
|
|
data = None
|
|
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
|
|
if payload is not None:
|
|
data = json.dumps(payload, separators=(",", ":")).encode("utf-8")
|
|
req = urllib.request.Request(base.rstrip("/") + path, data=data, headers=headers, method=method)
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
body = json.loads(resp.read().decode("utf-8"))
|
|
if not body.get("success"):
|
|
raise SystemExit("FAIL cloudflare_api_error")
|
|
return body["result"]
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--api-base", required=True)
|
|
parser.add_argument("--zone", required=True)
|
|
parser.add_argument("--public-ip", required=True)
|
|
parser.add_argument("--apply", action="store_true")
|
|
parser.add_argument("--output", required=True)
|
|
args = parser.parse_args()
|
|
|
|
token = sys.stdin.read().strip()
|
|
if not token:
|
|
raise SystemExit("FAIL missing_token_stdin")
|
|
ipaddress.ip_address(args.public_ip)
|
|
|
|
zones = request("GET", args.api_base, "/zones?name=" + urllib.parse.quote(args.zone), token)
|
|
if len(zones) != 1:
|
|
raise SystemExit(f"FAIL zone_lookup count={len(zones)}")
|
|
zone_id = zones[0]["id"]
|
|
desired = {
|
|
f"git.{args.zone}": {"type": "A", "content": args.public_ip, "proxied": False, "ttl": 300},
|
|
f"status.{args.zone}": {"type": "A", "content": args.public_ip, "proxied": False, "ttl": 300},
|
|
}
|
|
|
|
existing = request("GET", args.api_base, f"/zones/{zone_id}/dns_records?per_page=500", token)
|
|
by_name_type = {(r["name"], r["type"]): r for r in existing}
|
|
plan = []
|
|
for name, spec in sorted(desired.items()):
|
|
current = by_name_type.get((name, spec["type"]))
|
|
if current is None:
|
|
plan.append({"action": "create", "name": name, **spec})
|
|
else:
|
|
drift = any(current.get(k) != v for k, v in spec.items())
|
|
if drift:
|
|
plan.append({"action": "update", "id": current["id"], "name": name, **spec})
|
|
|
|
if args.apply:
|
|
for item in plan:
|
|
payload = {k: item[k] for k in ("type", "name", "content", "ttl", "proxied")}
|
|
if item["action"] == "create":
|
|
request("POST", args.api_base, f"/zones/{zone_id}/dns_records", token, payload)
|
|
else:
|
|
request("PUT", args.api_base, f"/zones/{zone_id}/dns_records/{item['id']}", token, payload)
|
|
|
|
result = {
|
|
"zone": args.zone,
|
|
"zone_id": zone_id,
|
|
"public_ip": args.public_ip,
|
|
"apply": bool(args.apply),
|
|
"changes": [{k: v for k, v in item.items() if k != "id"} for item in plan],
|
|
"preserved_record_types": ["MX", "TXT", "SPF", "DKIM", "DMARC", "verification"],
|
|
}
|
|
with open(args.output, "w", encoding="utf-8") as f:
|
|
json.dump(result, f, ensure_ascii=False, indent=2)
|
|
f.write("\n")
|
|
print(f"PASS edge_reconciler apply={bool(args.apply)} changes={len(plan)} zone={args.zone} values=redacted")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|