|
@@ -0,0 +1,55 @@
|
|
|
+# frozen_string_literal: true
|
|
|
+
|
|
|
+require 'rubygems/package'
|
|
|
+require_relative '../../config/boot'
|
|
|
+require_relative '../../config/environment'
|
|
|
+require_relative 'cli_helper'
|
|
|
+
|
|
|
+module Mastodon
|
|
|
+ class AccountsCLI < Thor
|
|
|
+ option :all, type: :boolean
|
|
|
+ desc 'rotate [USERNAME]', 'Generate and broadcast new keys'
|
|
|
+ long_desc <<-LONG_DESC
|
|
|
+ Generate and broadcast new RSA keys as part of security
|
|
|
+ maintenance.
|
|
|
+
|
|
|
+ With the --all option, all local accounts will be subject
|
|
|
+ to the rotation. Otherwise, and by default, only a single
|
|
|
+ account specified by the USERNAME argument will be
|
|
|
+ processed.
|
|
|
+ LONG_DESC
|
|
|
+ def rotate(username = nil)
|
|
|
+ if options[:all]
|
|
|
+ processed = 0
|
|
|
+ delay = 0
|
|
|
+
|
|
|
+ Account.local.without_suspended.find_in_batches do |accounts|
|
|
|
+ accounts.each do |account|
|
|
|
+ rotate_keys_for_account(account, delay)
|
|
|
+ processed += 1
|
|
|
+ say('.', :green, false)
|
|
|
+ end
|
|
|
+
|
|
|
+ delay += 5.minutes
|
|
|
+ end
|
|
|
+
|
|
|
+ say
|
|
|
+ say("OK, rotated keys for #{processed} accounts", :green)
|
|
|
+ elsif username.present?
|
|
|
+ rotate_keys_for_account(Account.find_local(username))
|
|
|
+ say('OK', :green)
|
|
|
+ else
|
|
|
+ say('No account(s) given', :red)
|
|
|
+ end
|
|
|
+ end
|
|
|
+
|
|
|
+ private
|
|
|
+
|
|
|
+ def rotate_keys_for_account(account, delay = 0)
|
|
|
+ old_key = account.private_key
|
|
|
+ new_key = OpenSSL::PKey::RSA.new(2048).to_pem
|
|
|
+ account.update(private_key: new_key)
|
|
|
+ ActivityPub::UpdateDistributionWorker.perform_in(delay, account.id, sign_with: old_key)
|
|
|
+ end
|
|
|
+ end
|
|
|
+end
|