OpenStack 환경에서 Cloudflare DNS와 certbot을 활용한 SSL 인증서 자동 발급 및 갱신 방법

#!/usr/bin/python3

import os
import subprocess

SRC_DIR = '/etc/letsencrypt/live'
DST_DIR = '/mnt/ssl'

def run_certbot_renew():
    """
    Executes the certbot renew command.
    """
    try:
        result = subprocess.run(
                ['certbot', 'renew'],
                check=True,
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,
                text=True
                )
        print("[certbot] Renewal succeeded:")
        print(result.stdout)
    except subprocess.CalledProcessError as e:
        print("[certbot] Renewal error:")
        print(e.stderr)

def merge_certificates():
    # Ensure that the destination directory exists
    if not os.path.exists(DST_DIR):
        os.makedirs(DST_DIR)

    for directory in os.listdir(SRC_DIR):
        domain_path = os.path.join(SRC_DIR, directory)
        if os.path.isdir(domain_path):
            print(domain_path)
            fullchain_path = os.path.join(domain_path, 'fullchain.pem')
            privkey_path = os.path.join(domain_path, 'privkey.pem')

            if os.path.exists(fullchain_path) and os.path.exists(privkey_path):
                try:
                    with open(fullchain_path, 'r') as fc_file:
                        fullchain_content = fc_file.read()
                    with open(privkey_path, 'r') as pk_file:
                        privkey_content = pk_file.read()
                    # Combine the contents with a newline in between
                    combined_content = fullchain_content.rstrip() + "\n" + privkey_content.lstrip()
                    # Build the destination file path, for example: /mnt/ssl/example.com.pem
                    dst_file = os.path.join(DST_DIR, f"{directory}.pem")

                    with open(dst_file, 'w') as out_file:
                        out_file.write(combined_content)

                    print(f"Merged certificates for '{directory}' into '{dst_file}'")
                except Exception as e:
                    print(f"Error processing '{directory}': {e}")
            else:
                print(f"Skipped '{directory}': missing fullchain.pem or privkey.pem")

if __name__ == "__main__":
    run_certbot_renew()
    merge_certificates()