plantroon/acme.sh
1
0
Fork 0
mirror of https://github.com/plantroon/acme.sh.git synced 2024-12-22 21:21:42 +00:00
Code Issues Projects Releases Wiki Activity

Backup old certificates before overwriting. Add userid export parameter.

Browse Source 
And generate error if nothing to do at remote server.
This commit is contained in:
David Kerr 2017-02-05 14:35:05 -05:00
parent 989651c23b
commit 7d75ad4c56
1 changed files with 82 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

108
deploy/sshdeploy.sh
View File

@ -1,22 +1,26 @@
#!/usr/bin/env sh #!/usr/bin/env sh
#Here is a script to deploy certificates to remote server by ssh # Script to deploy certificates to remote server by SSH
#This file name is "sshdeploy.sh" # Note that SSH must be able to login to remote host without a password...
#So, here must be a method sshdeploy_deploy() # SSH Keys must have been exchanged with the remote host. Validate and
#Which will be called by acme.sh to deploy the cert # test that you can login to USER@URL from the host running acme.sh before
#returns 0 means success, otherwise error. # using this script.
#
# The following variables exported from environment will be used. # The following variables exported from environment will be used.
# If not set then values previously saved in domain.conf file are used. # If not set then values previously saved in domain.conf file are used.
# #
# export ACME_DEPLOY_SSH_URL="admin@qnap" # Only a username is required. All others are optional.
# export ACME_DEPLOY_SSH_SERVICE_STOP="/etc/init.d/stunnel.sh stop" #
# The following examples are for QNAP NAS running QTS 4.2
# export ACME_DEPLOY_SSH_USER="admin"
# export ACME_DEPLOY_SSH_URL="qnap"
# export ACME_DEPLOY_SSH_SERVICE_STOP=""
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem" # export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem" # export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem" # export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_FULLCHAIN="" # export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart" # export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_SERVICE_START="/etc/init.d/stunnel.sh stop" # export ACME_DEPLOY_SSH_SERVICE_START=""
. "$DOMAIN_CONF" . "$DOMAIN_CONF"
@ -29,7 +33,9 @@ sshdeploy_deploy() {
_ccert="$3" _ccert="$3"
_cca="$4" _cca="$4"
_cfullchain="$5" _cfullchain="$5"
_cmdstr="{" _cmdstr=""
_homedir="~/.acme_ssh_deploy"
_backupdir="$_homedir/certs-backup-$(date +%Y%m%d%H%M%S)"
_debug _cdomain "$_cdomain" _debug _cdomain "$_cdomain"
_debug _ckey "$_ckey" _debug _ckey "$_ckey"
@ -37,18 +43,29 @@ sshdeploy_deploy() {
_debug _cca "$_cca" _debug _cca "$_cca"
_debug _cfullchain "$_cfullchain" _debug _cfullchain "$_cfullchain"
if [ -z "$ACME_DEPLOY_SSH_URL" ]; then # USER is required to login by SSH to remote host.
if [ -z "$Le_Deploy_ssh_url" ]; then if [ -z "$ACME_DEPLOY_SSH_USER" ]; then
_err "ACME_DEPLOY_SSH_URL not defined." if [ -z "$Le_Deploy_ssh_user" ]; then
_err "ACME_DEPLOY_SSH_USER not defined."
return 1 return 1
fi fi
else else
Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL" Le_Deploy_ssh_user="$ACME_DEPLOY_SSH_USER"
_savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url" _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
fi fi
_info "Deploy certificates to remote server $Le_Deploy_ssh_url" # URL is optional. If not provided then use _cdomain
if [ -n "$ACME_DEPLOY_SSH_URL" ]; then
Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL"
_savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url"
elif [ -z "$Le_Deploy_ssh_url" ]; then
Le_Deploy_ssh_url="$_cdomain"
fi
_info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_url"
# SERVICE_STOP is optional.
# If provided then this command will be executed on remote host.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then
Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP" Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP"
_savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop" _savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop"
@ -58,71 +75,114 @@ sshdeploy_deploy() {
_info "Will stop remote service with command $Le_Deploy_ssh_service_stop" _info "Will stop remote service with command $Le_Deploy_ssh_service_stop"
fi fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then
Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE" Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE"
_savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile" _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
fi fi
if [ -n "$Le_Deploy_ssh_keyfile" ]; then if [ -n "$Le_Deploy_ssh_keyfile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;"
_info "will copy private key to remote file $Le_Deploy_ssh_keyfile" _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
fi fi
# CERTFILE is optional.
# If provided then private key will be copied or appended to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then
Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE" Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE"
_savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile" _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
fi fi
if [ -n "$Le_Deploy_ssh_certfile" ]; then if [ -n "$Le_Deploy_ssh_certfile" ]; then
if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
# if filename is same as that provided for private key then append.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;"
_info "will append certificate to same file" _info "will append certificate to same file"
else else
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;"
_info "will copy certificate to remote file $Le_Deploy_ssh_certfile" _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
fi fi
fi fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then
Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE" Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE"
_savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile" _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
fi fi
if [ -n "$Le_Deploy_ssh_cafile" ]; then if [ -n "$Le_Deploy_ssh_cafile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;" _cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;"
_info "will copy CA file to remote file $Le_Deploy_ssh_cafile" _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
fi fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then
Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN" Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN"
_savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain" _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
fi fi
if [ -n "$Le_Deploy_ssh_fullchain" ]; then if [ -n "$Le_Deploy_ssh_fullchain" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;" _cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;"
_info "will copy full chain to remote file $Le_Deploy_ssh_fullchain" _info "will copy full chain to remote file $Le_Deploy_ssh_fullchain"
fi fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop.
if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then
Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD" Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD"
_savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd" _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
fi fi
if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_remote_cmd ;" if [ -n "$Le_Deploy_ssh_service_stop" ]; then
_info "Will sleep 2 seconds then execute remote command $Le_Deploy_ssh_remote_cmd" _cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd ;"
_info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
fi fi
# SERVICE_START is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop or previous command.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then
Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START" Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START"
_savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start" _savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start"
fi fi
if [ -n "$Le_Deploy_ssh_service_start" ]; then if [ -n "$Le_Deploy_ssh_service_start" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_service_start ;" if [ -n "$Le_Deploy_ssh_service_stop" ] || [ -n "$Le_Deploy_ssh_remote_cmd" ] ; then
_info "Will sleep 2 seconds then start remote service with command $Le_Deploy_ssh_remote_cmd" _cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_service_start ;"
_info "Will start remote service with command $Le_Deploy_ssh_remote_cmd"
fi fi
_cmdstr="$_cmdstr }" if [ -z "$_cmdstr" ]; then
_err "No remote commands to excute. Failed to deploy certificates to remote server"
_debug "Remote command to execute: $_cmdstr" return 1
else
# something to execute.
# run cleanup on the backup directory, erase all older than 180 days.
_cmdstr="find $_homedir/* -type d -mtime +180 2>/dev/null | xargs rm -rf ; $_cmdstr"
# Create our backup directory for overwritten cert files.
_cmdstr="mkdir -p $_backupdir ; $_cmdstr"
fi
_debug "Remote commands to execute: $_cmdstr"
_info "Submitting sequence of commands to remote server by ssh" _info "Submitting sequence of commands to remote server by ssh"
ssh -T "$Le_Deploy_ssh_url" bash -c "'$_cmdstr'" ssh -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
return 0 return 0
} }