Commit Graph

398 Commits

Author SHA1 Message Date
neil
f41f93af3a
Merge pull request #3491 from bgarret/consul-deploy-hook
Consul deploy hooks
2021-06-24 20:25:01 +08:00
Brian Hartvigsen
dcb51683c5
shellcheck cleanup
shellcheck sees '\\' as trying to escape the trailing quote (see
koalaman/shellcheck#1548 ).
2021-05-26 15:25:58 -06:00
Brian Hartvigsen
74a4a788b1
Make certificate descriptions sed safe
This escapes special characters used in POSIX sed to prevent mismatches.
e.g. `SYNO_Certficiate=*.example.com` would not match a description of
"*.example.com" and would look to match any number of double quotes (the
last character in the sed regex prior to certificate description),
followed by any single character, followed by "example", followed by any
character, followed by "com".

After this change, it will properly match `*.example.com` and not
`""zexamplefcom`.

Additionally we now store the certificate description as base64 encoded
to prevent issues with single quotes.

Tested on DSM 7.0-41222 (VDSM) and DSM 6.2.4-25556 (DS1515+).
2021-05-26 15:25:58 -06:00
Brian Hartvigsen
5ab9ca1c0d
Better fix for Synology DSM setting wrong default
As noted by @buxm, previous fix didn't work for all versions of DSM 6.
The better fix appears to be simply not outputting the "as_default"
parameter unless we are doing something with the default certificate.
2021-05-19 13:21:34 -06:00
Benoit Garret
07afc4953a Fix the shfmt check 2021-05-07 12:12:30 +02:00
neil
8c14150536
Merge pull request #3350 from temoffey/deploy-gcore_cdn
Deploy gcore_cdn fix
2021-05-05 23:48:37 +08:00
Benoit Garret
c127903127 Add Consul deploy hook 2021-05-05 10:01:09 +02:00
Brian Hartvigsen
1a4a180e8c
FIX: Synology sets "default" on wrong certificate
For some DSM installs, it appears that setting the "default" flag to the
string "false" actually sets it to true.  This causes Synology to set
the last updated certificate to be the default certificate.  Using an
empty string appears to still be accepted as a false-y value for DSMs
where this isn't happening and corrects the behavior in the cases that
it was.

Credit to @Run-King for identifying the fix and @buxm for reporting.
2021-05-02 13:37:59 -06:00
neil
e71238571a
Merge pull request #3464 from jpbede/cleverreach-deploy-sublient
CleverReach Deploy Hook: Allow deploy to agency subaccounts
2021-04-04 19:03:33 +08:00
Jan-Philipp Benecke
2867ec509e
Make CI happy 2021-03-30 09:18:33 +02:00
Jan-Philipp Benecke
d853a9ebbe
Make uploading cert to subaccount possible 2021-03-30 09:13:32 +02:00
Christophe Le Guern
cc90f83463
Use 'vault kv put' instead of 'vault write'
When using vault_cli with a kv2 path, it isn't working. I have the following error:
```
WARNING! The following warnings were returned from Vault:                                                                                                                                                                                     
                                                                                                                                                                                                                                              
  * Invalid path for a versioned K/V secrets engine. See the API docs for the                                                                                                                                                                 
  appropriate API endpoints to use. If using the Vault CLI, use 'vault kv put'                                                                                                                                                                
  for this operation.                                                                                                                                                                                                                         
```
The new way to write data  is to use `vault kv put`, it is compatible with kv1 and kv2.
Ref: https://www.vaultproject.io/docs/commands#reading-and-writing-data
```
The original version of K/V used the common read and write operations. A more advanced K/V Version 2 engine was released in Vault 0.10 and introduced the kv get and kv put commands.
```
2021-03-29 15:10:14 +02:00
Jan-Philipp Benecke
1530abbd1a
Make uploading cert to subaccount possible 2021-03-26 15:37:12 +01:00
F-Plass
4bb8e3a121 Update truenas.sh
-error handling
2021-02-21 22:48:31 +01:00
F-Plass
eacc00f786 Update truenas.sh
- check if curl exists
- check if wget exist, then errortext and exit scipt
- _get command "restartUI"  wirh info about curl error 52
2021-02-21 22:42:24 +01:00
Mike Edmunds
bf8c33703c
Fix: Unifi deploy hook support Unifi Cloud Key (#3327)
* fix: unifi deploy hook also update Cloud Key nginx certs

When running on a Unifi Cloud Key device, also deploy to
/etc/ssl/private/cloudkey.{crt,key} and reload nginx. This
makes the new cert available for the Cloud Key management
app running via nginx on port 443 (as well as the port 8443
Unifi Controller app the deploy hook already supported).

Fixes #3326

* Improve settings documentation comments

* Improve Cloud Key pre-flight error messaging

* Fix typo

* Add support for UnifiOS (Cloud Key Gen2)

Since UnifiOS does not use the Java keystore (like a Unifi
Controller or Cloud Key Gen1 deploy), this also reworks
the settings validation and error messaging somewhat.

* PR review fixes

* Detect unsupported Cloud Key java keystore location

* Don't try to restart inactive services

(and remove extra spaces from reload command)

* Clean up error messages and internal variables

* Change to _getdeployconf/_savedeployconf

* Switch from cp to cat to preserve file permissions
2021-02-15 15:01:21 +08:00
F-Plass
93fd6170a3 Update truenas.sh 2021-02-13 12:38:57 +01:00
F-Plass
6f4c5fcc87 Update truenas.sh 2021-02-07 21:25:49 +01:00
F-Plass
a7ca010d4e Update truenas.sh 2021-02-07 21:24:06 +01:00
F-Plass
a836842a7e Update truenas.sh 2021-02-07 21:20:56 +01:00
F-Plass
f8c11a324a Update truenas.sh 2021-02-07 19:19:04 +01:00
F-Plass
052c9be111 Update truenas.sh 2021-02-07 19:12:39 +01:00
F-Plass
854e520528 Update truenas.sh 2021-02-07 19:02:03 +01:00
F-Plass
05737b85eb Update truenas.sh 2021-02-07 18:47:04 +01:00
F-Plass
c8a2308739 Update truenas.sh 2021-02-07 18:42:48 +01:00
F-Plass
ed46a078f9 Update truenas.sh 2021-02-07 16:35:51 +01:00
F-Plass
4f7c2bf8c3 Update truenas.sh 2021-02-07 16:12:24 +01:00
F-Plass
0e341726d2
Edits after DoShellcheck 2021-02-06 23:20:52 +01:00
F-Plass
a4f9746d3a
Danksagung an danb35 2021-02-06 23:03:07 +01:00
F-Plass
556c546b2e
Deploy Scipt for TrueNAs Server
acme .sh deploy Scipt for TrueNAS Server that uses the REST API from TrueNAS.

- Authentification with API Key
- If HTTP redirect is configured, automatik switch to HTTPS
- If WebDAV Certificate is the same as Web UI Certificate, Webdav Certificate get also an updated
- If FTP Certificate is the same as Web UI Certificate, FTP Certificate get also an updated
2021-02-06 22:48:25 +01:00
neil
62c776d90c
Merge pull request #3343 from markchalloner/master
Add Peplink deploy hook
2021-01-16 13:26:43 +08:00
Mark Challoner
61549b4a74 Add Peplink deploy hook 2021-01-13 20:37:05 +00:00
tyahin
7ed7a57d92 deploy gcore_cdn fix syntax 2021-01-10 12:44:56 +03:00
tyahin
1eaf7c89b7 deploy gcore_cdn fix api 2021-01-10 12:39:20 +03:00
tyahin
1fff8dd306 deploy gcore_cdn fix auth 2021-01-10 12:39:12 +03:00
neil
54195b16ad
Merge pull request #3299 from tresni/synology_dsm
Add DSM7 support to synology_dsm deployhook
2020-12-22 22:45:22 +08:00
neil
15fb47cb3d fix https://github.com/acmesh-official/acme.sh/issues/3300 2020-12-10 20:22:14 +08:00
Brian Hartvigsen
2635dfef96
Shellcheck linting
Also removed unused code
2020-12-09 21:01:44 -07:00
Brian Hartvigsen
7d7789ae96
Support DSM 6 and 7
Small changes for DSM 6:

All fields (except enable_syno_token as explained below) must either be in the GET params or the POST params, you can't mix GET and POST params
enable_syno_token=yes must be in both the GET and POST params.
If enable_syno_token=yes is only in the POST fields, then DSM6 returns a synotoken of --------. If enable_syno_token=yes is only in the GET params, then it returns no synotoken at all. It must be in both to work.
Need to use /webapi/auth.cgi instead of /webapi/entry.cgi
Verified with DSM 6.2.3-25426 Update 2 and DSM 7.0-40850
2020-12-09 20:35:50 -07:00
Thijn
cc69285420
Fix synology_dsm deployhook for DSM 7 2020-12-09 19:47:31 -07:00
Brian Hartvigsen
99d3a283ef
Use POST for login
This allows us to get the cookie and the token (as it appears to be only in the body in DSM 7.)  HTTP_HEADERS is only guarenteed to be output with POST for both wget and curl.
2020-12-09 19:44:14 -07:00
neil
8440d013f8 fix 2020-12-07 22:01:30 +08:00
neil
174c87a192 fix 2020-12-07 21:42:31 +08:00
neil
32b62d6d4f fix 2020-12-07 21:41:08 +08:00
Christian Burmeister
2bc627970e
Update mailcow.sh
I have modified the following things:

    Originally, "/data/assets/ssl/" is always appended to the varialbe ${_mailcow_path}. Since I use acme.sh as docker container, I only want to include the mailcow-ssl directory in the acem.sh container and not the complete mailcow directory. So now it is checked if the file generate_config.sh is in the directory (then it is the mailcow root directory, see https://github.com/mailcow/mailcow-dockerized) and only then "/data/assets/ssl/" is appended, in all other cases the passed variable is taken over unchanged.

    Because of the RP mailcow/mailcow-dockerized#2443 I have extended the script with ECC certificates.

    I adapted the reboot commands as described in the mailcow manual (https://mailcow.github.io/mailcow-dockerized-docs/firststeps-ssl/#how-to-use-your-own-certificate).
2020-12-01 20:30:56 +01:00
neil
be067466fe
Merge pull request #3132 from jpbede/deploy-cleverreach
Add CleverReach Deploy API
2020-11-29 21:47:05 +08:00
Moritz H
ed01fd4edf uconv as fallback for iconv 2020-11-28 15:22:14 +01:00
neil
7530266330 remove dependency to md5 and awk 2020-11-09 20:14:22 +08:00
neil
97b87d4ce4
Merge pull request #3111 from pashinin/master
Vault deploy hook (using curl)
2020-11-02 22:37:43 +08:00
Sergey Pashinin
e203e98375
Use _savedeployconf 2020-11-02 16:46:09 +03:00
Sergey Pashinin
9fcd104065
Use _getdeployconf for env vars 2020-11-02 13:35:12 +03:00
Jan-Philipp Benecke
1db963361c
Rework based on review from Neilpang 2020-10-28 13:50:40 +01:00
Jan-Philipp Benecke
f7e12b629f
Update CleverReach REST Endpoint 2020-10-01 11:26:29 +02:00
Jan-Philipp Benecke
2a9c56d9e3
Formatting for CI 2020-08-28 11:30:23 +02:00
Jan-Philipp Benecke
39a5688464
Make CI happy 2020-08-28 11:28:06 +02:00
Jan-Philipp Benecke
e4e6173eff
CleverReach Deploy API 2020-08-28 11:21:20 +02:00
Sergey Pashinin
f511a52705
Using _post function 2020-08-24 00:05:21 +03:00
Sergey Pashinin
de692d3dcc
Vault deploy hook 2020-08-18 13:14:00 +03:00
neil
19c4345162 fix shfmt 2020-08-17 22:18:20 +08:00
Brian Hartvigsen
5f5096e1d4
Addressing issues found in DS218+ DSM
DS218+ appears to have a slighly different DSM that sends back headers in lowercase.

Reported by @BartSiwek in #2727
2020-07-25 21:56:18 -06:00
neil
7f33ae3bee
Merge pull request #3059 from andybotting/dev
Fix CI test failure for deploy/openstack.sh
2020-07-16 13:44:40 +08:00
neil
645135bf56
Merge pull request #3051 from szepeviktor/patch-2
Upgrade Travis image
2020-07-16 13:44:02 +08:00
Viktor Szépe
61613bee98
Fix SC2230 2020-07-16 06:13:15 +02:00
Andy Botting
3ce967d8e5 Fix CI test failure for deploy/openstack.sh 2020-07-16 13:53:21 +10:00
Andy Botting
9b23cd6d19 Add OpenStack Barbican deploy support
This provider relies on the the python-openstackclient and
python-designateclient tools be installed and working, with
either password or application credentials loaded in your env.
2020-07-16 09:59:40 +10:00
andrewheberle
01ebb6576d
Use base64 for reload
Ensure that reload command is encoded with base64 so special characters in command do not wreck config on renewals
2020-07-13 09:31:47 +08:00
Tony Gravagno
eca57beec1
Issue #2850 : grammar corrections for "exists" and "exist". 2020-06-29 11:29:10 -07:00
PM Extra
a78a09f594 Support multiple servers for SSH deployment. 2020-05-22 18:15:38 +08:00
neil
341f000b9c
Merge pull request #2947 from kref/patch-1
fix octal escapes for printf %b format
2020-05-19 13:45:42 +08:00
kref
0deea53931
fix octal escapes for printf %b format
Stop it from misinterpreting a following digit as part of the escape sequence
2020-05-19 13:27:00 +08:00
Brian Hartvigsen
694194be2f
Shellcheck fix
SYNO_Certificate gets set by _getdeployconf, so this may be an empty string but that's fine
2020-05-16 02:25:53 -06:00
Brian Hartvigsen
c7f61f8b80
Allow rotating the default certificate which has no description
This means, by default, we will rotate the default certificate that comes with the DSM
2020-05-16 02:02:23 -06:00
Brian Hartvigsen
3a7c7fe4e8
Fix shellcheck issues 2020-05-16 00:19:18 -06:00
Brian Hartvigsen
668967a719
If SYNO_Create is not set here, print the nice message 2020-05-16 00:05:35 -06:00
Brian Hartvigsen
d15c14ab93
Fix support for wget
I'm actually not entirely sure why/how this worked with curl but not wget, but it did.  The short answer is that using a GET does not result in the HTTP_HEADER file being written, instead you must pass in the http_headers param ($2) which will return the HTTP headers as a string.  Luckily, the Token is in both the body and the header.  We need it and the id (and smid if 2fa) cookie to proceed.  So now we parrse the response for that instead of the HTTP_HEADER file.

Interesting side note: wget is fine if the URL contains a \r or \n, but curl will barf on it.  So we need to make sure those are stripped from the token as it will be passed in the URL later.
2020-05-15 23:53:00 -06:00
Brian Hartvigsen
52b81608a1
need to _url_encode anything sent in GET requests
Fixes issue raised by @tatablack
2020-05-15 23:48:50 -06:00
Felix Bünemann
cf5952f508
fix haproxy deploy hook ocsp update
fixes ocsp reponse update failing with `Responder Error: unauthorized (6)`
by removing `-no_nonce` switch from `openssl oscp` command .
2020-05-02 22:14:21 +02:00
neil
b6fbb012ad
Merge pull request #2749 from dkerr64/ssh-deploy
Updates to ssh_deploy hook
2020-04-12 13:58:44 +08:00
ucando
6132af8ecb enable qiniu to deploy more than one domain 2020-03-26 14:59:23 +08:00
Brian Torres-Gil
0453d656d6 fix(deploy/panos): data format improvements
It was discovered in testing that PAN-OS < 9.0 has slightly different
requirements for the multipart/form-data format and requires the `type`
parameter to be passed in the URL. These corrections should work for all
PAN-OS versions.
2020-03-24 20:01:51 -07:00
dkerr64
f38df4df11 Make remote backup directory path user configurable. 2020-03-14 21:51:21 -04:00
dkerr64
554e083f3d For MULTI_CALL default to undefined, deleting entry in config file if set to "no" 2020-03-11 10:58:36 -04:00
Markus Lippert
fd64c20807 store device ID 2020-03-08 20:22:31 +01:00
Markus Lippert
80f1034dd6 add OTP support 2020-03-08 19:49:46 +01:00
dkerr64
8ba573d196 Change variable name to MULTI_CALL so default can be "no" 2020-03-03 13:40:33 -05:00
dkerr64
f73a494407 Remove spaces on blank line to fix travis error 2020-02-22 22:09:28 -05:00
dkerr64
46ee74ed16 Remove variable from info/error printout that could potentially expose login credentials. 2020-02-22 22:05:06 -05:00
dkerr64
806b746fc0 Fix bug where backup and batch_mode yes/no values could not be changed.
Once set to "no" then they could never be set back to "yes"
2020-02-22 21:23:59 -05:00
dkerr64
cc820e97c6 Add support for DEPLOY_SSH_BATCH_MODE with default of yes.
Before this update all remote commands were bunched together and
sent to the remote host in a single SSH command.  This could result
in a very long sequence of commands that might be rejected by a
remote host (example is VMware ESXi that uses busybox sh).
With this update you can set DEPLOY_SSH_BATCH_MODE="no" and
each remote command is sent as a separate SSH call so now we
do not have big long sequence of commands.  Defaults to same
behaviour as before this update.
2020-02-22 21:10:42 -05:00
dkerr64
283b04df73 Move cleanup of backup directory to first step in the function. 2020-02-22 20:43:28 -05:00
dkerr64
6420d1239f Move call to remote system into separate function 2020-02-22 20:31:52 -05:00
dkerr64
3d9608faa0 Move -T parameter into default ssh command variable 2020-02-22 20:09:24 -05:00
xpac1985
e184a1b9e6
haproxy deploy script now compatible with OpenSSL v1.1+
haproxy deploy script now compatible with OpenSSL v1.1+

The OpenSSL OCSP request for haproxy deployment breaks from OpenSSL v1.1.0 on.
The format of the `-header` option has been changed and does now contain a `=` instead of a whitespace.
Other projects have hit the same issue:
https://github.com/nghttp2/nghttp2/issues/742

This commit determines the OpenSSL/LibreSSL version and then adjusts the request accordingly.
Also removed the duplicate command line and added some more debug output.
2020-02-20 23:28:55 +01:00
neil
754f7a7891
Merge pull request #2614 from PaloAltoNetworks/deploy-panos
Adding abillity to deploy cert to Palo Alto Networks Firewall via API.
2020-02-15 20:46:59 +08:00
Paul Nguyen
21450a08c2 Fixed 6 character requirement. 2020-02-13 18:01:27 -08:00
Paul Nguyen
c355b25bb1 Fixed line formatting 2020-02-12 15:00:23 -08:00
Paul Nguyen
1fe3d80838 Updated to use saveconf function and base64encode. 2020-02-12 14:57:31 -08:00
Paul Nguyen
930e16b64a fix gitdiff 2020-02-11 22:50:05 -08:00
Paul Nguyen
2077a70d03 Fixing gitdiff 2020-02-11 22:44:51 -08:00
Paul Nguyen
cbdb8bd9b9 Fixing gitdiff 2020-02-11 22:34:55 -08:00