Backup old certificates before overwriting. Add userid export parameter.

And generate error if nothing to do at remote server.
This commit is contained in:
David Kerr 2017-02-05 14:35:05 -05:00
parent 989651c23b
commit 7d75ad4c56

View File

@ -1,22 +1,26 @@
#!/usr/bin/env sh #!/usr/bin/env sh
#Here is a script to deploy certificates to remote server by ssh # Script to deploy certificates to remote server by SSH
#This file name is "sshdeploy.sh" # Note that SSH must be able to login to remote host without a password...
#So, here must be a method sshdeploy_deploy() # SSH Keys must have been exchanged with the remote host. Validate and
#Which will be called by acme.sh to deploy the cert # test that you can login to USER@URL from the host running acme.sh before
#returns 0 means success, otherwise error. # using this script.
#
# The following variables exported from environment will be used. # The following variables exported from environment will be used.
# If not set then values previously saved in domain.conf file are used. # If not set then values previously saved in domain.conf file are used.
# #
# export ACME_DEPLOY_SSH_URL="admin@qnap" # Only a username is required. All others are optional.
# export ACME_DEPLOY_SSH_SERVICE_STOP="/etc/init.d/stunnel.sh stop" #
# The following examples are for QNAP NAS running QTS 4.2
# export ACME_DEPLOY_SSH_USER="admin"
# export ACME_DEPLOY_SSH_URL="qnap"
# export ACME_DEPLOY_SSH_SERVICE_STOP=""
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem" # export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem" # export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem" # export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_FULLCHAIN="" # export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart" # export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_SERVICE_START="/etc/init.d/stunnel.sh stop" # export ACME_DEPLOY_SSH_SERVICE_START=""
. "$DOMAIN_CONF" . "$DOMAIN_CONF"
@ -29,7 +33,9 @@ sshdeploy_deploy() {
_ccert="$3" _ccert="$3"
_cca="$4" _cca="$4"
_cfullchain="$5" _cfullchain="$5"
_cmdstr="{" _cmdstr=""
_homedir="~/.acme_ssh_deploy"
_backupdir="$_homedir/certs-backup-$(date +%Y%m%d%H%M%S)"
_debug _cdomain "$_cdomain" _debug _cdomain "$_cdomain"
_debug _ckey "$_ckey" _debug _ckey "$_ckey"
@ -37,18 +43,29 @@ sshdeploy_deploy() {
_debug _cca "$_cca" _debug _cca "$_cca"
_debug _cfullchain "$_cfullchain" _debug _cfullchain "$_cfullchain"
if [ -z "$ACME_DEPLOY_SSH_URL" ]; then # USER is required to login by SSH to remote host.
if [ -z "$Le_Deploy_ssh_url" ]; then if [ -z "$ACME_DEPLOY_SSH_USER" ]; then
_err "ACME_DEPLOY_SSH_URL not defined." if [ -z "$Le_Deploy_ssh_user" ]; then
_err "ACME_DEPLOY_SSH_USER not defined."
return 1 return 1
fi fi
else else
Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL" Le_Deploy_ssh_user="$ACME_DEPLOY_SSH_USER"
_savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url" _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
fi fi
_info "Deploy certificates to remote server $Le_Deploy_ssh_url" # URL is optional. If not provided then use _cdomain
if [ -n "$ACME_DEPLOY_SSH_URL" ]; then
Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL"
_savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url"
elif [ -z "$Le_Deploy_ssh_url" ]; then
Le_Deploy_ssh_url="$_cdomain"
fi
_info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_url"
# SERVICE_STOP is optional.
# If provided then this command will be executed on remote host.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then
Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP" Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP"
_savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop" _savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop"
@ -58,71 +75,114 @@ sshdeploy_deploy() {
_info "Will stop remote service with command $Le_Deploy_ssh_service_stop" _info "Will stop remote service with command $Le_Deploy_ssh_service_stop"
fi fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then
Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE" Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE"
_savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile" _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
fi fi
if [ -n "$Le_Deploy_ssh_keyfile" ]; then if [ -n "$Le_Deploy_ssh_keyfile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;"
_info "will copy private key to remote file $Le_Deploy_ssh_keyfile" _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
fi fi
# CERTFILE is optional.
# If provided then private key will be copied or appended to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then
Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE" Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE"
_savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile" _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
fi fi
if [ -n "$Le_Deploy_ssh_certfile" ]; then if [ -n "$Le_Deploy_ssh_certfile" ]; then
if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
# if filename is same as that provided for private key then append.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;"
_info "will append certificate to same file" _info "will append certificate to same file"
else else
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;" _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;"
_info "will copy certificate to remote file $Le_Deploy_ssh_certfile" _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
fi fi
fi fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then
Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE" Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE"
_savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile" _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
fi fi
if [ -n "$Le_Deploy_ssh_cafile" ]; then if [ -n "$Le_Deploy_ssh_cafile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;" _cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;"
_info "will copy CA file to remote file $Le_Deploy_ssh_cafile" _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
fi fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then
Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN" Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN"
_savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain" _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
fi fi
if [ -n "$Le_Deploy_ssh_fullchain" ]; then if [ -n "$Le_Deploy_ssh_fullchain" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;" _cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;"
_info "will copy full chain to remote file $Le_Deploy_ssh_fullchain" _info "will copy full chain to remote file $Le_Deploy_ssh_fullchain"
fi fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop.
if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then
Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD" Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD"
_savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd" _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
fi fi
if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_remote_cmd ;" if [ -n "$Le_Deploy_ssh_service_stop" ]; then
_info "Will sleep 2 seconds then execute remote command $Le_Deploy_ssh_remote_cmd" _cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd ;"
_info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
fi fi
# SERVICE_START is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop or previous command.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then
Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START" Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START"
_savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start" _savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start"
fi fi
if [ -n "$Le_Deploy_ssh_service_start" ]; then if [ -n "$Le_Deploy_ssh_service_start" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_service_start ;" if [ -n "$Le_Deploy_ssh_service_stop" ] || [ -n "$Le_Deploy_ssh_remote_cmd" ] ; then
_info "Will sleep 2 seconds then start remote service with command $Le_Deploy_ssh_remote_cmd" _cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_service_start ;"
_info "Will start remote service with command $Le_Deploy_ssh_remote_cmd"
fi fi
_cmdstr="$_cmdstr }" if [ -z "$_cmdstr" ]; then
_err "No remote commands to excute. Failed to deploy certificates to remote server"
_debug "Remote command to execute: $_cmdstr" return 1
else
# something to execute.
# run cleanup on the backup directory, erase all older than 180 days.
_cmdstr="find $_homedir/* -type d -mtime +180 2>/dev/null | xargs rm -rf ; $_cmdstr"
# Create our backup directory for overwritten cert files.
_cmdstr="mkdir -p $_backupdir ; $_cmdstr"
fi
_debug "Remote commands to execute: $_cmdstr"
_info "Submitting sequence of commands to remote server by ssh" _info "Submitting sequence of commands to remote server by ssh"
ssh -T "$Le_Deploy_ssh_url" bash -c "'$_cmdstr'" ssh -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
return 0 return 0
} }