You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

111 lines
3.6 KiB

6 years ago
  1. #!/usr/bin/env sh
  2. # Here is a script to deploy cert to routeros router.
  3. # Deploy the cert to remote routeros
  4. #
  5. # ```sh
  6. # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
  7. # ```
  8. #
  9. # Before you can deploy the certificate to router os, you need
  10. # to add the id_rsa.pub key to the routeros and assign a user
  11. # to that key.
  12. #
  13. # The user need to have access to ssh, ftp, read and write.
  14. #
  15. # There are no need to enable ftp service for the script to work,
  16. # as they are transmitted over SCP, however ftp is needed to store
  17. # the files on the router.
  18. #
  19. # Then you need to set the environment variables for the
  20. # deploy script to work.
  21. #
  22. # ```sh
  23. # export ROUTER_OS_USERNAME=certuser
  24. # export ROUTER_OS_HOST=router.example.com
  25. #
  26. # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
  27. # ```
  28. #
  29. # The deploy script will remove previously deployed certificates,
  30. # and it does this with an assumption on how RouterOS names imported
  31. # certificates, adding a "cer_0" suffix at the end. This is true for
  32. # versions 6.32 -> 6.41.3, but it is not guaranteed that it will be
  33. # true for future versions when upgrading.
  34. #
  35. # If the router have other certificates with the same name as the one
  36. # beeing deployed, then this script will remove those certificates.
  37. #
  38. # At the end of the script, the services that use those certificates
  39. # could be updated. Currently only the www-ssl service is beeing
  40. # updated, but more services could be added.
  41. #
  42. # For instance:
  43. # ```sh
  44. # export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"
  45. # ```
  46. #
  47. # One optional thing to do as well is to create a script that updates
  48. # all the required services and run that script in a single command.
  49. #
  50. # returns 0 means success, otherwise error.
  51. ######## Public functions #####################
  52. #domain keyfile certfile cafile fullchain
  53. routeros_deploy() {
  54. _cdomain="$1"
  55. _ckey="$2"
  56. _ccert="$3"
  57. _cca="$4"
  58. _cfullchain="$5"
  59. _debug _cdomain "$_cdomain"
  60. _debug _ckey "$_ckey"
  61. _debug _ccert "$_ccert"
  62. _debug _cca "$_cca"
  63. _debug _cfullchain "$_cfullchain"
  64. if [ -z "$ROUTER_OS_HOST" ]; then
  65. _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct."
  66. ROUTER_OS_HOST="$_cdomain"
  67. fi
  68. if [ -z "$ROUTER_OS_USERNAME" ]; then
  69. _err "Need to set the env variable ROUTER_OS_USERNAME"
  70. return 1
  71. fi
  72. if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
  73. _debug "Not enabling additional services"
  74. ROUTER_OS_ADDITIONAL_SERVICES=""
  75. fi
  76. _info "Trying to push key '$_ckey' to router"
  77. scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
  78. _info "Trying to push cert '$_cfullchain' to router"
  79. scp "$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer"
  80. DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive
  81. source=\"## generated by routeros deploy script in acme.sh
  82. \n/certificate remove [ find name=$_cdomain.cer_0 ]
  83. \n/certificate remove [ find name=$_cdomain.cer_1 ]
  84. \ndelay 1
  85. \n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\"
  86. \n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\"
  87. \ndelay 1
  88. \n/file remove $_cdomain.cer
  89. \n/file remove $_cdomain.key
  90. \ndelay 2
  91. \n/ip service set www-ssl certificate=$_cdomain.cer_0
  92. \n$ROUTER_OS_ADDITIONAL_SERVICES
  93. \n\"
  94. "
  95. # shellcheck disable=SC2029
  96. ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "$DEPLOY_SCRIPT_CMD"
  97. # shellcheck disable=SC2029
  98. ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script run \"LE Cert Deploy - $_cdomain\""
  99. # shellcheck disable=SC2029
  100. ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script remove \"LE Cert Deploy - $_cdomain\""
  101. return 0
  102. }