You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

81 lines
3.3 KiB

8 years ago
8 years ago
8 years ago
8 years ago
  1. #!/usr/bin/env sh
  2. # This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter.
  3. # Note that ssl plugin should be available on Kong instance
  4. # The hook will match cdomain to request_host, in case of multiple domain it will always take the first
  5. # one (acme.sh behaviour).
  6. # If ssl config already exist it will update only cert and key not touching other parameter
  7. # If ssl config doesn't exist it will only upload cert and key and not set other parameter
  8. # Not that we deploy full chain
  9. # See https://getkong.org/plugins/dynamic-ssl/ for other options
  10. # Written by Geoffroi Genot <ggenot@voxbone.com>
  11. ######## Public functions #####################
  12. #domain keyfile certfile cafile fullchain
  13. kong_deploy() {
  14. _cdomain="$1"
  15. _ckey="$2"
  16. _ccert="$3"
  17. _cca="$4"
  18. _cfullchain="$5"
  19. _info "Deploying certificate on Kong instance"
  20. if [ -z "$KONG_URL" ]; then
  21. _debug "KONG_URL Not set, using default http://localhost:8001"
  22. KONG_URL="http://localhost:8001"
  23. fi
  24. _debug _cdomain "$_cdomain"
  25. _debug _ckey "$_ckey"
  26. _debug _ccert "$_ccert"
  27. _debug _cca "$_cca"
  28. _debug _cfullchain "$_cfullchain"
  29. #Get uuid linked to the domain
  30. uuid=$(_get "$KONG_URL/apis?request_host=$_cdomain" | _normalizeJson | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
  31. if [ -z "$uuid" ]; then
  32. _err "Unable to get Kong uuid for domain $_cdomain"
  33. _err "Make sure that KONG_URL is correctly configured"
  34. _err "Make sure that a Kong api request_host match the domain"
  35. _err "Kong url: $KONG_URL"
  36. return 1
  37. fi
  38. #Save kong url if it's succesful (First run case)
  39. _saveaccountconf KONG_URL "$KONG_URL"
  40. #Generate DEIM
  41. delim="-----MultipartDelimiter$(date "+%s%N")"
  42. nl="\015\012"
  43. #Set Header
  44. _H1="Content-Type: multipart/form-data; boundary=$delim"
  45. #Generate data for request (Multipart/form-data with mixed content)
  46. #set name to ssl
  47. content="--$delim${nl}Content-Disposition: form-data; name=\"name\"${nl}${nl}ssl"
  48. #add key
  49. content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
  50. #Add cert
  51. content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.cert\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
  52. #Close multipart
  53. content="$content${nl}--$delim--${nl}"
  54. #Convert CRLF
  55. content=$(printf %b "$content")
  56. #DEBUG
  57. _debug header "$_H1"
  58. _debug content "$content"
  59. #Check if ssl plugins is aready enabled (if not => POST else => PATCH)
  60. ssl_uuid=$(_get "$KONG_URL/apis/$uuid/plugins" | _egrep_o '"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"' | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
  61. _debug ssl_uuid "$ssl_uuid"
  62. if [ -z "$ssl_uuid" ]; then
  63. #Post certificate to Kong
  64. response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins" "" "POST")
  65. else
  66. #patch
  67. response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins/$ssl_uuid" "" "PATCH")
  68. fi
  69. if ! [ "$(echo "$response" | _egrep_o "ssl")" = "ssl" ]; then
  70. _err "An error occurred with cert upload. Check response:"
  71. _err "$response"
  72. return 1
  73. fi
  74. _debug response "$response"
  75. _info "Certificate successfully deployed"
  76. }