You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

286 lines
10 KiB

8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
4 years ago
8 years ago
8 years ago
8 years ago
4 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
  1. #!/usr/bin/env sh
  2. # Script to deploy certificates to remote server by SSH
  3. # Note that SSH must be able to login to remote host without a password...
  4. # SSH Keys must have been exchanged with the remote host. Validate and
  5. # test that you can login to USER@SERVER from the host running acme.sh before
  6. # using this script.
  7. #
  8. # The following variables exported from environment will be used.
  9. # If not set then values previously saved in domain.conf file are used.
  10. #
  11. # Only a username is required. All others are optional.
  12. #
  13. # The following examples are for QNAP NAS running QTS 4.2
  14. # export DEPLOY_SSH_CMD="" # defaults to "ssh -T"
  15. # export DEPLOY_SSH_USER="admin" # required
  16. # export DEPLOY_SSH_SERVER="qnap" # defaults to domain name
  17. # export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
  18. # export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
  19. # export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
  20. # export DEPLOY_SSH_FULLCHAIN=""
  21. # export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
  22. # export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value
  23. # export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy
  24. # export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value
  25. #
  26. ######## Public functions #####################
  27. #domain keyfile certfile cafile fullchain
  28. ssh_deploy() {
  29. _cdomain="$1"
  30. _ckey="$2"
  31. _ccert="$3"
  32. _cca="$4"
  33. _cfullchain="$5"
  34. _deploy_ssh_servers=""
  35. if [ -f "$DOMAIN_CONF" ]; then
  36. # shellcheck disable=SC1090
  37. . "$DOMAIN_CONF"
  38. fi
  39. _debug _cdomain "$_cdomain"
  40. _debug _ckey "$_ckey"
  41. _debug _ccert "$_ccert"
  42. _debug _cca "$_cca"
  43. _debug _cfullchain "$_cfullchain"
  44. # USER is required to login by SSH to remote host.
  45. if [ -z "$DEPLOY_SSH_USER" ]; then
  46. if [ -z "$Le_Deploy_ssh_user" ]; then
  47. _err "DEPLOY_SSH_USER not defined."
  48. return 1
  49. fi
  50. else
  51. Le_Deploy_ssh_user="$DEPLOY_SSH_USER"
  52. _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
  53. fi
  54. # SERVER is optional. If not provided then use _cdomain
  55. if [ -n "$DEPLOY_SSH_SERVER" ]; then
  56. Le_Deploy_ssh_server="$DEPLOY_SSH_SERVER"
  57. _savedomainconf Le_Deploy_ssh_server "$Le_Deploy_ssh_server"
  58. elif [ -z "$Le_Deploy_ssh_server" ]; then
  59. Le_Deploy_ssh_server="$_cdomain"
  60. fi
  61. # CMD is optional. If not provided then use ssh
  62. if [ -n "$DEPLOY_SSH_CMD" ]; then
  63. Le_Deploy_ssh_cmd="$DEPLOY_SSH_CMD"
  64. _savedomainconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
  65. elif [ -z "$Le_Deploy_ssh_cmd" ]; then
  66. Le_Deploy_ssh_cmd="ssh -T"
  67. fi
  68. # BACKUP is optional. If not provided then default to previously saved value or yes.
  69. if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
  70. Le_Deploy_ssh_backup="no"
  71. elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
  72. Le_Deploy_ssh_backup="yes"
  73. fi
  74. _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
  75. # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
  76. if [ -n "$DEPLOY_SSH_BACKUP_PATH" ]; then
  77. Le_Deploy_ssh_backup_path="$DEPLOY_SSH_BACKUP_PATH"
  78. elif [ -z "$Le_Deploy_ssh_backup_path" ]; then
  79. Le_Deploy_ssh_backup_path=".acme_ssh_deploy"
  80. fi
  81. _savedomainconf Le_Deploy_ssh_backup_path "$Le_Deploy_ssh_backup_path"
  82. # MULTI_CALL is optional. If not provided then default to previously saved
  83. # value (which may be undefined... equivalent to "no").
  84. if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
  85. Le_Deploy_ssh_multi_call="yes"
  86. _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
  87. elif [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
  88. Le_Deploy_ssh_multi_call=""
  89. _cleardomainconf Le_Deploy_ssh_multi_call
  90. fi
  91. _deploy_ssh_servers=$Le_Deploy_ssh_server
  92. for Le_Deploy_ssh_server in $_deploy_ssh_servers; do
  93. _ssh_deploy
  94. done
  95. }
  96. _ssh_deploy() {
  97. _err_code=0
  98. _cmdstr=""
  99. _backupprefix=""
  100. _backupdir=""
  101. _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
  102. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  103. _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
  104. else
  105. _info "Required commands batched and sent in single call to remote host"
  106. fi
  107. if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
  108. _backupprefix="$Le_Deploy_ssh_backup_path/$_cdomain-backup"
  109. _backupdir="$_backupprefix-$(_utc_date | tr ' ' '-')"
  110. # run cleanup on the backup directory, erase all older
  111. # than 180 days (15552000 seconds).
  112. _cmdstr="{ now=\"\$(date -u +%s)\"; for fn in $_backupprefix*; \
  113. do if [ -d \"\$fn\" ] && [ \"\$(expr \$now - \$(date -ur \$fn +%s) )\" -ge \"15552000\" ]; \
  114. then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; done; }; $_cmdstr"
  115. # Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
  116. # Create our backup directory for overwritten cert files.
  117. _cmdstr="mkdir -p $_backupdir; $_cmdstr"
  118. _info "Backup of old certificate files will be placed in remote directory $_backupdir"
  119. _info "Backup directories erased after 180 days."
  120. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  121. if ! _ssh_remote_cmd "$_cmdstr"; then
  122. return $_err_code
  123. fi
  124. _cmdstr=""
  125. fi
  126. fi
  127. # KEYFILE is optional.
  128. # If provided then private key will be copied to provided filename.
  129. if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
  130. Le_Deploy_ssh_keyfile="$DEPLOY_SSH_KEYFILE"
  131. _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
  132. fi
  133. if [ -n "$Le_Deploy_ssh_keyfile" ]; then
  134. if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
  135. # backup file we are about to overwrite.
  136. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir >/dev/null;"
  137. fi
  138. # copy new certificate into file.
  139. _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
  140. _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
  141. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  142. if ! _ssh_remote_cmd "$_cmdstr"; then
  143. return $_err_code
  144. fi
  145. _cmdstr=""
  146. fi
  147. fi
  148. # CERTFILE is optional.
  149. # If provided then certificate will be copied or appended to provided filename.
  150. if [ -n "$DEPLOY_SSH_CERTFILE" ]; then
  151. Le_Deploy_ssh_certfile="$DEPLOY_SSH_CERTFILE"
  152. _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
  153. fi
  154. if [ -n "$Le_Deploy_ssh_certfile" ]; then
  155. _pipe=">"
  156. if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
  157. # if filename is same as previous file then append.
  158. _pipe=">>"
  159. elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
  160. # backup file we are about to overwrite.
  161. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null;"
  162. fi
  163. # copy new certificate into file.
  164. _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
  165. _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
  166. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  167. if ! _ssh_remote_cmd "$_cmdstr"; then
  168. return $_err_code
  169. fi
  170. _cmdstr=""
  171. fi
  172. fi
  173. # CAFILE is optional.
  174. # If provided then CA intermediate certificate will be copied or appended to provided filename.
  175. if [ -n "$DEPLOY_SSH_CAFILE" ]; then
  176. Le_Deploy_ssh_cafile="$DEPLOY_SSH_CAFILE"
  177. _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
  178. fi
  179. if [ -n "$Le_Deploy_ssh_cafile" ]; then
  180. _pipe=">"
  181. if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ] ||
  182. [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
  183. # if filename is same as previous file then append.
  184. _pipe=">>"
  185. elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
  186. # backup file we are about to overwrite.
  187. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir >/dev/null;"
  188. fi
  189. # copy new certificate into file.
  190. _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
  191. _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
  192. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  193. if ! _ssh_remote_cmd "$_cmdstr"; then
  194. return $_err_code
  195. fi
  196. _cmdstr=""
  197. fi
  198. fi
  199. # FULLCHAIN is optional.
  200. # If provided then fullchain certificate will be copied or appended to provided filename.
  201. if [ -n "$DEPLOY_SSH_FULLCHAIN" ]; then
  202. Le_Deploy_ssh_fullchain="$DEPLOY_SSH_FULLCHAIN"
  203. _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
  204. fi
  205. if [ -n "$Le_Deploy_ssh_fullchain" ]; then
  206. _pipe=">"
  207. if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ] ||
  208. [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ] ||
  209. [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
  210. # if filename is same as previous file then append.
  211. _pipe=">>"
  212. elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
  213. # backup file we are about to overwrite.
  214. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir >/dev/null;"
  215. fi
  216. # copy new certificate into file.
  217. _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
  218. _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
  219. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  220. if ! _ssh_remote_cmd "$_cmdstr"; then
  221. return $_err_code
  222. fi
  223. _cmdstr=""
  224. fi
  225. fi
  226. # REMOTE_CMD is optional.
  227. # If provided then this command will be executed on remote host.
  228. if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then
  229. Le_Deploy_ssh_remote_cmd="$DEPLOY_SSH_REMOTE_CMD"
  230. _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
  231. fi
  232. if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
  233. _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd;"
  234. _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
  235. if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
  236. if ! _ssh_remote_cmd "$_cmdstr"; then
  237. return $_err_code
  238. fi
  239. _cmdstr=""
  240. fi
  241. fi
  242. # if commands not all sent in multiple calls then all commands sent in a single SSH call now...
  243. if [ -n "$_cmdstr" ]; then
  244. if ! _ssh_remote_cmd "$_cmdstr"; then
  245. return $_err_code
  246. fi
  247. fi
  248. return 0
  249. }
  250. #cmd
  251. _ssh_remote_cmd() {
  252. _cmd="$1"
  253. _secure_debug "Remote commands to execute: $_cmd"
  254. _info "Submitting sequence of commands to remote server by ssh"
  255. # quotations in bash cmd below intended. Squash travis spellcheck error
  256. # shellcheck disable=SC2029
  257. $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmd'"
  258. _err_code="$?"
  259. if [ "$_err_code" != "0" ]; then
  260. _err "Error code $_err_code returned from ssh"
  261. fi
  262. return $_err_code
  263. }