Mirror
/
acme.sh
mirror of https://github.com/acmesh-official/acme.sh.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Backup old certificates before overwriting. Add userid export parameter. 

And generate error if nothing to do at remote server.
pull/586/head
David Kerr 8 years ago
parent
989651c23b
commit
7d75ad4c56
1 changed files with 82 additions and 22 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 104
      deploy/sshdeploy.sh

104
deploy/sshdeploy.sh
View File

@ -1,22 +1,26 @@
#!/usr/bin/env sh
#Here is a script to deploy certificates to remote server by ssh
#This file name is "sshdeploy.sh"
#So, here must be a method sshdeploy_deploy()
#Which will be called by acme.sh to deploy the cert
#returns 0 means success, otherwise error.
# Script to deploy certificates to remote server by SSH
# Note that SSH must be able to login to remote host without a password...
# SSH Keys must have been exchanged with the remote host. Validate and
# test that you can login to USER@URL from the host running acme.sh before
# using this script.
#
# The following variables exported from environment will be used.
# If not set then values previously saved in domain.conf file are used.
#
# export ACME_DEPLOY_SSH_URL="admin@qnap"
# export ACME_DEPLOY_SSH_SERVICE_STOP="/etc/init.d/stunnel.sh stop"
# Only a username is required. All others are optional.
#
# The following examples are for QNAP NAS running QTS 4.2
# export ACME_DEPLOY_SSH_USER="admin"
# export ACME_DEPLOY_SSH_URL="qnap"
# export ACME_DEPLOY_SSH_SERVICE_STOP=""
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_SERVICE_START="/etc/init.d/stunnel.sh stop"
# export ACME_DEPLOY_SSH_SERVICE_START=""
. "$DOMAIN_CONF"
@ -29,7 +33,9 @@ sshdeploy_deploy() {
_ccert="$3"
_cca="$4"
_cfullchain="$5"
_cmdstr="{"
_cmdstr=""
_homedir="~/.acme_ssh_deploy"
_backupdir="$_homedir/certs-backup-$(date +%Y%m%d%H%M%S)"
_debug _cdomain "$_cdomain"
_debug _ckey "$_ckey"
@ -37,18 +43,29 @@ sshdeploy_deploy() {
_debug _cca "$_cca"
_debug _cfullchain "$_cfullchain"
if [ -z "$ACME_DEPLOY_SSH_URL" ]; then
if [ -z "$Le_Deploy_ssh_url" ]; then
_err "ACME_DEPLOY_SSH_URL not defined."
# USER is required to login by SSH to remote host.
if [ -z "$ACME_DEPLOY_SSH_USER" ]; then
if [ -z "$Le_Deploy_ssh_user" ]; then
_err "ACME_DEPLOY_SSH_USER not defined."
return 1
fi
else
Le_Deploy_ssh_user="$ACME_DEPLOY_SSH_USER"
_savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
fi
# URL is optional. If not provided then use _cdomain
if [ -n "$ACME_DEPLOY_SSH_URL" ]; then
Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL"
_savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url"
elif [ -z "$Le_Deploy_ssh_url" ]; then
Le_Deploy_ssh_url="$_cdomain"
fi
_info "Deploy certificates to remote server $Le_Deploy_ssh_url"
_info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_url"
# SERVICE_STOP is optional.
# If provided then this command will be executed on remote host.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then
Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP"
_savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop"
@ -58,71 +75,114 @@ sshdeploy_deploy() {
_info "Will stop remote service with command $Le_Deploy_ssh_service_stop"
fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then
Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE"
_savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
fi
if [ -n "$Le_Deploy_ssh_keyfile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;"
_info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
fi
# CERTFILE is optional.
# If provided then private key will be copied or appended to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then
Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE"
_savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
fi
if [ -n "$Le_Deploy_ssh_certfile" ]; then
if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
# if filename is same as that provided for private key then append.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;"
_info "will append certificate to same file"
else
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;"
_info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
fi
fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then
Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE"
_savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
fi
if [ -n "$Le_Deploy_ssh_cafile" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;"
_info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied to provided filename.
if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then
Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN"
_savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
fi
if [ -n "$Le_Deploy_ssh_fullchain" ]; then
# backup file we are about to overwrite.
_cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir ;"
# copy new certificate into file.
_cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;"
_info "will copy full chain to remote file $Le_Deploy_ssh_fullchain"
fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop.
if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then
Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD"
_savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
fi
if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_remote_cmd ;"
_info "Will sleep 2 seconds then execute remote command $Le_Deploy_ssh_remote_cmd"
if [ -n "$Le_Deploy_ssh_service_stop" ]; then
_cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd ;"
_info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
fi
# SERVICE_START is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop or previous command.
if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then
Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START"
_savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start"
fi
if [ -n "$Le_Deploy_ssh_service_start" ]; then
_cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_service_start ;"
_info "Will sleep 2 seconds then start remote service with command $Le_Deploy_ssh_remote_cmd"
if [ -n "$Le_Deploy_ssh_service_stop" ] || [ -n "$Le_Deploy_ssh_remote_cmd" ] ; then
_cmdstr="$_cmdstr sleep 2 ;"
fi
_cmdstr="$_cmdstr $Le_Deploy_ssh_service_start ;"
_info "Will start remote service with command $Le_Deploy_ssh_remote_cmd"
fi
_cmdstr="$_cmdstr }"
_debug "Remote command to execute: $_cmdstr"
if [ -z "$_cmdstr" ]; then
_err "No remote commands to excute. Failed to deploy certificates to remote server"
return 1
else
# something to execute.
# run cleanup on the backup directory, erase all older than 180 days.
_cmdstr="find $_homedir/* -type d -mtime +180 2>/dev/null | xargs rm -rf ; $_cmdstr"
# Create our backup directory for overwritten cert files.
_cmdstr="mkdir -p $_backupdir ; $_cmdstr"
fi
_debug "Remote commands to execute: $_cmdstr"
_info "Submitting sequence of commands to remote server by ssh"
ssh -T "$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
ssh -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
return 0
}
Write Preview
Loading…
Cancel
Save