@ -14,7 +14,7 @@
# The following examples are for QNAP NAS running QTS 4.2 # The following examples are for QNAP NAS running QTS 4.2
# export DEPLOY_SSH_CMD="" # defaults to "ssh -T" # export DEPLOY_SSH_CMD="" # defaults to "ssh -T"
# export DEPLOY_SSH_USER="admin" # required # export DEPLOY_SSH_USER="admin" # required
# export DEPLOY_SSH_SERVER="qnap" # defaults to domain name
# export DEPLOY_SSH_SERVER="host1 host2:8022 192.168.0.1:9022" # defaults to domain name, support multiple servers with optional port
# export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem" # export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem" # export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem" # export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
@ -23,6 +23,8 @@
# export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value # export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value
# export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy # export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy
# export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value # export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value
# export DEPLOY_SSH_USE_SCP="" yes or no, default to no
# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -q"
# #
######## Public functions ##################### ######## Public functions #####################
@ -42,72 +44,134 @@ ssh_deploy() {
_debug _cfullchain " $_cfullchain " _debug _cfullchain " $_cfullchain "
# USER is required to login by SSH to remote host. # USER is required to login by SSH to remote host.
_migratedeployconf Le_Deploy_ssh_user DEPLOY_SSH_USER
_getdeployconf DEPLOY_SSH_USER _getdeployconf DEPLOY_SSH_USER
_debug2 DEPLOY_SSH_USER " $DEPLOY_SSH_USER " _debug2 DEPLOY_SSH_USER " $DEPLOY_SSH_USER "
if [ -z " $DEPLOY_SSH_USER " ] ; then if [ -z " $DEPLOY_SSH_USER " ] ; then
if [ -z " $Le_Deploy_ssh_user " ] ; then
_err "DEPLOY_SSH_USER not defined."
return 1
fi
else
Le_Deploy_ssh_user = " $DEPLOY_SSH_USER "
_savedomainconf Le_Deploy_ssh_user " $Le_Deploy_ssh_user "
_err "DEPLOY_SSH_USER not defined."
return 1
fi fi
_savedeployconf DEPLOY_SSH_USER " $DEPLOY_SSH_USER "
# SERVER is optional. If not provided then use _cdomain # SERVER is optional. If not provided then use _cdomain
_migratedeployconf Le_Deploy_ssh_server DEPLOY_SSH_SERVER
_getdeployconf DEPLOY_SSH_SERVER _getdeployconf DEPLOY_SSH_SERVER
_debug2 DEPLOY_SSH_SERVER " $DEPLOY_SSH_SERVER " _debug2 DEPLOY_SSH_SERVER " $DEPLOY_SSH_SERVER "
if [ -n " $DEPLOY_SSH_SERVER " ] ; then
Le_Deploy_ssh_server = " $DEPLOY_SSH_SERVER "
_savedomainconf Le_Deploy_ssh_server " $Le_Deploy_ssh_server "
elif [ -z " $Le_Deploy_ssh_server " ] ; then
Le_Deploy_ssh_server = " $_cdomain "
if [ -z " $DEPLOY_SSH_SERVER " ] ; then
DEPLOY_SSH_SERVER = " $_cdomain "
fi fi
_savedeployconf DEPLOY_SSH_SERVER " $DEPLOY_SSH_SERVER "
# CMD is optional. If not provided then use ssh # CMD is optional. If not provided then use ssh
_migratedeployconf Le_Deploy_ssh_cmd DEPLOY_SSH_CMD
_getdeployconf DEPLOY_SSH_CMD _getdeployconf DEPLOY_SSH_CMD
_debug2 DEPLOY_SSH_CMD " $DEPLOY_SSH_CMD " _debug2 DEPLOY_SSH_CMD " $DEPLOY_SSH_CMD "
if [ -n " $DEPLOY_SSH_CMD " ] ; then
Le_Deploy_ssh_cmd = " $DEPLOY_SSH_CMD "
_savedomainconf Le_Deploy_ssh_cmd " $Le_Deploy_ssh_cmd "
elif [ -z " $Le_Deploy_ssh_cmd " ] ; then
Le_Deploy_ssh_cmd = "ssh -T"
if [ -z " $DEPLOY_SSH_CMD " ] ; then
DEPLOY_SSH_CMD = "ssh -T"
fi fi
_savedeployconf DEPLOY_SSH_CMD " $DEPLOY_SSH_CMD "
# BACKUP is optional. If not provided then default to previously saved value or yes. # BACKUP is optional. If not provided then default to previously saved value or yes.
_migratedeployconf Le_Deploy_ssh_backup DEPLOY_SSH_BACKUP
_getdeployconf DEPLOY_SSH_BACKUP _getdeployconf DEPLOY_SSH_BACKUP
_debug2 DEPLOY_SSH_BACKUP " $DEPLOY_SSH_BACKUP " _debug2 DEPLOY_SSH_BACKUP " $DEPLOY_SSH_BACKUP "
if [ " $DEPLOY_SSH_BACKUP " = "no" ] ; then
Le_Deploy_ssh_backup = "no"
elif [ -z " $Le_Deploy_ssh_backup " ] || [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
Le_Deploy_ssh_backup = "yes"
if [ -z " $DEPLOY_SSH_BACKUP " ] ; then
DEPLOY_SSH_BACKUP = "yes"
fi fi
_savedomainconf Le_Deploy_ssh_backup " $Le_Deploy_ssh_backup "
_savedeployconf DEPLOY_SSH_BACKUP " $DEPLOY_SSH_BACKUP "
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
_migratedeployconf Le_Deploy_ssh_backup_path DEPLOY_SSH_BACKUP_PATH
_getdeployconf DEPLOY_SSH_BACKUP_PATH _getdeployconf DEPLOY_SSH_BACKUP_PATH
_debug2 DEPLOY_SSH_BACKUP_PATH " $DEPLOY_SSH_BACKUP_PATH " _debug2 DEPLOY_SSH_BACKUP_PATH " $DEPLOY_SSH_BACKUP_PATH "
if [ -n " $DEPLOY_SSH_BACKUP_PATH " ] ; then
Le_Deploy_ssh_backup_path = " $DEPLOY_SSH_BACKUP_PATH "
elif [ -z " $Le_Deploy_ssh_backup_path " ] ; then
Le_Deploy_ssh_backup_path = ".acme_ssh_deploy"
if [ -z " $DEPLOY_SSH_BACKUP_PATH " ] ; then
DEPLOY_SSH_BACKUP_PATH = ".acme_ssh_deploy"
fi fi
_savedomainconf Le_Deploy_ssh_backup_path " $Le_Deploy_ssh_backup_path "
_savedeployconf DEPLOY_SSH_BACKUP_PATH " $DEPLOY_SSH_BACKUP_PATH "
# MULTI_CALL is optional. If not provided then default to previously saved # MULTI_CALL is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no"). # value (which may be undefined... equivalent to "no").
_migratedeployconf Le_Deploy_ssh_multi_call DEPLOY_SSH_MULTI_CALL
_getdeployconf DEPLOY_SSH_MULTI_CALL _getdeployconf DEPLOY_SSH_MULTI_CALL
_debug2 DEPLOY_SSH_MULTI_CALL " $DEPLOY_SSH_MULTI_CALL " _debug2 DEPLOY_SSH_MULTI_CALL " $DEPLOY_SSH_MULTI_CALL "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
Le_Deploy_ssh_multi_call = "yes"
_savedomainconf Le_Deploy_ssh_multi_call " $Le_Deploy_ssh_multi_call "
elif [ " $DEPLOY_SSH_MULTI_CALL " = "no" ] ; then
Le_Deploy_ssh_multi_call = ""
_cleardomainconf Le_Deploy_ssh_multi_call
if [ -z " $DEPLOY_SSH_MULTI_CALL " ] ; then
DEPLOY_SSH_MULTI_CALL = "no"
fi
_savedeployconf DEPLOY_SSH_MULTI_CALL " $DEPLOY_SSH_MULTI_CALL "
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
_migratedeployconf Le_Deploy_ssh_keyfile DEPLOY_SSH_KEYFILE
_getdeployconf DEPLOY_SSH_KEYFILE
_debug2 DEPLOY_SSH_KEYFILE " $DEPLOY_SSH_KEYFILE "
if [ -n " $DEPLOY_SSH_KEYFILE " ] ; then
_savedeployconf DEPLOY_SSH_KEYFILE " $DEPLOY_SSH_KEYFILE "
fi
# CERTFILE is optional.
# If provided then certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_certfile DEPLOY_SSH_CERTFILE
_getdeployconf DEPLOY_SSH_CERTFILE
_debug2 DEPLOY_SSH_CERTFILE " $DEPLOY_SSH_CERTFILE "
if [ -n " $DEPLOY_SSH_CERTFILE " ] ; then
_savedeployconf DEPLOY_SSH_CERTFILE " $DEPLOY_SSH_CERTFILE "
fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_cafile DEPLOY_SSH_CAFILE
_getdeployconf DEPLOY_SSH_CAFILE
_debug2 DEPLOY_SSH_CAFILE " $DEPLOY_SSH_CAFILE "
if [ -n " $DEPLOY_SSH_CAFILE " ] ; then
_savedeployconf DEPLOY_SSH_CAFILE " $DEPLOY_SSH_CAFILE "
fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_fullchain DEPLOY_SSH_FULLCHAIN
_getdeployconf DEPLOY_SSH_FULLCHAIN
_debug2 DEPLOY_SSH_FULLCHAIN " $DEPLOY_SSH_FULLCHAIN "
if [ -n " $DEPLOY_SSH_FULLCHAIN " ] ; then
_savedeployconf DEPLOY_SSH_FULLCHAIN " $DEPLOY_SSH_FULLCHAIN "
fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
_migratedeployconf Le_Deploy_ssh_remote_cmd DEPLOY_SSH_REMOTE_CMD
_getdeployconf DEPLOY_SSH_REMOTE_CMD
_debug2 DEPLOY_SSH_REMOTE_CMD " $DEPLOY_SSH_REMOTE_CMD "
if [ -n " $DEPLOY_SSH_REMOTE_CMD " ] ; then
_savedeployconf DEPLOY_SSH_REMOTE_CMD " $DEPLOY_SSH_REMOTE_CMD "
fi
# USE_SCP is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no").
_getdeployconf DEPLOY_SSH_USE_SCP
_debug2 DEPLOY_SSH_USE_SCP " $DEPLOY_SSH_USE_SCP "
if [ -z " $DEPLOY_SSH_USE_SCP " ] ; then
DEPLOY_SSH_USE_SCP = "no"
fi
_savedeployconf DEPLOY_SSH_USE_SCP " $DEPLOY_SSH_USE_SCP "
# SCP_CMD is optional. If not provided then use scp
_getdeployconf DEPLOY_SSH_SCP_CMD
_debug2 DEPLOY_SSH_SCP_CMD " $DEPLOY_SSH_SCP_CMD "
if [ -z " $DEPLOY_SSH_SCP_CMD " ] ; then
DEPLOY_SSH_SCP_CMD = "scp -q"
fi
_savedeployconf DEPLOY_SSH_SCP_CMD " $DEPLOY_SSH_SCP_CMD "
if [ " $DEPLOY_SSH_USE_SCP " = "yes" ] ; then
DEPLOY_SSH_MULTI_CALL = "yes"
_info "Using scp as alternate method for copying files. Multicall Mode is implicit"
elif [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
_info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
else
_info "Required commands batched and sent in single call to remote host"
fi fi
_deploy_ssh_servers = $Le_Deploy_ssh_server
for Le_Deploy_ssh_server in $_deploy_ssh_servers ; do
_deploy_ssh_servers = " $DEPLOY_SSH_SERVER "
for DEPLOY_SSH_SERVER in $_deploy_ssh_servers ; do
_ssh_deploy _ssh_deploy
done done
} }
@ -117,16 +181,25 @@ _ssh_deploy() {
_cmdstr = "" _cmdstr = ""
_backupprefix = "" _backupprefix = ""
_backupdir = "" _backupdir = ""
_local_cert_file = ""
_local_ca_file = ""
_local_full_file = ""
_info " Deploy certificates to remote server $Le_Deploy_ssh_user @ $Le_Deploy_ssh_server "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
_info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
else
_info "Required commands batched and sent in single call to remote host"
fi
case $DEPLOY_SSH_SERVER in
*:*)
_host = ${ DEPLOY_SSH_SERVER % : * }
_port = ${ DEPLOY_SSH_SERVER ##* : }
; ;
*)
_host = $DEPLOY_SSH_SERVER
_port =
; ;
esac
if [ " $Le_Deploy_ssh_backup " = "yes" ] ; then
_backupprefix = " $Le_Deploy_ssh_backup_path / $_cdomain -backup "
_info " Deploy certificates to remote server $DEPLOY_SSH_USER @ $_host : $_port "
if [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
_backupprefix = " $DEPLOY_SSH_BACKUP_PATH / $_cdomain -backup "
_backupdir = " $_backupprefix - $( _utc_date | tr ' ' '-' ) " _backupdir = " $_backupprefix - $( _utc_date | tr ' ' '-' ) "
# run cleanup on the backup directory, erase all older # run cleanup on the backup directory, erase all older
# than 180 days (15552000 seconds). # than 180 days (15552000 seconds).
@ -138,7 +211,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
_cmdstr = " mkdir -p $_backupdir ; $_cmdstr " _cmdstr = " mkdir -p $_backupdir ; $_cmdstr "
_info " Backup of old certificate files will be placed in remote directory $_backupdir " _info " Backup of old certificate files will be placed in remote directory $_backupdir "
_info "Backup directories erased after 180 days." _info "Backup directories erased after 180 days."
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code return $_err_code
fi fi
@ -146,129 +219,184 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
fi fi
fi fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
_getdeployconf DEPLOY_SSH_KEYFILE
_debug2 DEPLOY_SSH_KEYFILE " $DEPLOY_SSH_KEYFILE "
if [ -n " $DEPLOY_SSH_KEYFILE " ] ; then if [ -n " $DEPLOY_SSH_KEYFILE " ] ; then
Le_Deploy_ssh_keyfile = " $DEPLOY_SSH_KEYFILE "
_savedomainconf Le_Deploy_ssh_keyfile " $Le_Deploy_ssh_keyfile "
fi
if [ -n " $Le_Deploy_ssh_keyfile " ] ; then
if [ " $Le_Deploy_ssh_backup " = "yes" ] ; then
if [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
# backup file we are about to overwrite. # backup file we are about to overwrite.
_cmdstr = " $_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir >/dev/null; "
_cmdstr = " $_cmdstr cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null; "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
# copy new certificate into file.
_cmdstr = " $_cmdstr echo \" $( cat " $_ckey " ) \" > $Le_Deploy_ssh_keyfile ; "
_info " will copy private key to remote file $Le_Deploy_ssh_keyfile "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
# copy new key into file.
if [ " $DEPLOY_SSH_USE_SCP " = "yes" ] ; then
# scp the file
if ! _scp_remote_cmd " $_ckey " " $DEPLOY_SSH_KEYFILE " ; then
return $_err_code return $_err_code
fi fi
_cmdstr = ""
else
# ssh echo to the file
_cmdstr = " $_cmdstr echo \" $( cat " $_ckey " ) \" > $DEPLOY_SSH_KEYFILE ; "
_info " will copy private key to remote file $DEPLOY_SSH_KEYFILE "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
fi fi
# CERTFILE is optional.
# If provided then certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CERTFILE
_debug2 DEPLOY_SSH_CERTFILE " $DEPLOY_SSH_CERTFILE "
if [ -n " $DEPLOY_SSH_CERTFILE " ] ; then if [ -n " $DEPLOY_SSH_CERTFILE " ] ; then
Le_Deploy_ssh_certfile = " $DEPLOY_SSH_CERTFILE "
_savedomainconf Le_Deploy_ssh_certfile " $Le_Deploy_ssh_certfile "
fi
if [ -n " $Le_Deploy_ssh_certfile " ] ; then
_pipe = ">" _pipe = ">"
if [ " $Le_Deploy_ssh_certfile " = " $Le_Deploy_ssh_keyfile " ] ; then
if [ " $DEPLOY_SSH_CERTFILE " = " $DEPLOY_SSH_KEYFILE " ] ; then
# if filename is same as previous file then append. # if filename is same as previous file then append.
_pipe = ">>" _pipe = ">>"
elif [ " $Le_Deploy_ssh_backup " = "yes" ] ; then
elif [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
# backup file we are about to overwrite. # backup file we are about to overwrite.
_cmdstr = " $_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null; "
_cmdstr = " $_cmdstr cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null; "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
# copy new certificate into file. # copy new certificate into file.
_cmdstr = " $_cmdstr echo \" $( cat " $_ccert " ) \" $_pipe $Le_Deploy_ssh_certfile ; "
_info " will copy certificate to remote file $Le_Deploy_ssh_certfile "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
if [ " $DEPLOY_SSH_USE_SCP " = "yes" ] ; then
# scp the file
_local_cert_file = $( _mktemp)
if [ " $DEPLOY_SSH_CERTFILE " = " $DEPLOY_SSH_KEYFILE " ] ; then
cat " $_ckey " >>" $_local_cert_file "
fi
cat " $_ccert " >>" $_local_cert_file "
if ! _scp_remote_cmd " $_local_cert_file " " $DEPLOY_SSH_CERTFILE " ; then
return $_err_code return $_err_code
fi fi
_cmdstr = ""
else
# ssh echo to the file
_cmdstr = " $_cmdstr echo \" $( cat " $_ccert " ) \" $_pipe $DEPLOY_SSH_CERTFILE ; "
_info " will copy certificate to remote file $DEPLOY_SSH_CERTFILE "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
fi fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CAFILE
_debug2 DEPLOY_SSH_CAFILE " $DEPLOY_SSH_CAFILE "
if [ -n " $DEPLOY_SSH_CAFILE " ] ; then if [ -n " $DEPLOY_SSH_CAFILE " ] ; then
Le_Deploy_ssh_cafile = " $DEPLOY_SSH_CAFILE "
_savedomainconf Le_Deploy_ssh_cafile " $Le_Deploy_ssh_cafile "
fi
if [ -n " $Le_Deploy_ssh_cafile " ] ; then
_pipe = ">" _pipe = ">"
if [ " $Le_Deploy_ssh_cafile " = " $Le_Deploy_ssh_keyfile " ] ||
[ " $Le_Deploy_ssh_cafile " = " $Le_Deploy_ssh_certfile " ] ; then
if [ " $DEPLOY_SSH_CAFILE " = " $DEPLOY_SSH_KEYFILE " ] ||
[ " $DEPLOY_SSH_CAFILE " = " $DEPLOY_SSH_CERTFILE " ] ; then
# if filename is same as previous file then append. # if filename is same as previous file then append.
_pipe = ">>" _pipe = ">>"
elif [ " $Le_Deploy_ssh_backup " = "yes" ] ; then
elif [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
# backup file we are about to overwrite. # backup file we are about to overwrite.
_cmdstr = " $_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir >/dev/null; "
_cmdstr = " $_cmdstr cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null; "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
# copy new certificate into file. # copy new certificate into file.
_cmdstr = " $_cmdstr echo \" $( cat " $_cca " ) \" $_pipe $Le_Deploy_ssh_cafile ; "
_info " will copy CA file to remote file $Le_Deploy_ssh_cafile "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
if [ " $DEPLOY_SSH_USE_SCP " = "yes" ] ; then
# scp the file
_local_ca_file = $( _mktemp)
if [ " $DEPLOY_SSH_CAFILE " = " $DEPLOY_SSH_KEYFILE " ] ; then
cat " $_ckey " >>" $_local_ca_file "
fi
if [ " $DEPLOY_SSH_CAFILE " = " $DEPLOY_SSH_CERTFILE " ] ; then
cat " $_ccert " >>" $_local_ca_file "
fi
cat " $_cca " >>" $_local_ca_file "
if ! _scp_remote_cmd " $_local_ca_file " " $DEPLOY_SSH_CAFILE " ; then
return $_err_code return $_err_code
fi fi
_cmdstr = ""
else
# ssh echo to the file
_cmdstr = " $_cmdstr echo \" $( cat " $_cca " ) \" $_pipe $DEPLOY_SSH_CAFILE ; "
_info " will copy CA file to remote file $DEPLOY_SSH_CAFILE "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
fi fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_FULLCHAIN
_debug2 DEPLOY_SSH_FULLCHAIN " $DEPLOY_SSH_FULLCHAIN "
if [ -n " $DEPLOY_SSH_FULLCHAIN " ] ; then if [ -n " $DEPLOY_SSH_FULLCHAIN " ] ; then
Le_Deploy_ssh_fullchain = " $DEPLOY_SSH_FULLCHAIN "
_savedomainconf Le_Deploy_ssh_fullchain " $Le_Deploy_ssh_fullchain "
fi
if [ -n " $Le_Deploy_ssh_fullchain " ] ; then
_pipe = ">" _pipe = ">"
if [ " $Le_Deploy_ssh_fullchain " = " $Le_Deploy_ssh_keyfile " ] ||
[ " $Le_Deploy_ssh_fullchain " = " $Le_Deploy_ssh_certfile " ] ||
[ " $Le_Deploy_ssh_fullchain " = " $Le_Deploy_ssh_cafile " ] ; then
if [ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_KEYFILE " ] ||
[ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_CERTFILE " ] ||
[ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_CAFILE " ] ; then
# if filename is same as previous file then append. # if filename is same as previous file then append.
_pipe = ">>" _pipe = ">>"
elif [ " $Le_Deploy_ssh_backup " = "yes" ] ; then
elif [ " $DEPLOY_SSH_BACKUP " = "yes" ] ; then
# backup file we are about to overwrite. # backup file we are about to overwrite.
_cmdstr = " $_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir >/dev/null; "
_cmdstr = " $_cmdstr cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null; "
if [ " $DEPLOY_SSH_FULLCHAIN " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
# copy new certificate into file. # copy new certificate into file.
_cmdstr = " $_cmdstr echo \" $( cat " $_cfullchain " ) \" $_pipe $Le_Deploy_ssh_fullchain ; "
_info " will copy fullchain to remote file $Le_Deploy_ssh_fullchain "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
if [ " $DEPLOY_SSH_USE_SCP " = "yes" ] ; then
# scp the file
_local_full_file = $( _mktemp)
if [ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_KEYFILE " ] ; then
cat " $_ckey " >>" $_local_full_file "
fi
if [ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_CERTFILE " ] ; then
cat " $_ccert " >>" $_local_full_file "
fi
if [ " $DEPLOY_SSH_FULLCHAIN " = " $DEPLOY_SSH_CAFILE " ] ; then
cat " $_cca " >>" $_local_full_file "
fi
cat " $_cfullchain " >>" $_local_full_file "
if ! _scp_remote_cmd " $_local_full_file " " $DEPLOY_SSH_FULLCHAIN " ; then
return $_err_code return $_err_code
fi fi
_cmdstr = ""
else
# ssh echo to the file
_cmdstr = " $_cmdstr echo \" $( cat " $_cfullchain " ) \" $_pipe $DEPLOY_SSH_FULLCHAIN ; "
_info " will copy fullchain to remote file $DEPLOY_SSH_FULLCHAIN "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code
fi
_cmdstr = ""
fi
fi fi
fi fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
_getdeployconf DEPLOY_SSH_REMOTE_CMD
_debug2 DEPLOY_SSH_REMOTE_CMD " $DEPLOY_SSH_REMOTE_CMD "
if [ -n " $DEPLOY_SSH_REMOTE_CMD " ] ; then
Le_Deploy_ssh_remote_cmd = " $DEPLOY_SSH_REMOTE_CMD "
_savedomainconf Le_Deploy_ssh_remote_cmd " $Le_Deploy_ssh_remote_cmd "
# cleanup local files if any
if [ -f " $_local_cert_file " ] ; then
rm -f " $_local_cert_file "
fi
if [ -f " $_local_ca_file " ] ; then
rm -f " $_local_ca_file "
fi fi
if [ -n " $Le_Deploy_ssh_remote_cmd " ] ; then
_cmdstr = " $_cmdstr $Le_Deploy_ssh_remote_cmd ; "
_info " Will execute remote command $Le_Deploy_ssh_remote_cmd "
if [ " $Le_Deploy_ssh_multi_call " = "yes" ] ; then
if [ -f " $_local_full_file " ] ; then
rm -f " $_local_full_file "
fi
if [ -n " $DEPLOY_SSH_REMOTE_CMD " ] ; then
_cmdstr = " $_cmdstr $DEPLOY_SSH_REMOTE_CMD ; "
_info " Will execute remote command $DEPLOY_SSH_REMOTE_CMD "
if [ " $DEPLOY_SSH_MULTI_CALL " = "yes" ] ; then
if ! _ssh_remote_cmd " $_cmdstr " ; then if ! _ssh_remote_cmd " $_cmdstr " ; then
return $_err_code return $_err_code
fi fi
@ -282,17 +410,25 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
return $_err_code return $_err_code
fi fi
fi fi
# cleanup in case all is ok
return 0 return 0
} }
#cmd #cmd
_ssh_remote_cmd( ) { _ssh_remote_cmd( ) {
_cmd = " $1 " _cmd = " $1 "
_ssh_cmd = " $DEPLOY_SSH_CMD "
if [ -n " $_port " ] ; then
_ssh_cmd = " $_ssh_cmd -p $_port "
fi
_secure_debug " Remote commands to execute: $_cmd " _secure_debug " Remote commands to execute: $_cmd "
_info "Submitting sequence of commands to remote server by ssh"
_info " Submitting sequence of commands to remote server by $_ssh_cmd "
# quotations in bash cmd below intended. Squash travis spellcheck error # quotations in bash cmd below intended. Squash travis spellcheck error
# shellcheck disable=SC2029 # shellcheck disable=SC2029
$Le_Deploy_ssh_cmd " $Le_Deploy_ssh_user @ $Le_Deploy_ssh_server " sh -c " ' $_cmd ' "
$_ssh_cmd " $DEPLOY_SSH_USER @ $_host " sh -c " ' $_cmd ' "
_err_code = " $? " _err_code = " $? "
if [ " $_err_code " != "0" ] ; then if [ " $_err_code " != "0" ] ; then
@ -301,3 +437,26 @@ _ssh_remote_cmd() {
return $_err_code return $_err_code
} }
# cmd scp
_scp_remote_cmd( ) {
_src = $1
_dest = $2
_scp_cmd = " $DEPLOY_SSH_SCP_CMD "
if [ -n " $_port " ] ; then
_scp_cmd = " $_scp_cmd -P $_port "
fi
_secure_debug " Remote copy source $_src to destination $_dest "
_info " Submitting secure copy by $_scp_cmd "
$_scp_cmd " $_src " " $DEPLOY_SSH_USER " @" $_host " :" $_dest "
_err_code = " $? "
if [ " $_err_code " != "0" ] ; then
_err " Error code $_err_code returned from scp "
fi
return $_err_code
}
Roman Lumetsberger
2 years ago
GitHub