Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
7d75ad4c
Commit
7d75ad4c
authored
Feb 05, 2017
by
David Kerr
Browse files
Backup old certificates before overwriting. Add userid export parameter.
And generate error if nothing to do at remote server.
parent
989651c2
Changes
1
Hide whitespace changes
Inline
Side-by-side
deploy/sshdeploy.sh
View file @
7d75ad4c
#!/usr/bin/env sh
#!/usr/bin/env sh
#
Here is a s
cript to deploy certificates to remote server by
ssh
#
S
cript to deploy certificates to remote server by
SSH
#
This file name is "sshdeploy.sh"
#
Note that SSH must be able to login to remote host without a password...
#
So, here must be a method sshdeploy_deploy()
#
SSH Keys must have been exchanged with the remote host. Validate and
#
Which will be called by acme.sh to deploy the cert
#
test that you can login to USER@URL from the host running acme.sh before
#
returns 0 means success, otherwise error
.
#
using this script
.
#
# The following variables exported from environment will be used.
# The following variables exported from environment will be used.
# If not set then values previously saved in domain.conf file are used.
# If not set then values previously saved in domain.conf file are used.
#
#
# export ACME_DEPLOY_SSH_URL="admin@qnap"
# Only a username is required. All others are optional.
# export ACME_DEPLOY_SSH_SERVICE_STOP="/etc/init.d/stunnel.sh stop"
#
# The following examples are for QNAP NAS running QTS 4.2
# export ACME_DEPLOY_SSH_USER="admin"
# export ACME_DEPLOY_SSH_URL="qnap"
# export ACME_DEPLOY_SSH_SERVICE_STOP=""
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_SERVICE_START="
/etc/init.d/stunnel.sh stop
"
# export ACME_DEPLOY_SSH_SERVICE_START=""
.
"
$DOMAIN_CONF
"
.
"
$DOMAIN_CONF
"
...
@@ -29,7 +33,9 @@ sshdeploy_deploy() {
...
@@ -29,7 +33,9 @@ sshdeploy_deploy() {
_ccert
=
"
$3
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_cfullchain
=
"
$5
"
_cmdstr
=
"{"
_cmdstr
=
""
_homedir
=
"~/.acme_ssh_deploy"
_backupdir
=
"
$_homedir
/certs-backup-
$(
date
+%Y%m%d%H%M%S
)
"
_debug _cdomain
"
$_cdomain
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ckey
"
$_ckey
"
...
@@ -37,18 +43,29 @@ sshdeploy_deploy() {
...
@@ -37,18 +43,29 @@ sshdeploy_deploy() {
_debug _cca
"
$_cca
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
if
[
-z
"
$ACME_DEPLOY_SSH_URL
"
]
;
then
# USER is required to login by SSH to remote host.
if
[
-z
"
$Le_Deploy_ssh_url
"
]
;
then
if
[
-z
"
$ACME_DEPLOY_SSH_USER
"
]
;
then
_err
"ACME_DEPLOY_SSH_URL not defined."
if
[
-z
"
$Le_Deploy_ssh_user
"
]
;
then
_err
"ACME_DEPLOY_SSH_USER not defined."
return
1
return
1
fi
fi
else
else
Le_Deploy_ssh_user
=
"
$ACME_DEPLOY_SSH_USER
"
_savedomainconf Le_Deploy_ssh_user
"
$Le_Deploy_ssh_user
"
fi
# URL is optional. If not provided then use _cdomain
if
[
-n
"
$ACME_DEPLOY_SSH_URL
"
]
;
then
Le_Deploy_ssh_url
=
"
$ACME_DEPLOY_SSH_URL
"
Le_Deploy_ssh_url
=
"
$ACME_DEPLOY_SSH_URL
"
_savedomainconf Le_Deploy_ssh_url
"
$Le_Deploy_ssh_url
"
_savedomainconf Le_Deploy_ssh_url
"
$Le_Deploy_ssh_url
"
elif
[
-z
"
$Le_Deploy_ssh_url
"
]
;
then
Le_Deploy_ssh_url
=
"
$_cdomain
"
fi
fi
_info
"Deploy certificates to remote server
$Le_Deploy_ssh_url
"
_info
"Deploy certificates to remote server
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_url
"
# SERVICE_STOP is optional.
# If provided then this command will be executed on remote host.
if
[
-n
"
$ACME_DEPLOY_SSH_SERVICE_STOP
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_SERVICE_STOP
"
]
;
then
Le_Deploy_ssh_service_stop
=
"
$ACME_DEPLOY_SSH_SERVICE_STOP
"
Le_Deploy_ssh_service_stop
=
"
$ACME_DEPLOY_SSH_SERVICE_STOP
"
_savedomainconf Le_Deploy_ssh_service_stop
"
$Le_Deploy_ssh_service_stop
"
_savedomainconf Le_Deploy_ssh_service_stop
"
$Le_Deploy_ssh_service_stop
"
...
@@ -58,71 +75,114 @@ sshdeploy_deploy() {
...
@@ -58,71 +75,114 @@ sshdeploy_deploy() {
_info
"Will stop remote service with command
$Le_Deploy_ssh_service_stop
"
_info
"Will stop remote service with command
$Le_Deploy_ssh_service_stop
"
fi
fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
if
[
-n
"
$ACME_DEPLOY_SSH_KEYFILE
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_KEYFILE
"
]
;
then
Le_Deploy_ssh_keyfile
=
"
$ACME_DEPLOY_SSH_KEYFILE
"
Le_Deploy_ssh_keyfile
=
"
$ACME_DEPLOY_SSH_KEYFILE
"
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_keyfile
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_keyfile
"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_keyfile
$_backupdir
;"
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ckey
)
\"
>
$Le_Deploy_ssh_keyfile
;"
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ckey
)
\"
>
$Le_Deploy_ssh_keyfile
;"
_info
"will copy private key to remote file
$Le_Deploy_ssh_keyfile
"
_info
"will copy private key to remote file
$Le_Deploy_ssh_keyfile
"
fi
fi
# CERTFILE is optional.
# If provided then private key will be copied or appended to provided filename.
if
[
-n
"
$ACME_DEPLOY_SSH_CERTFILE
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_CERTFILE
"
]
;
then
Le_Deploy_ssh_certfile
=
"
$ACME_DEPLOY_SSH_CERTFILE
"
Le_Deploy_ssh_certfile
=
"
$ACME_DEPLOY_SSH_CERTFILE
"
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_certfile
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_certfile
"
]
;
then
if
[
"
$Le_Deploy_ssh_certfile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
;
then
if
[
"
$Le_Deploy_ssh_certfile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
;
then
# if filename is same as that provided for private key then append.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ccert
)
\"
>>
$Le_Deploy_ssh_certfile
;"
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ccert
)
\"
>>
$Le_Deploy_ssh_certfile
;"
_info
"will append certificate to same file"
_info
"will append certificate to same file"
else
else
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_certfile
$_backupdir
;"
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ccert
)
\"
>
$Le_Deploy_ssh_certfile
;"
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_ccert
)
\"
>
$Le_Deploy_ssh_certfile
;"
_info
"will copy certificate to remote file
$Le_Deploy_ssh_certfile
"
_info
"will copy certificate to remote file
$Le_Deploy_ssh_certfile
"
fi
fi
fi
fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied to provided filename.
if
[
-n
"
$ACME_DEPLOY_SSH_CAFILE
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_CAFILE
"
]
;
then
Le_Deploy_ssh_cafile
=
"
$ACME_DEPLOY_SSH_CAFILE
"
Le_Deploy_ssh_cafile
=
"
$ACME_DEPLOY_SSH_CAFILE
"
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_cafile
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_cafile
"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_cafile
$_backupdir
;"
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_cca
)
\"
>
$Le_Deploy_ssh_cafile
;"
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_cca
)
\"
>
$Le_Deploy_ssh_cafile
;"
_info
"will copy CA file to remote file
$Le_Deploy_ssh_cafile
"
_info
"will copy CA file to remote file
$Le_Deploy_ssh_cafile
"
fi
fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied to provided filename.
if
[
-n
"
$ACME_DEPLOY_SSH_FULLCHAIN
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_FULLCHAIN
"
]
;
then
Le_Deploy_ssh_fullchain
=
"
$ACME_DEPLOY_SSH_FULLCHAIN
"
Le_Deploy_ssh_fullchain
=
"
$ACME_DEPLOY_SSH_FULLCHAIN
"
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_fullchain
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_fullchain
"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_fullchain
$_backupdir
;"
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_cfullchain
)
\"
>
$Le_Deploy_ssh_fullchain
;"
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
$_cfullchain
)
\"
>
$Le_Deploy_ssh_fullchain
;"
_info
"will copy full chain to remote file
$Le_Deploy_ssh_fullchain
"
_info
"will copy full chain to remote file
$Le_Deploy_ssh_fullchain
"
fi
fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop.
if
[
-n
"
$ACME_DEPLOY_SSH_REMOTE_CMD
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_REMOTE_CMD
"
]
;
then
Le_Deploy_ssh_remote_cmd
=
"
$ACME_DEPLOY_SSH_REMOTE_CMD
"
Le_Deploy_ssh_remote_cmd
=
"
$ACME_DEPLOY_SSH_REMOTE_CMD
"
_savedomainconf Le_Deploy_ssh_remote_cmd
"
$Le_Deploy_ssh_remote_cmd
"
_savedomainconf Le_Deploy_ssh_remote_cmd
"
$Le_Deploy_ssh_remote_cmd
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_remote_cmd
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_remote_cmd
"
]
;
then
_cmdstr
=
"
$_cmdstr
sleep 2 ;
$Le_Deploy_ssh_remote_cmd
;"
if
[
-n
"
$Le_Deploy_ssh_service_stop
"
]
;
then
_info
"Will sleep 2 seconds then execute remote command
$Le_Deploy_ssh_remote_cmd
"
_cmdstr
=
"
$_cmdstr
sleep 2 ;"
fi
_cmdstr
=
"
$_cmdstr
$Le_Deploy_ssh_remote_cmd
;"
_info
"Will execute remote command
$Le_Deploy_ssh_remote_cmd
"
fi
fi
# SERVICE_START is optional.
# If provided then this command will be executed on remote host.
# A 2 second delay is inserted to allow system to stabalize after
# executing a service stop or previous command.
if
[
-n
"
$ACME_DEPLOY_SSH_SERVICE_START
"
]
;
then
if
[
-n
"
$ACME_DEPLOY_SSH_SERVICE_START
"
]
;
then
Le_Deploy_ssh_service_start
=
"
$ACME_DEPLOY_SSH_SERVICE_START
"
Le_Deploy_ssh_service_start
=
"
$ACME_DEPLOY_SSH_SERVICE_START
"
_savedomainconf Le_Deploy_ssh_service_start
"
$Le_Deploy_ssh_service_start
"
_savedomainconf Le_Deploy_ssh_service_start
"
$Le_Deploy_ssh_service_start
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_service_start
"
]
;
then
if
[
-n
"
$Le_Deploy_ssh_service_start
"
]
;
then
_cmdstr
=
"
$_cmdstr
sleep 2 ;
$Le_Deploy_ssh_service_start
;"
if
[
-n
"
$Le_Deploy_ssh_service_stop
"
]
||
[
-n
"
$Le_Deploy_ssh_remote_cmd
"
]
;
then
_info
"Will sleep 2 seconds then start remote service with command
$Le_Deploy_ssh_remote_cmd
"
_cmdstr
=
"
$_cmdstr
sleep 2 ;"
fi
_cmdstr
=
"
$_cmdstr
$Le_Deploy_ssh_service_start
;"
_info
"Will start remote service with command
$Le_Deploy_ssh_remote_cmd
"
fi
fi
_cmdstr
=
"
$_cmdstr
}"
if
[
-z
"
$_cmdstr
"
]
;
then
_err
"No remote commands to excute. Failed to deploy certificates to remote server"
_debug
"Remote command to execute:
$_cmdstr
"
return
1
else
# something to execute.
# run cleanup on the backup directory, erase all older than 180 days.
_cmdstr
=
"find
$_homedir
/* -type d -mtime +180 2>/dev/null | xargs rm -rf ;
$_cmdstr
"
# Create our backup directory for overwritten cert files.
_cmdstr
=
"mkdir -p
$_backupdir
;
$_cmdstr
"
fi
_debug
"Remote commands to execute:
$_cmdstr
"
_info
"Submitting sequence of commands to remote server by ssh"
_info
"Submitting sequence of commands to remote server by ssh"
ssh
-T
"
$Le_Deploy_ssh_url
"
bash
-c
"'
$_cmdstr
'"
ssh
-T
"
$Le_Deploy_ssh_
user
@
$Le_Deploy_ssh_
url
"
bash
-c
"'
$_cmdstr
'"
return
0
return
0
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment