Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
a4b2cebe
"vscode:/vscode.git/clone" did not exist on "b3624f5a160c2a3372ef1a0ab1858a804b7cbfc0"
Commit
a4b2cebe
authored
Feb 11, 2017
by
David Kerr
Browse files
Make backup of certs on remote server optional. Defaults to yes.
parent
68d708e5
Changes
2
Hide whitespace changes
Inline
Side-by-side
deploy/README.md
View file @
a4b2cebe
...
...
@@ -49,6 +49,7 @@ export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
export
ACME_DEPLOY_SSH_CAFILE
=
"/etc/stunnel/uca.pem"
export
ACME_DEPLOY_SSH_FULLCHAIN
=
""
export
ACME_DEPLOY_SSH_REMOTE_CMD
=
"/etc/init.d/stunnel.sh restart"
export
ACME_DEPLOY_SSH_BACKUP
=
""
```
The values used above are illustrative only and represent those that could
be used to deploy certificates to a QNAP NAS device running QTS 4.2
...
...
@@ -87,8 +88,7 @@ file
Command to execute on the remote server after copying any certificates. This
could be any additional command required for example to stop and restart
the service.
###Backups
###ACME_DEPLOY_SSH_BACKUP
Before writing a certificate file to the remote server the existing
certificate will be copied to a backup directory on the remote server.
These are placed in a hidden directory in the home directory of the SSH
...
...
@@ -97,4 +97,4 @@ user
~/.acme_ssh_deploy/[domain name]-backup-[timestamp]
```
Any backups older than 180 days will be deleted when new certificates
are deployed.
are deployed.
This defaults to "yes" set to "no" to disable backup.
deploy/ssh.sh
View file @
a4b2cebe
...
...
@@ -12,15 +12,16 @@
# Only a username is required. All others are optional.
#
# The following examples are for QNAP NAS running QTS 4.2
# export ACME_DEPLOY_SSH_CMD=""
# export ACME_DEPLOY_SSH_USER="admin"
# export ACME_DEPLOY_SSH_SERVER="qnap"
# export ACME_DEPLOY_SSH_CMD=""
# defaults to ssh
# export ACME_DEPLOY_SSH_USER="admin"
# required
# export ACME_DEPLOY_SSH_SERVER="qnap"
# defaults to domain name
# export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export ACME_DEPLOY_SSH_FULLCHAIN=""
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export ACME_DEPLOY_SSH_BACKUP="" # yes or no, default to yes
#
######## Public functions #####################
#domain keyfile certfile cafile fullchain
...
...
@@ -73,6 +74,14 @@ ssh_deploy() {
Le_Deploy_ssh_cmd
=
"ssh"
fi
# BACKUP is optional. If not provided then default to yes
if
[
"
$ACME_DEPLOY_SSH_BACKUP
"
=
"no"
]
;
then
Le_Deploy_ssh_backup
=
"no"
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
;
then
Le_Deploy_ssh_backup
=
"yes"
fi
_savedomainconf Le_Deploy_ssh_backup
"
$Le_Deploy_ssh_backup
"
_info
"Deploy certificates to remote server
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
# KEYFILE is optional.
...
...
@@ -82,8 +91,10 @@ ssh_deploy() {
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
fi
if
[
-n
"
$Le_Deploy_ssh_keyfile
"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_keyfile
$_backupdir
;"
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_keyfile
$_backupdir
;"
fi
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ckey
"
)
\"
>
$Le_Deploy_ssh_keyfile
;"
_info
"will copy private key to remote file
$Le_Deploy_ssh_keyfile
"
...
...
@@ -96,13 +107,13 @@ ssh_deploy() {
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
fi
if
[
-n
"
$Le_Deploy_ssh_certfile
"
]
;
then
_pipe
=
">"
if
[
"
$Le_Deploy_ssh_certfile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
;
then
# if filename is same as previous file then append.
_pipe
=
">>"
el
se
el
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_certfile
$_backupdir
;"
_pipe
=
">"
fi
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ccert
"
)
\"
$_pipe
$Le_Deploy_ssh_certfile
;"
...
...
@@ -116,14 +127,14 @@ ssh_deploy() {
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
fi
if
[
-n
"
$Le_Deploy_ssh_cafile
"
]
;
then
if
[
"
$Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
||
[
"
$Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_certfile
"
]
;
then
_pipe
=
">"
if
[
"
$Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
\
||
[
"
$Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_certfile
"
]
;
then
# if filename is same as previous file then append.
_pipe
=
">>"
el
se
el
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_cafile
$_backupdir
;"
_pipe
=
">"
fi
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cca
"
)
\"
$_pipe
$Le_Deploy_ssh_cafile
;"
...
...
@@ -137,15 +148,15 @@ ssh_deploy() {
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
fi
if
[
-n
"
$Le_Deploy_ssh_fullchain
"
]
;
then
if
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_keyfile
"
]
||
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_certfile
"
]
||
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_cafile
"
]
;
then
_pipe
=
">"
if
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_keyfile
"
]
\
||
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_certfile
"
]
\
||
[
"
$Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_cafile
"
]
;
then
# if filename is same as previous file then append.
_pipe
=
">>"
el
se
el
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_fullchain
$_backupdir
;"
_pipe
=
">"
fi
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cfullchain
"
)
\"
$_pipe
$Le_Deploy_ssh_fullchain
;"
...
...
@@ -166,8 +177,7 @@ ssh_deploy() {
if
[
-z
"
$_cmdstr
"
]
;
then
_err
"No remote commands to excute. Failed to deploy certificates to remote server"
return
1
else
# something to execute.
elif
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# run cleanup on the backup directory, erase all older than 180 days.
_cmdstr
=
"find
$_backupprefix
* -type d -mtime +180 2>/dev/null | xargs rm -rf ;
$_cmdstr
"
# Create our backup directory for overwritten cert files.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment