Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
b54d6589
Unverified
Commit
b54d6589
authored
Dec 11, 2018
by
neil
Committed by
GitHub
Dec 11, 2018
Browse files
Merge pull request #1957 from pashinin/master
Write certs in Vault for Fabio load balancer
parents
a43545c6
9f067d7f
Changes
2
Hide whitespace changes
Inline
Side-by-side
deploy/README.md
View file @
b54d6589
...
@@ -295,4 +295,40 @@ You can then deploy the certificate as follows
...
@@ -295,4 +295,40 @@ You can then deploy the certificate as follows
```
sh
```
sh
acme.sh
--deploy
-d
www.mydomain.com
--deploy-hook
gitlab
acme.sh
--deploy
-d
www.mydomain.com
--deploy-hook
gitlab
```
```
\ No newline at end of file
## 12. Deploy your cert to Hashicorp Vault
```
sh
export
VAULT_PREFIX
=
"acme"
```
You can then deploy the certificate as follows
```
sh
acme.sh
--deploy
-d
www.mydomain.com
--deploy-hook
vault_cli
```
Your certs will be saved in Vault using this structure:
```
sh
vault write
"
${
VAULT_PREFIX
}
/
${
domain
}
/cert.pem"
value
=
@
"..."
vault write
"
${
VAULT_PREFIX
}
/
${
domain
}
/cert.key"
value
=
@
"..."
vault write
"
${
VAULT_PREFIX
}
/
${
domain
}
/chain.pem"
value
=
@
"..."
vault write
"
${
VAULT_PREFIX
}
/
${
domain
}
/fullchain.pem"
value
=
@
"..."
```
You might be using Fabio load balancer (which can get certs from
Vault). It needs a bit different structure of your certs in Vault. It
gets certs only from keys that were saved in
`prefix/domain`
, like this:
```
bash
vault write <PREFIX>/www.domain.com
cert
=
@cert.pem
key
=
@key.pem
```
If you want to save certs in Vault this way just set "FABIO" env
variable to anything (ex: "1") before running
`acme.sh`
:
```
sh
export
FABIO
=
"1"
```
deploy/vault_cli.sh
View file @
b54d6589
...
@@ -49,9 +49,13 @@ vault_cli_deploy() {
...
@@ -49,9 +49,13 @@ vault_cli_deploy() {
return
1
return
1
fi
fi
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
if
[
-n
"
$FABIO
"
]
;
then
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
else
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
$VAULT_CMD
write
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
fi
}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment