Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
b6fbb012
Unverified
Commit
b6fbb012
authored
Apr 12, 2020
by
neil
Committed by
GitHub
Apr 12, 2020
Browse files
Merge pull request #2749 from dkerr64/ssh-deploy
Updates to ssh_deploy hook
parents
7f4db5a7
f38df4df
Changes
1
Show whitespace changes
Inline
Side-by-side
deploy/ssh.sh
View file @
b6fbb012
...
...
@@ -12,7 +12,7 @@
# Only a username is required. All others are optional.
#
# The following examples are for QNAP NAS running QTS 4.2
# export DEPLOY_SSH_CMD="" # defaults to ssh
# export DEPLOY_SSH_CMD="" # defaults to
"
ssh
-T"
# export DEPLOY_SSH_USER="admin" # required
# export DEPLOY_SSH_SERVER="qnap" # defaults to domain name
# export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
...
...
@@ -20,7 +20,9 @@
# export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export DEPLOY_SSH_FULLCHAIN=""
# export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
# export DEPLOY_SSH_BACKUP="" # yes or no, default to yes
# export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value
# export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy
# export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value
#
######## Public functions #####################
...
...
@@ -31,10 +33,10 @@ ssh_deploy() {
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_err_code
=
0
_cmdstr
=
""
_homedir
=
'~'
_backupprefix
=
"
$_homedir
/.acme_ssh_deploy/
$_cdomain
-backup"
_backupdir
=
"
$_backupprefix
-
$(
_utc_date |
tr
' '
'-'
)
"
_backupprefix
=
""
_backupdir
=
""
if
[
-f
"
$DOMAIN_CONF
"
]
;
then
# shellcheck disable=SC1090
...
...
@@ -71,18 +73,62 @@ ssh_deploy() {
Le_Deploy_ssh_cmd
=
"
$DEPLOY_SSH_CMD
"
_savedomainconf Le_Deploy_ssh_cmd
"
$Le_Deploy_ssh_cmd
"
elif
[
-z
"
$Le_Deploy_ssh_cmd
"
]
;
then
Le_Deploy_ssh_cmd
=
"ssh"
Le_Deploy_ssh_cmd
=
"ssh
-T
"
fi
# BACKUP is optional. If not provided then default to yes
# BACKUP is optional. If not provided then default to
previously saved value or
yes
.
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"no"
]
;
then
Le_Deploy_ssh_backup
=
"no"
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
;
then
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
||
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
Le_Deploy_ssh_backup
=
"yes"
fi
_savedomainconf Le_Deploy_ssh_backup
"
$Le_Deploy_ssh_backup
"
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
if
[
-n
"
$DEPLOY_SSH_BACKUP_PATH
"
]
;
then
Le_Deploy_ssh_backup_path
=
"
$DEPLOY_SSH_BACKUP_PATH
"
elif
[
-z
"
$Le_Deploy_ssh_backup_path
"
]
;
then
Le_Deploy_ssh_backup_path
=
".acme_ssh_deploy"
fi
_savedomainconf Le_Deploy_ssh_backup_path
"
$Le_Deploy_ssh_backup_path
"
# MULTI_CALL is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no").
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
Le_Deploy_ssh_multi_call
=
"yes"
_savedomainconf Le_Deploy_ssh_multi_call
"
$Le_Deploy_ssh_multi_call
"
elif
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"no"
]
;
then
Le_Deploy_ssh_multi_call
=
""
_cleardomainconf Le_Deploy_ssh_multi_call
fi
_info
"Deploy certificates to remote server
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
_info
"Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
else
_info
"Required commands batched and sent in single call to remote host"
fi
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
_backupprefix
=
"
$Le_Deploy_ssh_backup_path
/
$_cdomain
-backup"
_backupdir
=
"
$_backupprefix
-
$(
_utc_date |
tr
' '
'-'
)
"
# run cleanup on the backup directory, erase all older
# than 180 days (15552000 seconds).
_cmdstr
=
"{ now=
\"\$
(date -u +%s)
\"
; for fn in
$_backupprefix
*;
\
do if [ -d
\"\$
fn
\"
] && [
\"\$
(expr
\$
now -
\$
(date -ur
\$
fn +%s) )
\"
-ge
\"
15552000
\"
];
\
then rm -rf
\"\$
fn
\"
; echo
\"
Backup
\$
fn deleted as older than 180 days
\"
; fi; done; };
$_cmdstr
"
# Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
# Create our backup directory for overwritten cert files.
_cmdstr
=
"mkdir -p
$_backupdir
;
$_cmdstr
"
_info
"Backup of old certificate files will be placed in remote directory
$_backupdir
"
_info
"Backup directories erased after 180 days."
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
...
...
@@ -98,6 +144,12 @@ ssh_deploy() {
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ckey
"
)
\"
>
$Le_Deploy_ssh_keyfile
;"
_info
"will copy private key to remote file
$Le_Deploy_ssh_keyfile
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
# CERTFILE is optional.
...
...
@@ -118,6 +170,12 @@ ssh_deploy() {
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ccert
"
)
\"
$_pipe
$Le_Deploy_ssh_certfile
;"
_info
"will copy certificate to remote file
$Le_Deploy_ssh_certfile
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
# CAFILE is optional.
...
...
@@ -139,6 +197,12 @@ ssh_deploy() {
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cca
"
)
\"
$_pipe
$Le_Deploy_ssh_cafile
;"
_info
"will copy CA file to remote file
$Le_Deploy_ssh_cafile
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
# FULLCHAIN is optional.
...
...
@@ -161,6 +225,12 @@ ssh_deploy() {
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cfullchain
"
)
\"
$_pipe
$Le_Deploy_ssh_fullchain
;"
_info
"will copy fullchain to remote file
$Le_Deploy_ssh_fullchain
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
# REMOTE_CMD is optional.
...
...
@@ -172,34 +242,36 @@ ssh_deploy() {
if
[
-n
"
$Le_Deploy_ssh_remote_cmd
"
]
;
then
_cmdstr
=
"
$_cmdstr
$Le_Deploy_ssh_remote_cmd
;"
_info
"Will execute remote command
$Le_Deploy_ssh_remote_cmd
"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
if
[
-z
"
$_cmdstr
"
]
;
then
_err
"No remote commands to excute. Failed to deploy certificates to remote server"
return
1
elif
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# run cleanup on the backup directory, erase all older
# than 180 days (15552000 seconds).
_cmdstr
=
"{ now=
\"\$
(date -u +%s)
\"
; for fn in
$_backupprefix
*;
\
do if [ -d
\"\$
fn
\"
] && [
\"\$
(expr
\$
now -
\$
(date -ur
\$
fn +%s) )
\"
-ge
\"
15552000
\"
];
\
then rm -rf
\"\$
fn
\"
; echo
\"
Backup
\$
fn deleted as older than 180 days
\"
; fi; done; };
$_cmdstr
"
# Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
# Create our backup directory for overwritten cert files.
_cmdstr
=
"mkdir -p
$_backupdir
;
$_cmdstr
"
_info
"Backup of old certificate files will be placed in remote directory
$_backupdir
"
_info
"Backup directories erased after 180 days."
# if commands not all sent in multiple calls then all commands sent in a single SSH call now...
if
[
-n
"
$_cmdstr
"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
fi
return
0
}
_secure_debug
"Remote commands to execute: "
"
$_cmdstr
"
#cmd
_ssh_remote_cmd
()
{
_cmd
=
"
$1
"
_secure_debug
"Remote commands to execute:
$_cmd
"
_info
"Submitting sequence of commands to remote server by ssh"
# quotations in bash cmd below intended. Squash travis spellcheck error
# shellcheck disable=SC2029
$Le_Deploy_ssh_cmd
-T
"
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
sh
-c
"'
$_cmd
str
'"
_
ret
=
"
$?
"
$Le_Deploy_ssh_cmd
"
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
sh
-c
"'
$_cmd
'"
_
err_code
=
"
$?
"
if
[
"
$_
ret
"
!=
"0"
]
;
then
_err
"Error code
$_
ret
returned from
$Le_Deploy_ssh_cmd
"
if
[
"
$_
err_code
"
!=
"0"
]
;
then
_err
"Error code
$_
err_code
returned from
ssh
"
fi
return
$_
ret
return
$_
err_code
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment