Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
c97c79ab
Commit
c97c79ab
authored
Apr 28, 2017
by
neil
Committed by
GitHub
Apr 28, 2017
Browse files
Merge pull request #809 from thecantero/patch-1
Update to support Kong-v0.10.x
parents
bcd2ee62
1231b712
Changes
2
Hide whitespace changes
Inline
Side-by-side
deploy/README.md
View file @
c97c79ab
...
...
@@ -21,8 +21,11 @@ acme.sh --deploy -d example.com --deploy-hook cpanel
## 2. Deploy ssl cert on kong proxy engine based on api.
Before you can deploy your cert, you must
[
issue the cert first
](
https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
)
.
Currently supports Kong-v0.10.x.
(TODO)
```
sh
acme.sh
--deploy
-d
ftp.example.com
--deploy-hook
kong
```
## 3. Deploy the cert to remote server through SSH access.
...
...
deploy/kong.sh
View file @
c97c79ab
#!/usr/bin/env sh
# This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter.
# Note that ssl plugin should be available on Kong instance
# The hook will match cdomain to request_host, in case of multiple domain it will always take the first
# one (acme.sh behaviour).
# If ssl config already exist it will update only cert and key not touching other parameter
# If ssl config doesn't exist it will only upload cert and key and not set other parameter
# Not that we deploy full chain
# See https://getkong.org/plugins/dynamic-ssl/ for other options
# If certificate already exist it will update only cert and key not touching other parameter
# If certificate doesn't exist it will only upload cert and key and not set other parameter
# Note that we deploy full chain
# Written by Geoffroi Genot <ggenot@voxbone.com>
######## Public functions #####################
...
...
@@ -31,14 +25,15 @@ kong_deploy() {
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
#Get uuid linked to the domain
uuid
=
$(
_get
"
$KONG_URL
/apis?request_host=
$_cdomain
"
| _normalizeJson | _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
if
[
-z
"
$uuid
"
]
;
then
_err
"Unable to get Kong uuid for domain
$_cdomain
"
_err
"Make sure that KONG_URL is correctly configured"
_err
"Make sure that a Kong api request_host match the domain"
_err
"Kong url:
$KONG_URL
"
return
1
#Get ssl_uuid linked to the domain
ssl_uuid
=
$(
_get
"
$KONG_URL
/certificates/
$_cdomain
"
| _normalizeJson | _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
if
[
-z
"
$ssl_uuid
"
]
;
then
_debug
"Unable to get Kong ssl_uuid for domain
$_cdomain
"
_debug
"Make sure that KONG_URL is correctly configured"
_debug
"Make sure that a Kong certificate match the sni"
_debug
"Kong url:
$KONG_URL
"
_info
"No existing certificate, creating..."
#return 1
fi
#Save kong url if it's succesful (First run case)
_saveaccountconf KONG_URL
"
$KONG_URL
"
...
...
@@ -48,12 +43,14 @@ kong_deploy() {
#Set Header
_H1
=
"Content-Type: multipart/form-data; boundary=
$delim
"
#Generate data for request (Multipart/form-data with mixed content)
#set name to ssl
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
name
\"
${
nl
}${
nl
}
ssl"
if
[
-z
"
$ssl_uuid
"
]
;
then
#set sni to domain
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
snis
\"
${
nl
}${
nl
}
$_cdomain
"
fi
#add key
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
#Add cert
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.
cert
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
cert
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
#Close multipart
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
#Convert CRLF
...
...
@@ -61,17 +58,16 @@ kong_deploy() {
#DEBUG
_debug header
"
$_H1
"
_debug content
"
$content
"
#Check if ssl plugins is aready enabled (if not => POST else => PATCH)
ssl_uuid
=
$(
_get
"
$KONG_URL
/apis/
$uuid
/plugins"
| _egrep_o
'"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"'
| _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
_debug ssl_uuid
"
$ssl_uuid
"
#Check if sslcreated (if not => POST else => PATCH)
if
[
-z
"
$ssl_uuid
"
]
;
then
#Post certificate to Kong
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
apis/
$uuid
/plugin
s"
""
"POST"
)
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
certificate
s"
""
"POST"
)
else
#patch
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
apis/
$uuid
/plugin
s/
$ssl_uuid
"
""
"PATCH"
)
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
certificate
s/
$ssl_uuid
"
""
"PATCH"
)
fi
if
!
[
"
$(
echo
"
$response
"
| _egrep_o
"
ssl"
)
"
=
"ssl
"
]
;
then
if
!
[
"
$(
echo
"
$response
"
| _egrep_o
"
created_at"
)
"
=
"created_at
"
]
;
then
_err
"An error occurred with cert upload. Check response:"
_err
"
$response
"
return
1
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment