Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
c97c79ab
Commit
c97c79ab
authored
Apr 28, 2017
by
neil
Committed by
GitHub
Apr 28, 2017
Browse files
Merge pull request #809 from thecantero/patch-1
Update to support Kong-v0.10.x
parents
bcd2ee62
1231b712
Changes
2
Show whitespace changes
Inline
Side-by-side
deploy/README.md
View file @
c97c79ab
...
...
@@ -21,8 +21,11 @@ acme.sh --deploy -d example.com --deploy-hook cpanel
## 2. Deploy ssl cert on kong proxy engine based on api.
Before you can deploy your cert, you must
[
issue the cert first
](
https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
)
.
Currently supports Kong-v0.10.x.
(TODO)
```
sh
acme.sh
--deploy
-d
ftp.example.com
--deploy-hook
kong
```
## 3. Deploy the cert to remote server through SSH access.
...
...
deploy/kong.sh
View file @
c97c79ab
#!/usr/bin/env sh
# This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter.
# Note that ssl plugin should be available on Kong instance
# The hook will match cdomain to request_host, in case of multiple domain it will always take the first
# one (acme.sh behaviour).
# If ssl config already exist it will update only cert and key not touching other parameter
# If ssl config doesn't exist it will only upload cert and key and not set other parameter
# Not that we deploy full chain
# See https://getkong.org/plugins/dynamic-ssl/ for other options
# If certificate already exist it will update only cert and key not touching other parameter
# If certificate doesn't exist it will only upload cert and key and not set other parameter
# Note that we deploy full chain
# Written by Geoffroi Genot <ggenot@voxbone.com>
######## Public functions #####################
...
...
@@ -31,14 +25,15 @@ kong_deploy() {
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
#Get uuid linked to the domain
uuid
=
$(
_get
"
$KONG_URL
/apis?request_host=
$_cdomain
"
| _normalizeJson | _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
if
[
-z
"
$uuid
"
]
;
then
_err
"Unable to get Kong uuid for domain
$_cdomain
"
_err
"Make sure that KONG_URL is correctly configured"
_err
"Make sure that a Kong api request_host match the domain"
_err
"Kong url:
$KONG_URL
"
return
1
#Get ssl_uuid linked to the domain
ssl_uuid
=
$(
_get
"
$KONG_URL
/certificates/
$_cdomain
"
| _normalizeJson | _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
if
[
-z
"
$ssl_uuid
"
]
;
then
_debug
"Unable to get Kong ssl_uuid for domain
$_cdomain
"
_debug
"Make sure that KONG_URL is correctly configured"
_debug
"Make sure that a Kong certificate match the sni"
_debug
"Kong url:
$KONG_URL
"
_info
"No existing certificate, creating..."
#return 1
fi
#Save kong url if it's succesful (First run case)
_saveaccountconf KONG_URL
"
$KONG_URL
"
...
...
@@ -48,12 +43,14 @@ kong_deploy() {
#Set Header
_H1
=
"Content-Type: multipart/form-data; boundary=
$delim
"
#Generate data for request (Multipart/form-data with mixed content)
#set name to ssl
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
name
\"
${
nl
}${
nl
}
ssl"
if
[
-z
"
$ssl_uuid
"
]
;
then
#set sni to domain
content
=
"--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
snis
\"
${
nl
}${
nl
}
$_cdomain
"
fi
#add key
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
key
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
#Add cert
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
config.
cert
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
cert
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
#Close multipart
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
#Convert CRLF
...
...
@@ -61,17 +58,16 @@ kong_deploy() {
#DEBUG
_debug header
"
$_H1
"
_debug content
"
$content
"
#Check if ssl plugins is aready enabled (if not => POST else => PATCH)
ssl_uuid
=
$(
_get
"
$KONG_URL
/apis/
$uuid
/plugins"
| _egrep_o
'"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"'
| _egrep_o
'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
)
_debug ssl_uuid
"
$ssl_uuid
"
#Check if sslcreated (if not => POST else => PATCH)
if
[
-z
"
$ssl_uuid
"
]
;
then
#Post certificate to Kong
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
apis/
$uuid
/plugin
s"
""
"POST"
)
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
certificate
s"
""
"POST"
)
else
#patch
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
apis/
$uuid
/plugin
s/
$ssl_uuid
"
""
"PATCH"
)
response
=
$(
_post
"
$content
"
"
$KONG_URL
/
certificate
s/
$ssl_uuid
"
""
"PATCH"
)
fi
if
!
[
"
$(
echo
"
$response
"
| _egrep_o
"
ssl"
)
"
=
"ssl
"
]
;
then
if
!
[
"
$(
echo
"
$response
"
| _egrep_o
"
created_at"
)
"
=
"created_at
"
]
;
then
_err
"An error occurred with cert upload. Check response:"
_err
"
$response
"
return
1
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment