Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
cb021efa
Unverified
Commit
cb021efa
authored
Jan 31, 2023
by
Roman Lumetsberger
Committed by
GitHub
Jan 31, 2023
Browse files
Merge branch 'acmesh-official:dev' into dev
parents
91e387e8
c2344f37
Changes
13
Show whitespace changes
Inline
Side-by-side
.github/workflows/NetBSD.yml
View file @
cb021efa
...
@@ -61,7 +61,6 @@ jobs:
...
@@ -61,7 +61,6 @@ jobs:
nat
:
|
nat
:
|
"8080": "80"
"8080": "80"
prepare
:
|
prepare
:
|
export PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r|cut -f '1 2' -d.)/All/"
pkg_add curl socat
pkg_add curl socat
usesh
:
true
usesh
:
true
copyback
:
false
copyback
:
false
...
...
.github/workflows/Ubuntu.yml
View file @
cb021efa
...
@@ -80,9 +80,14 @@ jobs:
...
@@ -80,9 +80,14 @@ jobs:
-p 9000:9000 \
-p 9000:9000 \
-e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
-e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT=true" \
-e "DOCKER_STEPCA_INIT_PASSWORD=test" \
--name stepca \
--name stepca \
smallstep/step-ca \
smallstep/step-ca:0.23.1
&& sleep 5 && docker exec stepca step ca provisioner add acme --type ACME \
sleep
5
docker exec stepca bash -c "echo test >test" \
&& docker exec stepca step ca provisioner add acme --type ACME --admin-subject step --admin-password-file=/home/step/test \
&& docker exec stepca kill -1 1 \
&& docker exec stepca kill -1 1 \
&& docker exec stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
&& docker exec stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
- name
:
Clone acmetest
- name
:
Clone acmetest
...
...
.github/workflows/dockerhub.yml
View file @
cb021efa
...
@@ -28,9 +28,9 @@ jobs:
...
@@ -28,9 +28,9 @@ jobs:
id
:
step_one
id
:
step_one
run
:
|
run
:
|
if [ "$DOCKER_PASSWORD" ] ; then
if [ "$DOCKER_PASSWORD" ] ; then
echo "
::set-output name=
hasToken
::
true"
echo "hasToken
=
true"
>>$GITHUB_OUTPUT
else
else
echo "
::set-output name=
hasToken
::
false"
echo "hasToken
=
false"
>>$GITHUB_OUTPUT
fi
fi
-
name
:
Check the value
-
name
:
Check the value
run
:
echo ${{ steps.step_one.outputs.hasToken }}
run
:
echo ${{ steps.step_one.outputs.hasToken }}
...
@@ -43,9 +43,9 @@ jobs:
...
@@ -43,9 +43,9 @@ jobs:
-
name
:
checkout code
-
name
:
checkout code
uses
:
actions/checkout@v3
uses
:
actions/checkout@v3
-
name
:
Set up QEMU
-
name
:
Set up QEMU
uses
:
docker/setup-qemu-action@v
1
uses
:
docker/setup-qemu-action@v
2
-
name
:
Set up Docker Buildx
-
name
:
Set up Docker Buildx
uses
:
docker/setup-buildx-action@v
1
uses
:
docker/setup-buildx-action@v
2
-
name
:
login to docker hub
-
name
:
login to docker hub
run
:
|
run
:
|
echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
...
...
Dockerfile
View file @
cb021efa
FROM
alpine:3.1
6.3
FROM
alpine:3.1
7
RUN
apk
--no-cache
add
-f
\
RUN
apk
--no-cache
add
-f
\
openssl
\
openssl
\
...
@@ -12,7 +12,8 @@ RUN apk --no-cache add -f \
...
@@ -12,7 +12,8 @@ RUN apk --no-cache add -f \
oath-toolkit-oathtool
\
oath-toolkit-oathtool
\
tar
\
tar
\
libidn
\
libidn
\
jq
jq
\
cronie
ENV
LE_CONFIG_HOME /acme.sh
ENV
LE_CONFIG_HOME /acme.sh
...
@@ -25,7 +26,7 @@ COPY ./ /install_acme.sh/
...
@@ -25,7 +26,7 @@ COPY ./ /install_acme.sh/
RUN
cd
/install_acme.sh
&&
([
-f
/install_acme.sh/acme.sh
]
&&
/install_acme.sh/acme.sh
--install
||
curl https://get.acme.sh | sh
)
&&
rm
-rf
/install_acme.sh/
RUN
cd
/install_acme.sh
&&
([
-f
/install_acme.sh/acme.sh
]
&&
/install_acme.sh/acme.sh
--install
||
curl https://get.acme.sh | sh
)
&&
rm
-rf
/install_acme.sh/
RUN
ln
-s
/root/.acme.sh/acme.sh
/usr/local/bin/acme.sh
&&
crontab
-l
|
grep
acme.sh |
sed
's#> /dev/null##'
| crontab -
RUN
ln
-s
/root/.acme.sh/acme.sh /usr/local/bin/acme.sh
&&
crontab
-l
|
grep
acme.sh |
sed
's#> /dev/null#
> /proc/1/fd/1 2>/proc/1/fd/2
#'
| crontab -
RUN for
verb
in
help
\
RUN for
verb
in
help
\
version
\
version
\
...
@@ -64,12 +65,10 @@ RUN for verb in help \
...
@@ -64,12 +65,10 @@ RUN for verb in help \
RUN
printf
"%b"
'#!'
"/usr/bin/env sh
\n
\
RUN
printf
"%b"
'#!'
"/usr/bin/env sh
\n
\
if [
\"\$
1
\"
=
\"
daemon
\"
]; then
\n
\
if [
\"\$
1
\"
=
\"
daemon
\"
]; then
\n
\
trap
\"
echo stop && killall crond && exit 0
\"
SIGTERM SIGINT
\n
\
exec crond -n -s -m off
\n
\
crond && sleep infinity &
\n
\
wait
\n
\
else
\n
\
else
\n
\
exec --
\"\$
@
\"\n
\
exec --
\"\$
@
\"\n
\
fi"
>
/entry.sh
&&
chmod
+x /entry.sh
fi
\n
"
>
/entry.sh
&&
chmod
+x /entry.sh
VOLUME
/acme.sh
VOLUME
/acme.sh
...
...
acme.sh
View file @
cb021efa
...
@@ -1637,7 +1637,7 @@ _stat() {
...
@@ -1637,7 +1637,7 @@ _stat() {
#keyfile
#keyfile
_isRSA
()
{
_isRSA
()
{
keyfile
=
$1
keyfile
=
$1
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
|
grep
"^publicExponent:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
2>&1
|
grep
"^publicExponent:"
2>&1
>
/dev/null
;
then
return
0
return
0
fi
fi
return
1
return
1
...
@@ -1646,7 +1646,7 @@ _isRSA() {
...
@@ -1646,7 +1646,7 @@ _isRSA() {
#keyfile
#keyfile
_isEcc
()
{
_isEcc
()
{
keyfile
=
$1
keyfile
=
$1
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
2>&1
>
/dev/null
;
then
return
0
return
0
fi
fi
return
1
return
1
...
@@ -1744,7 +1744,7 @@ _calcjwk() {
...
@@ -1744,7 +1744,7 @@ _calcjwk() {
_debug3 x64
"
$x64
"
_debug3 x64
"
$x64
"
xend
=
$(
_math
"
$xend
"
+ 1
)
xend
=
$(
_math
"
$xend
"
+ 1
)
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
10000
)
"
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
2048
)
"
_debug3 y
"
$y
"
_debug3 y
"
$y
"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url_replace
)
"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url_replace
)
"
...
@@ -1852,9 +1852,14 @@ _inithttp() {
...
@@ -1852,9 +1852,14 @@ _inithttp() {
_ACME_CURL
=
"
$_ACME_CURL
--cacert
$CA_BUNDLE
"
_ACME_CURL
=
"
$_ACME_CURL
--cacert
$CA_BUNDLE
"
fi
fi
if
_contains
"
$(
curl
--help
2>&1
)
"
"--globoff"
;
then
if
_contains
"
$(
curl
--help
2>&1
)
"
"--globoff"
||
_contains
"
$(
curl
--help
curl 2>&1
)
"
"--globoff"
;
then
_ACME_CURL
=
"
$_ACME_CURL
-g "
_ACME_CURL
=
"
$_ACME_CURL
-g "
fi
fi
#from curl 7.76: return fail on HTTP errors but keep the body
if
_contains
"
$(
curl
--help
http 2>&1
)
"
"--fail-with-body"
;
then
_ACME_CURL
=
"
$_ACME_CURL
--fail-with-body "
fi
fi
fi
if
[
-z
"
$_ACME_WGET
"
]
&&
_exists
"wget"
;
then
if
[
-z
"
$_ACME_WGET
"
]
&&
_exists
"wget"
;
then
...
@@ -1872,12 +1877,12 @@ _inithttp() {
...
@@ -1872,12 +1877,12 @@ _inithttp() {
elif
[
"
$CA_BUNDLE
"
]
;
then
elif
[
"
$CA_BUNDLE
"
]
;
then
_ACME_WGET
=
"
$_ACME_WGET
--ca-certificate=
$CA_BUNDLE
"
_ACME_WGET
=
"
$_ACME_WGET
--ca-certificate=
$CA_BUNDLE
"
fi
fi
fi
#from wget 1.14: do not skip body on 404 error
#from wget 1.14: do not skip body on 404 error
if
[
"
$_ACME_WGET
"
]
&&
_contains
"
$(
$_ACME_WGET
--help
2>&1
)
"
"--content-on-error"
;
then
if
_contains
"
$(
wget
--help
2>&1
)
"
"--content-on-error"
;
then
_ACME_WGET
=
"
$_ACME_WGET
--content-on-error "
_ACME_WGET
=
"
$_ACME_WGET
--content-on-error "
fi
fi
fi
__HTTP_INITIALIZED
=
1
__HTTP_INITIALIZED
=
1
...
@@ -2058,7 +2063,7 @@ _get() {
...
@@ -2058,7 +2063,7 @@ _get() {
fi
fi
_debug
"_WGET"
"
$_WGET
"
_debug
"_WGET"
"
$_WGET
"
if
[
"
$onlyheader
"
]
;
then
if
[
"
$onlyheader
"
]
;
then
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
if
_contains
"
$_WGET
"
" -d "
;
then
if
_contains
"
$_WGET
"
" -d "
;
then
# Demultiplex wget debug output
# Demultiplex wget debug output
echo
"
$_wget_out
"
>
&2
echo
"
$_wget_out
"
>
&2
...
@@ -2352,6 +2357,26 @@ _readdomainconf() {
...
@@ -2352,6 +2357,26 @@ _readdomainconf() {
_read_conf
"
$DOMAIN_CONF
"
"
$1
"
_read_conf
"
$DOMAIN_CONF
"
"
$1
"
}
}
#_migratedomainconf oldkey newkey base64encode
_migratedomainconf
()
{
_old_key
=
"
$1
"
_new_key
=
"
$2
"
_b64encode
=
"
$3
"
_value
=
$(
_readdomainconf
"
$_old_key
"
)
if
[
-z
"
$_value
"
]
;
then
return
1
# oldkey is not found
fi
_savedomainconf
"
$_new_key
"
"
$_value
"
"
$_b64encode
"
_cleardomainconf
"
$_old_key
"
_debug
"Domain config
$_old_key
has been migrated to
$_new_key
"
}
#_migratedeployconf oldkey newkey base64encode
_migratedeployconf
()
{
_migratedomainconf
"
$1
"
"SAVED_
$2
"
"
$3
"
||
_migratedomainconf
"SAVED_
$1
"
"SAVED_
$2
"
"
$3
"
# try only when oldkey itself is not found
}
#key value base64encode
#key value base64encode
_savedeployconf
()
{
_savedeployconf
()
{
_savedomainconf
"SAVED_
$1
"
"
$2
"
"
$3
"
_savedomainconf
"SAVED_
$1
"
"
$2
"
"
$3
"
...
@@ -2366,12 +2391,14 @@ _getdeployconf() {
...
@@ -2366,12 +2391,14 @@ _getdeployconf() {
if
[
"
$_rac_value
"
]
;
then
if
[
"
$_rac_value
"
]
;
then
if
_startswith
"
$_rac_value
"
'"'
&&
_endswith
"
$_rac_value
"
'"'
;
then
if
_startswith
"
$_rac_value
"
'"'
&&
_endswith
"
$_rac_value
"
'"'
;
then
_debug2
"trim quotation marks"
_debug2
"trim quotation marks"
eval
"export
$_rac_key
=
$_rac_value
"
eval
$_rac_key
=
$_rac_value
export
$_rac_key
fi
fi
return
0
# do nothing
return
0
# do nothing
fi
fi
_saved
=
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
_saved
=
"
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
"
eval
"export
$_rac_key
=
\"\$
_saved
\"
"
eval
$_rac_key
=
"
$_saved
"
export
$_rac_key
}
}
#_saveaccountconf key value base64encode
#_saveaccountconf key value base64encode
...
@@ -2837,7 +2864,8 @@ _initpath() {
...
@@ -2837,7 +2864,8 @@ _initpath() {
DOMAIN_PATH
=
"
$domainhomeecc
"
DOMAIN_PATH
=
"
$domainhomeecc
"
else
else
if
[
!
-d
"
$domainhome
"
]
&&
[
-d
"
$domainhomeecc
"
]
;
then
if
[
!
-d
"
$domainhome
"
]
&&
[
-d
"
$domainhomeecc
"
]
;
then
_info
"The domain '
$domain
' seems to have a ECC cert already, please add '
$(
__red
"--ecc"
)
' parameter if you want to use that cert."
_info
"The domain '
$domain
' seems to have a ECC cert already, lets use ecc cert."
DOMAIN_PATH
=
"
$domainhomeecc
"
fi
fi
fi
fi
_debug DOMAIN_PATH
"
$DOMAIN_PATH
"
_debug DOMAIN_PATH
"
$DOMAIN_PATH
"
...
@@ -3995,7 +4023,7 @@ _ns_purge_cf() {
...
@@ -3995,7 +4023,7 @@ _ns_purge_cf() {
#checks if cf server is available
#checks if cf server is available
_ns_is_available_cf
()
{
_ns_is_available_cf
()
{
if
_get
"https://cloudflare-dns.com"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://cloudflare-dns.com"
""
1
0
>
/dev/null
;
then
return
0
return
0
else
else
return
1
return
1
...
@@ -4003,7 +4031,7 @@ _ns_is_available_cf() {
...
@@ -4003,7 +4031,7 @@ _ns_is_available_cf() {
}
}
_ns_is_available_google
()
{
_ns_is_available_google
()
{
if
_get
"https://dns.google"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://dns.google"
""
1
0
>
/dev/null
;
then
return
0
return
0
else
else
return
1
return
1
...
@@ -4019,7 +4047,7 @@ _ns_lookup_google() {
...
@@ -4019,7 +4047,7 @@ _ns_lookup_google() {
}
}
_ns_is_available_ali
()
{
_ns_is_available_ali
()
{
if
_get
"https://dns.alidns.com"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://dns.alidns.com"
""
1
0
>
/dev/null
;
then
return
0
return
0
else
else
return
1
return
1
...
@@ -4035,7 +4063,7 @@ _ns_lookup_ali() {
...
@@ -4035,7 +4063,7 @@ _ns_lookup_ali() {
}
}
_ns_is_available_dp
()
{
_ns_is_available_dp
()
{
if
_get
"https://doh.pub"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://doh.pub"
""
1
0
>
/dev/null
;
then
return
0
return
0
else
else
return
1
return
1
...
@@ -6707,6 +6735,13 @@ _send_notify() {
...
@@ -6707,6 +6735,13 @@ _send_notify() {
return
0
return
0
fi
fi
_nsource
=
"
$NOTIFY_SOURCE
"
if
[
-z
"
$_nsource
"
]
;
then
_nsource
=
"
$(
hostname
)
"
fi
_nsubject
=
"
$_nsubject
by
$_nsource
"
_send_err
=
0
_send_err
=
0
for
_n_hook
in
$(
echo
"
$_nhooks
"
|
tr
','
" "
)
;
do
for
_n_hook
in
$(
echo
"
$_nhooks
"
|
tr
','
" "
)
;
do
_n_hook_file
=
"
$(
_findHook
""
$_SUB_FOLDER_NOTIFY
"
$_n_hook
"
)
"
_n_hook_file
=
"
$(
_findHook
""
$_SUB_FOLDER_NOTIFY
"
$_n_hook
"
)
"
...
@@ -6761,11 +6796,12 @@ setnotify() {
...
@@ -6761,11 +6796,12 @@ setnotify() {
_nhook
=
"
$1
"
_nhook
=
"
$1
"
_nlevel
=
"
$2
"
_nlevel
=
"
$2
"
_nmode
=
"
$3
"
_nmode
=
"
$3
"
_nsource
=
"
$4
"
_initpath
_initpath
if
[
-z
"
$_nhook$_nlevel$_nmode
"
]
;
then
if
[
-z
"
$_nhook$_nlevel$_nmode
$_nsource
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]"
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]
[--notify-source <hostname>]
"
_usage
"
$_NOTIFY_WIKI
"
_usage
"
$_NOTIFY_WIKI
"
return
1
return
1
fi
fi
...
@@ -6782,6 +6818,12 @@ setnotify() {
...
@@ -6782,6 +6818,12 @@ setnotify() {
_saveaccountconf
"NOTIFY_MODE"
"
$NOTIFY_MODE
"
_saveaccountconf
"NOTIFY_MODE"
"
$NOTIFY_MODE
"
fi
fi
if
[
"
$_nsource
"
]
;
then
_info
"Set notify source to:
$_nsource
"
export
"NOTIFY_SOURCE=
$_nsource
"
_saveaccountconf
"NOTIFY_SOURCE"
"
$NOTIFY_SOURCE
"
fi
if
[
"
$_nhook
"
]
;
then
if
[
"
$_nhook
"
]
;
then
_info
"Set notify hook to:
$_nhook
"
_info
"Set notify hook to:
$_nhook
"
if
[
"
$_nhook
"
=
"
$NO_VALUE
"
]
;
then
if
[
"
$_nhook
"
=
"
$NO_VALUE
"
]
;
then
...
@@ -6942,6 +6984,7 @@ Parameters:
...
@@ -6942,6 +6984,7 @@ Parameters:
0: Bulk mode. Send all the domain's notifications in one message(mail).
0: Bulk mode. Send all the domain's notifications in one message(mail).
1: Cert mode. Send a message for every single cert.
1: Cert mode. Send a message for every single cert.
--notify-hook <hookname> Set the notify hook
--notify-hook <hookname> Set the notify hook
--notify-source <server name> Set the server name in the notification message
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
See:
$_REVOKE_WIKI
See:
$_REVOKE_WIKI
...
@@ -7099,7 +7142,9 @@ _selectServer() {
...
@@ -7099,7 +7142,9 @@ _selectServer() {
_getCAShortName
()
{
_getCAShortName
()
{
caurl
=
"
$1
"
caurl
=
"
$1
"
if
[
-z
"
$caurl
"
]
;
then
if
[
-z
"
$caurl
"
]
;
then
caurl
=
"
$DEFAULT_CA
"
#use letsencrypt as default value if the Le_API is empty
#this case can only come from the old upgrading.
caurl
=
"
$CA_LETSENCRYPT_V2
"
fi
fi
if
[
"
$CA_SSLCOM_ECC
"
=
"
$caurl
"
]
;
then
if
[
"
$CA_SSLCOM_ECC
"
=
"
$caurl
"
]
;
then
caurl
=
"
$CA_SSLCOM_RSA
"
#just hack to get the short name
caurl
=
"
$CA_SSLCOM_RSA
"
#just hack to get the short name
...
@@ -7216,6 +7261,7 @@ _process() {
...
@@ -7216,6 +7261,7 @@ _process() {
_notify_hook
=
""
_notify_hook
=
""
_notify_level
=
""
_notify_level
=
""
_notify_mode
=
""
_notify_mode
=
""
_notify_source
=
""
_revoke_reason
=
""
_revoke_reason
=
""
_eab_kid
=
""
_eab_kid
=
""
_eab_hmac_key
=
""
_eab_hmac_key
=
""
...
@@ -7708,6 +7754,15 @@ _process() {
...
@@ -7708,6 +7754,15 @@ _process() {
_notify_mode
=
"
$_nmode
"
_notify_mode
=
"
$_nmode
"
shift
shift
;;
;;
--notify-source
)
_nsource
=
"
$2
"
if
_startswith
"
$_nsource
"
"-"
;
then
_err
"'
$_nsource
' is not valid host name for '
$1
'"
return
1
fi
_notify_source
=
"
$_nsource
"
shift
;;
--revoke-reason
)
--revoke-reason
)
_revoke_reason
=
"
$2
"
_revoke_reason
=
"
$2
"
if
_startswith
"
$_revoke_reason
"
"-"
;
then
if
_startswith
"
$_revoke_reason
"
"-"
;
then
...
@@ -7862,7 +7917,7 @@ _process() {
...
@@ -7862,7 +7917,7 @@ _process() {
createCSR
"
$_domain
"
"
$_altdomains
"
"
$_ecc
"
createCSR
"
$_domain
"
"
$_altdomains
"
"
$_ecc
"
;;
;;
setnotify
)
setnotify
)
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
"
$_notify_source
"
;;
;;
setdefaultca
)
setdefaultca
)
setdefaultca
setdefaultca
...
...
deploy/gcore_cdn.sh
View file @
cb021efa
#!/usr/bin/env sh
#!/usr/bin/env sh
# Here is the script to deploy the cert to G-Core CDN service (https://gcore
labs
.com/
ru/
) using the G-Core Labs API (https://docs.gcore
labs
.com/cdn
/
).
# Here is the script to deploy the cert to G-Core CDN service (https://gcore.com/) using the G-Core Labs API (https://
api
docs.gcore.com/cdn).
# Returns 0 when success.
# Returns 0 when success.
#
#
# Written by temoffey <temofffey@gmail.com>
# Written by temoffey <temofffey@gmail.com>
# Public domain, 2019
# Public domain, 2019
# Update by DreamOfIce <admin@dreamofice.cn> in 2023
#export DEPLOY_GCORE_CDN_USERNAME=myusername
#export DEPLOY_GCORE_CDN_USERNAME=myusername
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
...
@@ -56,7 +57,7 @@ gcore_cdn_deploy() {
...
@@ -56,7 +57,7 @@ gcore_cdn_deploy() {
_request
=
"{
\"
username
\"
:
\"
$Le_Deploy_gcore_cdn_username
\"
,
\"
password
\"
:
\"
$Le_Deploy_gcore_cdn_password
\"
}"
_request
=
"{
\"
username
\"
:
\"
$Le_Deploy_gcore_cdn_username
\"
,
\"
password
\"
:
\"
$Le_Deploy_gcore_cdn_password
\"
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
export
_H1
=
"Content-Type:application/json"
export
_H1
=
"Content-Type:application/json"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn
.co/auth/jwt/login"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore
.co
m
/auth/jwt/login"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
access
\"
:
\"\(
[-._0-9A-Za-z]*
\)\"
.*$"
_regex
=
".*
\"
access
\"
:
\"\(
[-._0-9A-Za-z]*
\)\"
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -69,8 +70,8 @@ gcore_cdn_deploy() {
...
@@ -69,8 +70,8 @@ gcore_cdn_deploy() {
fi
fi
_info
"Find CDN resource with cname
$_cdomain
"
_info
"Find CDN resource with cname
$_cdomain
"
export
_H2
=
"Authorization:
Token
$_token
"
export
_H2
=
"Authorization:
Bearer
$_token
"
_response
=
$(
_get
"https://api.gc
dn.co
/resources"
)
_response
=
$(
_get
"https://api.gc
ore.com/cdn
/resources"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
"
\"
primary_resource
\"
:null},"
_regex
=
"
\"
primary_resource
\"
:null},"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -102,7 +103,7 @@ gcore_cdn_deploy() {
...
@@ -102,7 +103,7 @@ gcore_cdn_deploy() {
_date
=
$(
date
"+%d.%m.%Y %H:%M:%S"
)
_date
=
$(
date
"+%d.%m.%Y %H:%M:%S"
)
_request
=
"{
\"
name
\"
:
\"
$_cdomain
(
$_date
)
\"
,
\"
sslCertificate
\"
:
\"
$_fullchain
\"
,
\"
sslPrivateKey
\"
:
\"
$_key
\"
}"
_request
=
"{
\"
name
\"
:
\"
$_cdomain
(
$_date
)
\"
,
\"
sslCertificate
\"
:
\"
$_fullchain
\"
,
\"
sslPrivateKey
\"
:
\"
$_key
\"
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/sslData"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/sslData"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
id
\"
:
\(
[0-9]*
\)
.*$"
_regex
=
".*
\"
id
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -117,7 +118,7 @@ gcore_cdn_deploy() {
...
@@ -117,7 +118,7 @@ gcore_cdn_deploy() {
_info
"Update CDN resource"
_info
"Update CDN resource"
_request
=
"{
\"
originGroup
\"
:
$_originGroup
,
\"
sslData
\"
:
$_sslDataAdd
}"
_request
=
"{
\"
originGroup
\"
:
$_originGroup
,
\"
sslData
\"
:
$_sslDataAdd
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/resources/
$_resourceId
"
''
"PUT"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/resources/
$_resourceId
"
''
"PUT"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
sslData
\"
:
\(
[0-9]*
\)
.*$"
_regex
=
".*
\"
sslData
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -133,7 +134,7 @@ gcore_cdn_deploy() {
...
@@ -133,7 +134,7 @@ gcore_cdn_deploy() {
_info
"Not found old SSL certificate"
_info
"Not found old SSL certificate"
else
else
_info
"Delete old SSL certificate"
_info
"Delete old SSL certificate"
_response
=
$(
_post
''
"https://api.gc
dn.co
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_response
=
$(
_post
''
"https://api.gc
ore.com/cdn
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
fi
fi
...
...
deploy/ssh.sh
View file @
cb021efa
...
@@ -14,7 +14,7 @@
...
@@ -14,7 +14,7 @@
# The following examples are for QNAP NAS running QTS 4.2
# The following examples are for QNAP NAS running QTS 4.2
# export DEPLOY_SSH_CMD="" # defaults to "ssh -T"
# export DEPLOY_SSH_CMD="" # defaults to "ssh -T"
# export DEPLOY_SSH_USER="admin" # required
# export DEPLOY_SSH_USER="admin" # required
# export DEPLOY_SSH_SERVER="
qnap" # defaults to domain name
# export DEPLOY_SSH_SERVER="
host1 host2:8022 192.168.0.1:9022" # defaults to domain name, support multiple servers with optional port
# export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
# export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
# export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
...
@@ -23,6 +23,8 @@
...
@@ -23,6 +23,8 @@
# export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value
# export DEPLOY_SSH_BACKUP="" # yes or no, default to yes or previously saved value
# export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy
# export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy" # path on remote system. Defaults to .acme_ssh_deploy
# export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value
# export DEPLOY_SSH_MULTI_CALL="" # yes or no, default to no or previously saved value
# export DEPLOY_SSH_USE_SCP="" yes or no, default to no
# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -q"
#
#
######## Public functions #####################
######## Public functions #####################
...
@@ -42,72 +44,134 @@ ssh_deploy() {
...
@@ -42,72 +44,134 @@ ssh_deploy() {
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
# USER is required to login by SSH to remote host.
# USER is required to login by SSH to remote host.
_migratedeployconf Le_Deploy_ssh_user DEPLOY_SSH_USER
_getdeployconf DEPLOY_SSH_USER
_getdeployconf DEPLOY_SSH_USER
_debug2 DEPLOY_SSH_USER
"
$DEPLOY_SSH_USER
"
_debug2 DEPLOY_SSH_USER
"
$DEPLOY_SSH_USER
"
if
[
-z
"
$DEPLOY_SSH_USER
"
]
;
then
if
[
-z
"
$DEPLOY_SSH_USER
"
]
;
then
if
[
-z
"
$Le_Deploy_ssh_user
"
]
;
then
_err
"DEPLOY_SSH_USER not defined."
_err
"DEPLOY_SSH_USER not defined."
return
1
return
1
fi
fi
else
_savedeployconf DEPLOY_SSH_USER
"
$DEPLOY_SSH_USER
"
Le_Deploy_ssh_user
=
"
$DEPLOY_SSH_USER
"
_savedomainconf Le_Deploy_ssh_user
"
$Le_Deploy_ssh_user
"
fi
# SERVER is optional. If not provided then use _cdomain
# SERVER is optional. If not provided then use _cdomain
_migratedeployconf Le_Deploy_ssh_server DEPLOY_SSH_SERVER
_getdeployconf DEPLOY_SSH_SERVER
_getdeployconf DEPLOY_SSH_SERVER
_debug2 DEPLOY_SSH_SERVER
"
$DEPLOY_SSH_SERVER
"
_debug2 DEPLOY_SSH_SERVER
"
$DEPLOY_SSH_SERVER
"
if
[
-n
"
$DEPLOY_SSH_SERVER
"
]
;
then
if
[
-z
"
$DEPLOY_SSH_SERVER
"
]
;
then
Le_Deploy_ssh_server
=
"
$DEPLOY_SSH_SERVER
"
DEPLOY_SSH_SERVER
=
"
$_cdomain
"
_savedomainconf Le_Deploy_ssh_server
"
$Le_Deploy_ssh_server
"
elif
[
-z
"
$Le_Deploy_ssh_server
"
]
;
then
Le_Deploy_ssh_server
=
"
$_cdomain
"
fi
fi
_savedeployconf DEPLOY_SSH_SERVER
"
$DEPLOY_SSH_SERVER
"
# CMD is optional. If not provided then use ssh
# CMD is optional. If not provided then use ssh
_migratedeployconf Le_Deploy_ssh_cmd DEPLOY_SSH_CMD
_getdeployconf DEPLOY_SSH_CMD
_getdeployconf DEPLOY_SSH_CMD
_debug2 DEPLOY_SSH_CMD
"
$DEPLOY_SSH_CMD
"
_debug2 DEPLOY_SSH_CMD
"
$DEPLOY_SSH_CMD
"
if
[
-n
"
$DEPLOY_SSH_CMD
"
]
;
then
if
[
-z
"
$DEPLOY_SSH_CMD
"
]
;
then
Le_Deploy_ssh_cmd
=
"
$DEPLOY_SSH_CMD
"
DEPLOY_SSH_CMD
=
"ssh -T"
_savedomainconf Le_Deploy_ssh_cmd
"
$Le_Deploy_ssh_cmd
"
elif
[
-z
"
$Le_Deploy_ssh_cmd
"
]
;
then
Le_Deploy_ssh_cmd
=
"ssh -T"
fi
fi
_savedeployconf DEPLOY_SSH_CMD
"
$DEPLOY_SSH_CMD
"
# BACKUP is optional. If not provided then default to previously saved value or yes.
# BACKUP is optional. If not provided then default to previously saved value or yes.
_migratedeployconf Le_Deploy_ssh_backup DEPLOY_SSH_BACKUP
_getdeployconf DEPLOY_SSH_BACKUP
_getdeployconf DEPLOY_SSH_BACKUP
_debug2 DEPLOY_SSH_BACKUP
"
$DEPLOY_SSH_BACKUP
"
_debug2 DEPLOY_SSH_BACKUP
"
$DEPLOY_SSH_BACKUP
"
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"no"
]
;
then
if
[
-z
"
$DEPLOY_SSH_BACKUP
"
]
;
then
Le_Deploy_ssh_backup
=
"no"
DEPLOY_SSH_BACKUP
=
"yes"
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
||
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
Le_Deploy_ssh_backup
=
"yes"
fi
fi
_saved
omainconf Le_Deploy_ssh_backup
"
$Le_Deploy_ssh_backup
"
_saved
eployconf DEPLOY_SSH_BACKUP
"
$DEPLOY_SSH_BACKUP
"
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
_migratedeployconf Le_Deploy_ssh_backup_path DEPLOY_SSH_BACKUP_PATH
_getdeployconf DEPLOY_SSH_BACKUP_PATH
_getdeployconf DEPLOY_SSH_BACKUP_PATH
_debug2 DEPLOY_SSH_BACKUP_PATH
"
$DEPLOY_SSH_BACKUP_PATH
"
_debug2 DEPLOY_SSH_BACKUP_PATH
"
$DEPLOY_SSH_BACKUP_PATH
"
if
[
-n
"
$DEPLOY_SSH_BACKUP_PATH
"
]
;
then
if
[
-z
"
$DEPLOY_SSH_BACKUP_PATH
"
]
;
then
Le_Deploy_ssh_backup_path
=
"
$DEPLOY_SSH_BACKUP_PATH
"
DEPLOY_SSH_BACKUP_PATH
=
".acme_ssh_deploy"
elif
[
-z
"
$Le_Deploy_ssh_backup_path
"
]
;
then
Le_Deploy_ssh_backup_path
=
".acme_ssh_deploy"
fi
fi
_saved
omainconf Le_Deploy_ssh_backup_path
"
$Le_Deploy_ssh_backup_path
"
_saved
eployconf DEPLOY_SSH_BACKUP_PATH
"
$DEPLOY_SSH_BACKUP_PATH
"
# MULTI_CALL is optional. If not provided then default to previously saved
# MULTI_CALL is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no").
# value (which may be undefined... equivalent to "no").
_migratedeployconf Le_Deploy_ssh_multi_call DEPLOY_SSH_MULTI_CALL
_getdeployconf DEPLOY_SSH_MULTI_CALL
_getdeployconf DEPLOY_SSH_MULTI_CALL
_debug2 DEPLOY_SSH_MULTI_CALL
"
$DEPLOY_SSH_MULTI_CALL
"
_debug2 DEPLOY_SSH_MULTI_CALL
"
$DEPLOY_SSH_MULTI_CALL
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
[
-z
"
$DEPLOY_SSH_MULTI_CALL
"
]
;
then
Le_Deploy_ssh_multi_call
=
"yes"
DEPLOY_SSH_MULTI_CALL
=
"no"
_savedomainconf Le_Deploy_ssh_multi_call
"
$Le_Deploy_ssh_multi_call
"
fi
elif
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"no"
]
;
then
_savedeployconf DEPLOY_SSH_MULTI_CALL
"
$DEPLOY_SSH_MULTI_CALL
"
Le_Deploy_ssh_multi_call
=
""
_cleardomainconf Le_Deploy_ssh_multi_call
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
_migratedeployconf Le_Deploy_ssh_keyfile DEPLOY_SSH_KEYFILE
_getdeployconf DEPLOY_SSH_KEYFILE
_debug2 DEPLOY_SSH_KEYFILE
"
$DEPLOY_SSH_KEYFILE
"
if
[
-n
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
_savedeployconf DEPLOY_SSH_KEYFILE
"
$DEPLOY_SSH_KEYFILE
"
fi
fi
_deploy_ssh_servers
=
$Le_Deploy_ssh_server
# CERTFILE is optional.
for
Le_Deploy_ssh_server
in
$_deploy_ssh_servers
;
do
# If provided then certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_certfile DEPLOY_SSH_CERTFILE
_getdeployconf DEPLOY_SSH_CERTFILE
_debug2 DEPLOY_SSH_CERTFILE
"
$DEPLOY_SSH_CERTFILE
"
if
[
-n
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
_savedeployconf DEPLOY_SSH_CERTFILE
"
$DEPLOY_SSH_CERTFILE
"
fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_cafile DEPLOY_SSH_CAFILE
_getdeployconf DEPLOY_SSH_CAFILE
_debug2 DEPLOY_SSH_CAFILE
"
$DEPLOY_SSH_CAFILE
"
if
[
-n
"
$DEPLOY_SSH_CAFILE
"
]
;
then
_savedeployconf DEPLOY_SSH_CAFILE
"
$DEPLOY_SSH_CAFILE
"
fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied or appended to provided filename.
_migratedeployconf Le_Deploy_ssh_fullchain DEPLOY_SSH_FULLCHAIN
_getdeployconf DEPLOY_SSH_FULLCHAIN
_debug2 DEPLOY_SSH_FULLCHAIN
"
$DEPLOY_SSH_FULLCHAIN
"
if
[
-n
"
$DEPLOY_SSH_FULLCHAIN
"
]
;
then
_savedeployconf DEPLOY_SSH_FULLCHAIN
"
$DEPLOY_SSH_FULLCHAIN
"
fi
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
_migratedeployconf Le_Deploy_ssh_remote_cmd DEPLOY_SSH_REMOTE_CMD
_getdeployconf DEPLOY_SSH_REMOTE_CMD
_debug2 DEPLOY_SSH_REMOTE_CMD
"
$DEPLOY_SSH_REMOTE_CMD
"
if
[
-n
"
$DEPLOY_SSH_REMOTE_CMD
"
]
;
then
_savedeployconf DEPLOY_SSH_REMOTE_CMD
"
$DEPLOY_SSH_REMOTE_CMD
"
fi
# USE_SCP is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no").
_getdeployconf DEPLOY_SSH_USE_SCP
_debug2 DEPLOY_SSH_USE_SCP
"
$DEPLOY_SSH_USE_SCP
"
if
[
-z
"
$DEPLOY_SSH_USE_SCP
"
]
;
then
DEPLOY_SSH_USE_SCP
=
"no"
fi
_savedeployconf DEPLOY_SSH_USE_SCP
"
$DEPLOY_SSH_USE_SCP
"
# SCP_CMD is optional. If not provided then use scp
_getdeployconf DEPLOY_SSH_SCP_CMD
_debug2 DEPLOY_SSH_SCP_CMD
"
$DEPLOY_SSH_SCP_CMD
"
if
[
-z
"
$DEPLOY_SSH_SCP_CMD
"
]
;
then
DEPLOY_SSH_SCP_CMD
=
"scp -q"
fi
_savedeployconf DEPLOY_SSH_SCP_CMD
"
$DEPLOY_SSH_SCP_CMD
"
if
[
"
$DEPLOY_SSH_USE_SCP
"
=
"yes"
]
;
then
DEPLOY_SSH_MULTI_CALL
=
"yes"
_info
"Using scp as alternate method for copying files. Multicall Mode is implicit"
elif
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
_info
"Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
else
_info
"Required commands batched and sent in single call to remote host"
fi
_deploy_ssh_servers
=
"
$DEPLOY_SSH_SERVER
"
for
DEPLOY_SSH_SERVER
in
$_deploy_ssh_servers
;
do
_ssh_deploy
_ssh_deploy
done
done
}
}
...
@@ -117,16 +181,25 @@ _ssh_deploy() {
...
@@ -117,16 +181,25 @@ _ssh_deploy() {
_cmdstr
=
""
_cmdstr
=
""
_backupprefix
=
""
_backupprefix
=
""
_backupdir
=
""
_backupdir
=
""
_local_cert_file
=
""
_local_ca_file
=
""
_local_full_file
=
""
_info
"Deploy certificates to remote server
$Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
case
$DEPLOY_SSH_SERVER
in
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
*
:
*
)
_info
"Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
_host
=
${
DEPLOY_SSH_SERVER
%
:
*
}
else
_port
=
${
DEPLOY_SSH_SERVER
##*
:
}
_info
"Required commands batched and sent in single call to remote host"
;;
fi
*
)
_host
=
$DEPLOY_SSH_SERVER
_port
=
;;
esac
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
_info
"Deploy certificates to remote server
$DEPLOY_SSH_USER
@
$_host
:
$_port
"
_backupprefix
=
"
$Le_Deploy_ssh_backup_path
/
$_cdomain
-backup"
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
_backupprefix
=
"
$DEPLOY_SSH_BACKUP_PATH
/
$_cdomain
-backup"
_backupdir
=
"
$_backupprefix
-
$(
_utc_date |
tr
' '
'-'
)
"
_backupdir
=
"
$_backupprefix
-
$(
_utc_date |
tr
' '
'-'
)
"
# run cleanup on the backup directory, erase all older
# run cleanup on the backup directory, erase all older
# than 180 days (15552000 seconds).
# than 180 days (15552000 seconds).
...
@@ -138,7 +211,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -138,7 +211,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
_cmdstr
=
"mkdir -p
$_backupdir
;
$_cmdstr
"
_cmdstr
=
"mkdir -p
$_backupdir
;
$_cmdstr
"
_info
"Backup of old certificate files will be placed in remote directory
$_backupdir
"
_info
"Backup of old certificate files will be placed in remote directory
$_backupdir
"
_info
"Backup directories erased after 180 days."
_info
"Backup directories erased after 180 days."
if
[
"
$
Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
if
[
"
$
DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
...
@@ -146,129 +219,184 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -146,129 +219,184 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
fi
fi
fi
fi
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
_getdeployconf DEPLOY_SSH_KEYFILE
_debug2 DEPLOY_SSH_KEYFILE
"
$DEPLOY_SSH_KEYFILE
"
if
[
-n
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
Le_Deploy_ssh_keyfile
=
"
$DEPLOY_SSH_KEYFILE
"
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
fi
if
[
-n
"
$Le_Deploy_ssh_keyfile
"
]
;
then
if
[
"
$Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_keyfile
$_backupdir
>/dev/null;"
_cmdstr
=
"
$_cmdstr
cp
$DEPLOY_SSH_KEYFILE
$_backupdir
>/dev/null;"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
fi
# copy new certificate into file.
_cmdstr
=
""
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ckey
"
)
\"
>
$Le_Deploy_ssh_keyfile
;"
fi
_info
"will copy private key to remote file
$Le_Deploy_ssh_keyfile
"
fi
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
# copy new key into file.
if
[
"
$DEPLOY_SSH_USE_SCP
"
=
"yes"
]
;
then
# scp the file
if
!
_scp_remote_cmd
"
$_ckey
"
"
$DEPLOY_SSH_KEYFILE
"
;
then
return
$_err_code
fi
else
# ssh echo to the file
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ckey
"
)
\"
>
$DEPLOY_SSH_KEYFILE
;"
_info
"will copy private key to remote file
$DEPLOY_SSH_KEYFILE
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
_cmdstr
=
""
_cmdstr
=
""
fi
fi
fi
fi
fi
# CERTFILE is optional.
# If provided then certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CERTFILE
_debug2 DEPLOY_SSH_CERTFILE
"
$DEPLOY_SSH_CERTFILE
"
if
[
-n
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
Le_Deploy_ssh_certfile
=
"
$DEPLOY_SSH_CERTFILE
"
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
fi
if
[
-n
"
$Le_Deploy_ssh_certfile
"
]
;
then
_pipe
=
">"
_pipe
=
">"
if
[
"
$
Le_Deploy_ssh_certfile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
;
then
if
[
"
$
DEPLOY_SSH_CERTFILE
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
# if filename is same as previous file then append.
# if filename is same as previous file then append.
_pipe
=
">>"
_pipe
=
">>"
elif
[
"
$
Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
elif
[
"
$
DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_certfile
$_backupdir
>/dev/null;"
_cmdstr
=
"
$_cmdstr
cp
$DEPLOY_SSH_CERTFILE
$_backupdir
>/dev/null;"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
fi
# copy new certificate into file.
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ccert
"
)
\"
$_pipe
$Le_Deploy_ssh_certfile
;"
if
[
"
$DEPLOY_SSH_USE_SCP
"
=
"yes"
]
;
then
_info
"will copy certificate to remote file
$Le_Deploy_ssh_certfile
"
# scp the file
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
_local_cert_file
=
$(
_mktemp
)
if
[
"
$DEPLOY_SSH_CERTFILE
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
cat
"
$_ckey
"
>>
"
$_local_cert_file
"
fi
cat
"
$_ccert
"
>>
"
$_local_cert_file
"
if
!
_scp_remote_cmd
"
$_local_cert_file
"
"
$DEPLOY_SSH_CERTFILE
"
;
then
return
$_err_code
fi
else
# ssh echo to the file
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_ccert
"
)
\"
$_pipe
$DEPLOY_SSH_CERTFILE
;"
_info
"will copy certificate to remote file
$DEPLOY_SSH_CERTFILE
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
_cmdstr
=
""
_cmdstr
=
""
fi
fi
fi
fi
fi
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CAFILE
_debug2 DEPLOY_SSH_CAFILE
"
$DEPLOY_SSH_CAFILE
"
if
[
-n
"
$DEPLOY_SSH_CAFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_CAFILE
"
]
;
then
Le_Deploy_ssh_cafile
=
"
$DEPLOY_SSH_CAFILE
"
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
fi
if
[
-n
"
$Le_Deploy_ssh_cafile
"
]
;
then
_pipe
=
">"
_pipe
=
">"
if
[
"
$
Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_keyfile
"
]
||
if
[
"
$
DEPLOY_SSH_CAFILE
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
||
[
"
$
Le_Deploy_ssh_cafile
"
=
"
$Le_Deploy_ssh_certfile
"
]
;
then
[
"
$
DEPLOY_SSH_CAFILE
"
=
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
# if filename is same as previous file then append.
# if filename is same as previous file then append.
_pipe
=
">>"
_pipe
=
">>"
elif
[
"
$
Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
elif
[
"
$
DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_cafile
$_backupdir
>/dev/null;"
_cmdstr
=
"
$_cmdstr
cp
$DEPLOY_SSH_CAFILE
$_backupdir
>/dev/null;"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
_cmdstr
=
""
fi
fi
fi
# copy new certificate into file.
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cca
"
)
\"
$_pipe
$Le_Deploy_ssh_cafile
;"
if
[
"
$DEPLOY_SSH_USE_SCP
"
=
"yes"
]
;
then
_info
"will copy CA file to remote file
$Le_Deploy_ssh_cafile
"
# scp the file
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
_local_ca_file
=
$(
_mktemp
)
if
[
"
$DEPLOY_SSH_CAFILE
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
cat
"
$_ckey
"
>>
"
$_local_ca_file
"
fi
if
[
"
$DEPLOY_SSH_CAFILE
"
=
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
cat
"
$_ccert
"
>>
"
$_local_ca_file
"
fi
cat
"
$_cca
"
>>
"
$_local_ca_file
"
if
!
_scp_remote_cmd
"
$_local_ca_file
"
"
$DEPLOY_SSH_CAFILE
"
;
then
return
$_err_code
fi
else
# ssh echo to the file
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cca
"
)
\"
$_pipe
$DEPLOY_SSH_CAFILE
;"
_info
"will copy CA file to remote file
$DEPLOY_SSH_CAFILE
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
_cmdstr
=
""
_cmdstr
=
""
fi
fi
fi
fi
fi
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_FULLCHAIN
_debug2 DEPLOY_SSH_FULLCHAIN
"
$DEPLOY_SSH_FULLCHAIN
"
if
[
-n
"
$DEPLOY_SSH_FULLCHAIN
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_FULLCHAIN
"
]
;
then
Le_Deploy_ssh_fullchain
=
"
$DEPLOY_SSH_FULLCHAIN
"
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
fi
if
[
-n
"
$Le_Deploy_ssh_fullchain
"
]
;
then
_pipe
=
">"
_pipe
=
">"
if
[
"
$
Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_keyfile
"
]
||
if
[
"
$
DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
||
[
"
$
Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_certfile
"
]
||
[
"
$
DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_CERTFILE
"
]
||
[
"
$
Le_Deploy_ssh_fullchain
"
=
"
$Le_Deploy_ssh_cafile
"
]
;
then
[
"
$
DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_CAFILE
"
]
;
then
# if filename is same as previous file then append.
# if filename is same as previous file then append.
_pipe
=
">>"
_pipe
=
">>"
elif
[
"
$
Le_Deploy_ssh_backup
"
=
"yes"
]
;
then
elif
[
"
$
DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
# backup file we are about to overwrite.
# backup file we are about to overwrite.
_cmdstr
=
"
$_cmdstr
cp
$Le_Deploy_ssh_fullchain
$_backupdir
>/dev/null;"
_cmdstr
=
"
$_cmdstr
cp
$DEPLOY_SSH_FULLCHAIN
$_backupdir
>/dev/null;"
if
[
"
$DEPLOY_SSH_FULLCHAIN
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
fi
fi
_cmdstr
=
""
fi
fi
# copy new certificate into file.
# copy new certificate into file.
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cfullchain
"
)
\"
$_pipe
$Le_Deploy_ssh_fullchain
;"
if
[
"
$DEPLOY_SSH_USE_SCP
"
=
"yes"
]
;
then
_info
"will copy fullchain to remote file
$Le_Deploy_ssh_fullchain
"
# scp the file
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
_local_full_file
=
$(
_mktemp
)
if
[
"
$DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
cat
"
$_ckey
"
>>
"
$_local_full_file
"
fi
if
[
"
$DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
cat
"
$_ccert
"
>>
"
$_local_full_file
"
fi
if
[
"
$DEPLOY_SSH_FULLCHAIN
"
=
"
$DEPLOY_SSH_CAFILE
"
]
;
then
cat
"
$_cca
"
>>
"
$_local_full_file
"
fi
cat
"
$_cfullchain
"
>>
"
$_local_full_file
"
if
!
_scp_remote_cmd
"
$_local_full_file
"
"
$DEPLOY_SSH_FULLCHAIN
"
;
then
return
$_err_code
fi
else
# ssh echo to the file
_cmdstr
=
"
$_cmdstr
echo
\"
$(
cat
"
$_cfullchain
"
)
\"
$_pipe
$DEPLOY_SSH_FULLCHAIN
;"
_info
"will copy fullchain to remote file
$DEPLOY_SSH_FULLCHAIN
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
_cmdstr
=
""
_cmdstr
=
""
fi
fi
fi
fi
fi
# REMOTE_CMD is optional.
# cleanup local files if any
# If provided then this command will be executed on remote host.
if
[
-f
"
$_local_cert_file
"
]
;
then
_getdeployconf DEPLOY_SSH_REMOTE_CMD
rm
-f
"
$_local_cert_file
"
_debug2 DEPLOY_SSH_REMOTE_CMD
"
$DEPLOY_SSH_REMOTE_CMD
"
fi
if
[
-n
"
$DEPLOY_SSH_REMOTE_CMD
"
]
;
then
if
[
-f
"
$_local_ca_file
"
]
;
then
Le_Deploy_ssh_remote_cmd
=
"
$DEPLOY_SSH_REMOTE_CMD
"
rm
-f
"
$_local_ca_file
"
_savedomainconf Le_Deploy_ssh_remote_cmd
"
$Le_Deploy_ssh_remote_cmd
"
fi
if
[
-f
"
$_local_full_file
"
]
;
then
rm
-f
"
$_local_full_file
"
fi
fi
if
[
-n
"
$Le_Deploy_ssh_remote_cmd
"
]
;
then
_cmdstr
=
"
$_cmdstr
$Le_Deploy_ssh_remote_cmd
;"
if
[
-n
"
$DEPLOY_SSH_REMOTE_CMD
"
]
;
then
_info
"Will execute remote command
$Le_Deploy_ssh_remote_cmd
"
_cmdstr
=
"
$_cmdstr
$DEPLOY_SSH_REMOTE_CMD
;"
if
[
"
$Le_Deploy_ssh_multi_call
"
=
"yes"
]
;
then
_info
"Will execute remote command
$DEPLOY_SSH_REMOTE_CMD
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
if
!
_ssh_remote_cmd
"
$_cmdstr
"
;
then
return
$_err_code
return
$_err_code
fi
fi
...
@@ -282,17 +410,25 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -282,17 +410,25 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
return
$_err_code
return
$_err_code
fi
fi
fi
fi
# cleanup in case all is ok
return
0
return
0
}
}
#cmd
#cmd
_ssh_remote_cmd
()
{
_ssh_remote_cmd
()
{
_cmd
=
"
$1
"
_cmd
=
"
$1
"
_ssh_cmd
=
"
$DEPLOY_SSH_CMD
"
if
[
-n
"
$_port
"
]
;
then
_ssh_cmd
=
"
$_ssh_cmd
-p
$_port
"
fi
_secure_debug
"Remote commands to execute:
$_cmd
"
_secure_debug
"Remote commands to execute:
$_cmd
"
_info
"Submitting sequence of commands to remote server by ssh"
_info
"Submitting sequence of commands to remote server by
$_ssh_cmd
"
# quotations in bash cmd below intended. Squash travis spellcheck error
# quotations in bash cmd below intended. Squash travis spellcheck error
# shellcheck disable=SC2029
# shellcheck disable=SC2029
$
Le_Deploy
_ssh_cmd
"
$
Le_Deploy_ssh_user
@
$Le_Deploy_ssh_server
"
sh
-c
"'
$_cmd
'"
$_ssh_cmd
"
$
DEPLOY_SSH_USER
@
$_host
"
sh
-c
"'
$_cmd
'"
_err_code
=
"
$?
"
_err_code
=
"
$?
"
if
[
"
$_err_code
"
!=
"0"
]
;
then
if
[
"
$_err_code
"
!=
"0"
]
;
then
...
@@ -301,3 +437,26 @@ _ssh_remote_cmd() {
...
@@ -301,3 +437,26 @@ _ssh_remote_cmd() {
return
$_err_code
return
$_err_code
}
}
# cmd scp
_scp_remote_cmd
()
{
_src
=
$1
_dest
=
$2
_scp_cmd
=
"
$DEPLOY_SSH_SCP_CMD
"
if
[
-n
"
$_port
"
]
;
then
_scp_cmd
=
"
$_scp_cmd
-P
$_port
"
fi
_secure_debug
"Remote copy source
$_src
to destination
$_dest
"
_info
"Submitting secure copy by
$_scp_cmd
"
$_scp_cmd
"
$_src
"
"
$DEPLOY_SSH_USER
"
@
"
$_host
"
:
"
$_dest
"
_err_code
=
"
$?
"
if
[
"
$_err_code
"
!=
"0"
]
;
then
_err
"Error code
$_err_code
returned from scp"
fi
return
$_err_code
}
deploy/truenas.sh
View file @
cb021efa
...
@@ -184,6 +184,27 @@ truenas_deploy() {
...
@@ -184,6 +184,27 @@ truenas_deploy() {
_info
"S3 certificate is not configured or is not the same as TrueNAS web UI"
_info
"S3 certificate is not configured or is not the same as TrueNAS web UI"
fi
fi
_info
"Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
if
_exists jq
;
then
_info
"Query all chart release"
_release_list
=
$(
_get
"
$_api_url
/chart/release"
)
_related_name_list
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
"[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==
$_active_cert_id
) | .name ] | unique"
)
_release_length
=
$(
printf
"%s"
"
$_related_name_list
"
| jq
-r
"length"
)
_info
"Found
$_release_length
related chart release in list:
$_related_name_list
"
for
i
in
$(
seq
0
$((
_release_length
-
1
))
)
;
do
_release_name
=
$(
echo
"
$_related_name_list
"
| jq
-r
".[
$i
]"
)
_info
"Updating certificate from
$_active_cert_id
to
$_cert_id
for chart release:
$_release_name
"
#Read the chart release configuration
_chart_config
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
".[] | select(.name==
\"
$_release_name
\"
)"
)
#Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
_updated_chart_config
=
$(
printf
"%s"
"
$_chart_config
"
| jq
"(.config.ingress?.main.tls[]? | select(.scaleCert==
$_active_cert_id
) | .scaleCert ) |=
$_cert_id
| .config.ingress "
)
_update_chart_result
=
"
$(
_post
"{
\"
values
\"
: {
\"
ingress
\"
:
$_updated_chart_config
} }"
"
$_api_url
/chart/release/id/
$_release_name
"
""
"PUT"
"application/json"
)
"
_debug3 _update_chart_result
"
$_update_chart_result
"
done
else
_info
"Tool 'jq' does not exists, skip chart release checking"
fi
_info
"Deleting old certificate"
_info
"Deleting old certificate"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
...
...
deploy/vault.sh
View file @
cb021efa
...
@@ -7,6 +7,9 @@
...
@@ -7,6 +7,9 @@
#
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
# VAULT_KV_V2 - set to anything if you are using v2 of the kv engine
#
#
# additionally, you need to ensure that VAULT_TOKEN is avialable
# additionally, you need to ensure that VAULT_TOKEN is avialable
# to access the vault server
# to access the vault server
...
@@ -45,6 +48,26 @@ vault_deploy() {
...
@@ -45,6 +48,26 @@ vault_deploy() {
fi
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_KV_V2
_savedeployconf VAULT_KV_V2
"
$VAULT_KV_V2
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
# JSON does not allow multiline strings.
# JSON does not allow multiline strings.
# So replacing new-lines with "\n" here
# So replacing new-lines with "\n" here
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
...
@@ -52,26 +75,56 @@ vault_deploy() {
...
@@ -52,26 +75,56 @@ vault_deploy() {
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
URL
=
"
$VAULT_ADDR
/v1/auth/token/renew-self"
_info
"Renew the Vault token to default TTL"
if
!
_post
""
"
$URL
"
>
/dev/null
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
$URL
in Fabio mode"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
>
/dev/null
||
return
1
else
else
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
>
/dev/null
||
return
1
fi
fi
else
else
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
else
else
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
fi
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
_contains
"
$(
_get
"
$URL
/chain.pem"
)
"
"-----BEGIN CERTIFICATE-----"
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
$URL
/chain.pem for backward compatibility"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
else
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
fi
fi
fi
fi
fi
...
...
deploy/vault_cli.sh
View file @
cb021efa
...
@@ -8,6 +8,8 @@
...
@@ -8,6 +8,8 @@
#
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
#
#
# additionally, you need to ensure that VAULT_TOKEN is avialable or
# additionally, you need to ensure that VAULT_TOKEN is avialable or
# `vault auth` has applied the appropriate authorization for the vault binary
# `vault auth` has applied the appropriate authorization for the vault binary
...
@@ -33,15 +35,36 @@ vault_cli_deploy() {
...
@@ -33,15 +35,36 @@ vault_cli_deploy() {
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
# validate required env vars
# validate required env vars
_getdeployconf VAULT_PREFIX
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
return
1
return
1
fi
fi
_savedeployconf VAULT_PREFIX
"
$VAULT_PREFIX
"
_getdeployconf VAULT_ADDR
if
[
-z
"
$VAULT_ADDR
"
]
;
then
if
[
-z
"
$VAULT_ADDR
"
]
;
then
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
return
1
return
1
fi
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
VAULT_CMD
=
$(
command
-v
vault
)
VAULT_CMD
=
$(
command
-v
vault
)
if
[
!
$?
]
;
then
if
[
!
$?
]
;
then
...
@@ -49,13 +72,33 @@ vault_cli_deploy() {
...
@@ -49,13 +72,33 @@ vault_cli_deploy() {
return
1
return
1
fi
fi
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
_info
"Renew the Vault token to default TTL"
if
!
$VAULT_CMD
token renew
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
in Fabio mode"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
else
else
_info
"Writing certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
_info
"Writing key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing full-chain certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
$VAULT_CMD
kv get
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
>
/dev/null
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem for backward compatibility"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
fi
fi
fi
}
}
dnsapi/dns_gcore.sh
0 → 100755
View file @
cb021efa
#!/usr/bin/env sh
#
#GCORE_Key='773$7b7adaf2a2b32bfb1b83787b4ff32a67eb178e3ada1af733e47b1411f2461f7f4fa7ed7138e2772a46124377bad7384b3bb8d87748f87b3f23db4b8bbe41b2bb'
#
GCORE_Api
=
"https://api.gcorelabs.com/dns/v2"
GCORE_Doc
=
"https://apidocs.gcore.com/dns"
######## Public functions #####################
#Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_gcore_add
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
if
[
-z
"
$GCORE_Key
"
]
;
then
GCORE_Key
=
""
_err
"You didn't specify a Gcore api key yet."
_err
"You can get yours from here
$GCORE_Doc
"
return
1
fi
#save the api key to the account conf file.
_saveaccountconf_mutable GCORE_Key
"
$GCORE_Key
"
_debug
"First detect the zone name"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
payload
=
""
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"Record doesn't exists"
payload
=
"{
\"
resource_records
\"
:[{
\"
content
\"
:[
\"
$txtvalue
\"
],
\"
enabled
\"
:true}],
\"
ttl
\"
:120}"
elif
echo
"
$response
"
|
grep
"
$txtvalue
"
>
/dev/null
;
then
_info
"Already exists, OK"
return
0
elif
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_info
"Record with mismatch txtvalue, try update it"
payload
=
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/"meta":{}}]}/"meta":{}},{"content":['
\"
"
$txtvalue
"
\"
'],"enabled":true}]}/'
)
fi
# For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
# we can not use updating anymore.
# count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
# _debug count "$count"
# if [ "$count" = "0" ]; then
_info
"Adding record"
if
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Added, OK"
return
0
elif
_contains
"
$response
"
"rrset is already exists"
;
then
_info
"Already exists, OK"
return
0
else
_err
"Add txt record error."
return
1
fi
fi
_err
"Add txt record error."
return
1
}
#fulldomain txtvalue
dns_gcore_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_err
"Error:
$response
"
return
1
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
"
$txtvalue
"
\"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
count
=
"
$(
echo
"
$response
"
|
grep
-o
"content"
|
wc
-l
)
"
if
[
"
$count
"
=
"1"
]
;
then
if
!
_gcore_rest DELETE
"zones/
$_zone_name
/
$fulldomain
/TXT"
;
then
_err
"Delete record error.
$response
"
return
1
fi
return
0
fi
payload
=
"
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/{"id":[0-9]\+,"content":\["'
"
$txtvalue
"
'"\],"enabled":true,"meta":{}}//'
|
sed
's/\[,/\[/'
|
sed
's/,,/,/'
|
sed
's/,\]/\]/'
)
"
if
!
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
_err
"Delete record error.
$response
"
fi
}
#################### Private functions below ##################################
#_acme-challenge.sub.domain.com
#returns
# _sub_domain=_acme-challenge.sub or _acme-challenge
# _domain=domain.com
# _zone_name=domain.com or sub.domain.com
_get_root
()
{
domain
=
$1
i
=
1
p
=
1
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
if
[
-z
"
$h
"
]
;
then
#not valid
return
1
fi
if
!
_gcore_rest GET
"zones/
$h
"
;
then
return
1
fi
if
_contains
"
$response
"
"
\"
name
\"
:
\"
$h
\"
"
;
then
_zone_name
=
$h
if
[
"
$_zone_name
"
]
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
return
0
fi
return
1
fi
p
=
$i
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
}
_gcore_rest
()
{
m
=
$1
ep
=
"
$2
"
data
=
"
$3
"
_debug
"
$ep
"
key_trimmed
=
$(
echo
"
$GCORE_Key
"
|
tr
-d
'"'
)
export
_H1
=
"Content-Type: application/json"
export
_H2
=
"Authorization: APIKey
$key_trimmed
"
if
[
"
$m
"
!=
"GET"
]
;
then
_debug data
"
$data
"
response
=
"
$(
_post
"
$data
"
"
$GCORE_Api
/
$ep
"
""
"
$m
"
)
"
else
response
=
"
$(
_get
"
$GCORE_Api
/
$ep
"
)
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
_err
"error
$ep
"
return
1
fi
_debug2 response
"
$response
"
return
0
}
dnsapi/dns_gd.sh
View file @
cb021efa
...
@@ -22,8 +22,8 @@ dns_gd_add() {
...
@@ -22,8 +22,8 @@ dns_gd_add() {
if
[
-z
"
$GD_Key
"
]
||
[
-z
"
$GD_Secret
"
]
;
then
if
[
-z
"
$GD_Key
"
]
||
[
-z
"
$GD_Secret
"
]
;
then
GD_Key
=
""
GD_Key
=
""
GD_Secret
=
""
GD_Secret
=
""
_err
"You d
o
n't specify godaddy api key and secret yet."
_err
"You d
id
n't specify godaddy api key and secret yet."
_err
"Please create you key and try again."
_err
"Please create you
r
key and try again."
return
1
return
1
fi
fi
...
@@ -46,7 +46,7 @@ dns_gd_add() {
...
@@ -46,7 +46,7 @@ dns_gd_add() {
fi
fi
if
_contains
"
$response
"
"
$txtvalue
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Th
e
record
is
exist
ing
, skip"
_info
"Th
is
record
already
exist
s
, skip
ping
"
return
0
return
0
fi
fi
...
...
dnsapi/dns_openstack.sh
View file @
cb021efa
...
@@ -57,16 +57,16 @@ _dns_openstack_create_recordset() {
...
@@ -57,16 +57,16 @@ _dns_openstack_create_recordset() {
if
[
-z
"
$_recordset_id
"
]
;
then
if
[
-z
"
$_recordset_id
"
]
;
then
_info
"Creating a new recordset"
_info
"Creating a new recordset"
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
=
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"No recordset ID found after create"
_err
"No recordset ID found after create"
return
1
return
1
fi
fi
else
else
_info
"Updating existing recordset"
_info
"Updating existing recordset"
# Build new list of --record
<rec> args for update
# Build new list of --record
=
<rec> args for update
_record_args
=
"--record
$txtvalue
"
_record_args
=
"--record
=
$txtvalue
"
for
_rec
in
$_records
;
do
for
_rec
in
$_records
;
do
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
done
# shellcheck disable=SC2086
# shellcheck disable=SC2086
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
...
@@ -107,13 +107,13 @@ _dns_openstack_delete_recordset() {
...
@@ -107,13 +107,13 @@ _dns_openstack_delete_recordset() {
fi
fi
else
else
_info
"Found existing records, updating recordset"
_info
"Found existing records, updating recordset"
# Build new list of --record
<rec> args for update
# Build new list of --record
=
<rec> args for update
_record_args
=
""
_record_args
=
""
for
_rec
in
$_records
;
do
for
_rec
in
$_records
;
do
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
continue
continue
fi
fi
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
done
# shellcheck disable=SC2086
# shellcheck disable=SC2086
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment