Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
e291ada3
Unverified
Commit
e291ada3
authored
Apr 20, 2019
by
neil
Committed by
GitHub
Apr 20, 2019
Browse files
Merge pull request #2226 from Neilpang/dev
sync
parents
d01ab227
9c9fed74
Changes
2
Hide whitespace changes
Inline
Side-by-side
deploy/routeros.sh
0 → 100644
View file @
e291ada3
#!/usr/bin/env sh
# Here is a script to deploy cert to routeros router.
# Deploy the cert to remote routeros
#
# ```sh
# acme.sh --deploy -d ftp.example.com --deploy-hook routeros
# ```
#
# Before you can deploy the certificate to router os, you need
# to add the id_rsa.pub key to the routeros and assign a user
# to that key.
#
# The user need to have access to ssh, ftp, read and write.
#
# There are no need to enable ftp service for the script to work,
# as they are transmitted over SCP, however ftp is needed to store
# the files on the router.
#
# Then you need to set the environment variables for the
# deploy script to work.
#
# ```sh
# export ROUTER_OS_USERNAME=certuser
# export ROUTER_OS_HOST=router.example.com
#
# acme.sh --deploy -d ftp.example.com --deploy-hook routeros
# ```
#
# The deploy script will remove previously deployed certificates,
# and it does this with an assumption on how RouterOS names imported
# certificates, adding a "cer_0" suffix at the end. This is true for
# versions 6.32 -> 6.41.3, but it is not guaranteed that it will be
# true for future versions when upgrading.
#
# If the router have other certificates with the same name as the one
# beeing deployed, then this script will remove those certificates.
#
# At the end of the script, the services that use those certificates
# could be updated. Currently only the www-ssl service is beeing
# updated, but more services could be added.
#
# For instance:
# ```sh
# export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"
# ```
#
# One optional thing to do as well is to create a script that updates
# all the required services and run that script in a single command.
#
# returns 0 means success, otherwise error.
######## Public functions #####################
#domain keyfile certfile cafile fullchain
routeros_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
if
[
-z
"
$ROUTER_OS_HOST
"
]
;
then
_debug
"Using _cdomain as ROUTER_OS_HOST, please set if not correct."
ROUTER_OS_HOST
=
"
$_cdomain
"
fi
if
[
-z
"
$ROUTER_OS_USERNAME
"
]
;
then
_err
"Need to set the env variable ROUTER_OS_USERNAME"
return
1
fi
if
[
-z
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
]
;
then
_debug
"Not enabling additional services"
ROUTER_OS_ADDITIONAL_SERVICES
=
""
fi
_info
"Trying to push key '
$_ckey
' to router"
scp
"
$_ckey
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.key"
_info
"Trying to push cert '
$_cfullchain
' to router"
scp
"
$_cfullchain
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.cer"
# shellcheck disable=SC2029
ssh
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
"
bash
-c
"'
/certificate remove
$_cdomain
.cer_0
/certificate remove
$_cdomain
.cer_1
delay 1
/certificate import file-name=
$_cdomain
.cer passphrase=
\"\"
/certificate import file-name=
$_cdomain
.key passphrase=
\"\"
delay 1
/file remove
$_cdomain
.cer
/file remove
$_cdomain
.key
delay 2
/ip service set www-ssl certificate=
$_cdomain
.cer_0
$ROUTER_OS_ADDITIONAL_SERVICES
'"
return
0
}
dnsapi/dns_nsupdate.sh
View file @
e291ada3
...
...
@@ -6,14 +6,22 @@
dns_nsupdate_add
()
{
fulldomain
=
$1
txtvalue
=
$2
NSUPDATE_SERVER
=
"
${
NSUPDATE_SERVER
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER
)
}
"
NSUPDATE_SERVER_PORT
=
"
${
NSUPDATE_SERVER_PORT
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER_PORT
)
}
"
NSUPDATE_KEY
=
"
${
NSUPDATE_KEY
:-
$(
_readaccountconf_mutable NSUPDATE_KEY
)
}
"
NSUPDATE_ZONE
=
"
${
NSUPDATE_ZONE
:-
$(
_readaccountconf_mutable NSUPDATE_ZONE
)
}
"
_checkKeyFile
||
return
1
# save the dns server and key to the account conf file.
_saveaccountconf_mutable NSUPDATE_SERVER
"
${
NSUPDATE_SERVER
}
"
_saveaccountconf_mutable NSUPDATE_SERVER_PORT
"
${
NSUPDATE_SERVER_PORT
}
"
_saveaccountconf_mutable NSUPDATE_KEY
"
${
NSUPDATE_KEY
}
"
_saveaccountconf_mutable NSUPDATE_ZONE
"
${
NSUPDATE_ZONE
}
"
[
-n
"
${
NSUPDATE_SERVER
}
"
]
||
NSUPDATE_SERVER
=
"localhost"
[
-n
"
${
NSUPDATE_SERVER_PORT
}
"
]
||
NSUPDATE_SERVER_PORT
=
53
# save the dns server and key to the account conf file.
_saveaccountconf NSUPDATE_SERVER
"
${
NSUPDATE_SERVER
}
"
_saveaccountconf NSUPDATE_SERVER_PORT
"
${
NSUPDATE_SERVER_PORT
}
"
_saveaccountconf NSUPDATE_KEY
"
${
NSUPDATE_KEY
}
"
_saveaccountconf NSUPDATE_ZONE
"
${
NSUPDATE_ZONE
}
"
_info
"adding
${
fulldomain
}
. 60 in txt
\"
${
txtvalue
}
\"
"
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-ge
"
$DEBUG_LEVEL_1
"
]
&&
nsdebug
=
"-d"
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-ge
"
$DEBUG_LEVEL_2
"
]
&&
nsdebug
=
"-D"
...
...
@@ -42,6 +50,12 @@ EOF
#Usage: dns_nsupdate_rm _acme-challenge.www.domain.com
dns_nsupdate_rm
()
{
fulldomain
=
$1
NSUPDATE_SERVER
=
"
${
NSUPDATE_SERVER
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER
)
}
"
NSUPDATE_SERVER_PORT
=
"
${
NSUPDATE_SERVER_PORT
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER_PORT
)
}
"
NSUPDATE_KEY
=
"
${
NSUPDATE_KEY
:-
$(
_readaccountconf_mutable NSUPDATE_KEY
)
}
"
NSUPDATE_ZONE
=
"
${
NSUPDATE_ZONE
:-
$(
_readaccountconf_mutable NSUPDATE_ZONE
)
}
"
_checkKeyFile
||
return
1
[
-n
"
${
NSUPDATE_SERVER
}
"
]
||
NSUPDATE_SERVER
=
"localhost"
[
-n
"
${
NSUPDATE_SERVER_PORT
}
"
]
||
NSUPDATE_SERVER_PORT
=
53
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment