Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
e291ada3
Unverified
Commit
e291ada3
authored
Apr 20, 2019
by
neil
Committed by
GitHub
Apr 20, 2019
Browse files
Merge pull request #2226 from Neilpang/dev
sync
parents
d01ab227
9c9fed74
Changes
2
Show whitespace changes
Inline
Side-by-side
deploy/routeros.sh
0 → 100644
View file @
e291ada3
#!/usr/bin/env sh
# Here is a script to deploy cert to routeros router.
# Deploy the cert to remote routeros
#
# ```sh
# acme.sh --deploy -d ftp.example.com --deploy-hook routeros
# ```
#
# Before you can deploy the certificate to router os, you need
# to add the id_rsa.pub key to the routeros and assign a user
# to that key.
#
# The user need to have access to ssh, ftp, read and write.
#
# There are no need to enable ftp service for the script to work,
# as they are transmitted over SCP, however ftp is needed to store
# the files on the router.
#
# Then you need to set the environment variables for the
# deploy script to work.
#
# ```sh
# export ROUTER_OS_USERNAME=certuser
# export ROUTER_OS_HOST=router.example.com
#
# acme.sh --deploy -d ftp.example.com --deploy-hook routeros
# ```
#
# The deploy script will remove previously deployed certificates,
# and it does this with an assumption on how RouterOS names imported
# certificates, adding a "cer_0" suffix at the end. This is true for
# versions 6.32 -> 6.41.3, but it is not guaranteed that it will be
# true for future versions when upgrading.
#
# If the router have other certificates with the same name as the one
# beeing deployed, then this script will remove those certificates.
#
# At the end of the script, the services that use those certificates
# could be updated. Currently only the www-ssl service is beeing
# updated, but more services could be added.
#
# For instance:
# ```sh
# export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"
# ```
#
# One optional thing to do as well is to create a script that updates
# all the required services and run that script in a single command.
#
# returns 0 means success, otherwise error.
######## Public functions #####################
#domain keyfile certfile cafile fullchain
routeros_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
if
[
-z
"
$ROUTER_OS_HOST
"
]
;
then
_debug
"Using _cdomain as ROUTER_OS_HOST, please set if not correct."
ROUTER_OS_HOST
=
"
$_cdomain
"
fi
if
[
-z
"
$ROUTER_OS_USERNAME
"
]
;
then
_err
"Need to set the env variable ROUTER_OS_USERNAME"
return
1
fi
if
[
-z
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
]
;
then
_debug
"Not enabling additional services"
ROUTER_OS_ADDITIONAL_SERVICES
=
""
fi
_info
"Trying to push key '
$_ckey
' to router"
scp
"
$_ckey
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.key"
_info
"Trying to push cert '
$_cfullchain
' to router"
scp
"
$_cfullchain
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.cer"
# shellcheck disable=SC2029
ssh
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
"
bash
-c
"'
/certificate remove
$_cdomain
.cer_0
/certificate remove
$_cdomain
.cer_1
delay 1
/certificate import file-name=
$_cdomain
.cer passphrase=
\"\"
/certificate import file-name=
$_cdomain
.key passphrase=
\"\"
delay 1
/file remove
$_cdomain
.cer
/file remove
$_cdomain
.key
delay 2
/ip service set www-ssl certificate=
$_cdomain
.cer_0
$ROUTER_OS_ADDITIONAL_SERVICES
'"
return
0
}
dnsapi/dns_nsupdate.sh
View file @
e291ada3
...
...
@@ -6,14 +6,22 @@
dns_nsupdate_add
()
{
fulldomain
=
$1
txtvalue
=
$2
NSUPDATE_SERVER
=
"
${
NSUPDATE_SERVER
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER
)
}
"
NSUPDATE_SERVER_PORT
=
"
${
NSUPDATE_SERVER_PORT
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER_PORT
)
}
"
NSUPDATE_KEY
=
"
${
NSUPDATE_KEY
:-
$(
_readaccountconf_mutable NSUPDATE_KEY
)
}
"
NSUPDATE_ZONE
=
"
${
NSUPDATE_ZONE
:-
$(
_readaccountconf_mutable NSUPDATE_ZONE
)
}
"
_checkKeyFile
||
return
1
# save the dns server and key to the account conf file.
_saveaccountconf_mutable NSUPDATE_SERVER
"
${
NSUPDATE_SERVER
}
"
_saveaccountconf_mutable NSUPDATE_SERVER_PORT
"
${
NSUPDATE_SERVER_PORT
}
"
_saveaccountconf_mutable NSUPDATE_KEY
"
${
NSUPDATE_KEY
}
"
_saveaccountconf_mutable NSUPDATE_ZONE
"
${
NSUPDATE_ZONE
}
"
[
-n
"
${
NSUPDATE_SERVER
}
"
]
||
NSUPDATE_SERVER
=
"localhost"
[
-n
"
${
NSUPDATE_SERVER_PORT
}
"
]
||
NSUPDATE_SERVER_PORT
=
53
# save the dns server and key to the account conf file.
_saveaccountconf NSUPDATE_SERVER
"
${
NSUPDATE_SERVER
}
"
_saveaccountconf NSUPDATE_SERVER_PORT
"
${
NSUPDATE_SERVER_PORT
}
"
_saveaccountconf NSUPDATE_KEY
"
${
NSUPDATE_KEY
}
"
_saveaccountconf NSUPDATE_ZONE
"
${
NSUPDATE_ZONE
}
"
_info
"adding
${
fulldomain
}
. 60 in txt
\"
${
txtvalue
}
\"
"
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-ge
"
$DEBUG_LEVEL_1
"
]
&&
nsdebug
=
"-d"
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-ge
"
$DEBUG_LEVEL_2
"
]
&&
nsdebug
=
"-D"
...
...
@@ -42,6 +50,12 @@ EOF
#Usage: dns_nsupdate_rm _acme-challenge.www.domain.com
dns_nsupdate_rm
()
{
fulldomain
=
$1
NSUPDATE_SERVER
=
"
${
NSUPDATE_SERVER
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER
)
}
"
NSUPDATE_SERVER_PORT
=
"
${
NSUPDATE_SERVER_PORT
:-
$(
_readaccountconf_mutable NSUPDATE_SERVER_PORT
)
}
"
NSUPDATE_KEY
=
"
${
NSUPDATE_KEY
:-
$(
_readaccountconf_mutable NSUPDATE_KEY
)
}
"
NSUPDATE_ZONE
=
"
${
NSUPDATE_ZONE
:-
$(
_readaccountconf_mutable NSUPDATE_ZONE
)
}
"
_checkKeyFile
||
return
1
[
-n
"
${
NSUPDATE_SERVER
}
"
]
||
NSUPDATE_SERVER
=
"localhost"
[
-n
"
${
NSUPDATE_SERVER_PORT
}
"
]
||
NSUPDATE_SERVER_PORT
=
53
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment