You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

193 lines
7.5 KiB

8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
  1. #!/usr/bin/env sh
  2. # Script to deploy certificates to remote server by SSH
  3. # Note that SSH must be able to login to remote host without a password...
  4. # SSH Keys must have been exchanged with the remote host. Validate and
  5. # test that you can login to USER@URL from the host running acme.sh before
  6. # using this script.
  7. #
  8. # The following variables exported from environment will be used.
  9. # If not set then values previously saved in domain.conf file are used.
  10. #
  11. # Only a username is required. All others are optional.
  12. #
  13. # The following examples are for QNAP NAS running QTS 4.2
  14. # export ACME_DEPLOY_SSH_USER="admin"
  15. # export ACME_DEPLOY_SSH_URL="qnap"
  16. # export ACME_DEPLOY_SSH_SERVICE_STOP=""
  17. # export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
  18. # export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
  19. # export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
  20. # export ACME_DEPLOY_SSH_FULLCHAIN=""
  21. # export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
  22. # export ACME_DEPLOY_SSH_SERVICE_START=""
  23. ######## Public functions #####################
  24. #domain keyfile certfile cafile fullchain
  25. sshdeploy_deploy() {
  26. _cdomain="$1"
  27. _ckey="$2"
  28. _ccert="$3"
  29. _cca="$4"
  30. _cfullchain="$5"
  31. _cmdstr=""
  32. _homedir='~'
  33. _homedir="$_homedir/.acme_ssh_deploy"
  34. _backupdir="$_homedir/certs-backup-$(date +%Y%m%d%H%M%S)"
  35. if [ -f "$DOMAIN_CONF" ]; then
  36. . "$DOMAIN_CONF"
  37. fi
  38. _debug _cdomain "$_cdomain"
  39. _debug _ckey "$_ckey"
  40. _debug _ccert "$_ccert"
  41. _debug _cca "$_cca"
  42. _debug _cfullchain "$_cfullchain"
  43. # USER is required to login by SSH to remote host.
  44. if [ -z "$ACME_DEPLOY_SSH_USER" ]; then
  45. if [ -z "$Le_Deploy_ssh_user" ]; then
  46. _err "ACME_DEPLOY_SSH_USER not defined."
  47. return 1
  48. fi
  49. else
  50. Le_Deploy_ssh_user="$ACME_DEPLOY_SSH_USER"
  51. _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
  52. fi
  53. # URL is optional. If not provided then use _cdomain
  54. if [ -n "$ACME_DEPLOY_SSH_URL" ]; then
  55. Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL"
  56. _savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url"
  57. elif [ -z "$Le_Deploy_ssh_url" ]; then
  58. Le_Deploy_ssh_url="$_cdomain"
  59. fi
  60. _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_url"
  61. # SERVICE_STOP is optional.
  62. # If provided then this command will be executed on remote host.
  63. if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then
  64. Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP"
  65. _savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop"
  66. fi
  67. if [ -n "$Le_Deploy_ssh_service_stop" ]; then
  68. _cmdstr="$_cmdstr $Le_Deploy_ssh_service_stop ;"
  69. _info "Will stop remote service with command $Le_Deploy_ssh_service_stop"
  70. fi
  71. # KEYFILE is optional.
  72. # If provided then private key will be copied to provided filename.
  73. if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then
  74. Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE"
  75. _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
  76. fi
  77. if [ -n "$Le_Deploy_ssh_keyfile" ]; then
  78. # backup file we are about to overwrite.
  79. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir ;"
  80. # copy new certificate into file.
  81. _cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;"
  82. _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
  83. fi
  84. # CERTFILE is optional.
  85. # If provided then private key will be copied or appended to provided filename.
  86. if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then
  87. Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE"
  88. _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
  89. fi
  90. if [ -n "$Le_Deploy_ssh_certfile" ]; then
  91. if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
  92. # if filename is same as that provided for private key then append.
  93. _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;"
  94. _info "will append certificate to same file"
  95. else
  96. # backup file we are about to overwrite.
  97. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir ;"
  98. # copy new certificate into file.
  99. _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;"
  100. _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
  101. fi
  102. fi
  103. # CAFILE is optional.
  104. # If provided then CA intermediate certificate will be copied to provided filename.
  105. if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then
  106. Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE"
  107. _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
  108. fi
  109. if [ -n "$Le_Deploy_ssh_cafile" ]; then
  110. # backup file we are about to overwrite.
  111. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir ;"
  112. # copy new certificate into file.
  113. _cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;"
  114. _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
  115. fi
  116. # FULLCHAIN is optional.
  117. # If provided then fullchain certificate will be copied to provided filename.
  118. if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then
  119. Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN"
  120. _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
  121. fi
  122. if [ -n "$Le_Deploy_ssh_fullchain" ]; then
  123. # backup file we are about to overwrite.
  124. _cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir ;"
  125. # copy new certificate into file.
  126. _cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;"
  127. _info "will copy full chain to remote file $Le_Deploy_ssh_fullchain"
  128. fi
  129. # REMOTE_CMD is optional.
  130. # If provided then this command will be executed on remote host.
  131. # A 2 second delay is inserted to allow system to stabalize after
  132. # executing a service stop.
  133. if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then
  134. Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD"
  135. _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
  136. fi
  137. if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
  138. if [ -n "$Le_Deploy_ssh_service_stop" ]; then
  139. _cmdstr="$_cmdstr sleep 2 ;"
  140. fi
  141. _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd ;"
  142. _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
  143. fi
  144. # SERVICE_START is optional.
  145. # If provided then this command will be executed on remote host.
  146. # A 2 second delay is inserted to allow system to stabalize after
  147. # executing a service stop or previous command.
  148. if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then
  149. Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START"
  150. _savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start"
  151. fi
  152. if [ -n "$Le_Deploy_ssh_service_start" ]; then
  153. if [ -n "$Le_Deploy_ssh_service_stop" ] || [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
  154. _cmdstr="$_cmdstr sleep 2 ;"
  155. fi
  156. _cmdstr="$_cmdstr $Le_Deploy_ssh_service_start ;"
  157. _info "Will start remote service with command $Le_Deploy_ssh_remote_cmd"
  158. fi
  159. if [ -z "$_cmdstr" ]; then
  160. _err "No remote commands to excute. Failed to deploy certificates to remote server"
  161. return 1
  162. else
  163. # something to execute.
  164. # run cleanup on the backup directory, erase all older than 180 days.
  165. _cmdstr="find $_homedir/* -type d -mtime +180 2>/dev/null | xargs rm -rf ; $_cmdstr"
  166. # Create our backup directory for overwritten cert files.
  167. _cmdstr="mkdir -p $_backupdir ; $_cmdstr"
  168. _info "Backup of old certificate files will be placed in remote directory $_backupdir"
  169. _info "Backup directories erased after 180 days."
  170. fi
  171. _debug "Remote commands to execute: $_cmdstr"
  172. _info "Submitting sequence of commands to remote server by ssh"
  173. ssh -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
  174. return 0
  175. }