Backup old certificates before overwriting. Add userid export parameter.

And generate error if nothing to do at remote server.

deploy/sshdeploy.sh

@@ -1,22 +1,26 @@
 #!/usr/bin/env sh
 
-#Here is a script to deploy certificates to remote server by ssh
-#This file name is "sshdeploy.sh"
-#So, here must be a method   sshdeploy_deploy()
-#Which will be called by acme.sh to deploy the cert
-#returns 0 means success, otherwise error.
-
+# Script to deploy certificates to remote server by SSH
+# Note that SSH must be able to login to remote host without a password...
+# SSH Keys must have been exchanged with the remote host.  Validate and
+# test that you can login to USER@URL from the host running acme.sh before
+# using this script.
+#
 # The following variables exported from environment will be used.
 # If not set then values previously saved in domain.conf file are used.
 #
-# export ACME_DEPLOY_SSH_URL="admin@qnap"
-# export ACME_DEPLOY_SSH_SERVICE_STOP="/etc/init.d/stunnel.sh stop"
+# Only a username is required.  All others are optional.
+#
+# The following examples are for QNAP NAS running QTS 4.2 
+# export ACME_DEPLOY_SSH_USER="admin"
+# export ACME_DEPLOY_SSH_URL="qnap"
+# export ACME_DEPLOY_SSH_SERVICE_STOP=""
 # export ACME_DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
 # export ACME_DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
 # export ACME_DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
 # export ACME_DEPLOY_SSH_FULLCHAIN=""
 # export ACME_DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
-# export ACME_DEPLOY_SSH_SERVICE_START="/etc/init.d/stunnel.sh stop"
+# export ACME_DEPLOY_SSH_SERVICE_START=""
 
 . "$DOMAIN_CONF"
 
@@ -29,7 +33,9 @@ sshdeploy_deploy() {
   _ccert="$3"
   _cca="$4"
   _cfullchain="$5"
-  _cmdstr="{"
+  _cmdstr=""
+  _homedir="~/.acme_ssh_deploy"
+  _backupdir="$_homedir/certs-backup-$(date +%Y%m%d%H%M%S)"
 
   _debug _cdomain "$_cdomain"
   _debug _ckey "$_ckey"
@@ -37,18 +43,29 @@ sshdeploy_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
-  if [ -z "$ACME_DEPLOY_SSH_URL" ]; then
-    if [ -z "$Le_Deploy_ssh_url" ]; then
-      _err "ACME_DEPLOY_SSH_URL not defined."
+  # USER is required to login by SSH to remote host.
+  if [ -z "$ACME_DEPLOY_SSH_USER" ]; then
+    if [ -z "$Le_Deploy_ssh_user" ]; then
+      _err "ACME_DEPLOY_SSH_USER not defined."
       return 1
     fi
   else
+    Le_Deploy_ssh_user="$ACME_DEPLOY_SSH_USER"
+    _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
+  fi
+
+  # URL is optional.  If not provided then use _cdomain
+  if [ -n "$ACME_DEPLOY_SSH_URL" ]; then
     Le_Deploy_ssh_url="$ACME_DEPLOY_SSH_URL"
     _savedomainconf Le_Deploy_ssh_url "$Le_Deploy_ssh_url"
+  elif [ -z "$Le_Deploy_ssh_url" ]; then
+    Le_Deploy_ssh_url="$_cdomain"
   fi
   
-  _info "Deploy certificates to remote server $Le_Deploy_ssh_url"
+  _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_url"
 
+  # SERVICE_STOP is optional.
+  # If provided then this command will be executed on remote host.
   if [ -n "$ACME_DEPLOY_SSH_SERVICE_STOP" ]; then
     Le_Deploy_ssh_service_stop="$ACME_DEPLOY_SSH_SERVICE_STOP"
     _savedomainconf Le_Deploy_ssh_service_stop "$Le_Deploy_ssh_service_stop"
@@ -58,71 +75,114 @@ sshdeploy_deploy() {
     _info "Will stop remote service with command $Le_Deploy_ssh_service_stop"
   fi
 
+  # KEYFILE is optional.
+  # If provided then private key will be copied to provided filename.
   if [ -n "$ACME_DEPLOY_SSH_KEYFILE" ]; then
     Le_Deploy_ssh_keyfile="$ACME_DEPLOY_SSH_KEYFILE"
     _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
   fi
   if [ -n "$Le_Deploy_ssh_keyfile" ]; then
+    # backup file we are about to overwrite.
+    _cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir ;"
+    # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat $_ckey)\" > $Le_Deploy_ssh_keyfile ;"
     _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
   fi
 
+  # CERTFILE is optional.
+  # If provided then private key will be copied or appended to provided filename.
   if [ -n "$ACME_DEPLOY_SSH_CERTFILE" ]; then
     Le_Deploy_ssh_certfile="$ACME_DEPLOY_SSH_CERTFILE"
     _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
   fi
   if [ -n "$Le_Deploy_ssh_certfile" ]; then
     if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
+      # if filename is same as that provided for private key then append.
       _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" >> $Le_Deploy_ssh_certfile ;"
       _info "will append certificate to same file"
     else
+      # backup file we are about to overwrite.
+      _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir ;"
+      # copy new certificate into file.
       _cmdstr="$_cmdstr echo \"$(cat $_ccert)\" > $Le_Deploy_ssh_certfile ;"
       _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
     fi
   fi
 
+  # CAFILE is optional.
+  # If provided then CA intermediate certificate will be copied to provided filename.
   if [ -n "$ACME_DEPLOY_SSH_CAFILE" ]; then
     Le_Deploy_ssh_cafile="$ACME_DEPLOY_SSH_CAFILE"
     _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
   fi
   if [ -n "$Le_Deploy_ssh_cafile" ]; then
+    # backup file we are about to overwrite.
+    _cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir ;"
+    # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat $_cca)\" > $Le_Deploy_ssh_cafile ;"
     _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
   fi
 
+  # FULLCHAIN is optional.
+  # If provided then fullchain certificate will be copied to provided filename.
   if [ -n "$ACME_DEPLOY_SSH_FULLCHAIN" ]; then
     Le_Deploy_ssh_fullchain="$ACME_DEPLOY_SSH_FULLCHAIN"
     _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
   fi
   if [ -n "$Le_Deploy_ssh_fullchain" ]; then
+    # backup file we are about to overwrite.
+    _cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir ;"
+    # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat $_cfullchain)\" > $Le_Deploy_ssh_fullchain ;"
     _info "will copy full chain to remote file $Le_Deploy_ssh_fullchain"
   fi
 
+  # REMOTE_CMD is optional.
+  # If provided then this command will be executed on remote host.
+  # A 2 second delay is inserted to allow system to stabalize after
+  # executing a service stop.
   if [ -n "$ACME_DEPLOY_SSH_REMOTE_CMD" ]; then
     Le_Deploy_ssh_remote_cmd="$ACME_DEPLOY_SSH_REMOTE_CMD"
     _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
   fi
   if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
-    _cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_remote_cmd ;"
-    _info "Will sleep 2 seconds then execute remote command $Le_Deploy_ssh_remote_cmd"
+     if [ -n "$Le_Deploy_ssh_service_stop" ]; then
+       _cmdstr="$_cmdstr sleep 2 ;"
+     fi
+    _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd ;"
+    _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
   fi
 
+  # SERVICE_START is optional.
+  # If provided then this command will be executed on remote host.
+  # A 2 second delay is inserted to allow system to stabalize after
+  # executing a service stop or previous command.
   if [ -n "$ACME_DEPLOY_SSH_SERVICE_START" ]; then
     Le_Deploy_ssh_service_start="$ACME_DEPLOY_SSH_SERVICE_START"
     _savedomainconf Le_Deploy_ssh_service_start "$Le_Deploy_ssh_service_start"
   fi
   if [ -n "$Le_Deploy_ssh_service_start" ]; then
-    _cmdstr="$_cmdstr sleep 2 ; $Le_Deploy_ssh_service_start ;"
-    _info "Will sleep 2 seconds then start remote service with command $Le_Deploy_ssh_remote_cmd"
+     if [ -n "$Le_Deploy_ssh_service_stop" ] || [ -n "$Le_Deploy_ssh_remote_cmd" ] ; then
+       _cmdstr="$_cmdstr sleep 2 ;"
+     fi
+    _cmdstr="$_cmdstr $Le_Deploy_ssh_service_start ;"
+    _info "Will start remote service with command $Le_Deploy_ssh_remote_cmd"
   fi
 
-  _cmdstr="$_cmdstr }"
-
-  _debug "Remote command to execute: $_cmdstr"
+  if [ -z "$_cmdstr" ]; then
+    _err "No remote commands to excute. Failed to deploy certificates to remote server"
+    return 1
+  else
+    # something to execute.
+    # run cleanup on the backup directory, erase all older than 180 days.
+    _cmdstr="find $_homedir/* -type d -mtime +180 2>/dev/null | xargs rm -rf ; $_cmdstr"
+    # Create our backup directory for overwritten cert files.
+    _cmdstr="mkdir -p $_backupdir ; $_cmdstr"
+  fi
 
+  _debug "Remote commands to execute: $_cmdstr"
   _info "Submitting sequence of commands to remote server by ssh"
-  ssh -T "$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
+  ssh -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_url" bash -c "'$_cmdstr'"
 
   return 0
 }