Add new -A option to 'A'lso push certs out to remotes after successful generation/renewal.
This commit is contained in:
parent
2d8ea1e8ec
commit
b7c4fec190
|
|
@ -30,6 +30,7 @@ Script to automate management of letsencrypt SSL certificates, supporting wildca
|
|||
|
||||
mode is one of: deploy|renew|generate|test
|
||||
|
||||
-A In generate/renew modes, Also deploy certs if needed
|
||||
-c Cron mode - only output if something is done.
|
||||
-f Push out certs even if they haven't changed.
|
||||
-i Iniitalise new config file in /Users/rpearce/.lehook/config
|
||||
|
|
|
|||
320
lehook.sh
320
lehook.sh
|
|
@ -3,17 +3,6 @@ DIR=$HOME/.lehook
|
|||
configfile=$DIR/config
|
||||
VALIDMODES="deploy|renew|generate|test"
|
||||
|
||||
function doinstall() {
|
||||
echo "Creating hardlinks in $DIR..."
|
||||
cp -f $0 $DIR/lehook.sh
|
||||
for x in pre post deploy; do
|
||||
ln -f $DIR/lehook.sh $DIR/lehook-${x}.sh
|
||||
done
|
||||
ln -f $DIR/lehook.sh /usr/local/bin/lehook.sh
|
||||
echo "Install complete. Files are in $DIR."
|
||||
echo "Main binary in /usr/local/bin/lehook.sh."
|
||||
}
|
||||
|
||||
function doinit() {
|
||||
mkdir -p $DIR
|
||||
if [[ ! -e $configfile ]]; then
|
||||
|
|
@ -67,6 +56,20 @@ function doinstall() {
|
|||
echo "Main binary in /usr/local/bin/lehook.sh."
|
||||
}
|
||||
|
||||
function log() {
|
||||
local showtoo txt
|
||||
if [[ $1 == "-v" ]]; then
|
||||
showtoo=1
|
||||
shift 1
|
||||
else
|
||||
showtoo=0
|
||||
fi
|
||||
txt="$(date): $*"
|
||||
|
||||
echo "$txt" >>$LOG
|
||||
[[ $showtoo -eq 1 ]] && echo "$txt"
|
||||
}
|
||||
|
||||
function out() {
|
||||
local nl
|
||||
nl="\n"
|
||||
|
|
@ -99,7 +102,7 @@ function copycert() {
|
|||
dec
|
||||
}
|
||||
function dossh() {
|
||||
local h desc cmd rv
|
||||
local h desc cmd rv err
|
||||
h=$1
|
||||
desc="$2"
|
||||
cmd="$3"
|
||||
|
|
@ -112,7 +115,7 @@ function dossh() {
|
|||
if [[ $? -eq 0 ]]; then
|
||||
[[ $quiet -ne 1 ]] && echo "Ok"
|
||||
else
|
||||
[[ $quiet -ne 1 ]] && echo "$err"
|
||||
[[ $quiet -ne 1 ]] && echo "Error: [$err]"
|
||||
rv=1
|
||||
fi
|
||||
dec
|
||||
|
|
@ -125,9 +128,11 @@ function usage() {
|
|||
echo
|
||||
echo " mode is one of: $VALIDMODES"
|
||||
echo
|
||||
echo " -A In generate/renew modes, Also deploy certs if needed"
|
||||
echo " -c Cron mode - only output if something is done."
|
||||
echo " -f Push out certs even if they haven't changed."
|
||||
echo " -i Install files in $DIR and generate config if it doesn't exist."
|
||||
echo " -i Iniitalise new config file in $configfile"
|
||||
echo " -I Install binary symlinks in home dir"
|
||||
echo " -r remotes Only push certs to the given remotes [default: $remotes]"
|
||||
echo " -s services Only restart the given services [default: $services]"
|
||||
echo " -d domain Only push cert for given domain [default: $domains]."
|
||||
|
|
@ -171,17 +176,20 @@ quiet=0
|
|||
verbose=0
|
||||
cronmode=0
|
||||
init=0
|
||||
alsodeploy=0
|
||||
recurseargs=""
|
||||
|
||||
if [[ -e $configfile ]]; then
|
||||
. $configfile
|
||||
fi
|
||||
|
||||
ARGS="cd:fhiIqr:s:v"
|
||||
# TODO: add renew mode
|
||||
# TODO: add generate mode
|
||||
ARGS="Acd:fhiIqr:s:v"
|
||||
while getopts "$ARGS" i; do
|
||||
case "$i" in
|
||||
A)
|
||||
alsodeploy=1
|
||||
;;
|
||||
|
||||
c)
|
||||
cronmode=1
|
||||
recurseargs="$recurseargs -c"
|
||||
|
|
@ -235,12 +243,20 @@ if [[ ! -e $configfile ]]; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
LOG=/var/log/lehook.log
|
||||
|
||||
if [[ $0 =~ pre|post|deploy ]]; then
|
||||
log -v "lehook running with cmd="$0" args='$*' CERTBOT_DOMAIN='$CERTBOT_DOMAIN' CERTBOT_VALIDATION='$CERTBOT_VALIDATION'"
|
||||
set -e
|
||||
set -u
|
||||
set -o pipefail
|
||||
if [[ -z $CERTBOT_DOMAIN ]]; then
|
||||
echo "Error: no domain env var received from certbot. vars are:"
|
||||
log -v "Error: no \$CERTBOT_DOMAIN env var received from certbot. vars are:"
|
||||
set | grep CERTBOT
|
||||
exit 1
|
||||
fi
|
||||
if [[ -z $CERTBOT_VALIDATION ]]; then
|
||||
log -v "Error: no \$CERTBOT_VALIDATION env var received from certbot. vars are:"
|
||||
set | grep CERTBOT
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -265,112 +281,12 @@ else
|
|||
fi
|
||||
fi
|
||||
|
||||
function needsrestart() {
|
||||
local sname rv
|
||||
sname=$1
|
||||
rv=1
|
||||
if [[ $sname == "dovecot" ]]; then
|
||||
rv=0
|
||||
fi
|
||||
return $rv
|
||||
}
|
||||
|
||||
function wait_for_dns_update() { # wait_for_dns_update domain value
|
||||
local ns record
|
||||
record="_acme-challenge.$1"
|
||||
value="$2"
|
||||
for ns in $check_nameservers; do
|
||||
[[ $quiet -eq 0 || $cronmode -eq 1 ]] && echo -n "Waiting for challenge record to update on $ns..."
|
||||
res=$(dig +short @${ns} $record IN TXT | tr -d '"' 2>&1)
|
||||
while [[ $res != $value ]]; do
|
||||
sleep 5
|
||||
echo -n "."
|
||||
res=$(dig +short @${ns} $record IN TXT | tr -d '"' 2>&1)
|
||||
done
|
||||
echo "done"
|
||||
done
|
||||
}
|
||||
|
||||
if [[ $0 == *pre* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
DATA="$CERTBOT_VALIDATION"
|
||||
cmd=$(printf "server %s\nlocal $LOCALADDR\n update add _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${DOMAIN}" "${TTL}" "${DATA}")
|
||||
#echo "PREHOOK - ABOUT TO RUN:"
|
||||
#echo "$cmd" | sed -e 's/^/ /'
|
||||
echo "$cmd" | $NSUPDATE
|
||||
rv=$?
|
||||
wait_for_dns_update "$DOMAIN" "$DATA"
|
||||
exit $rv
|
||||
elif [[ $0 == *post* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
DATA="$CERTBOT_VALIDATION"
|
||||
cmd=$(printf "server %s\nlocal $LOCALADDR\n update delete _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${DOMAIN}" "${TTL}" "${DATA}")
|
||||
#echo "POSTHOOK - ABOUT TO RUN"
|
||||
#echo "$cmd" | sed -e 's/^/ /'
|
||||
echo "$cmd" | $NSUPDATE
|
||||
rv=$?
|
||||
wait_for_dns_update "$DOMAIN" ""
|
||||
exit $rv
|
||||
elif [[ $0 == *deploy* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
/usr/local/bin/lehook.sh deploy -d $DOMAIN $recurseargs
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
|
||||
rv=0
|
||||
if [[ $mode == "generate" ]]; then
|
||||
rv=0
|
||||
for this in $domains; do
|
||||
res=$(certbot certonly -n --manual --preferred-challenges=dns --email $email --agree-tos --manual-auth-hook $DIR/lehook-pre.sh --manual-cleanup-hook $DIR/lehook-post.sh --deploy-hook $DIR/lehook-deploy.sh -d *.${this} 2>&1)
|
||||
rv=$((rv + $?))
|
||||
[[ $verbose -eq 1 ]] && echo "$res"
|
||||
done
|
||||
elif [[ $mode == "renew" ]]; then
|
||||
rv=0
|
||||
extraargs=""
|
||||
[[ $force -eq 1 ]] && extraargs="$extraargs --force-renewal"
|
||||
for this in $domains; do
|
||||
res=$(certbot renew -n --manual --preferred-challenges=dns --email $email --agree-tos --manual-auth-hook $DIR/lehook-pre.sh --manual-cleanup-hook $DIR/lehook-post.sh --deploy-hook $DIR/lehook-deploy.sh $extraargs --cert-name ${this} 2>&1)
|
||||
rv=$((rv + $?))
|
||||
[[ $verbose -eq 1 ]] && echo "$res"
|
||||
if [[ "$res" =~ "not due for" ]]; then
|
||||
if [[ $quiet -eq 0 && $cronmode -eq 0 ]]; then
|
||||
exp=$(certbot certificates --cert-name $this 2>&1 | grep Expiry | sed -e 's/^.*Date: //')
|
||||
echo "$this not due for renewal yet. Expiry: $exp"
|
||||
fi
|
||||
elif [[ "$res" =~ "renewals succeeded" ]]; then
|
||||
if [[ $quiet -eq 0 || $cronmode -eq 1 ]]; then
|
||||
exp=$(certbot certificates --cert-name $this 2>&1 | grep Expiry | sed -e 's/^.*Date: //')
|
||||
echo "$this has been renewed. New expiry: $exp"
|
||||
fi
|
||||
else
|
||||
echo "Error renewing $this. Certbot output:"
|
||||
echo "$res"
|
||||
fi
|
||||
done
|
||||
elif [[ $mode == "test" ]]; then
|
||||
nowdate="$(date +%s)"
|
||||
echo "== Test mode."
|
||||
echo "== About to run pre-hook"
|
||||
export CERTBOT_DOMAIN="${domains%% *}" # just use the first one
|
||||
export CERTBOT_VALIDATION="test-${nowdate}"
|
||||
$DIR/lehook-pre.sh
|
||||
echo "== Pre-hook done. Checking DNS record:"
|
||||
dig -b $LOCALADDR @${DNSSERVER} _acme-challenge.${domains%% *}. IN txt
|
||||
echo -n "The above should show a TXT record saying '$nowdate'.... hit ENTER: "
|
||||
read dummy
|
||||
echo "== About to run post-hook"
|
||||
export CERTBOT_DOMAIN="${domains%% *}"
|
||||
export CERTBOT_VALIDATION="test-${nowdate}"
|
||||
echo "== Post-hook done. Checking DNS record:"
|
||||
$DIR/lehook-post.sh
|
||||
dig -b $LOCALADDR @${DNSSERVER} _acme-challenge.${domains%% *}. IN txt
|
||||
echo -n "The above should NOT show a TXT record any more. Hit ENTER: "
|
||||
read dummy
|
||||
exit 1
|
||||
elif [[ $mode == "deploy" ]]; then
|
||||
function dodeploy() {
|
||||
local certdirs d rv
|
||||
local r newcerta ip domain dest_cert dest_priv
|
||||
local local_cert_sum local_priv_sum needupate
|
||||
local isrh checkcmd reloadcmd enabled
|
||||
local nok nfail okservs failservs s
|
||||
certdirs=""
|
||||
for d in $domains; do
|
||||
thisone=$certbase/$d
|
||||
|
|
@ -427,15 +343,16 @@ elif [[ $mode == "deploy" ]]; then
|
|||
|
||||
out "* Restarting services"
|
||||
inc
|
||||
ssh root@$r "grep -qi 'Release 6' /etc/redhat-release 2>/dev/null"
|
||||
if [[ $? -eq 0 ]]; then
|
||||
checkcmd="chkconfig"
|
||||
isrh=$(ssh root@$r "test -f /etc/redhat-release && echo yes || echo no")
|
||||
if [[ $isrh == "no" ]]; then
|
||||
checkcmd="service --status-all"
|
||||
reloadcmd="service XX restart && echo Ok || echo failed"
|
||||
else
|
||||
checkcmd="systemctl list-unit-files --state=enabled"
|
||||
reloadcmd="systemctl restart XX"
|
||||
fi
|
||||
enabled=$(ssh root@$r "$checkcmd" | awk '/:on|nabled/ { print $1 }')
|
||||
|
||||
enabled=$(ssh root@$r "$checkcmd 2>&1" | awk '/:on|nabled/ { print $1 } ($2 == "+") { print $4 }')
|
||||
nok=0
|
||||
nfail=0
|
||||
okservs=""
|
||||
|
|
@ -443,9 +360,6 @@ elif [[ $mode == "deploy" ]]; then
|
|||
for s in $services; do
|
||||
if [[ $enabled == *$s* ]]; then
|
||||
reloadcmd=$(echo "$reloadcmd" | sed -e "s/XX/$s/")
|
||||
if needsrestart $s; then
|
||||
reloadcmd=$(echo "$reloadcmd" | sed -e "s/reload/restart/")
|
||||
fi
|
||||
dossh $r $s "$reloadcmd"
|
||||
thisrv=$?
|
||||
rv=$((rv + $thisrv))
|
||||
|
|
@ -481,5 +395,149 @@ elif [[ $mode == "deploy" ]]; then
|
|||
fi
|
||||
dec
|
||||
done
|
||||
}
|
||||
|
||||
function wait_for_dns_update() { # wait_for_dns_update [-v for inverse match] domain value
|
||||
local ns record secs grv wantgrv verb
|
||||
if [[ $1 == "-v" ]]; then
|
||||
# want grep NOT to match
|
||||
verb="does NOT contain"
|
||||
wantgrv=1
|
||||
shift 1
|
||||
else
|
||||
# want grep to match
|
||||
verb="contains"
|
||||
wantgrv=0
|
||||
fi
|
||||
record="_acme-challenge.$1"
|
||||
value="$2"
|
||||
secs=5
|
||||
|
||||
log -v "Delaying until dns is done with:"
|
||||
log -v " servers: $check_nameservers"
|
||||
log -v " record: $record"
|
||||
log -v "desired value: $verb $value"
|
||||
log -v " delay: $secs"
|
||||
for ns in $check_nameservers; do
|
||||
[[ $verbose -eq 1 || $quiet -eq 0 || $cronmode -eq 1 ]] && echo -n "Waiting for challenge record to update on $ns..."
|
||||
res=$(dig +short @${ns} $record IN TXT | tr -d '"' 2>&1)
|
||||
(echo "$res" | grep -q "$value") && grv=0 || grv=1
|
||||
while [[ $grv -ne $wantgrv ]]; do
|
||||
sleep $secs
|
||||
[[ $verbose -eq 1 || $quiet -eq 0 || $cronmode -eq 1 ]] && echo -n "."
|
||||
res=$(dig +short @${ns} $record IN TXT | tr -d '"' 2>&1)
|
||||
(echo "$res" | grep -q "$value") && grv=0 || grv=1
|
||||
done
|
||||
[[ $verbose -eq 1 || $quiet -eq 0 || $cronmode -eq 1 ]] && echo "done"
|
||||
done
|
||||
log -v "All DNS updates done."
|
||||
return 0
|
||||
}
|
||||
|
||||
if [[ $0 == *pre* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
DATA="$CERTBOT_VALIDATION"
|
||||
cmd=$(printf "server %s\nlocal $LOCALADDR\n update add _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${DOMAIN}" "${TTL}" "${DATA}")
|
||||
log -v "PREHOOK - Adding challenge key '$DATA' for domain "$DOMAIN" via:"
|
||||
log -v "$cmd" | sed -e 's/^/ /'
|
||||
echo "$cmd" | $NSUPDATE
|
||||
rv=$?
|
||||
log -v "PREHOOK - Done, now waiting for dns update."
|
||||
wait_for_dns_update "$DOMAIN" "$DATA"
|
||||
log -v "PREHOOK - Waiting for any children"
|
||||
wait
|
||||
log -v "PREHOOK - About to exit with code $rv"
|
||||
exit $rv
|
||||
elif [[ $0 == *post* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
DATA="$CERTBOT_VALIDATION"
|
||||
cmd=$(printf "server %s\nlocal $LOCALADDR\n update delete _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${DOMAIN}" "${TTL}" "${DATA}")
|
||||
#echo "POSTHOOK - ABOUT TO RUN"
|
||||
#echo "$cmd" | sed -e 's/^/ /'
|
||||
log -v "POSTHOOK - Removing challenge key '$DATA' via:"
|
||||
log -v "$cmd" | sed -e 's/^/ /'
|
||||
echo "$cmd" | $NSUPDATE
|
||||
rv=$?
|
||||
log -v "POSTHOOK - Done, now waiting for dns update."
|
||||
wait_for_dns_update -v "$DOMAIN" "$DATA"
|
||||
log -v "POSTHOOK - Waiting for any children"
|
||||
wait
|
||||
log -v "POSTHOOK - About to exit with code $rv"
|
||||
exit $rv
|
||||
elif [[ $0 == *deploy* ]]; then
|
||||
DOMAIN="$CERTBOT_DOMAIN"
|
||||
/usr/local/bin/lehook.sh deploy -d $DOMAIN $recurseargs
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
|
||||
rv=0
|
||||
if [[ $mode == "generate" ]]; then
|
||||
rv=0
|
||||
for this in $domains; do
|
||||
res=$(certbot certonly -n --manual --preferred-challenges=dns --email $email --agree-tos --manual-auth-hook $DIR/lehook-pre.sh --manual-cleanup-hook $DIR/lehook-post.sh --deploy-hook $DIR/lehook-deploy.sh --expand -d "${this},*.${this}" 2>&1)
|
||||
rv=$((rv + $?))
|
||||
[[ $verbose -eq 1 ]] && echo "$res"
|
||||
done
|
||||
if [[ $rv -eq 0 && $alsodeploy -eq 1 ]]; then
|
||||
dodeploy
|
||||
rv=$?
|
||||
fi
|
||||
elif [[ $mode == "renew" ]]; then
|
||||
rv=0
|
||||
extraargs=""
|
||||
renewed=0
|
||||
[[ $force -eq 1 ]] && extraargs="$extraargs --force-renewal"
|
||||
cp -f /dev/null /tmp/lh-renew
|
||||
for this in $domains; do
|
||||
[[ $verbose -eq 1 ]] && echo "Will run: certbot renew -n --manual --preferred-challenges=dns --email $email --agree-tos --manual-auth-hook $DIR/lehook-pre.sh --manual-cleanup-hook $DIR/lehook-post.sh --deploy-hook $DIR/lehook-deploy.sh $extraargs --cert-name ${this} 2>&1" | tee -a /tmp/lh-renew
|
||||
res=$(certbot renew -n --manual --preferred-challenges=dns --email $email --agree-tos --manual-auth-hook $DIR/lehook-pre.sh --manual-cleanup-hook $DIR/lehook-post.sh --deploy-hook $DIR/lehook-deploy.sh $extraargs --cert-name ${this} 2>&1 | tee -a /tmp/lh-renew)
|
||||
rv=$((rv + $?))
|
||||
[[ $verbose -eq 1 ]] && echo "$res"
|
||||
if [[ "$res" =~ "not due for" ]]; then
|
||||
if [[ $quiet -eq 0 && $cronmode -eq 0 ]]; then
|
||||
exp=$(certbot certificates --cert-name $this 2>&1 | grep Expiry | sed -e 's/^.*Date: //')
|
||||
echo "$this not due for renewal yet. Expiry: $exp"
|
||||
fi
|
||||
elif [[ "$res" =~ "renewals succeeded" ]]; then
|
||||
renewed=$((renewed + 1))
|
||||
if [[ $quiet -eq 0 || $cronmode -eq 1 ]]; then
|
||||
exp=$(certbot certificates --cert-name $this 2>&1 | grep Expiry | sed -e 's/^.*Date: //')
|
||||
echo "$this has been renewed. New expiry: $exp"
|
||||
fi
|
||||
else
|
||||
echo "Error renewing $this. Certbot output:"
|
||||
echo "$res"
|
||||
fi
|
||||
done
|
||||
if [[ $rv -eq 0 && $alsodeploy -eq 1 && $renewed -gt 0 ]]; then
|
||||
dodeploy
|
||||
rv=$?
|
||||
fi
|
||||
elif [[ $mode == "test" ]]; then
|
||||
nowdate="$(date +%s)"
|
||||
echo "== Test mode."
|
||||
echo "== About to run pre-hook"
|
||||
export CERTBOT_DOMAIN="${domains%% *}" # just use the first one
|
||||
export CERTBOT_VALIDATION="test-${nowdate}"
|
||||
$DIR/lehook-pre.sh
|
||||
echo "== Pre-hook done. Checking DNS record:"
|
||||
dig -b $LOCALADDR @${DNSSERVER} _acme-challenge.${domains%% *}. IN txt
|
||||
echo -n "The above should show a TXT record saying '$nowdate'.... hit ENTER: "
|
||||
read dummy
|
||||
echo "== About to run post-hook"
|
||||
export CERTBOT_DOMAIN="${domains%% *}"
|
||||
export CERTBOT_VALIDATION="test-${nowdate}"
|
||||
echo "== Post-hook done. Checking DNS record:"
|
||||
$DIR/lehook-post.sh
|
||||
dig -b $LOCALADDR @${DNSSERVER} _acme-challenge.${domains%% *}. IN txt
|
||||
echo -n "The above should NOT show a TXT record any more. Hit ENTER: "
|
||||
read dummy
|
||||
exit 1
|
||||
elif [[ $mode == "deploy" ]]; then
|
||||
dodeploy
|
||||
rv=$?
|
||||
fi
|
||||
exit $rv
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue