|
| 1 | +#!/usr/bin/env sh |
| 2 | + |
| 3 | +# Script to deploy certificate to a FreeNAS server |
| 4 | + |
| 5 | +# The following variables exported from environment will be used. |
| 6 | +# If not set then values previously saved in domain.conf file are used. |
| 7 | + |
| 8 | +# Required variables: |
| 9 | +# export FREENAS_PASSWORD="xxxxxxx" |
| 10 | +# |
| 11 | +# Optional variables (default values described): |
| 12 | +# export FREENAS_HOST="http://localhost:80" |
| 13 | +# export FREENAS_VERIFY=false |
| 14 | + |
| 15 | +#domain keyfile certfile cafile fullchain |
| 16 | +freenas_deploy() { |
| 17 | + _cdomain="$1" |
| 18 | + _ckey="$2" |
| 19 | + _ccert="$3" |
| 20 | + _cca="$4" |
| 21 | + _cfullchain="$5" |
| 22 | + |
| 23 | + _debug _cdomain "$_cdomain" |
| 24 | + _debug _ckey "$_ckey" |
| 25 | + _debug _ccert "$_ccert" |
| 26 | + _debug _cca "$_cca" |
| 27 | + _debug _cfullchain "$_cfullchain" |
| 28 | + |
| 29 | + _fullchain=$(tr '\n\r' '@#' <"$_cfullchain" | sed 's/@/\\n/g;s/#/\\r/g') |
| 30 | + _key=$(tr '\n\r' '@#' <"$_ckey" | sed 's/@/\\n/g;s/#/\\r/g') |
| 31 | + |
| 32 | + _debug _fullchain "$_fullchain" |
| 33 | + _debug _key "$_key" |
| 34 | + |
| 35 | + if [ -z "$FREENAS_PASSWORD" ]; then |
| 36 | + if [ -z "$Le_Deploy_FreeNAS_password" ]; then |
| 37 | + _err "FREENAS_PASSWORD not defined." |
| 38 | + return 1 |
| 39 | + fi |
| 40 | + else |
| 41 | + Le_Deploy_FreeNAS_password="$FREENAS_PASSWORD" |
| 42 | + _savedomainconf Le_Deploy_FreeNAS_password "$Le_Deploy_FreeNAS_password" |
| 43 | + fi |
| 44 | + |
| 45 | + if [ -z "$FREENAS_HOST" ]; then |
| 46 | + if [ -z "$Le_Deploy_FreeNAS_host" ]; then |
| 47 | + Le_Deploy_FreeNAS_host="http://localhost:80" |
| 48 | + _savedomainconf Le_Deploy_freenas_host "$Le_Deploy_FreeNAS_host" |
| 49 | + fi |
| 50 | + else |
| 51 | + Le_Deploy_FreeNAS_host="$FREENAS_HOST" |
| 52 | + _savedomainconf Le_Deploy_freenas_host "$Le_Deploy_FreeNAS_host" |
| 53 | + fi |
| 54 | + |
| 55 | + if [ -z "$FREENAS_VERIFY" ]; then |
| 56 | + if [ -z "$Le_Deploy_FreeNAS_verify" ]; then |
| 57 | + Le_Deploy_FreeNAS_verify=false |
| 58 | + _savedomainconf Le_Deploy_FreeNAS_verify "$Le_Deploy_FreeNAS_verify" |
| 59 | + fi |
| 60 | + else |
| 61 | + Le_Deploy_FreeNAS_verify="$FREENAS_VERIFY" |
| 62 | + _savedomainconf Le_Deploy_FreeNAS_verify "$Le_Deploy_FreeNAS_verify" |
| 63 | + fi |
| 64 | + |
| 65 | + _api_base="${Le_Deploy_FreeNAS_host}/api/v1.0" |
| 66 | +# _cert=$(date +letsencrypt-%Y-%m-%d-%H%M%S) |
| 67 | + _cert=$(date +letsencrypt-%Y-%m-%d) |
| 68 | + _realm=$(printf "%s:%s" "root" "$Le_Deploy_FreeNAS_password" | _base64) |
| 69 | + |
| 70 | + _debug _api_base "$_api_base" |
| 71 | + _debug _cert "$_cert" |
| 72 | + _debug _realm "$_realm" |
| 73 | + |
| 74 | + _info "Update or create SSL certificate" |
| 75 | + export _H1="Authorization: Basic $_realm" |
| 76 | + export _H2="Content-Type: application/json" |
| 77 | + _request="{\"cert_name\":\"$_cert\",\"cert_certificate\":\"$_fullchain\",\"cert_privatekey\":\"$_key\"}" |
| 78 | + _debug _request "$_request" |
| 79 | + _response="$(_post "$_request" "$_api_base/system/certificate/import/")" |
| 80 | + _debug _response "$_response" |
| 81 | + |
| 82 | + if echo "$_response" | grep -q "certificate with this name already exists"; then |
| 83 | + _err "SSL certificate with name '$_cert' are already exists. Stop deploying" |
| 84 | + return 0 |
| 85 | + elif [ "$_response" != "Certificate imported." ]; then |
| 86 | + _err "Error SSL certificate import" |
| 87 | + return 1 |
| 88 | + fi |
| 89 | + |
| 90 | + _info "Download certificate list and parse it to find the ID that matches our cert name" |
| 91 | + _response=$(_get "$_api_base/system/certificate/?limit=0") |
| 92 | + _debug _response "$_response" |
| 93 | + _regex="^.*\"cert_name\": *\"$_cert\".*$" |
| 94 | + _debug _regex "$_regex" |
| 95 | + _resource=$(echo "$_response" | sed 's/},{/},\n{/g' | _egrep_o "$_regex") |
| 96 | + _debug _resource "$_resource" |
| 97 | + _regex="^.*\"cert_name\": \"$_cert\".*$" |
| 98 | + _debug _regex "$_regex" |
| 99 | + _resource=$(echo "$_response" | sed 's/},{/},\n{/g' | _egrep_o "$_regex") |
| 100 | + _debug _resource "$_resource" |
| 101 | + _regex=".*\"id\": *\([0-9]*\).*$" |
| 102 | + _debug _regex "$_regex" |
| 103 | + _cert_id=$(echo "$_resource" | sed -n "s/$_regex/\1/p") |
| 104 | + _debug _resourceId "$_cert_id" |
| 105 | + |
| 106 | + _info "Set our cert as active" |
| 107 | + _request="{\"stg_guicertificate\":\"$_cert_id\"}" |
| 108 | + _response=$(_post "$_request" "$_api_base/system/settings/" '' "PUT") |
| 109 | + _debug _response "$_response" |
| 110 | + |
| 111 | + _info "Reload nginx with new cert" |
| 112 | + _response="$(_post "" "$_api_base/system/settings/restart-httpd-all/")" |
| 113 | + _debug _response "$_response" |
| 114 | + |
| 115 | + # Make time for httpd for reloading |
| 116 | + sleep 3 |
| 117 | + |
| 118 | + _info "Set our cert as active for FTP plugin" |
| 119 | + _request="{\"ftp_ssltls_certfile\":\"$_cert\"}" |
| 120 | + _response=$(_post "$_request" "$_api_base/services/ftp/" '' "PUT") |
| 121 | + _debug _response "$_response" |
| 122 | + |
| 123 | + _info "Certificate successfully deployed" |
| 124 | + return 0 |
| 125 | +} |
0 commit comments