free
/
freedomboneeee
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

letsencrypt repo change

This commit is contained in:
Bob Mottram 2016-08-08 10:29:52 +01:00
parent ba7398ffbd
commit 93b20c01c0
1 changed files with 124 additions and 124 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

248
src/freedombone-addcert
View File

@ -50,7 +50,7 @@ NODH=
DH_KEYLENGTH=2048 DH_KEYLENGTH=2048
INSTALL_DIR=/root/build INSTALL_DIR=/root/build
LETSENCRYPT_SERVER='https://acme-v01.api.letsencrypt.org/directory' LETSENCRYPT_SERVER='https://acme-v01.api.letsencrypt.org/directory'
LETSENCRYPT_REPO="https://github.com/letsencrypt/letsencrypt" LETSENCRYPT_REPO="https://github.com/certbot/certbot"
MY_EMAIL_ADDRESS= MY_EMAIL_ADDRESS=
FRIENDS_MIRRORS_SERVER= FRIENDS_MIRRORS_SERVER=
FRIENDS_MIRRORS_PASSWORD= FRIENDS_MIRRORS_PASSWORD=
@ -59,40 +59,40 @@ MY_MIRRORS_PASSWORD=
function read_repo_servers { function read_repo_servers {
if [ -f $CONFIGURATION_FILE ]; then if [ -f $CONFIGURATION_FILE ]; then
if grep -q "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_SERVER=$(grep "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_SERVER=$(grep "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_SSH_PORT=$(grep "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_SSH_PORT=$(grep "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then if grep -q "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then
MY_MIRRORS_PASSWORD=$(grep "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}') MY_MIRRORS_PASSWORD=$(grep "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_PASSWORD=$(grep "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_PASSWORD=$(grep "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
fi fi
if [ ! $FRIENDS_MIRRORS_SERVER ]; then if [ ! $FRIENDS_MIRRORS_SERVER ]; then
return return
fi fi
if [ ${#FRIENDS_MIRRORS_SERVER} -lt 2 ]; then if [ ${#FRIENDS_MIRRORS_SERVER} -lt 2 ]; then
return return
fi fi
MAIN_COMMAND=/usr/local/bin/${PROJECT_NAME} MAIN_COMMAND=/usr/local/bin/${PROJECT_NAME}
if [ ! -f $MAIN_COMMAND ]; then if [ ! -f $MAIN_COMMAND ]; then
MAIN_COMMAND=/usr/bin/${PROJECT_NAME} MAIN_COMMAND=/usr/bin/${PROJECT_NAME}
fi fi
REPOS=($(cat ${MAIN_COMMAND} | grep "_REPO=\"" | uniq -u | sed 's|${PROJECT_NAME}|'"${PROJECT_NAME}"'|g')) REPOS=($(cat ${MAIN_COMMAND} | grep "_REPO=\"" | uniq -u | sed 's|${PROJECT_NAME}|'"${PROJECT_NAME}"'|g'))
for line in "${REPOS[@]}" for line in "${REPOS[@]}"
do do
repo_name=$(echo "$line" | awk -F '=' '{print $1}') repo_name=$(echo "$line" | awk -F '=' '{print $1}')
mirrors_name=$(echo "$repo_name" | sed "s|_REPO||g" | awk '{print tolower($0)}') mirrors_name=$(echo "$repo_name" | sed "s|_REPO||g" | awk '{print tolower($0)}')
friends_repo_url="ssh://mirrors@${FRIENDS_MIRRORS_SERVER}:${FRIENDS_MIRRORS_SSH_PORT}/home/mirrors/${mirrors_name}" friends_repo_url="ssh://mirrors@${FRIENDS_MIRRORS_SERVER}:${FRIENDS_MIRRORS_SSH_PORT}/home/mirrors/${mirrors_name}"
${repo_name}="${friends_repo_url}" ${repo_name}="${friends_repo_url}"
done done
} }
@ -125,69 +125,69 @@ do
key="$1" key="$1"
case $key in case $key in
--help) --help)
show_help show_help
;; ;;
-h|--hostname) -h|--hostname)
shift shift
HOSTNAME="$1" HOSTNAME="$1"
;; ;;
-e|--letsencrypt) -e|--letsencrypt)
shift shift
LETSENCRYPT_HOSTNAME="$1" LETSENCRYPT_HOSTNAME="$1"
;; ;;
--email) --email)
shift shift
MY_EMAIL_ADDRESS="$1" MY_EMAIL_ADDRESS="$1"
;; ;;
-s|--server) -s|--server)
shift shift
LETSENCRYPT_SERVER="$1" LETSENCRYPT_SERVER="$1"
;; ;;
-c|--country) -c|--country)
shift shift
COUNTRY_CODE="$1" COUNTRY_CODE="$1"
;; ;;
-a|--area) -a|--area)
shift shift
AREA="$1" AREA="$1"
;; ;;
-l|--location) -l|--location)
shift shift
LOCATION="$1" LOCATION="$1"
;; ;;
-o|--organisation) -o|--organisation)
shift shift
ORGANISATION="$1" ORGANISATION="$1"
;; ;;
-u|--unit) -u|--unit)
shift shift
UNIT="$1" UNIT="$1"
;; ;;
--ca) --ca)
shift shift
EXTENSIONS="-extensions v3_ca" EXTENSIONS="-extensions v3_ca"
ORGANISATION="Freedombone-CA" ORGANISATION="Freedombone-CA"
;; ;;
--nodh) --nodh)
shift shift
NODH="true" NODH="true"
;; ;;
--dhkey) --dhkey)
shift shift
DH_KEYLENGTH=${1} DH_KEYLENGTH=${1}
;; ;;
*) *)
# unknown option # unknown option
;; ;;
esac esac
shift shift
done done
if [ ! $HOSTNAME ]; then if [ ! $HOSTNAME ]; then
if [ ! $LETSENCRYPT_HOSTNAME ]; then if [ ! $LETSENCRYPT_HOSTNAME ]; then
echo $'No hostname specified' echo $'No hostname specified'
exit 5748 exit 5748
fi fi
fi fi
@ -207,35 +207,35 @@ function add_cert_letsencrypt {
# obtain the email address for the admin user # obtain the email address for the admin user
if [ ! $MY_EMAIL_ADDRESS ]; then if [ ! $MY_EMAIL_ADDRESS ]; then
if [ -f $CONFIGURATION_FILE ]; then if [ -f $CONFIGURATION_FILE ]; then
if grep -q "MY_EMAIL_ADDRESS=" $CONFIGURATION_FILE; then if grep -q "MY_EMAIL_ADDRESS=" $CONFIGURATION_FILE; then
MY_EMAIL_ADDRESS=$(cat $CONFIGURATION_FILE | grep "MY_EMAIL_ADDRESS=" | awk -F '=' '{print $2}') MY_EMAIL_ADDRESS=$(cat $CONFIGURATION_FILE | grep "MY_EMAIL_ADDRESS=" | awk -F '=' '{print $2}')
fi fi
fi fi
fi fi
if [ ! $MY_EMAIL_ADDRESS ]; then if [ ! $MY_EMAIL_ADDRESS ]; then
if [ -f $COMPLETION_FILE ]; then if [ -f $COMPLETION_FILE ]; then
if grep -q "Admin user:" $COMPLETION_FILE; then if grep -q "Admin user:" $COMPLETION_FILE; then
ADMIN_USER=$(cat $COMPLETION_FILE | grep "Admin user" | awk -F ':' '{print $2}') ADMIN_USER=$(cat $COMPLETION_FILE | grep "Admin user" | awk -F ':' '{print $2}')
MY_EMAIL_ADDRESS=$ADMIN_USER@$HOSTNAME MY_EMAIL_ADDRESS=$ADMIN_USER@$HOSTNAME
fi fi
fi fi
fi fi
if [ ! -d $INSTALL_DIR ]; then if [ ! -d $INSTALL_DIR ]; then
mkdir -p $INSTALL_DIR mkdir -p $INSTALL_DIR
fi fi
cd $INSTALL_DIR cd $INSTALL_DIR
# obtain the repo # obtain the repo
if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then
git_clone $LETSENCRYPT_REPO ${INSTALL_DIR}/letsencrypt git_clone $LETSENCRYPT_REPO ${INSTALL_DIR}/letsencrypt
if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then
exit 76283 exit 76283
fi fi
else else
cd ${INSTALL_DIR}/letsencrypt cd ${INSTALL_DIR}/letsencrypt
git_pull $LETSENCRYPT_REPO git_pull $LETSENCRYPT_REPO
fi fi
# stop the web server # stop the web server
@ -244,38 +244,38 @@ function add_cert_letsencrypt {
cd ${INSTALL_DIR}/letsencrypt cd ${INSTALL_DIR}/letsencrypt
./letsencrypt-auto certonly --server $LETSENCRYPT_SERVER --standalone -d $LETSENCRYPT_HOSTNAME --renew-by-default --agree-tos --email $MY_EMAIL_ADDRESS ./letsencrypt-auto certonly --server $LETSENCRYPT_SERVER --standalone -d $LETSENCRYPT_HOSTNAME --renew-by-default --agree-tos --email $MY_EMAIL_ADDRESS
if [ ! "$?" = "0" ]; then if [ ! "$?" = "0" ]; then
echo $"Failed to install letsencrypt for domain $LETSENCRYPT_HOSTNAME" echo $"Failed to install letsencrypt for domain $LETSENCRYPT_HOSTNAME"
systemctl start nginx systemctl start nginx
exit 63216 exit 63216
fi fi
# replace some legacy filenames # replace some legacy filenames
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME
sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME
# link the private key # link the private key
if [ -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ]; then if [ -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ]; then
if [ ! -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old ]; then if [ ! -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old ]; then
mv /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old mv /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old
else else
rm -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key rm -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key
fi fi
fi fi
ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/privkey.pem /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/privkey.pem /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key
# link the public key # link the public key
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ]; then
if [ ! -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old ]; then if [ ! -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old
else else
rm -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem rm -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
fi fi
ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
@ -285,42 +285,42 @@ function add_cert_letsencrypt {
${PROJECT_NAME}-pin-cert $LETSENCRYPT_HOSTNAME ${PROJECT_NAME}-pin-cert $LETSENCRYPT_HOSTNAME
if [ ! "$?" = "0" ]; then if [ ! "$?" = "0" ]; then
echo $"Certificate for $LETSENCRYPT_HOSTNAME could not be pinned" echo $"Certificate for $LETSENCRYPT_HOSTNAME could not be pinned"
exit 62878 exit 62878
fi fi
} }
function add_cert_selfsigned { function add_cert_selfsigned {
if [[ $ORGANISATION == "Freedombone-CA" ]]; then if [[ $ORGANISATION == "Freedombone-CA" ]]; then
CERTFILE="ca-$HOSTNAME" CERTFILE="ca-$HOSTNAME"
fi fi
openssl req -x509 ${EXTENSIONS} -nodes -days 3650 -sha256 \ openssl req -x509 ${EXTENSIONS} -nodes -days 3650 -sha256 \
-subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \ -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \
-newkey rsa:4096 -keyout /etc/ssl/private/${CERTFILE}.key \ -newkey rsa:4096 -keyout /etc/ssl/private/${CERTFILE}.key \
-out /etc/ssl/certs/${CERTFILE}.crt -out /etc/ssl/certs/${CERTFILE}.crt
chmod 400 /etc/ssl/private/${CERTFILE}.key chmod 400 /etc/ssl/private/${CERTFILE}.key
chmod 640 /etc/ssl/certs/${CERTFILE}.crt chmod 640 /etc/ssl/certs/${CERTFILE}.crt
cp /etc/ssl/certs/${CERTFILE}.crt /etc/ssl/mycerts cp /etc/ssl/certs/${CERTFILE}.crt /etc/ssl/mycerts
${PROJECT_NAME}-pin-cert $CERTFILE ${PROJECT_NAME}-pin-cert $CERTFILE
if [ ! "$?" = "0" ]; then if [ ! "$?" = "0" ]; then
echo $"Certificate for $CERTFILE could not be pinned" echo $"Certificate for $CERTFILE could not be pinned"
exit 62879 exit 62879
fi fi
} }
function generate_dh_params { function generate_dh_params {
if [ ! $NODH ]; then if [ ! $NODH ]; then
if [ ! -f /etc/ssl/certs/${CERTFILE}.dhparam ]; then if [ ! -f /etc/ssl/certs/${CERTFILE}.dhparam ]; then
${PROJECT_NAME}-dhparam -h ${CERTFILE} --fast yes ${PROJECT_NAME}-dhparam -h ${CERTFILE} --fast yes
fi fi
fi fi
} }
function restart_web_server { function restart_web_server {
if [ -f /etc/init.d/nginx ]; then if [ -f /etc/init.d/nginx ]; then
/etc/init.d/nginx reload /etc/init.d/nginx reload
fi fi
} }
@ -332,9 +332,9 @@ function make_cert_bundle {
function create_cert { function create_cert {
if [ $LETSENCRYPT_HOSTNAME ]; then if [ $LETSENCRYPT_HOSTNAME ]; then
add_cert_letsencrypt add_cert_letsencrypt
else else
add_cert_selfsigned add_cert_selfsigned
fi fi
} }