| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152 | 
							- #!/bin/bash -e
 
- # This file aims to be called by a cron task
 
- # and not directly. See ssl-helper.
 
- source /container/run/environment.sh
 
- SSL_HELPER_TOOL=$1
 
- PREFIX=$2
 
- CERT_FILE=$3
 
- KEY_FILE=$4
 
- CA_FILE=$5
 
- IMPACTED_SERVICES=$6
 
- JSONSSL_FILE=$7
 
- FROM_FILES=$8
 
- CERT_FROM_FILE=$9
 
- KEY_FROM_FILE=${10}
 
- CA_CERT_FROM_FILE=${11}
 
- function stop_impacted_services() {
 
-     # Stop impacted services
 
-     if [ -n "${IMPACTED_SERVICES}" ]; then
 
-         log-helper info "Services to stop: ${IMPACTED_SERVICES}"
 
-         
 
-         impacted_services_table=("${IMPACTED_SERVICES}")
 
-         for service in "${impacted_services_table[@]}"
 
-         do
 
-             log-helper info "Stopping ${service}..."
 
-             sv stop "/container/run/process/${service}"
 
-         done
 
-         
 
-         log-helper info "All services are stopped"
 
-     fi
 
- }
 
- function start_impacted_services() {
 
-     # restart impacted services
 
-     if [ -n "${IMPACTED_SERVICES}" ]; then
 
-         
 
-         impacted_services_table=("${IMPACTED_SERVICES}")
 
-         for service in "${impacted_services_table[@]}"
 
-         do
 
-             log-helper info "Starting ${service}..."
 
-             sv start "/container/run/process/${service}"
 
-         done
 
-         
 
-         log-helper info "All services are started"
 
-     fi
 
- }
 
- # renew from container files
 
- if [ "${FROM_FILES,,}" = "true" ]; then
 
-     
 
-     log-helper info "Check renew from files"
 
-     renew=false
 
-     
 
-     # File previous md5
 
-     CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5") || true
 
-     KEY_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5") || true
 
-     CA_CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5") || true
 
-     
 
-     # from file current md5
 
-     FROM_CERT_MD5=$(md5sum "${CERT_FROM_FILE}" | awk '{ print $1 }')
 
-     FROM_KEY_MD5=$(md5sum "${KEY_FROM_FILE}" | awk '{ print $1 }')
 
-     FROM_CA_CERT_MD5=$(md5sum "${CA_CERT_FROM_FILE}" | awk '{ print $1 }')
 
-     
 
-     [[ "$CERT_PREVIOUS_MD5" != "$FROM_CERT_MD5" ]] && renew=true
 
-     [[ "$KEY_PREVIOUS_MD5" != "$FROM_KEY_MD5" ]] && renew=true
 
-     [[ "$CA_CERT_PREVIOUS_MD5" != "$FROM_CA_CERT_MD5" ]] && renew=true
 
-     
 
-     if ! $renew; then
 
-         log-helper info "Certificate files are identicals"
 
-         exit 0
 
-     fi
 
-     
 
-     log-helper info "Certificate files are differents"
 
-     
 
-     stop_impacted_services
 
-     
 
-     if [ "${CERT_FROM_FILE}" != "${CERT_FILE}" ]; then
 
-         log-helper info "Copy ${CERT_FROM_FILE} to ${CERT_FILE}"
 
-         cp -f "${CERT_FROM_FILE}" "${CERT_FILE}"
 
-     fi
 
-     
 
-     if [ "${KEY_FROM_FILE}" != "${KEY_FILE}" ]; then
 
-         log-helper info "Copy ${KEY_FROM_FILE} to ${KEY_FILE}"
 
-         cp -f "${KEY_FROM_FILE}" "${KEY_FILE}"
 
-     fi
 
-     
 
-     if [ "${CA_CERT_FROM_FILE}" != "${CA_FILE}" ]; then
 
-         log-helper info "Copy ${CA_CERT_FROM_FILE} to ${CA_FILE}"
 
-         cp -f "${CA_CERT_FROM_FILE}" "${CA_FILE}"
 
-     fi
 
-     
 
-     log-helper info "Update file md5 with new values"
 
-     echo "${FROM_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5"
 
-     echo "${FROM_KEY_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5"
 
-     echo "${FROM_CA_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5"
 
-     
 
-     start_impacted_services
 
-     
 
-     # renew with cfssl or jsonssl
 
- else
 
-     log-helper info "Check renew for cfssl or jsonssl"
 
-     
 
-     cert_ok=false
 
-     ca_ok=false
 
-     
 
-     # the certificate will expired in the next day
 
-     if openssl x509 -checkend 259200 -noout -in "${CERT_FILE}"; then
 
-         log-helper info "The certificate '${CERT_FILE}' is ok for the next 3 days at least."
 
-         cert_ok=true
 
-     fi
 
-     
 
-     if openssl x509 -checkend 259200 -noout -in "${CA_FILE}"; then
 
-         log-helper info "The CA certificate '${CA_FILE}' is ok for the next 3 days at least."
 
-         ca_ok=true
 
-     fi
 
-     
 
-     if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
 
-         log-helper info "Check if ${JSONSSL_FILE} has changed"
 
-         JSONSSL_FILE_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5") || true
 
-         JSONSSL_FILE_MD5=$(md5sum "${JSONSSL_FILE}" | awk '{ print $1 }')
 
-         
 
-         [[ "${JSONSSL_FILE_PREVIOUS_MD5}" != "${JSONSSL_FILE_MD5}" ]] && cert_ok=false
 
-     fi
 
-     
 
-     if ${cert_ok} && ${ca_ok}; then
 
-         log-helper info "Nothing to do :)"
 
-         exit 0
 
-     fi
 
-     
 
-     log-helper info "Auto-renew on the way!"
 
-     
 
-     stop_impacted_services
 
-     
 
-     log-helper info "Remove certificate files"
 
-     rm -f "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
 
-     
 
-     log-helper info "Regenerate certificate with ${SSL_HELPER_TOOL}"
 
-     ${SSL_HELPER_TOOL} "${PREFIX}" "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
 
-     
 
-     start_impacted_services
 
-     
 
-     if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
 
-         log-helper info "Update file md5 with new values"
 
-         echo "${JSONSSL_FILE_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5"
 
-     fi
 
-     
 
- fi
 
- log-helper info "Auto-renew finished! Champagne!"
 
 
  |