jsonssl-helper 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. #!/bin/bash
  2. log-helper level eq trace && set -x
  3. # This tool helps get certificates from json files
  4. # like kubernetes secrets or traefik acme.json
  5. # It takes its configuration from environment variable.
  6. # See json-default-env file
  7. PREFIX=$1
  8. CERT_FILE=$2
  9. KEY_FILE=$3
  10. CA_FILE=$4
  11. log-helper debug "jsonssl-helper is launched, everybody on the floor!"
  12. if [ -z "${PREFIX}" ] || [ -z "${CERT_FILE}" ] || [ -z "${KEY_FILE}" ] || [ -z "${CA_FILE}" ]; then
  13. log-helper error "Usage: jsonssl-helper prefix cert_file key_file ca_file"
  14. exit 1
  15. fi
  16. if [ ! -e "${CERT_FILE}" ] && [ ! -e "${KEY_FILE}" ]; then
  17. # set env vars
  18. PREFIX=${PREFIX^^} # uppercase
  19. # search for prefixed env var first
  20. # set prefix variable name
  21. # example : PREFIX_JSONSSL_FILE='MARIADB_JSONSSL_FILE'
  22. PREFIX_JSONSSL_FILE=${PREFIX}_JSONSSL_FILE
  23. PREFIX_JSONSSL_HOSTNAME=${PREFIX}_JSONSSL_HOSTNAME
  24. PREFIX_JSONSSL_PROFILE=${PREFIX}_JSONSSL_PROFILE
  25. PREFIX_JSONSSL_GET_CA_CERT_CMD=${PREFIX}_JSONSSL_GET_CA_CERT_CMD
  26. PREFIX_JSONSSL_GET_CERT_CMD=${PREFIX}_JSONSSL_GET_CERT_CMD
  27. PREFIX_JSONSSL_GET_KEY_CMD=${PREFIX}_JSONSSL_GET_KEY_CMD
  28. # assign JSONSSL_FILE=${!PREFIX_JSONSSL_FILE} if value is not empty otherwise JSONSSL_FILE=JSONSSL_FILE
  29. JSONSSL_FILE=${!PREFIX_JSONSSL_FILE:-$JSONSSL_FILE}
  30. JSONSSL_HOSTNAME=${!PREFIX_JSONSSL_HOSTNAME:-$JSONSSL_HOSTNAME}
  31. JSONSSL_PROFILE=${!PREFIX_JSONSSL_PROFILE:-$JSONSSL_PROFILE}
  32. JSONSSL_GET_CA_CERT_CMD=${!PREFIX_JSONSSL_GET_CA_CERT_CMD:-$JSONSSL_GET_CA_CERT_CMD}
  33. JSONSSL_GET_CERT_CMD=${!PREFIX_JSONSSL_GET_CERT_CMD:-$JSONSSL_GET_CERT_CMD}
  34. JSONSSL_GET_KEY_CMD=${!PREFIX_JSONSSL_GET_KEY_CMD:-$JSONSSL_GET_KEY_CMD}
  35. source "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/jsonssl-default-env"
  36. if [ -z "${JSONSSL_FILE}" ]; then
  37. log-helper info "Variable JSONSSL_FILE is empty, set to default location:"
  38. log-helper info "JSONSSL_FILE=${JSONSSL_FILE_DEFAULT}"
  39. JSONSSL_FILE=${JSONSSL_FILE_DEFAULT}
  40. fi
  41. if [ ! -e "${JSONSSL_FILE}" ]; then
  42. log-helper error "JSONSSL_FILE file '${JSONSSL_FILE}' not found"
  43. exit 1
  44. fi
  45. # Json file profile, only traefik for now
  46. if [ "${JSONSSL_PROFILE,,}" = "traefik" ]; then
  47. # Let's Encrypt CA certificate is in cert file after the domain certificate.
  48. # So we took what's after the first cert.
  49. JSONSSL_GET_CA_CERT_CMD="awk '{if(found) print} /END CERTIFICATE/{found=1}' ${CERT_FILE}"
  50. JSONSSL_GET_CERT_CMD="cat ${JSONSSL_FILE} | jq -r '[.Certificates[]] | map(select(.Domain.Main == \"${JSONSSL_HOSTNAME}\")) | .[0].Certificate' | base64 -d"
  51. JSONSSL_GET_KEY_CMD="cat ${JSONSSL_FILE} | jq -r '[.Certificates[]] | map(select(.Domain.Main == \"${JSONSSL_HOSTNAME}\")) | .[0].Key' | base64 -d"
  52. elif [ "${JSONSSL_PROFILE,,}" = "traefik_up_to_v1_6" ]; then
  53. # Let's Encrypt CA certificate is in cert file after the domain certificate.
  54. # So we took what's after the first cert.
  55. JSONSSL_GET_CA_CERT_CMD="awk '{if(found) print} /END CERTIFICATE/{found=1}' ${CERT_FILE}"
  56. JSONSSL_GET_CERT_CMD="cat ${JSONSSL_FILE} | jq -r '[.[\"DomainsCertificate\"].Certs[].Certificate] | map(select(.Domain == \"${JSONSSL_HOSTNAME}\")) | .[0].Certificate' | base64 -d"
  57. JSONSSL_GET_KEY_CMD="cat ${JSONSSL_FILE} | jq -r '[.[\"DomainsCertificate\"].Certs[].Certificate] | map(select(.Domain == \"${JSONSSL_HOSTNAME}\")) | .[0].PrivateKey' | base64 -d"
  58. fi
  59. log-helper debug "Run JSONSSL_GET_CERT_CMD: ${JSONSSL_GET_CERT_CMD}"
  60. log-helper debug "put return in ${CERT_FILE}"
  61. eval "${JSONSSL_GET_CERT_CMD}" > "${CERT_FILE}"
  62. if [ ! -s "$CERT_FILE" ]; then
  63. log-helper error "Generated file '${CERT_FILE}' is empty"
  64. log-helper error "Set loglevel to debug for more information"
  65. exit 1
  66. fi
  67. log-helper debug "Run JSONSSL_GET_KEY_CMD: ${JSONSSL_GET_KEY_CMD}"
  68. log-helper debug "put return in ${KEY_FILE}"
  69. eval "$JSONSSL_GET_KEY_CMD" > "${KEY_FILE}"
  70. if [ ! -s "${KEY_FILE}" ]; then
  71. log-helper error "Generated file '${KEY_FILE}' is empty"
  72. log-helper error "Set loglevel to debug for more information"
  73. exit 1
  74. fi
  75. # if CA cert doesn't exist
  76. if [ ! -e "$CA_FILE" ]; then
  77. log-helper debug "Run JSONSSL_GET_CA_CERT_CMD: ${JSONSSL_GET_CA_CERT_CMD}"
  78. log-helper debug "put return in ${CA_FILE}"
  79. eval "$JSONSSL_GET_CA_CERT_CMD" > "${CA_FILE}"
  80. if [ ! -s "$CA_FILE" ]; then
  81. log-helper error "Generated file '${CA_FILE}' is empty"
  82. log-helper error "Set loglevel to debug for more information"
  83. exit 1
  84. fi
  85. fi
  86. log-helper debug "done :)"
  87. elif [ ! -e "${KEY_FILE}" ]; then
  88. log-helper error "Certificate file ${CERT_FILE} exists but not key file ${KEY_FILE}"
  89. exit 1
  90. elif [ ! -e "${CERT_FILE}" ]; then
  91. log-helper error "Key file ${KEY_FILE} exists but not certificate file ${CERT_FILE}"
  92. exit 1
  93. else
  94. log-helper debug "Files ${CERT_FILE} and ${KEY_FILE} exists, fix files permissions"
  95. chmod 644 "${CERT_FILE}"
  96. chmod 600 "${KEY_FILE}"
  97. fi