| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152 | #!/bin/bash -e# This file aims to be called by a cron task# and not directly. See ssl-helper.source /container/run/environment.shSSL_HELPER_TOOL=$1PREFIX=$2CERT_FILE=$3KEY_FILE=$4CA_FILE=$5IMPACTED_SERVICES=$6JSONSSL_FILE=$7FROM_FILES=$8CERT_FROM_FILE=$9KEY_FROM_FILE=${10}CA_CERT_FROM_FILE=${11}function stop_impacted_services() {    # Stop impacted services    if [ -n "${IMPACTED_SERVICES}" ]; then        log-helper info "Services to stop: ${IMPACTED_SERVICES}"                impacted_services_table=("${IMPACTED_SERVICES}")        for service in "${impacted_services_table[@]}"        do            log-helper info "Stopping ${service}..."            sv stop "/container/run/process/${service}"        done                log-helper info "All services are stopped"    fi}function start_impacted_services() {    # restart impacted services    if [ -n "${IMPACTED_SERVICES}" ]; then                impacted_services_table=("${IMPACTED_SERVICES}")        for service in "${impacted_services_table[@]}"        do            log-helper info "Starting ${service}..."            sv start "/container/run/process/${service}"        done                log-helper info "All services are started"    fi}# renew from container filesif [ "${FROM_FILES,,}" = "true" ]; then        log-helper info "Check renew from files"    renew=false        # File previous md5    CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5") || true    KEY_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5") || true    CA_CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5") || true        # from file current md5    FROM_CERT_MD5=$(md5sum "${CERT_FROM_FILE}" | awk '{ print $1 }')    FROM_KEY_MD5=$(md5sum "${KEY_FROM_FILE}" | awk '{ print $1 }')    FROM_CA_CERT_MD5=$(md5sum "${CA_CERT_FROM_FILE}" | awk '{ print $1 }')        [[ "$CERT_PREVIOUS_MD5" != "$FROM_CERT_MD5" ]] && renew=true    [[ "$KEY_PREVIOUS_MD5" != "$FROM_KEY_MD5" ]] && renew=true    [[ "$CA_CERT_PREVIOUS_MD5" != "$FROM_CA_CERT_MD5" ]] && renew=true        if ! $renew; then        log-helper info "Certificate files are identicals"        exit 0    fi        log-helper info "Certificate files are differents"        stop_impacted_services        if [ "${CERT_FROM_FILE}" != "${CERT_FILE}" ]; then        log-helper info "Copy ${CERT_FROM_FILE} to ${CERT_FILE}"        cp -f "${CERT_FROM_FILE}" "${CERT_FILE}"    fi        if [ "${KEY_FROM_FILE}" != "${KEY_FILE}" ]; then        log-helper info "Copy ${KEY_FROM_FILE} to ${KEY_FILE}"        cp -f "${KEY_FROM_FILE}" "${KEY_FILE}"    fi        if [ "${CA_CERT_FROM_FILE}" != "${CA_FILE}" ]; then        log-helper info "Copy ${CA_CERT_FROM_FILE} to ${CA_FILE}"        cp -f "${CA_CERT_FROM_FILE}" "${CA_FILE}"    fi        log-helper info "Update file md5 with new values"    echo "${FROM_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5"    echo "${FROM_KEY_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5"    echo "${FROM_CA_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5"        start_impacted_services        # renew with cfssl or jsonsslelse    log-helper info "Check renew for cfssl or jsonssl"        cert_ok=false    ca_ok=false        # the certificate will expired in the next day    if openssl x509 -checkend 259200 -noout -in "${CERT_FILE}"; then        log-helper info "The certificate '${CERT_FILE}' is ok for the next 3 days at least."        cert_ok=true    fi        if openssl x509 -checkend 259200 -noout -in "${CA_FILE}"; then        log-helper info "The CA certificate '${CA_FILE}' is ok for the next 3 days at least."        ca_ok=true    fi        if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then        log-helper info "Check if ${JSONSSL_FILE} has changed"        JSONSSL_FILE_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5") || true        JSONSSL_FILE_MD5=$(md5sum "${JSONSSL_FILE}" | awk '{ print $1 }')                [[ "${JSONSSL_FILE_PREVIOUS_MD5}" != "${JSONSSL_FILE_MD5}" ]] && cert_ok=false    fi        if ${cert_ok} && ${ca_ok}; then        log-helper info "Nothing to do :)"        exit 0    fi        log-helper info "Auto-renew on the way!"        stop_impacted_services        log-helper info "Remove certificate files"    rm -f "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"        log-helper info "Regenerate certificate with ${SSL_HELPER_TOOL}"    ${SSL_HELPER_TOOL} "${PREFIX}" "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"        start_impacted_services        if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then        log-helper info "Update file md5 with new values"        echo "${JSONSSL_FILE_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5"    fi    filog-helper info "Auto-renew finished! Champagne!"
 |