# -*- mode: shell-script -*- yaml_opt_bash_env() { local prefix="$1" key value while read-0 key value; do new_prefix="${prefix}_${key^^}" if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then echo "$value" | yaml_opt_bash_env "${new_prefix}" else printf "%s\0%s\0" "${new_prefix/-/_}" "$value" fi done < <(shyaml key-values-0) } yaml_opt_bash_env_ignore_first_level() { local prefix="$1" key value while read-0 key value; do new_prefix="${prefix}_${key^^}" if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then echo "$value" | yaml_opt_bash_env "${new_prefix}" fi done < <(shyaml key-values-0) } get_dc_env() { local cfg="$1" action="$2" domain="$3" config="\ $SERVICE_NAME: docker-compose: environment:" if USER_EMAIL=$(echo "$cfg" | shyaml get-value email 2>/dev/null); then config+=$'\n'" LETSENCRYPT_USER_MAIL: $USER_EMAIL" fi if environment_def="$(printf "%s" "$cfg" | shyaml -y get-value env 2>/dev/null)"; then while read-0 key value; do config+="$(printf "\n %s: %s" "$key" "$value")" done < <(e "$environment_def" | yaml_opt_bash_env_ignore_first_level LEXICON) if ! provider=$(e "$environment_def" | shyaml get-value provider 2>/dev/null); then provider= ## If no provider is given, we fallback on the first found while read-0 key value; do [[ "$(echo "$value" | shyaml get-type)" == "struct" ]] && { provider="$key" break } done < <(e "$environment_def" | shyaml key-values-0) warn "No ${WHITE}provider${NORMAL} key given, had to infer it, chose '$key'." fi if [ "$provider" ]; then config+=$(echo -en "\n LEXICON_PROVIDER: $provider") fi fi challenge_type=$(get_challenge_type "$cfg" "$action" "$domain") config+=$(echo -en "\n CHALLENGE_TYPE: $challenge_type") info "Challenge type is $challenge_type" echo "$config" } compose_get_challenge_type() { local cfg="$1" e "$cfg" | shyaml get-value "challenge-type" 2>/dev/null } letsencrypt_get_challenge_type() { local domain="$1" renewal_file renewal_file="$SERVICE_DATASTORE"/etc/letsencrypt/renewal/"$domain".conf [ -e "$renewal_file" ] || return 1 grep '^pref_challs' "$renewal_file" | cut -f 2 -d "=" | nspc } letsencrypt_set_renew_before_expiry() { local domain="$1" days="$2" renewal_file renewal_file="$SERVICE_DATASTORE"/etc/letsencrypt/renewal/"$domain".conf [ -e "$renewal_file" ] || return 1 sed -ri "s/^(#\s+)?(renew_before_expiry\s*=)\s*[0-9]+(\s+days)$/\2 $days\3/g" "$renewal_file" } letsencrypt_get_renew_before_expiry() { local domain="$1" renewal_file renewal_file="$SERVICE_DATASTORE"/etc/letsencrypt/renewal/"$domain".conf [ -e "$renewal_file" ] || return 1 if out=$(egrep "^renew_before_expiry\s*=\s*[0-9]+\s+days$" "$renewal_file" 2>/dev/null); then e "$out" | sed -r "s/^renew_before_expiry\s*=\s*([0-9]+)\s+days$/\1/g" else err "Couldn't find 'renew_before_expiry' in letsencrypt renewal" \ "configuration for domain '$domain'." return 1 fi } get_challenge_type() { local cfg="$1" action="$2" domain="$3" challenge_type renewal_file challenge case "$action" in create) if ! challenge_type=$(compose_get_challenge_type "$cfg"); then warn "No ${WHITE}challenge-type${NORMAL} provided, defaulting to 'http'." challenge_type=http fi echo "$challenge_type" ;; renew) challenge=$(letsencrypt_get_challenge_type "$domain") if [[ "$challenge" =~ ^http ]]; then echo "http" else echo "$challenge" fi ;; *) err "Invalid action '$action'." ;; esac } will_need_http_access() { local cfg="$1" action="$2" domain="$3" domains args_domains remaining challenge_type=$(get_challenge_type "$cfg" "$action" "$domain") [ "$challenge_type" == "http" ] || return 1 } has_existing_cert() { local domain="$1" [ -d "$SERVICE_DATASTORE/etc/letsencrypt/live/$domain" ] || return 1 } letsencrypt_cert_info() { local domain="$1" compose -q --no-init --no-relations run --rm "$SERVICE_NAME" \ crt info "$domain" } letsencrypt_cert_delete() { local domain="$1" compose --debug --no-init --no-relations run --rm "$SERVICE_NAME" \ certbot delete --cert-name "$domain" } valid_existing_cert() { local renew_before_expiry="$1" domain="$2" args_domains domains remaining shift args_domains=("$@") has_existing_cert "$domain" || return 1 info "Querying $domain for previous info..." out=$(letsencrypt_cert_info "$domain") || return 1 domains=$(e "$out" | shyaml get-value domains) || return 1 domains=$(printf "%s " $domains | tr " " "\n" | sort) args_domains=$(printf "%s " "${args_domains[@]}" | tr " " "\n" | sort) # info domains: "$domains" # info args_domain: "$args_domains" remaining=$(e "$out" | shyaml get-value remaining) || return 1 if [ "$domains" != "$args_domains" ]; then info "Domains mismatch:" info " old: $domains" info " new: $args_domains" return 2 fi if [ "$remaining" == EXPIRED ]; then info "Existing certificate expired." return 1 fi if [ "$remaining" -lt "$renew_before_expiry" ]; then info "Existing certificate in renew period" \ "($remaining remaining days of validity)." return 1 fi } get_domain_list() { compose -q --no-init --no-relations run --rm "$SERVICE_NAME" crt list } crt() { local cfg="$1" action="$2" domain="$3" config \ stopped_containers container_ids shift shift ## expiry was checked, launch the action on the real charm, but take care of ## correctly running it. ## - provide env ## - declare proper ports ## - stop containers and restart them if necessary config=$(get_dc_env "$cfg" "$action" "$domain") || return 1 stopped_containers=() if will_need_http_access "$cfg" "$action" "$domain"; then container_ids=($(docker ps \ --filter label="compose.project=$PROJECT_NAME" \ --filter publish=80 \ --format "{{.ID}}" )) || exit 1 for container_id in "${container_ids[@]}"; do info "Attempting to clear port 80 by stopping $container_id" docker stop -t 5 "$container_id" stopped_containers+=("$container_id") done config+=$(echo -en "\n ports: - \"0.0.0.0:80:80\"") fi compose_opts=() if [ "$DEBUG" ]; then compose_opts+=("--debug") else compose_opts+=("--quiet") fi compose "${compose_opts[@]}" --no-init --no-relations --add-compose-content "$config" \ run --service-ports --rm "$SERVICE_NAME" crt "$action" "$@" errlvl="$?" for container_id in "${stopped_containers[@]}"; do info "Attempting restart $container_id" docker start "$container_id" done return "$errlvl" } crt_create() { local force service_def cfg renew_before_expiry msg domains usage=" $exname [-h|--help] $exname MAIN_DOMAIN [ALT_DOMAINS...]" force= domains=() while [ "$1" ]; do case "$1" in "--help"|"-h") print_usage return 0 ;; "--force"|"-f") force=1;; *) domains+=("$1");; esac shift done if [ "${#domains[@]}" == 0 ]; then err "At least one domain should be provided as argument." print_usage >&2 return 1 fi service_def=$(get_compose_service_def "$SERVICE_NAME") || return 1 cfg=$(e "$service_def" | shyaml get-value "options" 2>/dev/null) renew_before_expiry=$(e "$cfg" | shyaml get-value "renew-before-expiry" 30 2>/dev/null) renew_before_expiry=${renew_before_expiry:-30} valid_existing_cert "$renew_before_expiry" "${domains[@]}" valid_existing_cert="$?" if [ -z "$force" ] && [ "$valid_existing_cert" == 0 ]; then if [ "${#domains[@]}" -gt 1 ]; then msg=" (with ${domains[*]:1})" fi info "A valid cert already exists for domain ${domains[0]}$msg." return 0 fi if [ "$valid_existing_cert" == 2 ]; then err "Domain mismatch detected, lets delete previous cert." letsencrypt_cert_delete "${domains[0]}" || return 1 err "Previous cert for ${domains[0]} deleted." fi crt "$cfg" create "${domains[@]}" || { err "Certificate creation/renew failed for domain '${domains[0]}'." return 1 } letsencrypt_set_renew_before_expiry "${domains[0]}" "$renew_before_expiry" || { err "Setting renew-before-expiry on '${domains[0]}' failed." return 1 } } crt_renew() { local service_def cfg renew_before_expiry msg start domains_yml \ domain domain_cfg usage="$ $exname [-h|--help] " while [ "$1" ]; do case "$1" in "--help"|"-h") print_usage return 0 ;; *) err "No argument required" print_usage >&2 return 1 ;; esac shift done service_def=$(get_compose_service_def "$SERVICE_NAME") || return 1 cfg=$(e "$service_def" | shyaml get-value "options" 2>/dev/null) default_renew_before_expiry=$(e "$cfg" | shyaml get-value "renew-before-expiry" 2>/dev/null) default_renew_before_expiry=${renew_before_expiry:-30} if ! renew_before_expiry=$(letsencrypt_get_renew_before_expiry "$domain") || \ [ -z "$renew_before_expiry" ]; then renew_before_expiry=$default_renew_before_expiry fi start="$SECONDS" info "Get domain list.." domains_yml=$(get_domain_list) || return 1 info " .. Done ${GRAY}($((SECONDS - start))s)${NORMAL}" [ "$domains_yml" ] || { info "No domain founds" return 0 } failed=() while read-0 domain domain_cfg; do remaining=$(e "$domain_cfg" | shyaml get-value "remaining") || return 1 if [ "$remaining" == EXPIRED ] || [ "$remaining" -lt "$renew_before_expiry" ]; then if [ "$remaining" == EXPIRED ]; then info "Renewing domain $domain (expired)." else info "Renewing domain $domain ($remaining days left)." fi crt "$cfg" renew "$domain" if [ "$?" != "0" ]; then failed+=("$domain") err "Certificate renew of '$domain' failed." fi else info "Domain $domain does not need renewing ($remaining days left)." fi done < <(e "$domains_yml" | shyaml key-values-0) if [ "${#failed[@]}" -gt 0 ]; then err "At least one domain failed to be renewed: ${failed[@]}" return 1 fi }