3
This commit is contained in:
Cantibra
@@ -68,11 +68,12 @@ jobs:
|
||||
/usr/bin/chmod --verbose '0755' './traefik/DEBIAN/prerm'
|
||||
/usr/bin/chmod --verbose '0755' './traefik/etc/init.d/traefik'
|
||||
/usr/bin/touch './traefik/etc/traefik/traefik.env'
|
||||
/usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env'
|
||||
/usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme'
|
||||
/usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/00-export'
|
||||
/usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/01-changelog'
|
||||
/usr/bin/chmod --verbose '0640' './traefik/etc/traefik/acme/acme.env'
|
||||
/usr/bin/chmod --verbose '0640' './traefik/etc/traefik/providers.env'
|
||||
/usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env'
|
||||
/usr/bin/install --directory --verbose './traefik/usr/sbin'
|
||||
/usr/bin/mv --verbose './sources/traefik' './traefik/usr/sbin'
|
||||
- name: Debian Package [Generate]
|
||||
|
||||
@@ -2,5 +2,4 @@
|
||||
/etc/traefik/traefik.env
|
||||
/etc/traefik/traefik.yml
|
||||
/etc/traefik/acme/00-export
|
||||
/etc/traefik/acme/01-changelog
|
||||
/etc/traefik/acme/acme.env
|
||||
|
||||
@@ -2,7 +2,7 @@ Package: traefik
|
||||
Version:
|
||||
Architecture:
|
||||
Installed-Size:
|
||||
Depends: jq
|
||||
Depends: jq, openssl, ssl-cert
|
||||
Priority: optional
|
||||
Section: misc
|
||||
Homepage: http://www.privlab.it
|
||||
|
||||
@@ -37,7 +37,8 @@ case "${1}" in
|
||||
/usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/lib/traefik'
|
||||
/usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/log/traefik'
|
||||
/usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/logrotate/traefik'
|
||||
/usr/bin/chown --quiet --recursive 'traefik' \
|
||||
/usr/bin/chown --quiet 'traefik' \
|
||||
'/etc/traefik' \
|
||||
'/etc/traefik/providers.yml' \
|
||||
'/etc/traefik/traefik.env' \
|
||||
'/etc/traefik/traefik.yml'
|
||||
|
||||
@@ -24,8 +24,27 @@ set -o pipefail
|
||||
###
|
||||
|
||||
source '/etc/traefik/acme/acme.env'
|
||||
ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
|
||||
ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
|
||||
ACME_STORAGE="${ACME_STORAGE:='/etc/ssl/traefik'}"
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Function Section
|
||||
#
|
||||
###
|
||||
|
||||
function export () {
|
||||
local PREFIX="${1}"
|
||||
/usr/bin/echo "${CERTIFICATE}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
||||
/usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
||||
/usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
||||
/usr/bin/echo "${KEY}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
||||
/usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
||||
/usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
||||
}
|
||||
|
||||
|
||||
###
|
||||
@@ -34,7 +53,7 @@ ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
|
||||
#
|
||||
###
|
||||
|
||||
if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
|
||||
if [[ "${EUID}" -ne '0' ]]; then
|
||||
/usr/bin/echo -e 'Error: Permission Denied'
|
||||
exit 1
|
||||
fi
|
||||
@@ -43,36 +62,25 @@ if [[ -d "${ACME_STORAGE}" ]]; then
|
||||
/usr/bin/rm --force --recursive "${ACME_STORAGE}"
|
||||
fi
|
||||
|
||||
/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}"
|
||||
/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}"
|
||||
|
||||
for RESOLVER in $(/usr/bin/jq --raw-output --exit-status 'keys[]' "${ACME_DATABASE}"); do
|
||||
|
||||
ACCOUNT=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Account.PrivateKey' "${ACME_DATABASE}")
|
||||
/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/.${RESOLVER}"
|
||||
/usr/bin/install --directory --group='root' --mode='0700' --owner='root' "${ACME_STORAGE}/.acme/${RESOLVER}"
|
||||
/usr/bin/echo -e "-----BEGIN RSA PRIVATE KEY-----\n${ACCOUNT}\n-----END RSA PRIVATE KEY-----" | \
|
||||
/usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.${RESOLVER}/account.key" &> '/dev/null'
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/.${RESOLVER}/account.key"
|
||||
/usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" &> '/dev/null'
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/.acme/${RESOLVER}/account.key"
|
||||
for DOMAIN in $(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Certificates[].domain.main' "${ACME_DATABASE}"); do
|
||||
CERTIFICATE=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .certificate' "${ACME_DATABASE}")
|
||||
KEY=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .key' "${ACME_DATABASE}")
|
||||
/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}"
|
||||
/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}/${DOMAIN}"
|
||||
case "${RESOLVER}" in
|
||||
*rsa*)
|
||||
/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/rsa"
|
||||
/usr/bin/echo "${CERTIFICATE}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
|
||||
/usr/bin/echo "${KEY}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
|
||||
export 'rsa'
|
||||
;;
|
||||
*ecdsa*)
|
||||
/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/ecc"
|
||||
/usr/bin/echo "${CERTIFICATE}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
|
||||
/usr/bin/echo "${KEY}" | \
|
||||
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
|
||||
/usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
|
||||
export 'ecc'
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
|
||||
|
||||
#
|
||||
# Generate changelog with hashsum from the exported certificates
|
||||
#
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Options Section
|
||||
#
|
||||
###
|
||||
|
||||
set -e
|
||||
set -u
|
||||
set -o pipefail
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Variables Section
|
||||
#
|
||||
###
|
||||
|
||||
source '/etc/traefik/acme/acme.env'
|
||||
ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
|
||||
ACME_STORAGE_HASH="${ACME_STORAGE_HASH:='/var/lib/traefik/acme.md5sum'}"
|
||||
ACME_STORAGE_CHANGELOG="${ACME_STORAGE_CHANGELOG:='/var/lib/traefik/acme.log'}"
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Runtime Environment
|
||||
#
|
||||
###
|
||||
|
||||
if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
|
||||
/usr/bin/echo -e 'Error: Permission Denied'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TMP_DIRECTORY=$(/usr/bin/mktemp --directory --quiet)
|
||||
trap "/usr/bin/rm --force --recursive ${TMP_DIRECTORY}" EXIT
|
||||
|
||||
if [[ ! -f "${ACME_STORAGE_HASH}" ]]; then
|
||||
/usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${ACME_STORAGE_HASH}"
|
||||
/usr/bin/chmod 0600 "${ACME_STORAGE_HASH}"
|
||||
# /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_HASH}"
|
||||
/usr/bin/diff '/dev/null' "${ACME_STORAGE_HASH}" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
|
||||
/usr/bin/true
|
||||
/usr/bin/chmod 0600 "${ACME_STORAGE_CHANGELOG}"
|
||||
# /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_CHANGELOG}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
/usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${TMP_DIRECTORY}/traefik_acme.md5sum"
|
||||
|
||||
/usr/bin/diff "${ACME_STORAGE_HASH}" "${TMP_DIRECTORY}/traefik_acme.md5sum" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
|
||||
/usr/bin/true
|
||||
|
||||
/usr/bin/cat "${TMP_DIRECTORY}/traefik_acme.md5sum" > "${ACME_STORAGE_HASH}"
|
||||
@@ -10,14 +10,8 @@
|
||||
# Default: '/var/lib/traefik/acme.json'
|
||||
ACME_DATABASE='/var/lib/traefik/acme.json'
|
||||
|
||||
# Default: '/var/lib/traefik/acme'
|
||||
ACME_STORAGE='/var/lib/traefik/acme'
|
||||
|
||||
# Default: '/var/lib/traefik/acme.md5sum'
|
||||
ACME_STORAGE_HASH='/var/lib/traefik/acme.md5sum'
|
||||
|
||||
# Default: '/var/lib/traefik/acme.log'
|
||||
ACME_STORAGE_CHANGELOG='/var/lib/traefik/acme.log'
|
||||
# Default: '/etc/ssl/traefik'
|
||||
ACME_STORAGE='/etc/ssl/traefik'
|
||||
|
||||
|
||||
################################
|
||||
|
||||
Reference in New Issue
Block a user