Cantibra
88 lines
2.6 KiB
Bash
88 lines
2.6 KiB
Bash
#!/usr/bin/bash
|
|
|
|
|
|
#
|
|
# Export the certificates and keys from 'acme.json'
|
|
#
|
|
|
|
|
|
###
|
|
#
|
|
# Options Section
|
|
#
|
|
###
|
|
|
|
set -e
|
|
set -u
|
|
set -o pipefail
|
|
|
|
|
|
###
|
|
#
|
|
# Variables Section
|
|
#
|
|
###
|
|
|
|
source '/etc/traefik/acme/acme.env'
|
|
ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
|
|
ACME_STORAGE="${ACME_STORAGE:='/etc/ssl/traefik'}"
|
|
|
|
|
|
###
|
|
#
|
|
# Function Section
|
|
#
|
|
###
|
|
|
|
function export () {
|
|
local PREFIX="${1}"
|
|
/usr/bin/echo "${CERTIFICATE}" | \
|
|
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
|
/usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
|
/usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
|
|
/usr/bin/echo "${KEY}" | \
|
|
/usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
|
/usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
|
/usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
|
|
}
|
|
|
|
|
|
###
|
|
#
|
|
# Runtime Environment
|
|
#
|
|
###
|
|
|
|
if [[ "${EUID}" -ne '0' ]]; then
|
|
/usr/bin/echo -e 'Error: Permission Denied'
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -d "${ACME_STORAGE}" ]]; then
|
|
/usr/bin/rm --force --recursive "${ACME_STORAGE}"
|
|
fi
|
|
|
|
/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}"
|
|
|
|
for RESOLVER in $(/usr/bin/jq --raw-output --exit-status 'keys[]' "${ACME_DATABASE}"); do
|
|
|
|
ACCOUNT=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Account.PrivateKey' "${ACME_DATABASE}")
|
|
/usr/bin/install --directory --group='root' --mode='0700' --owner='root' "${ACME_STORAGE}/.acme/${RESOLVER}"
|
|
/usr/bin/echo -e "-----BEGIN RSA PRIVATE KEY-----\n${ACCOUNT}\n-----END RSA PRIVATE KEY-----" | \
|
|
/usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" &> '/dev/null'
|
|
/usr/bin/chmod '0400' "${ACME_STORAGE}/.acme/${RESOLVER}/account.key"
|
|
for DOMAIN in $(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Certificates[].domain.main' "${ACME_DATABASE}"); do
|
|
CERTIFICATE=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .certificate' "${ACME_DATABASE}")
|
|
KEY=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .key' "${ACME_DATABASE}")
|
|
/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}/${DOMAIN}"
|
|
case "${RESOLVER}" in
|
|
*rsa*)
|
|
export 'rsa'
|
|
;;
|
|
*ecdsa*)
|
|
export 'ecc'
|
|
;;
|
|
esac
|
|
done
|
|
done
|