summaryrefslogtreecommitdiffstats
path: root/scripts
diff options
context:
space:
mode:
Diffstat (limited to 'scripts')
-rwxr-xr-xscripts/certificate_hook.sh28
1 files changed, 16 insertions, 12 deletions
diff --git a/scripts/certificate_hook.sh b/scripts/certificate_hook.sh
index 36e4422..7d84ed9 100755
--- a/scripts/certificate_hook.sh
+++ b/scripts/certificate_hook.sh
@@ -2,18 +2,21 @@
#to-do: make this universal / not specific to a certain service
set -C
-set -e
+#set -e
set -u
certname="irc.casa"
mailto="system@lysergic.dev"
-hosts="dericom01 deriweb01"
+#hosts="dericom01 deriweb01"
+hosts="dericom01"
OUTPUT="/var/log/lysergic/certificate-scripts/$certname.log"
crt="/etc/ssl/lego/certificates/$certname.crt"
key="/etc/ssl/lego/certificates/$certname.key"
-crtdest="/etc/ssl/irc/crt"
-keydest="/etc/ssl/irc/key"
-sshkey="/home/brain/.ssh/id_ed25519_brain"
+destdir="/etc/ssl/irc/"
+#crtdest="/etc/ssl/irc/crt"
+#keydest="/etc/ssl/irc/key"
+sshuser="brain"
+sshkey="/home/brain/.ssh/id_lysergic"
sshopts=" -qi $sshkey"
cn=`openssl x509 -in $crt -noout -text | grep "CN ="`
@@ -25,22 +28,22 @@ fp_crt=`openssl x509 -fingerprint -sha256 -noout -in $crt`
install () {
local host="$1"
local source="$2"
- local target="$host:$3"
+ local target="$sshuser@$host:$3"
echo "$host: Installing $target ..." >> $OUTPUT
- scp $sshopts $source $target >> $OUTPUT 2>&1
+ scp $sshopts "$source" "$target" >> $OUTPUT 2>&1
}
reload () {
local host="$1"
local service="$2"
echo "$host: Reloading $service ..." >> $OUTPUT
- ssh $sshopts "/usr/bin/sudo /usr/bin/systemctl reload $service.service" >> $OUTPUT 2>&1
+ ssh $sshopts "$sshuser:$host" "/usr/bin/sudo /usr/bin/systemctl reload $service.service" >> $OUTPUT 2>&1
}
check () {
local host="$1"
local port="$2"
- echo "Performing self-check [$host:$port]..." > $OUTPUT
+ echo "Performing self-check [$host:$port]..." >> $OUTPUT
local fp_remote=`openssl s_client -connect "$host":"$port" < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin`
echo "Remote fingerprint: $fp_crt" >> $OUTPUT
if [ "$fp_crt" = "$fp_crt" ]; then
@@ -51,6 +54,7 @@ check () {
}
echo "Last renewal happened on `date`" >| $OUTPUT
+
echo "$cn" >> $OUTPUT
echo "$alt" >> $OUTPUT
echo "$notbefore" >> $OUTPUT
@@ -58,10 +62,10 @@ echo "$notafter" | grep "Not After" >> $OUTPUT
echo "Installing files ..." >> $OUTPUT
-for host in "$hosts"
+for host in $hosts
do
- install "$host" "$crt" "$crtdest"
- install "$host" "$key" "$keydest"
+ install "$host" "$crt" "$destdir"
+ install "$host" "$key" "$destdir"
done
# do we really need this certificate on the webserver?