evolix/ansible-roles
22
2
Fork 2
Code Issues 61 Pull requests 18 Releases 33 Wiki Activity

improve hooks maintainability

Browse source
This commit is contained in:
Jérémy Lecour 2019-09-27 14:03:39 +02:00 committed by Jérémy Lecour
parent 44b2480e03
commit 68e6d6cb23
7 changed files with 194 additions and 124 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
certbot/files/hooks/apache.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,12 +9,19 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
apache2ctl_bin=$(command -v apache2ctl)
if [ -n "$(pidof apache2)" ] && [ -n "${apache2ctl_bin}" ]; then
if grep -q -r -E "letsencrypt" /etc/apache2/; then
if ${apache2ctl_bin} configtest > /dev/null 2>&1; then
daemon_found_and_running() {
test -n "$(pidof apache2)" && test -n "${apache2ctl_bin}"
}
config_check() {
${apache2ctl_bin} configtest > /dev/null 2>&1
}
letsencrypt_used() {
grep -q -r -E "letsencrypt" /etc/apache2/
}
main() {
if daemon_found_and_running; then
if letsencrypt_used; then
if config_check; then
debug "Apache detected... reloading"
systemctl reload apache2
else
@ -27,6 +30,15 @@ if [ -n "$(pidof apache2)" ] && [ -n "${apache2ctl_bin}" ]; then
else
debug "Apache doesn't use Let's Encrypt certificate. Skip."
fi
else
else
debug "Apache is not running or missing. Skip."
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly apache2ctl_bin=$(command -v apache2ctl)
main

26
certbot/files/hooks/commit-etc.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,13 +9,11 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
main() {
export GIT_DIR="/etc/.git"
export GIT_WORK_TREE="/etc"
git_bin=$(command -v git)
letsencrypt_dir=/etc/letsencrypt
export GIT_DIR="/etc/.git"
export GIT_WORK_TREE="/etc"
if test -x "${git_bin}" && test -d "${GIT_DIR}" && test -d "${GIT_WORK_TREE}"; then
if test -x "${git_bin}" && test -d "${GIT_DIR}" && test -d "${GIT_WORK_TREE}"; then
changed_lines=$(${git_bin} status --porcelain -- ${letsencrypt_dir} | wc -l | tr -d ' ')
if [ "${changed_lines}" != "0" ]; then
@ -30,4 +24,14 @@ if test -x "${git_bin}" && test -d "${GIT_DIR}" && test -d "${GIT_WORK_TREE}"; t
else
error "Weird, nothing has changed but the hook has been executed for '${RENEWED_DOMAINS}'"
fi
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly git_bin=$(command -v git)
readonly letsencrypt_dir=/etc/letsencrypt
main

36
certbot/files/hooks/dovecot.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,12 +9,19 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
doveconf_bin=$(command -v doveconf)
if [ -n "$(pidof dovecot)" ] && [ -n "${doveconf_bin}" ]; then
if ${doveconf_bin} | grep -E "^ssl_cert[^_]" | grep -q "letsencrypt"; then
if ${doveconf_bin} > /dev/null 2>&1; then
daemon_found_and_running() {
test -n "$(pidof dovecot)" && test -n "${doveconf_bin}"
}
config_check() {
${doveconf_bin} > /dev/null 2>&1
}
letsencrypt_used() {
${doveconf_bin} | grep -E "^ssl_cert[^_]" | grep -q "letsencrypt"
}
main() {
if daemon_found_and_running; then
if letsencrypt_used; then
if config_check; then
debug "Dovecot detected... reloading"
systemctl reload dovecot
else
@ -27,6 +30,15 @@ if [ -n "$(pidof dovecot)" ] && [ -n "${doveconf_bin}" ]; then
else
debug "Dovecot doesn't use Let's Encrypt certificate. Skip."
fi
else
else
debug "Dovecot is not running or missing. Skip."
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly doveconf_bin=$(command -v doveconf)
main

62
certbot/files/hooks/haproxy.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,19 +9,16 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
if [ -z "${RENEWED_LINEAGE}" ]; then
error "This script must be called only by certbot!"
fi
haproxy_bin=$(command -v haproxy)
haproxy_cert_dir="/etc/ssl/haproxy/"
if [ -n "$(pidof haproxy)" ] && [ -n "${haproxy_bin}" ]; then
if [ -f "${RENEWED_LINEAGE}/fullchain.pem" ] && [ -f "${RENEWED_LINEAGE}/privkey.pem" ]; then
haproxy_cert_file="${haproxy_cert_dir}/$(basename "${RENEWED_LINEAGE}").pem"
failed_cert_file="/root/$(basename "${RENEWED_LINEAGE}").failed.pem"
daemon_found_and_running() {
test -n "$(pidof haproxy)" && test -n "${haproxy_bin}"
}
found_renewed_lineage() {
test -f "${RENEWED_LINEAGE}/fullchain.pem" && test -f "${RENEWED_LINEAGE}/privkey.pem"
}
config_check() {
${haproxy_bin} -c -f /etc/haproxy/haproxy.cfg > /dev/null 2>&1
}
concat_files() {
# shellcheck disable=SC2174
mkdir --mode=700 --parents "${haproxy_cert_dir}"
chown root: "${haproxy_cert_dir}"
@ -34,16 +27,31 @@ if [ -n "$(pidof haproxy)" ] && [ -n "${haproxy_bin}" ]; then
cat "${RENEWED_LINEAGE}/fullchain.pem" "${RENEWED_LINEAGE}/privkey.pem" > "${haproxy_cert_file}"
chmod 600 "${haproxy_cert_file}"
chown root: "${haproxy_cert_file}"
}
cert_and_key_mismatch() {
haproxy_cert_md5=$(openssl x509 -noout -modulus -in "${haproxy_cert_file}" | openssl md5)
haproxy_key_md5=$(openssl rsa -noout -modulus -in "${haproxy_cert_file}" | openssl md5)
if [ "${haproxy_cert_md5}" != "${haproxy_key_md5}" ]; then
test "${haproxy_cert_md5}" != "${haproxy_key_md5}"
}
main() {
if [ -z "${RENEWED_LINEAGE}" ]; then
error "This script must be called only by certbot!"
fi
if daemon_found_and_running; then
if found_renewed_lineage; then
haproxy_cert_file="${haproxy_cert_dir}/$(basename "${RENEWED_LINEAGE}").pem"
failed_cert_file="/root/$(basename "${RENEWED_LINEAGE}").failed.pem"
concat_files
if cert_and_key_mismatch; then
mv "${haproxy_cert_file}" "${failed_cert_file}"
error "Key and cert don't match, we moved the file to ${failed_cert_file} for inspection"
fi
if ${haproxy_bin} -c -f /etc/haproxy/haproxy.cfg > /dev/null 2>&1; then
if config_check; then
debug "HAProxy detected... reloading"
systemctl reload apache2
else
@ -52,6 +60,16 @@ if [ -n "$(pidof haproxy)" ] && [ -n "${haproxy_bin}" ]; then
else
error "Couldn't find ${RENEWED_LINEAGE}/fullchain.pem or ${RENEWED_LINEAGE}/privkey.pem"
fi
else
else
debug "HAProxy is not running or missing. Skip."
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly haproxy_bin=$(command -v haproxy)
readonly haproxy_cert_dir="/etc/ssl/haproxy"
main

36
certbot/files/hooks/nginx.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,12 +9,19 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
nginx_bin=$(command -v nginx)
if [ -n "$(pidof nginx)" ] && [ -n "${nginx_bin}" ]; then
if grep -q --dereference-recursive -E "letsencrypt" /etc/nginx/sites-enabled; then
if ${nginx_bin} -t > /dev/null 2>&1; then
daemon_found_and_running() {
test -n "$(pidof nginx)" && test -n "${nginx_bin}"
}
config_check() {
${nginx_bin} -t > /dev/null 2>&1
}
letsencrypt_used() {
grep -q --dereference-recursive -E "letsencrypt" /etc/nginx/sites-enabled
}
main() {
if daemon_found_and_running; then
if letsencrypt_used; then
if config_check; then
debug "Nginx detected... reloading"
systemctl reload nginx
else
@ -27,6 +30,15 @@ if [ -n "$(pidof nginx)" ] && [ -n "${nginx_bin}" ]; then
else
debug "Nginx doesn't use Let's Encrypt certificate. Skip."
fi
else
else
debug "Nginx is not running or missing. Skip."
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly nginx_bin=$(command -v nginx)
main

36
certbot/files/hooks/postfix.sh
View file

@ -1,9 +1,5 @@
#!/bin/sh
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
error() {
>&2 echo "${PROGNAME}: $1"
exit 1
@ -13,12 +9,19 @@ debug() {
>&2 echo "${PROGNAME}: $1"
fi
}
postconf_bin=$(command -v postconf)
if [ -n "$(pidof master)" ] && [ -n "${postconf_bin}" ]; then
if ${postconf_bin} | grep -E "^smtpd_tls_cert_file" | grep -q "letsencrypt"; then
if ${postconf_bin} > /dev/null 2>&1; then
daemon_found_and_running() {
test -n "$(pidof master)" && test -n "${postconf_bin}"
}
config_check() {
${postconf_bin} > /dev/null 2>&1
}
letsencrypt_used() {
${postconf_bin} | grep -E "^smtpd_tls_cert_file" | grep -q "letsencrypt"
}
main() {
if daemon_found_and_running; then
if letsencrypt_used; then
if config_check; then
debug "Postfix detected... reloading"
systemctl reload postfix
else
@ -27,6 +30,15 @@ if [ -n "$(pidof master)" ] && [ -n "${postconf_bin}" ]; then
else
debug "Postfix doesn't use Let's Encrypt certificate. Skip."
fi
else
else
debug "Postfix is not running or missing. Skip."
fi
fi
}
readonly PROGNAME=$(basename "$0")
readonly VERBOSE=${VERBOSE:-"0"}
readonly QUIET=${QUIET:-"0"}
readonly postconf_bin=$(command -v postconf)
main

2
certbot/tasks/acme-challenge.yml
View file

@ -46,5 +46,5 @@
- name: ACME challenge for HAProxy is installed
debug:
msg: "ACME challenge configuration for HAProxy should be configured manually"
msg: "ACME challenge configuration for HAProxy must be configured manually"
when: is_haproxy.stat.exists