Last active
April 24, 2019 03:39
-
-
Save fabiotatsuo/2753916481be06f1f62fba2dd4f11e78 to your computer and use it in GitHub Desktop.
acme-client deploy.sh customize to HAProxy with SSL Termination and multiple domains
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
# This script copy fullchain.pem and privkey.pem to concatanate and make the CRT pem | |
# Separate domains by whitespace in DOMAIN_LIST | |
# CRT pem are stored at /usr/local/etc/haproxy/ssl for HAProxy use, change if you want a different dir | |
# ACMEDIR is the location for files produced by acme-client /usr/ports/security/acme-client/ | |
set -e | |
TODAY=`date +"%Y%m%d"` | |
DOMAIN_LIST="example.com example1.com" | |
ACMEDIR="/usr/local/etc/ssl/acme" | |
TARGETDIR="/usr/local/etc/haproxy/ssl" | |
for domain in ${DOMAIN_LIST}; do | |
echo "Deploy ${domain}" | |
echo "Check if the certificate has changed" | |
[ -f "${TARGETDIR}/certs/${domain}.pem" ] && [ -z "`diff -rq ${ACMEDIR}/${domain}/fullchain.pem ${TARGETDIR}/certs/${domain}.pem`" ] && continue | |
echo "Copying pem from Acme dir to Target dir" | |
[ -d "${TARGETDIR}/priv" ] && echo "Priv dir exist" || mkdir -pm700 "${TARGETDIR}/priv" | |
cp -L "${ACMEDIR}/private/${domain}/privkey.pem" "${TARGETDIR}/priv/${domain}.pem" | |
[ -d "${TARGETDIR}/certs" ] && echo "Certs dir exist" || mkdir -pm755 "${TARGETDIR}/certs" | |
cp -L "${ACMEDIR}/${domain}/fullchain.pem" "${TARGETDIR}/certs/${domain}.pem" | |
chmod 400 "${TARGETDIR}/priv/${domain}.pem" | |
chmod 644 "${TARGETDIR}/certs/${domain}.pem" | |
echo "Concatanate fullchain.epm and privkey.pem - CRT file" | |
# temporary backup dir | |
echo "Backup ${domain}.pem if exist" | |
[ -d "${TARGETDIR}/backup" ] || mkdir -pm700 "${TARGETDIR}/backup" | |
[ -f "${TARGETDIR}/${domain}.pem" ] && cp -L "${TARGETDIR}/${domain}.pem" "${TARGETDIR}/backup/${domain}.${TODAY}.pem" | |
echo "Creating new CRT for ${domain}.pem" | |
cat "${TARGETDIR}/priv/${domain}.pem" "${TARGETDIR}/certs/${domain}.pem" | tee "${TARGETDIR}/${domain}.pem" | |
chmod 600 "${TARGETDIR}/${domain}.pem" | |
echo "Restart/-load relevant services" | |
#[[ "${domain}" = "example.com" ]] && service haproxy restart | |
done | |
echo "Restarting HAProxy" | |
service haproxy restart |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment