totoro: remove cloudflare credentials from raritan-sslrenew
This commit is contained in:
parent
4be2eaeb6d
commit
e50f682237
3 changed files with 26 additions and 20 deletions
ops
|
@ -481,8 +481,7 @@ in {
|
|||
ExecStart = "${depot.ops.raritan.ssl-renew}/lego.sh";
|
||||
EnvironmentFile = pkgs.writeText "sslrenew-secret" ''
|
||||
CERTIFICATE_DOMAIN=kvm.lukegb.xyz
|
||||
LETSENCRYPT_EMAIL=letsencrypt@lukegb.com
|
||||
CF_DNS_API_TOKEN=${secrets.cloudflareCredentials.token}
|
||||
CERTIFICATE_ROLE=letsencrypt-cloudflare
|
||||
RARITAN_IP=192.168.1.50
|
||||
RARITAN_USERNAME=${secrets.raritan.sslrenew.username}
|
||||
RARITAN_PASSWORD=${secrets.raritan.sslrenew.password}
|
||||
|
|
|
@ -5,7 +5,7 @@
|
|||
{ depot, pkgs, ... }:
|
||||
|
||||
pkgs.runCommandNoCC "raritan-update" {
|
||||
inherit (pkgs) lego curl;
|
||||
inherit (pkgs) curl jq;
|
||||
} ''
|
||||
mkdir $out
|
||||
substituteAll ${./deploy.sh} $out/deploy.sh
|
||||
|
|
|
@ -2,23 +2,30 @@
|
|||
|
||||
set -euo pipefail
|
||||
|
||||
export LEGO_FLAGS="\
|
||||
--accept-tos \
|
||||
--dns cloudflare \
|
||||
--dns.resolvers 1.1.1.1 \
|
||||
--domains "${CERTIFICATE_DOMAIN}" \
|
||||
--key-type rsa4096 \
|
||||
--email "${LETSENCRYPT_EMAIL}" \
|
||||
"
|
||||
CERTIFICATE_JSON="$(@curl@/bin/curl \
|
||||
-H "X-Vault-Request: true" \
|
||||
-X PUT \
|
||||
-d "{\"common_name\": \"${CERTIFICATE_DOMAIN}\"}" \
|
||||
"http://localhost:8200/v1/acme/certs/${CERTIFICATE_ROLE}")"
|
||||
|
||||
if ! [[ -f .lego/certificates/${CERTIFICATE_DOMAIN}.crt ]]; then
|
||||
exec @lego@/bin/lego \
|
||||
$LEGO_FLAGS \
|
||||
run \
|
||||
--run-hook="@out@/deploy.sh"
|
||||
if [[ "$(@jq@/bin/jq .errors <(echo "$CERTIFICATE_JSON") 2>/dev/null)" != "null" ]]; then
|
||||
@jq@/bin/jq .errors <(echo "$CERTIFICATE_JSON") >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exec @lego@/bin/lego \
|
||||
$LEGO_FLAGS \
|
||||
renew \
|
||||
--renew-hook="@out@/deploy.sh"
|
||||
temp_dir=$(mktemp -d)
|
||||
trap "rm -rf $temp_dir" INT TERM HUP EXIT
|
||||
|
||||
@jq@/bin/jq -r .data.cert <(echo "$CERTIFICATE_JSON") > "$temp_dir/cert.pem"
|
||||
@jq@/bin/jq -r .data.private_key <(echo "$CERTIFICATE_JSON") > "$temp_dir/pkey.pem"
|
||||
|
||||
@curl@/bin/curl -k \
|
||||
--user "${RARITAN_USERNAME}:${RARITAN_PASSWORD}" \
|
||||
-F cert_file=@"$temp_dir/cert.pem" \
|
||||
-F key_file=@"$temp_dir/pkey.pem" \
|
||||
"https://${RARITAN_IP}/cgi-bin/server_ssl_cert_upload.cgi"
|
||||
@curl@/bin/curl -k \
|
||||
--user "${RARITAN_USERNAME}:${RARITAN_PASSWORD}" \
|
||||
"https://${RARITAN_IP}/bulk" \
|
||||
-H 'Content-Type: application/json; charset=UTF-8' \
|
||||
--data-binary '{"jsonrpc":"2.0","method":"performBulk","params":{"requests":[{"rid":"/server_ssl_cert","json":{"jsonrpc":"2.0","method":"installPendingKeyPair","params":null,"id":1}}]},"id":2}'
|
||||
|
|
Loading…
Reference in a new issue