]>
Commit | Line | Data |
---|---|---|
555e0de9 BH |
1 | #!/usr/bin/env sh |
2 | ||
3 | # Here is a script to deploy cert to Synology DSM vault | |
4 | # (https://www.vaultproject.io/) | |
5 | # | |
6 | # it requires the jq and curl are in the $PATH and the following | |
7 | # environment variables must be set: | |
8 | # | |
9 | # SYNO_Username - Synology Username to login (must be an administrator) | |
10 | # SYNO_Password - Synology Password to login | |
11 | # SYNO_Certificate - Certificate description to target for replacement | |
12 | # | |
13 | # The following environmental variables may be set if you don't like their | |
14 | # default values: | |
15 | # | |
16 | # SYNO_Scheme - defaults to http | |
17 | # SYNO_Hostname - defaults to localhost | |
18 | # SYNO_Port - defaults to 5000 | |
19 | # | |
20 | #returns 0 means success, otherwise error. | |
21 | ||
22 | ######## Public functions ##################### | |
23 | ||
24 | #domain keyfile certfile cafile fullchain | |
25 | synology_dsm_deploy() { | |
26 | ||
27 | _cdomain="$1" | |
28 | _ckey="$2" | |
29 | _ccert="$3" | |
30 | _cca="$4" | |
31 | ||
32 | _debug _cdomain "$_cdomain" | |
33 | ||
34 | # Get Username and Password, but don't save until we successfully authenticate | |
35 | SYNO_Username="${SYNO_Username:-$(_readaccountconf_mutable SYNO_Username)}" | |
36 | SYNO_Password="${SYNO_Password:-$(_readaccountconf_mutable SYNO_Password)}" | |
37 | if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then | |
38 | SYNO_Username="" | |
39 | SYNO_Password="" | |
40 | _err "SYNO_Username & SYNO_Password must be set" | |
41 | return 1 | |
42 | fi | |
43 | _debug2 SYNO_Username "$SYNO_Username" | |
44 | _secure_debug2 SYNO_Password "$SYNO_Password" | |
45 | ||
46 | # Optional scheme, hostname, and port for Synology DSM | |
47 | SYNO_Scheme="${SYNO_Scheme:-$(_readaccountconf_mutable SYNO_Scheme)}" | |
48 | SYNO_Hostname="${SYNO_Hostname:-$(_readaccountconf_mutable SYNO_Hostname)}" | |
49 | SYNO_Port="${SYNO_Port:-$(_readaccountconf_mutable SYNO_Port)}" | |
50 | _saveaccountconf_mutable SYNO_Scheme "$SYNO_Scheme" | |
51 | _saveaccountconf_mutable SYNO_Hostname "$SYNO_Hostname" | |
52 | _saveaccountconf_mutable SYNO_Port "$SYNO_Port" | |
53 | ||
54 | # default vaules for scheme, hostname, and port | |
55 | # defaulting to localhost and http because it's localhost... | |
56 | [ -n "${SYNO_Scheme}" ] || SYNO_Scheme="http" | |
57 | [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost" | |
58 | [ -n "${SYNO_Port}" ] || SYNO_Port="5000" | |
59 | ||
60 | _debug2 SYNO_Scheme "$SYNO_Scheme" | |
61 | _debug2 SYNO_Hostname "$SYNO_Hostname" | |
62 | _debug2 SYNO_Port "$SYNO_Port" | |
63 | ||
64 | # Get the certificate description, but don't save it until we verfiy it's real | |
65 | _getdeployconf SYNO_Certificate | |
548f83c3 | 66 | # shellcheck disable=SC2154 |
555e0de9 BH |
67 | if [ -z "${SYNO_Certificate}" ]; then |
68 | _err "SYNO_Certificate needs to be defined (with the Certificate description name)" | |
69 | return 1 | |
70 | fi | |
71 | _debug SYNO_Certificate "$SYNO_Certificate" | |
72 | ||
73 | # We can't use _get or _post because they lack support for cookies | |
74 | # use jq because I'm too lazy to figure out what is required to parse json | |
75 | # by hand. Also it seems to be in place for Synology DSM (6.2.1 at least) | |
76 | for x in curl jq; do | |
77 | if ! _exists "$x"; then | |
78 | _err "Please install $x first." | |
79 | _err "We need $x to work." | |
80 | return 1 | |
81 | fi | |
82 | done | |
83 | ||
84 | _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port" | |
85 | _debug _base_url "$_base_url" | |
86 | ||
87 | _cookie_jar="$(_mktemp)" | |
88 | _debug _cookie_jar "$_cookie_jar" | |
89 | ||
90 | # Login, get the token from JSON and session id from cookie | |
91 | _debug "Logging into $SYNO_Hostname:$SYNO_Port" | |
548f83c3 BH |
92 | token=$(curl -sk -c "$_cookie_jar" "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken) |
93 | if [ "$token" = "null" ]; then | |
555e0de9 BH |
94 | _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme." |
95 | _err "Check your username and password." | |
96 | rm "$_cookie_jar" | |
97 | return 1 | |
98 | fi | |
99 | ||
100 | # Now that we know the username and password are good, save them | |
101 | _saveaccountconf_mutable SYNO_Username "$SYNO_Username" | |
102 | _saveaccountconf_mutable SYNO_Password "$SYNO_Password" | |
103 | _secure_debug2 token "$token" | |
104 | ||
105 | # Use token and session id to get the list of certificates | |
548f83c3 | 106 | response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi" -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1) |
555e0de9 BH |
107 | _debug3 response "$response" |
108 | # select the first certificate matching our description | |
109 | cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]") | |
110 | _debug3 cert "$cert" | |
111 | ||
112 | if [ "$cert" = "null" ]; then | |
113 | _err "Unable to find certificate: $SYNO_Certificate" | |
114 | rm "$_cookie_jar" | |
115 | return 1 | |
116 | fi | |
117 | ||
118 | # we've verified this certificate description is a thing, so save it | |
119 | _savedeployconf SYNO_Certificate "$SYNO_Certificate" | |
120 | ||
548f83c3 | 121 | id=$(echo "$cert" | jq -r ".id") |
555e0de9 BH |
122 | default=$(echo "$cert" | jq -r ".is_default") |
123 | _debug2 id "$id" | |
124 | _debug2 default "$default" | |
125 | ||
126 | # This is the heavy lifting, make the API call to update a certificate in place | |
548f83c3 | 127 | response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F "key=@$_ckey" -F "cert=@$_ccert" -F "inter_cert=@$_cca" -F "id=$id" -F "desc=$SYNO_Certificate" -F "as_default=$default") |
555e0de9 BH |
128 | _debug3 response "$response" |
129 | success=$(echo "$response" | jq -r ".success") | |
130 | _debug2 success "$success" | |
131 | rm "$_cookie_jar" | |
132 | ||
133 | if [ "$success" = "true" ]; then | |
134 | restarted=$(echo "$response" | jq -r ".data.restart_httpd") | |
135 | if [ "$restarted" = "true" ]; then | |
136 | _info "http services were restarted" | |
137 | else | |
138 | _info "http services were NOT restarted" | |
139 | fi | |
140 | return 0; | |
141 | else | |
142 | code=$(echo "$response" | jq -r ".error.code") | |
143 | _err "Unable to update certificate, error code $code" | |
144 | return 1 | |
145 | fi | |
146 | } |