[mirror_acme.sh.git] / deploy / truenas.sh

#!/usr/bin/env sh

# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
#
# Written by Frank Plass github@f-plass.de
# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
# Thanks to danb35 for your template!
#
# Following environment variables must be set:
#
# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
#
# The following environmental variables may be set if you don't like their
# default values:
#
# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
#
#returns 0 means success, otherwise error.

########  Public functions #####################

#domain keyfile certfile cafile fullchain
truenas_deploy() {
  _cdomain="$1"
  _ckey="$2"
  _ccert="$3"
  _cca="$4"
  _cfullchain="$5"

  _debug _cdomain "$_cdomain"
  _debug _ckey "$_ckey"
  _debug _ccert "$_ccert"
  _debug _cca "$_cca"
  _debug _cfullchain "$_cfullchain"

  _getdeployconf DEPLOY_TRUENAS_APIKEY

  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
    _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
    return 1
  fi
  _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"

  # Optional hostname, scheme for TrueNAS
  _getdeployconf DEPLOY_TRUENAS_HOSTNAME
  _getdeployconf DEPLOY_TRUENAS_SCHEME

  # default values for hostname and scheme
  [ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] || DEPLOY_TRUENAS_HOSTNAME="localhost"
  [ -n "${DEPLOY_TRUENAS_SCHEME}" ] || DEPLOY_TRUENAS_SCHEME="http"

  _debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
  _debug2 DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"

  _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
  _debug _api_url "$_api_url"

  _H1="Authorization: Bearer $DEPLOY_TRUENAS_APIKEY"
  _secure_debug3 _H1 "$_H1"

  _info "Testing Connection TrueNAS"
  _response=$(_get "$_api_url/system/state")
  _info "TrueNAS system state: $_response."

  if [ -z "$_response" ]; then
    _err "Unable to authenticate to $_api_url."
    _err 'Check your connection settings are correct, e.g.'
    _err 'DEPLOY_TRUENAS_HOSTNAME="192.168.x.y" or DEPLOY_TRUENAS_HOSTNAME="truenas.example.com".'
    _err 'DEPLOY_TRUENAS_SCHEME="https" or DEPLOY_TRUENAS_SCHEME="http".'
    _err "Verify your TrueNAS API key is valid and set correctly, e.g. DEPLOY_TRUENAS_APIKEY=xxxx...."
    return 1
  fi

  _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
  _savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
  _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"

  _info "Getting current active certificate from TrueNAS"
  _response=$(_get "$_api_url/system/general")
  _active_cert_id=$(echo "$_response" | grep -B2 '"name":' | grep 'id' | tr -d -- '"id: ,')
  _active_cert_name=$(echo "$_response" | grep '"name":' | sed -n 's/.*: "\(.\{1,\}\)",$/\1/p')
  _param_httpsredirect=$(echo "$_response" | grep '"ui_httpsredirect":' | sed -n 's/.*": \(.\{1,\}\),$/\1/p')
  _debug Active_UI_Certificate_ID "$_active_cert_id"
  _debug Active_UI_Certificate_Name "$_active_cert_name"
  _debug Active_UI_http_redirect "$_param_httpsredirect"

  if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ]; then
    _info "HTTP->HTTPS redirection is enabled"
    _info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
    DEPLOY_TRUENAS_SCHEME="https"
    _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
    _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
  fi

  _info "Uploading new certificate to TrueNAS"
  _certname="Letsencrypt_$(_utc_date | tr ' ' '_' | tr -d -- ':')"
  _debug3 _certname "$_certname"

  _certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
  _add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"

  _debug3 _add_cert_result "$_add_cert_result"

  _info "Fetching list of installed certificates"
  _cert_list=$(_get "$_api_url/system/general/ui_certificate_choices")
  _cert_id=$(echo "$_cert_list" | grep "$_certname" | sed -n 's/.*"\([0-9]\{1,\}\)".*$/\1/p')

  _debug3 _cert_id "$_cert_id"

  _info "Current activate certificate ID: $_cert_id"
  _activateData="{\"ui_certificate\": \"${_cert_id}\"}"
  _activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"

  _debug3 _activate_result "$_activate_result"

  _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
  _webdav_list=$(_get "$_api_url/webdav")
  _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')

  if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
    _info "Updating the WebDAV certificate"
    _debug _webdav_cert_id "$_webdav_cert_id"
    _webdav_data="{\"certssl\": \"${_cert_id}\"}"
    _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
    _webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | grep '"certssl":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
    if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
      _info "WebDAV certificate updated successfully"
    else
      _err "Unable to set WebDAV certificate"
      _debug3 _activate_webdav_cert "$_activate_webdav_cert"
      _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
      return 1
    fi
    _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
  else
    _info "WebDAV certificate is not configured or is not the same as TrueNAS web UI"
  fi

  _info "Checking if FTP certificate is the same as the TrueNAS web UI"
  _ftp_list=$(_get "$_api_url/ftp")
  _ftp_cert_id=$(echo "$_ftp_list" | grep '"ssltls_certificate":' | tr -d -- '"certislfa:_ ,')

  if [ "$_ftp_cert_id" = "$_active_cert_id" ]; then
    _info "Updating the FTP certificate"
    _debug _ftp_cert_id "$_ftp_cert_id"
    _ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}"
    _activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")"
    _ftp_new_cert_id=$(echo "$_activate_ftp_cert" | _json_decode | grep '"ssltls_certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
    if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then
      _info "FTP certificate updated successfully"
    else
      _err "Unable to set FTP certificate"
      _debug3 _activate_ftp_cert "$_activate_ftp_cert"
      _debug3 _ftp_new_cert_id "$_ftp_new_cert_id"
      return 1
    fi
    _debug3 _activate_ftp_cert "$_activate_ftp_cert"
  else
    _info "FTP certificate is not configured or is not the same as TrueNAS web UI"
  fi

  _info "Checking if S3 certificate is the same as the TrueNAS web UI"
  _s3_list=$(_get "$_api_url/s3")
  _s3_cert_id=$(echo "$_s3_list" | grep '"certificate":' | tr -d -- '"certifa:_ ,')

  if [ "$_s3_cert_id" = "$_active_cert_id" ]; then
    _info "Updating the S3 certificate"
    _debug _s3_cert_id "$_s3_cert_id"
    _s3_data="{\"certificate\": \"${_cert_id}\"}"
    _activate_s3_cert="$(_post "$_s3_data" "$_api_url/s3" "" "PUT" "application/json")"
    _s3_new_cert_id=$(echo "$_activate_s3_cert" | _json_decode | grep '"certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
    if [ "$_s3_new_cert_id" -eq "$_cert_id" ]; then
      _info "S3 certificate updated successfully"
    else
      _err "Unable to set S3 certificate"
      _debug3 _activate_s3_cert "$_activate_s3_cert"
      _debug3 _s3_new_cert_id "$_s3_new_cert_id"
      return 1
    fi
    _debug3 _activate_s3_cert "$_activate_s3_cert"
  else
    _info "S3 certificate is not configured or is not the same as TrueNAS web UI"
  fi

  _info "Deleting old certificate"
  _delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"

  _debug3 _delete_result "$_delete_result"

  _info "Reloading TrueNAS web UI"
  _restart_UI=$(_get "$_api_url/system/general/ui_restart")
  _debug2 _restart_UI "$_restart_UI"

  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then
    return 0
  else
    _err "Certificate update was not succesful, please try again with --debug"
    return 1
  fi
}
Commit	Line	Data
052c9be1	1	#!/usr/bin/env sh
556c546b	2
a4f9746d	3	# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
556c546b P	4	# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
	5	#
	6	# Written by Frank Plass github@f-plass.de
a4f9746d P	7	# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
a4f9746d P	8	# Thanks to danb35 for your template!
556c546b P	9	#
	10	# Following environment variables must be set:
	11	#
	12	# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
	13	#
	14	# The following environmental variables may be set if you don't like their
	15	# default values:
	16	#
	17	# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
	18	# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
	19	#
	20	#returns 0 means success, otherwise error.
	21
	22	######## Public functions #####################
	23
	24	#domain keyfile certfile cafile fullchain
	25	truenas_deploy() {
	26	_cdomain="$1"
	27	_ckey="$2"
	28	_ccert="$3"
	29	_cca="$4"
	30	_cfullchain="$5"
	31
	32	_debug _cdomain "$_cdomain"
	33	_debug _ckey "$_ckey"
	34	_debug _ccert "$_ccert"
	35	_debug _cca "$_cca"
	36	_debug _cfullchain "$_cfullchain"
	37
	38	_getdeployconf DEPLOY_TRUENAS_APIKEY
	39
	40	if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
afa06267	41	_err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
556c546b P	42	return 1
	43	fi
	44	_secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
	45
a836842a	46	# Optional hostname, scheme for TrueNAS
556c546b P	47	_getdeployconf DEPLOY_TRUENAS_HOSTNAME
	48	_getdeployconf DEPLOY_TRUENAS_SCHEME
	49
a836842a	50	# default values for hostname and scheme
556c546b P	51	[ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] \|\| DEPLOY_TRUENAS_HOSTNAME="localhost"
	52	[ -n "${DEPLOY_TRUENAS_SCHEME}" ] \|\| DEPLOY_TRUENAS_SCHEME="http"
	53
	54	_debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
	55	_debug2 DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
	56
	57	_api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
	58	_debug _api_url "$_api_url"
	59
	60	_H1="Authorization: Bearer $DEPLOY_TRUENAS_APIKEY"
	61	_secure_debug3 _H1 "$_H1"
	62
	63	_info "Testing Connection TrueNAS"
	64	_response=$(_get "$_api_url/system/state")
afa06267	65	_info "TrueNAS system state: $_response."
556c546b P	66
	67	if [ -z "$_response" ]; then
	68	_err "Unable to authenticate to $_api_url."
afa06267 IG	69	_err 'Check your connection settings are correct, e.g.'
	70	_err 'DEPLOY_TRUENAS_HOSTNAME="192.168.x.y" or DEPLOY_TRUENAS_HOSTNAME="truenas.example.com".'
	71	_err 'DEPLOY_TRUENAS_SCHEME="https" or DEPLOY_TRUENAS_SCHEME="http".'
	72	_err "Verify your TrueNAS API key is valid and set correctly, e.g. DEPLOY_TRUENAS_APIKEY=xxxx...."
556c546b P	73	return 1
	74	fi
	75
93fd6170 P	76	_savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
	77	_savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
	78	_savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
556c546b	79
afa06267	80	_info "Getting current active certificate from TrueNAS"
556c546b P	81	_response=$(_get "$_api_url/system/general")
	82	_active_cert_id=$(echo "$_response" \| grep -B2 '"name":' \| grep 'id' \| tr -d -- '"id: ,')
	83	_active_cert_name=$(echo "$_response" \| grep '"name":' \| sed -n 's/.*: "\(.\{1,\}\)",$/\1/p')
	84	_param_httpsredirect=$(echo "$_response" \| grep '"ui_httpsredirect":' \| sed -n 's/.*": \(.\{1,\}\),$/\1/p')
	85	_debug Active_UI_Certificate_ID "$_active_cert_id"
	86	_debug Active_UI_Certificate_Name "$_active_cert_name"
	87	_debug Active_UI_http_redirect "$_param_httpsredirect"
	88
a836842a	89	if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ]; then
afa06267	90	_info "HTTP->HTTPS redirection is enabled"
556c546b P	91	_info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
	92	DEPLOY_TRUENAS_SCHEME="https"
	93	_api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
93fd6170	94	_savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
556c546b P	95	fi
556c546b P	96
afa06267	97	_info "Uploading new certificate to TrueNAS"
a836842a	98	_certname="Letsencrypt_$(_utc_date \| tr ' ' '_' \| tr -d -- ':')"
556c546b P	99	_debug3 _certname "$_certname"
	100
	101	_certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
	102	_add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"
	103
	104	_debug3 _add_cert_result "$_add_cert_result"
	105
afa06267	106	_info "Fetching list of installed certificates"
556c546b P	107	_cert_list=$(_get "$_api_url/system/general/ui_certificate_choices")
	108	_cert_id=$(echo "$_cert_list" \| grep "$_certname" \| sed -n 's/."\([0-9]\{1,\}\)".$/\1/p')
	109
	110	_debug3 _cert_id "$_cert_id"
	111
afa06267	112	_info "Current activate certificate ID: $_cert_id"
556c546b P	113	_activateData="{\"ui_certificate\": \"${_cert_id}\"}"
	114	_activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"
	115
0e341726	116	_debug3 _activate_result "$_activate_result"
556c546b	117
afa06267	118	_info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
556c546b P	119	_webdav_list=$(_get "$_api_url/webdav")
	120	_webdav_cert_id=$(echo "$_webdav_list" \| grep '"certssl":' \| tr -d -- '"certsl: ,')
	121
	122	if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
afa06267	123	_info "Updating the WebDAV certificate"
556c546b P	124	_debug _webdav_cert_id "$_webdav_cert_id"
	125	_webdav_data="{\"certssl\": \"${_cert_id}\"}"
	126	_activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
d4a6d9c0	127	_webdav_new_cert_id=$(echo "$_activate_webdav_cert" \| _json_decode \| grep '"certssl":' \| sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
556c546b	128	if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
afa06267	129	_info "WebDAV certificate updated successfully"
556c546b P	130	else
	131	_err "Unable to set WebDAV certificate"
	132	_debug3 _activate_webdav_cert "$_activate_webdav_cert"
	133	_debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
	134	return 1
	135	fi
	136	_debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
	137	else
afa06267	138	_info "WebDAV certificate is not configured or is not the same as TrueNAS web UI"
556c546b P	139	fi
556c546b P	140
afa06267	141	_info "Checking if FTP certificate is the same as the TrueNAS web UI"
556c546b P	142	_ftp_list=$(_get "$_api_url/ftp")
	143	_ftp_cert_id=$(echo "$_ftp_list" \| grep '"ssltls_certificate":' \| tr -d -- '"certislfa:_ ,')
	144
	145	if [ "$_ftp_cert_id" = "$_active_cert_id" ]; then
afa06267	146	_info "Updating the FTP certificate"
556c546b P	147	_debug _ftp_cert_id "$_ftp_cert_id"
	148	_ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}"
	149	_activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")"
d4a6d9c0	150	_ftp_new_cert_id=$(echo "$_activate_ftp_cert" \| _json_decode \| grep '"ssltls_certificate":' \| sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
556c546b	151	if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then
afa06267	152	_info "FTP certificate updated successfully"
556c546b P	153	else
	154	_err "Unable to set FTP certificate"
	155	_debug3 _activate_ftp_cert "$_activate_ftp_cert"
	156	_debug3 _ftp_new_cert_id "$_ftp_new_cert_id"
	157	return 1
	158	fi
	159	_debug3 _activate_ftp_cert "$_activate_ftp_cert"
	160	else
c3f61124 IG	161	_info "FTP certificate is not configured or is not the same as TrueNAS web UI"
	162	fi
	163
	164	_info "Checking if S3 certificate is the same as the TrueNAS web UI"
	165	_s3_list=$(_get "$_api_url/s3")
	166	_s3_cert_id=$(echo "$_s3_list" \| grep '"certificate":' \| tr -d -- '"certifa:_ ,')
	167
	168	if [ "$_s3_cert_id" = "$_active_cert_id" ]; then
	169	_info "Updating the S3 certificate"
	170	_debug _s3_cert_id "$_s3_cert_id"
	171	_s3_data="{\"certificate\": \"${_cert_id}\"}"
	172	_activate_s3_cert="$(_post "$_s3_data" "$_api_url/s3" "" "PUT" "application/json")"
	173	_s3_new_cert_id=$(echo "$_activate_s3_cert" \| _json_decode \| grep '"certificate":' \| sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
	174	if [ "$_s3_new_cert_id" -eq "$_cert_id" ]; then
	175	_info "S3 certificate updated successfully"
	176	else
	177	_err "Unable to set S3 certificate"
	178	_debug3 _activate_s3_cert "$_activate_s3_cert"
	179	_debug3 _s3_new_cert_id "$_s3_new_cert_id"
	180	return 1
	181	fi
	182	_debug3 _activate_s3_cert "$_activate_s3_cert"
	183	else
	184	_info "S3 certificate is not configured or is not the same as TrueNAS web UI"
556c546b P	185	fi
556c546b P	186
afa06267	187	_info "Deleting old certificate"
556c546b P	188	_delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"
	189
	190	_debug3 _delete_result "$_delete_result"
	191
afa06267	192	_info "Reloading TrueNAS web UI"
eacc00f7	193	_restart_UI=$(_get "$_api_url/system/general/ui_restart")
eacc00f7	194	_debug2 _restart_UI "$_restart_UI"
c8a23087	195
4bb8e3a1	196	if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then
05737b85	197	return 0
854e5205	198	else
afa06267	199	_err "Certificate update was not succesful, please try again with --debug"
854e5205	200	return 1
c8a23087	201	fi
6f4c5fcc	202	}