]>
Commit | Line | Data |
---|---|---|
052c9be1 | 1 | #!/usr/bin/env sh |
556c546b | 2 | |
a4f9746d | 3 | # Here is a scipt to deploy the cert to your TrueNAS using the REST API. |
556c546b P |
4 | # https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html |
5 | # | |
6 | # Written by Frank Plass github@f-plass.de | |
a4f9746d P |
7 | # https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py |
8 | # Thanks to danb35 for your template! | |
556c546b P |
9 | # |
10 | # Following environment variables must be set: | |
11 | # | |
12 | # export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI" | |
13 | # | |
14 | # The following environmental variables may be set if you don't like their | |
15 | # default values: | |
16 | # | |
17 | # DEPLOY_TRUENAS_HOSTNAME - defaults to localhost | |
18 | # DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https | |
19 | # | |
20 | #returns 0 means success, otherwise error. | |
21 | ||
22 | ######## Public functions ##################### | |
23 | ||
24 | #domain keyfile certfile cafile fullchain | |
25 | truenas_deploy() { | |
26 | _cdomain="$1" | |
27 | _ckey="$2" | |
28 | _ccert="$3" | |
29 | _cca="$4" | |
30 | _cfullchain="$5" | |
31 | ||
32 | _debug _cdomain "$_cdomain" | |
33 | _debug _ckey "$_ckey" | |
34 | _debug _ccert "$_ccert" | |
35 | _debug _cca "$_cca" | |
36 | _debug _cfullchain "$_cfullchain" | |
37 | ||
38 | _getdeployconf DEPLOY_TRUENAS_APIKEY | |
39 | ||
40 | if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then | |
afa06267 | 41 | _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable." |
556c546b P |
42 | return 1 |
43 | fi | |
44 | _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY" | |
45 | ||
a836842a | 46 | # Optional hostname, scheme for TrueNAS |
556c546b P |
47 | _getdeployconf DEPLOY_TRUENAS_HOSTNAME |
48 | _getdeployconf DEPLOY_TRUENAS_SCHEME | |
49 | ||
a836842a | 50 | # default values for hostname and scheme |
556c546b P |
51 | [ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] || DEPLOY_TRUENAS_HOSTNAME="localhost" |
52 | [ -n "${DEPLOY_TRUENAS_SCHEME}" ] || DEPLOY_TRUENAS_SCHEME="http" | |
53 | ||
54 | _debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME" | |
55 | _debug2 DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME" | |
56 | ||
57 | _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0" | |
58 | _debug _api_url "$_api_url" | |
59 | ||
60 | _H1="Authorization: Bearer $DEPLOY_TRUENAS_APIKEY" | |
61 | _secure_debug3 _H1 "$_H1" | |
62 | ||
63 | _info "Testing Connection TrueNAS" | |
64 | _response=$(_get "$_api_url/system/state") | |
afa06267 | 65 | _info "TrueNAS system state: $_response." |
556c546b P |
66 | |
67 | if [ -z "$_response" ]; then | |
68 | _err "Unable to authenticate to $_api_url." | |
afa06267 IG |
69 | _err 'Check your connection settings are correct, e.g.' |
70 | _err 'DEPLOY_TRUENAS_HOSTNAME="192.168.x.y" or DEPLOY_TRUENAS_HOSTNAME="truenas.example.com".' | |
71 | _err 'DEPLOY_TRUENAS_SCHEME="https" or DEPLOY_TRUENAS_SCHEME="http".' | |
72 | _err "Verify your TrueNAS API key is valid and set correctly, e.g. DEPLOY_TRUENAS_APIKEY=xxxx...." | |
556c546b P |
73 | return 1 |
74 | fi | |
75 | ||
93fd6170 P |
76 | _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY" |
77 | _savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME" | |
78 | _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME" | |
556c546b | 79 | |
afa06267 | 80 | _info "Getting current active certificate from TrueNAS" |
556c546b P |
81 | _response=$(_get "$_api_url/system/general") |
82 | _active_cert_id=$(echo "$_response" | grep -B2 '"name":' | grep 'id' | tr -d -- '"id: ,') | |
83 | _active_cert_name=$(echo "$_response" | grep '"name":' | sed -n 's/.*: "\(.\{1,\}\)",$/\1/p') | |
84 | _param_httpsredirect=$(echo "$_response" | grep '"ui_httpsredirect":' | sed -n 's/.*": \(.\{1,\}\),$/\1/p') | |
85 | _debug Active_UI_Certificate_ID "$_active_cert_id" | |
86 | _debug Active_UI_Certificate_Name "$_active_cert_name" | |
87 | _debug Active_UI_http_redirect "$_param_httpsredirect" | |
88 | ||
a836842a | 89 | if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ]; then |
afa06267 | 90 | _info "HTTP->HTTPS redirection is enabled" |
556c546b P |
91 | _info "Setting DEPLOY_TRUENAS_SCHEME to 'https'" |
92 | DEPLOY_TRUENAS_SCHEME="https" | |
93 | _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0" | |
93fd6170 | 94 | _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME" |
556c546b P |
95 | fi |
96 | ||
afa06267 | 97 | _info "Uploading new certificate to TrueNAS" |
a836842a | 98 | _certname="Letsencrypt_$(_utc_date | tr ' ' '_' | tr -d -- ':')" |
556c546b P |
99 | _debug3 _certname "$_certname" |
100 | ||
101 | _certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}" | |
102 | _add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")" | |
103 | ||
104 | _debug3 _add_cert_result "$_add_cert_result" | |
105 | ||
afa06267 | 106 | _info "Fetching list of installed certificates" |
556c546b P |
107 | _cert_list=$(_get "$_api_url/system/general/ui_certificate_choices") |
108 | _cert_id=$(echo "$_cert_list" | grep "$_certname" | sed -n 's/.*"\([0-9]\{1,\}\)".*$/\1/p') | |
109 | ||
110 | _debug3 _cert_id "$_cert_id" | |
111 | ||
afa06267 | 112 | _info "Current activate certificate ID: $_cert_id" |
556c546b P |
113 | _activateData="{\"ui_certificate\": \"${_cert_id}\"}" |
114 | _activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")" | |
115 | ||
0e341726 | 116 | _debug3 _activate_result "$_activate_result" |
556c546b | 117 | |
afa06267 | 118 | _info "Checking if WebDAV certificate is the same as the TrueNAS web UI" |
556c546b P |
119 | _webdav_list=$(_get "$_api_url/webdav") |
120 | _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,') | |
121 | ||
122 | if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then | |
afa06267 | 123 | _info "Updating the WebDAV certificate" |
556c546b P |
124 | _debug _webdav_cert_id "$_webdav_cert_id" |
125 | _webdav_data="{\"certssl\": \"${_cert_id}\"}" | |
126 | _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")" | |
d4a6d9c0 | 127 | _webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | grep '"certssl":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p') |
556c546b | 128 | if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then |
afa06267 | 129 | _info "WebDAV certificate updated successfully" |
556c546b P |
130 | else |
131 | _err "Unable to set WebDAV certificate" | |
132 | _debug3 _activate_webdav_cert "$_activate_webdav_cert" | |
133 | _debug3 _webdav_new_cert_id "$_webdav_new_cert_id" | |
134 | return 1 | |
135 | fi | |
136 | _debug3 _webdav_new_cert_id "$_webdav_new_cert_id" | |
137 | else | |
afa06267 | 138 | _info "WebDAV certificate is not configured or is not the same as TrueNAS web UI" |
556c546b P |
139 | fi |
140 | ||
afa06267 | 141 | _info "Checking if FTP certificate is the same as the TrueNAS web UI" |
556c546b P |
142 | _ftp_list=$(_get "$_api_url/ftp") |
143 | _ftp_cert_id=$(echo "$_ftp_list" | grep '"ssltls_certificate":' | tr -d -- '"certislfa:_ ,') | |
144 | ||
145 | if [ "$_ftp_cert_id" = "$_active_cert_id" ]; then | |
afa06267 | 146 | _info "Updating the FTP certificate" |
556c546b P |
147 | _debug _ftp_cert_id "$_ftp_cert_id" |
148 | _ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}" | |
149 | _activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")" | |
d4a6d9c0 | 150 | _ftp_new_cert_id=$(echo "$_activate_ftp_cert" | _json_decode | grep '"ssltls_certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p') |
556c546b | 151 | if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then |
afa06267 | 152 | _info "FTP certificate updated successfully" |
556c546b P |
153 | else |
154 | _err "Unable to set FTP certificate" | |
155 | _debug3 _activate_ftp_cert "$_activate_ftp_cert" | |
156 | _debug3 _ftp_new_cert_id "$_ftp_new_cert_id" | |
157 | return 1 | |
158 | fi | |
159 | _debug3 _activate_ftp_cert "$_activate_ftp_cert" | |
160 | else | |
c3f61124 IG |
161 | _info "FTP certificate is not configured or is not the same as TrueNAS web UI" |
162 | fi | |
163 | ||
164 | _info "Checking if S3 certificate is the same as the TrueNAS web UI" | |
165 | _s3_list=$(_get "$_api_url/s3") | |
166 | _s3_cert_id=$(echo "$_s3_list" | grep '"certificate":' | tr -d -- '"certifa:_ ,') | |
167 | ||
168 | if [ "$_s3_cert_id" = "$_active_cert_id" ]; then | |
169 | _info "Updating the S3 certificate" | |
170 | _debug _s3_cert_id "$_s3_cert_id" | |
171 | _s3_data="{\"certificate\": \"${_cert_id}\"}" | |
172 | _activate_s3_cert="$(_post "$_s3_data" "$_api_url/s3" "" "PUT" "application/json")" | |
173 | _s3_new_cert_id=$(echo "$_activate_s3_cert" | _json_decode | grep '"certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p') | |
174 | if [ "$_s3_new_cert_id" -eq "$_cert_id" ]; then | |
175 | _info "S3 certificate updated successfully" | |
176 | else | |
177 | _err "Unable to set S3 certificate" | |
178 | _debug3 _activate_s3_cert "$_activate_s3_cert" | |
179 | _debug3 _s3_new_cert_id "$_s3_new_cert_id" | |
180 | return 1 | |
181 | fi | |
182 | _debug3 _activate_s3_cert "$_activate_s3_cert" | |
183 | else | |
184 | _info "S3 certificate is not configured or is not the same as TrueNAS web UI" | |
556c546b P |
185 | fi |
186 | ||
bd2d0e6a | 187 | _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required" |
04a5d794 | 188 | if _exists jq; then |
189 | _info "Query all chart release" | |
190 | _release_list=$(_get "$_api_url/chart/release") | |
5a59c390 | 191 | _related_name_list=$(printf "%s" "$_release_list" | jq -r "[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==$_active_cert_id) | .name ] | unique") |
2690c057 | 192 | _release_length=$(printf "%s" "$_related_name_list" | jq -r "length") |
04a5d794 | 193 | _info "Found $_release_length related chart release in list: $_related_name_list" |
e3b688c9 | 194 | for i in $(seq 0 $((_release_length - 1))); do |
5a59c390 | 195 | _release_name=$(echo "$_related_name_list" | jq -r ".[$i]") |
04a5d794 | 196 | _info "Updating certificate from $_active_cert_id to $_cert_id for chart release: $_release_name" |
197 | #Read the chart release configuration | |
5a59c390 | 198 | _chart_config=$(printf "%s" "$_release_list" | jq -r ".[] | select(.name==\"$_release_name\")") |
04a5d794 | 199 | #Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress |
41b6f18a | 200 | _updated_chart_config=$(printf "%s" "$_chart_config" | jq "(.config.ingress?.main.tls[]? | select(.scaleCert==$_active_cert_id) | .scaleCert ) |= $_cert_id | .config.ingress ") |
04a5d794 | 201 | _update_chart_result="$(_post "{\"values\" : { \"ingress\" : $_updated_chart_config } }" "$_api_url/chart/release/id/$_release_name" "" "PUT" "application/json")" |
202 | _debug3 _update_chart_result "$_update_chart_result" | |
203 | done | |
204 | else | |
205 | _info "Tool 'jq' does not exists, skip chart release checking" | |
206 | fi | |
207 | ||
afa06267 | 208 | _info "Deleting old certificate" |
556c546b P |
209 | _delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")" |
210 | ||
211 | _debug3 _delete_result "$_delete_result" | |
212 | ||
afa06267 | 213 | _info "Reloading TrueNAS web UI" |
eacc00f7 | 214 | _restart_UI=$(_get "$_api_url/system/general/ui_restart") |
eacc00f7 | 215 | _debug2 _restart_UI "$_restart_UI" |
c8a23087 | 216 | |
4bb8e3a1 | 217 | if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then |
05737b85 | 218 | return 0 |
854e5205 | 219 | else |
afa06267 | 220 | _err "Certificate update was not succesful, please try again with --debug" |
854e5205 | 221 | return 1 |
c8a23087 | 222 | fi |
6f4c5fcc | 223 | } |