update
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
#!/usr/bin/env bash
|
||||
VERS='4.15.9-11222023'
|
||||
VERS='4.15.10-11222023'
|
||||
|
||||
noheader=' service status-check nightlyrephp7.3-fpm,new backup report check checkcerts gitea update-nodes copynpmcerts singleservercheck update-dyndns backup-offsitepfsense gui nightlyreview update log '
|
||||
CERT_DAEMON='/snap/bin/certbot'
|
||||
|
||||
109
inc/certs.inc
109
inc/certs.inc
@@ -621,6 +621,88 @@ CHECK-CERTS(){
|
||||
fi
|
||||
}
|
||||
|
||||
VCENTER-SSL(){
|
||||
[ "${NM_VC_ACMEFOLDER}" == "" ] && NM_VC_ACMEFOLDER="/root/.acme.sh"
|
||||
[ "${NM_VC_ACMESCRIPT}" == "" ] && NM_VC_ACMESCRIPT="acme.sh"
|
||||
|
||||
if [ "${NM_VC_HOSTNAME}" != "" ] && [ "${NM_VC_USER}" != "" ] && [ "${NM_VC_PASS}" != "" ] && [ "${NM_WPDNS_KEY}" != "" ]; then
|
||||
VCSERVER="https://${NM_VC_HOSTNAME}"
|
||||
|
||||
VC_CERT="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/${NM_VC_HOSTNAME}.cer"
|
||||
VC_KEY="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/${NM_VC_HOSTNAME}.key"
|
||||
VC_CHAIN="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/fullchain.cer"
|
||||
|
||||
echo -en "${idsCL[LightCyan]}Checking days left on vCenter cert... ${idsCL[Default]}"
|
||||
VCCERTDAYS=$(${NM_FOLDER}/ssl-cert-check/ssl-cert-check -p 443 -s ${NM_VC_HOSTNAME} -N)
|
||||
VCCERTDAYS=${VCCERTDAYS#*=}
|
||||
|
||||
if [ "${VCCERTDAYS}" -gt "29" ]; then
|
||||
if [ "${1}" == "force" ]; then
|
||||
echo -e "${idsCL[Yellow]}${VCCERTDAYS} days left, forcing certificate update${idsCL[Default]}"
|
||||
echo
|
||||
else
|
||||
echo -e "${idsCL[Green]}${VCCERTDAYS} days left, Certificate is still valid, no need to update${idsCL[Default]}"
|
||||
echo
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo -e "${idsCL[Yellow]}${VCCERTDAYS} days left, Certificate needs to be updated${idsCL[Default]}"
|
||||
echo
|
||||
fi
|
||||
|
||||
echo '#!/usr/bin/env bash' >| /tmp/vcenter-update-ssl.sh
|
||||
echo "export PDNS_Url='https://wdns.scity.us'
|
||||
export PDNS_Token='${NM_WPDNS_KEY}'
|
||||
# export PDNS_ServerId='localhost'
|
||||
export PDNS_ServerId='scity.us'
|
||||
export PDNS_Ttl=60
|
||||
" >> /tmp/vcenter-update-ssl.sh
|
||||
|
||||
if ssh -q root@${NM_VC_HOSTNAME} [ ! -d ${NM_VC_ACMEFOLDER} ]; then
|
||||
echo -e "${idsCL[Yellow]}Installing acme.sh scripts on vCenter${idsCL[Default]}\n"
|
||||
ssh -q root@${NM_VC_HOSTNAME} "wget -O - https://get.acme.sh | sh"
|
||||
echo -e "\n${idsCL[LightGreen]}Requesting new certificate ...${idsCL[Default]}\n"
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --server letsencrypt -k 2048 --preferred-chain 'ISRG Root X1' --issue --dns dns_pdns -d ${NM_VC_HOSTNAME}" >> /tmp/vcenter-update-ssl.sh
|
||||
else
|
||||
echo -e "${idsCL[Green]}Verified acme.sh scripts are installed on vCenter, checking for updates${idsCL[Default]}\n"
|
||||
ssh -q root@${NM_VC_HOSTNAME} "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --upgrade"
|
||||
echo -e "\n${idsCL[LightGreen]}Renewing certificate ...${idsCL[Default]}\n"
|
||||
if [ "${1}" == "force" ]; then
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --renew-all --force" >> /tmp/vcenter-update-ssl.sh
|
||||
else
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --renew-all" >> /tmp/vcenter-update-ssl.sh
|
||||
fi
|
||||
fi
|
||||
|
||||
scp -q /tmp/vcenter-update-ssl.sh root@${NM_VC_HOSTNAME}:/tmp/vcenter-update-ssl.sh
|
||||
ssh -q root@${NM_VC_HOSTNAME} "bash /tmp/vcenter-update-ssl.sh"
|
||||
|
||||
LIVEMD5=$(ssh -q root@${NM_VC_HOSTNAME} "md5sum /etc/vmware-rhttpproxy/ssl/rui.crt | cut -d\ -f1")
|
||||
CURRENTMD5=$(ssh -q root@${NM_VC_HOSTNAME} "md5sum ${VC_CERT} | cut -d\ -f1")
|
||||
if [ "$LIVEMD5" == "$CURRENTMD5" ] && [ "${1}" != "force" ]; then
|
||||
echo -e "${idsCL[Yellow]}Certificates remains the same, no newer certificates exist${idsCL[Default]}"
|
||||
echo
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo -e "${idsCL[LightGreen]}Updating certificates on vCenter... ${idsCL[Default]}"
|
||||
echo -e "${idsCL[LightCyan]}This process make take up to 10mins${idsCL[Default]}"
|
||||
echo
|
||||
|
||||
ssh -q root@${NM_VC_HOSTNAME} "(printf '1\n%s\n' '${NM_VC_USER}'; sleep 1; printf '%s\n' '${NM_VC_PASS}'; sleep 1; printf '2\n'; sleep 1; printf '%s\n%s\n%s\ny\n\n' '${VC_CERT}' '${VC_KEY}' '${VC_CHAIN}') | setsid /usr/lib/vmware-vmca/bin/certificate-manager"
|
||||
|
||||
SENDNOTICE "vCenter SSL Updated" "Refresh/rescan any systems connecting to vcenter like Veeam"
|
||||
|
||||
ssh -q root@${NM_VC_HOSTNAME} "rm -f /tmp/vcenter-update-ssl.sh"
|
||||
rm -f /tmp/vcenter-update-ssl.sh
|
||||
|
||||
echo -e "\n${idsCL[Green]}The vCenter certifcate has been updated${idsCL[Default]}"
|
||||
echo -e "${idsCL[LightCyan]}Don't forget to re-scan the vCenter connection in Veeam${idsCL[Default]}\n"
|
||||
else
|
||||
echo -e "${idsCL[Yellow]}vCenter info not configured in 'defaults.local.inc'${idsCL[Default]}\n"
|
||||
fi
|
||||
}
|
||||
|
||||
UPGRADECERTS(){
|
||||
ssldir=$(${NCMD} find ${NM_CERTPATH}/live/* -type d)
|
||||
|
||||
@@ -638,8 +720,33 @@ UPGRADECERTS(){
|
||||
else
|
||||
allnames="${SUBJECT},$SUBJECTNAMES"
|
||||
fi
|
||||
echo "$certdir = $allnames "
|
||||
|
||||
$CERT_DAEMON certonly --expand --preferred-chain "ISRG Root X1" --key-type rsa --server https://acme-staging-v02.api.letsencrypt.org/directory --webroot --webroot-path ${NM_CERTPATH}/letsencrypt-acme-challenge -d ${allnames}
|
||||
|
||||
|
||||
if [ -d ${NM_CERTPATH}/live/${MAIN_CERT} ]; then
|
||||
echo
|
||||
echo -e "${idsCL[Green]}Certificate has been successfully created for '${idsCL[Yellow]}${NEW_CERT}${idsCL[Green]}'...${idsCL[Default]}"
|
||||
else
|
||||
echo
|
||||
echo -e "${idsCL[Red]}Certificate could not be created for '${idsCL[Yellow]}${NEW_CERT}${idsCL[Red]}'...${idsCL[Default]}"
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
chown -R root:le ${NM_CERTPATH}
|
||||
chmod -R 6775 ${NM_CERTPATH}
|
||||
|
||||
echo -e -n "${idsCL[LightCyan]}Restart NGINX on all Nodes (Y/n): ${idsCL[Default]}"
|
||||
read -n 1 NGINXRELOAD
|
||||
if [[ ${NGINXRELOAD} =~ ^[Nn]$ ]]; then
|
||||
tmp=''
|
||||
else
|
||||
echo
|
||||
SERVICE_MGMT nginx restart
|
||||
fi
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -395,87 +395,6 @@ NODEUPDATE() {
|
||||
echo
|
||||
}
|
||||
|
||||
VCENTER-SSL(){
|
||||
[ "${NM_VC_ACMEFOLDER}" == "" ] && NM_VC_ACMEFOLDER="/root/.acme.sh"
|
||||
[ "${NM_VC_ACMESCRIPT}" == "" ] && NM_VC_ACMESCRIPT="acme.sh"
|
||||
|
||||
if [ "${NM_VC_HOSTNAME}" != "" ] && [ "${NM_VC_USER}" != "" ] && [ "${NM_VC_PASS}" != "" ] && [ "${NM_WPDNS_KEY}" != "" ]; then
|
||||
VCSERVER="https://${NM_VC_HOSTNAME}"
|
||||
|
||||
VC_CERT="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/${NM_VC_HOSTNAME}.cer"
|
||||
VC_KEY="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/${NM_VC_HOSTNAME}.key"
|
||||
VC_CHAIN="${NM_VC_ACMEFOLDER}/${NM_VC_HOSTNAME}/fullchain.cer"
|
||||
|
||||
echo -en "${idsCL[LightCyan]}Checking days left on vCenter cert... ${idsCL[Default]}"
|
||||
VCCERTDAYS=$(${NM_FOLDER}/ssl-cert-check/ssl-cert-check -p 443 -s ${NM_VC_HOSTNAME} -N)
|
||||
VCCERTDAYS=${VCCERTDAYS#*=}
|
||||
|
||||
if [ "${VCCERTDAYS}" -gt "29" ]; then
|
||||
if [ "${1}" == "force" ]; then
|
||||
echo -e "${idsCL[Yellow]}${VCCERTDAYS} days left, forcing certificate update${idsCL[Default]}"
|
||||
echo
|
||||
else
|
||||
echo -e "${idsCL[Green]}${VCCERTDAYS} days left, Certificate is still valid, no need to update${idsCL[Default]}"
|
||||
echo
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo -e "${idsCL[Yellow]}${VCCERTDAYS} days left, Certificate needs to be updated${idsCL[Default]}"
|
||||
echo
|
||||
fi
|
||||
|
||||
echo '#!/usr/bin/env bash' >| /tmp/vcenter-update-ssl.sh
|
||||
echo "export PDNS_Url='https://wdns.scity.us'
|
||||
export PDNS_Token='${NM_WPDNS_KEY}'
|
||||
# export PDNS_ServerId='localhost'
|
||||
export PDNS_ServerId='scity.us'
|
||||
export PDNS_Ttl=60
|
||||
" >> /tmp/vcenter-update-ssl.sh
|
||||
|
||||
if ssh -q root@${NM_VC_HOSTNAME} [ ! -d ${NM_VC_ACMEFOLDER} ]; then
|
||||
echo -e "${idsCL[Yellow]}Installing acme.sh scripts on vCenter${idsCL[Default]}\n"
|
||||
ssh -q root@${NM_VC_HOSTNAME} "wget -O - https://get.acme.sh | sh"
|
||||
echo -e "\n${idsCL[LightGreen]}Requesting new certificate ...${idsCL[Default]}\n"
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --server letsencrypt -k 2048 --preferred-chain 'ISRG Root X1' --issue --dns dns_pdns -d ${NM_VC_HOSTNAME}" >> /tmp/vcenter-update-ssl.sh
|
||||
else
|
||||
echo -e "${idsCL[Green]}Verified acme.sh scripts are installed on vCenter, checking for updates${idsCL[Default]}\n"
|
||||
ssh -q root@${NM_VC_HOSTNAME} "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --upgrade"
|
||||
echo -e "\n${idsCL[LightGreen]}Renewing certificate ...${idsCL[Default]}\n"
|
||||
if [ "${1}" == "force" ]; then
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --renew-all --force" >> /tmp/vcenter-update-ssl.sh
|
||||
else
|
||||
echo "${NM_VC_ACMEFOLDER}/${NM_VC_ACMESCRIPT} --renew-all" >> /tmp/vcenter-update-ssl.sh
|
||||
fi
|
||||
fi
|
||||
|
||||
scp -q /tmp/vcenter-update-ssl.sh root@${NM_VC_HOSTNAME}:/tmp/vcenter-update-ssl.sh
|
||||
ssh -q root@${NM_VC_HOSTNAME} "bash /tmp/vcenter-update-ssl.sh"
|
||||
|
||||
LIVEMD5=$(ssh -q root@${NM_VC_HOSTNAME} "md5sum /etc/vmware-rhttpproxy/ssl/rui.crt | cut -d\ -f1")
|
||||
CURRENTMD5=$(ssh -q root@${NM_VC_HOSTNAME} "md5sum ${VC_CERT} | cut -d\ -f1")
|
||||
if [ "$LIVEMD5" == "$CURRENTMD5" ] && [ "${1}" != "force" ]; then
|
||||
echo -e "${idsCL[Yellow]}Certificates remains the same, no newer certificates exist${idsCL[Default]}"
|
||||
echo
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo -e "${idsCL[LightGreen]}Updating certificates on vCenter... ${idsCL[Default]}"
|
||||
echo -e "${idsCL[LightCyan]}This process make take up to 10mins${idsCL[Default]}"
|
||||
echo
|
||||
|
||||
ssh -q root@${NM_VC_HOSTNAME} "(printf '1\n%s\n' '${NM_VC_USER}'; sleep 1; printf '%s\n' '${NM_VC_PASS}'; sleep 1; printf '2\n'; sleep 1; printf '%s\n%s\n%s\ny\n\n' '${VC_CERT}' '${VC_KEY}' '${VC_CHAIN}') | setsid /usr/lib/vmware-vmca/bin/certificate-manager"
|
||||
|
||||
SENDNOTICE "vCenter SSL Updated" "Refresh/rescan any systems connecting to vcenter like Veeam"
|
||||
|
||||
ssh -q root@${NM_VC_HOSTNAME} "rm -f /tmp/vcenter-update-ssl.sh"
|
||||
rm -f /tmp/vcenter-update-ssl.sh
|
||||
|
||||
echo -e "\n${idsCL[Green]}The vCenter certifcate has been updated${idsCL[Default]}"
|
||||
echo -e "${idsCL[LightCyan]}Don't forget to re-scan the vCenter connection in Veeam${idsCL[Default]}\n"
|
||||
else
|
||||
echo -e "${idsCL[Yellow]}vCenter info not configured in 'defaults.local.inc'${idsCL[Default]}\n"
|
||||
fi
|
||||
}
|
||||
ADD_LOGROTATE_CRONTAB(){
|
||||
if ! crontab -l | grep -q "${NM_FOLDER}/tmp-logrotate"; then
|
||||
(crontab -l ; echo "0 */1 * * * logrotate -f ${NM_FOLDER}/tmp-logrotate") >/dev/null 2>&1 | crontab -
|
||||
|
||||
Reference in New Issue
Block a user