update

defaults.inc

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-VERS='5.6.28-11082025'
+VERS='5.6.50-11152025'
 NM_BETA=false
 
 

inc/vCenter-SSL.ps1

@@ -1,43 +1,32 @@
 #!/usr/bin/env pwsh
 # -----------------------------------------------------------------------------------
-# vCenter + Posh-ACME Script (Fully Automated with Verbose Logging)
+# vCenter + Posh-ACME Script (Fully Automated, Idempotent, Verbose Logging)
 # -----------------------------------------------------------------------------------
 
 . /opt/idssys/nodemgmt/conf/powerwall/settings.ps1
 
-# ----------------------------
-# Global variables for troubleshooting
-# ----------------------------
 $global:helpme = $null
 $global:responseBody = $null
 
-# ----------------------------
-# Error handler
-# ----------------------------
 function Show-Failure {
     param([System.Management.Automation.ErrorRecord]$ErrorRecord)
-
     $global:responseBody = $ErrorRecord.Exception.Message
     $global:helpme = $global:responseBody
-
     Write-Host "----------------------------------------" -ForegroundColor Red
     Write-Host "Status: A system exception was caught." -ForegroundColor Red
     Write-Host $global:responseBody -ForegroundColor Red
     Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red
     Write-Host "----------------------------------------" -ForegroundColor Red
-
     exit 1
 }
 
 # ----------------------------
-# Ensure PowerCLI module
+# PowerCLI
 # ----------------------------
 if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) {
     Install-Module -Name VMware.PowerCLI -Force -Scope AllUsers
 }
 Import-Module VMware.PowerCLI -ErrorAction Stop
-
-# Ignore self-signed cert warnings
 Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null
 
 # ----------------------------
@@ -58,12 +47,10 @@ try {
     $vms = Get-VM
     Write-Host "Retrieved VM list:" -ForegroundColor Cyan
     $vms | ForEach-Object { Write-Host " - $($_.Name)" }
-} catch {
+} catch { Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow }
-    Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow
-}
 
 # ----------------------------
-# Ensure Posh-ACME module
+# Posh-ACME
 # ----------------------------
 if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
     Install-Module -Name Posh-ACME -Force -Scope AllUsers
@@ -71,47 +58,48 @@ if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
 Import-Module Posh-ACME -ErrorAction Stop
 
 # ----------------------------
-# ACME / PowerDNS certificate request
+# Determine if ACME request is needed
 # ----------------------------
-# Convert API key to SecureString for PowerDNS plugin
-if ($PDNSAPI -is [string]) {
-    $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force
-} else {
-    $securePDNSAPI = $PDNSAPI
-}
-
-$pArgs = @{
-    PowerDNSApiHost    = $WDNSHOST
-    PowerDNSApiKey     = $securePDNSAPI
-    PowerDNSUseTLS     = $true
-    PowerDNSPort       = 443
-    PowerDNSServerName = 'localhost'
-}
-
-$certName = "vcenter-cert"
 $certSuccess = $false
+$existingCert = Get-PAOrder -Domain $VCENTERHOST -ErrorAction SilentlyContinue | Sort-Object Created -Descending | Select-Object -First 1
 
-try {
+if ($existingCert -and ($existingCert.Cert.NotAfter -gt (Get-Date).AddDays(30))) {
-    Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
+    Write-Host "Existing certificate valid >30 days (expires $($existingCert.Cert.NotAfter)), skipping ACME request." -ForegroundColor Green
-    New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15
+    $certFolder = $existingCert.CertFolder
-    $certSuccess = $true
-} catch {
-    Write-Host "ACME certificate request failed: $($_.Exception.Message)" -ForegroundColor Yellow
-    $global:helpme = $_.Exception.Message
-}
-
-# ----------------------------
-# Collect certificate paths dynamically
-# ----------------------------
-if ($certSuccess) {
-    # Get the most recent order
-    $paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1
-    $certFolder = $paOrder.CertFolder
-
     $certPath  = Join-Path $certFolder "cert.pem"
     $keyPath   = Join-Path $certFolder "privkey.pem"
     $chainPath = Join-Path $certFolder "chain.pem"
+    $certSuccess = $true
+} else {
+    if ($PDNSAPI -is [string]) { $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force } else { $securePDNSAPI = $PDNSAPI }
 
+    $pArgs = @{
+        PowerDNSApiHost    = $WDNSHOST
+        PowerDNSApiKey     = $securePDNSAPI
+        PowerDNSUseTLS     = $true
+        PowerDNSPort       = 443
+        PowerDNSServerName = 'localhost'
+    }
+
+    try {
+        Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
+        New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15
+        $paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1
+        $certFolder = $paOrder.CertFolder
+        $certPath  = Join-Path $certFolder "cert.pem"
+        $keyPath   = Join-Path $certFolder "privkey.pem"
+        $chainPath = Join-Path $certFolder "chain.pem"
+        $certSuccess = $true
+    } catch {
+        Write-Host "ACME request failed: $($_.Exception.Message)" -ForegroundColor Yellow
+        $global:helpme = $_.Exception.Message
+    }
+}
+
+# ----------------------------
+# Validate certificate files
+# ----------------------------
+if ($certSuccess) {
     foreach ($f in @($certPath, $keyPath, $chainPath)) {
         if (-not (Test-Path $f)) {
             Write-Host "Certificate file missing: $f" -ForegroundColor Yellow
@@ -121,48 +109,56 @@ if ($certSuccess) {
 }
 
 # ----------------------------
-# Upload and apply certificate via REST (with verbose logging)
+# Check if vCenter already has this cert
 # ----------------------------
+$updateNeeded = $true
 if ($certSuccess) {
     try {
-        $sessionHeaders = @{
+        $sessionHeaders = @{ 'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId }
-            'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId
+        $vcenterCertUri = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
-        }
+        $vCenterCert = Invoke-RestMethod -Uri $vcenterCertUri -Method Get -SkipCertificateCheck -Headers $sessionHeaders -ErrorAction Stop
 
+        $currentCertPem = $vCenterCert.certificate | Out-String
+        $newCertPem     = Get-Content -Path $certPath -Raw
+
+        if ($currentCertPem -eq $newCertPem) {
+            Write-Host "vCenter already has the latest certificate applied. Skipping upload/apply." -ForegroundColor Green
+            $updateNeeded = $false
+        }
+    } catch {
+        Write-Host "Unable to verify current vCenter certificate, will attempt update." -ForegroundColor Yellow
+    }
+}
+
+# ----------------------------
+# Upload & apply if needed
+# ----------------------------
+if ($certSuccess -and $updateNeeded) {
+    try {
         $body = @{
             cert  = Get-Content -Path $certPath -Raw
             key   = Get-Content -Path $keyPath -Raw
             chain = Get-Content -Path $chainPath -Raw
         }
 
-        $jsonBody = $body | ConvertTo-Json -Compress
-
-        $uriUpload = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
         Write-Host "Uploading TLS certificate to vCenter..." -ForegroundColor Cyan
-        Write-Host "URI: $uriUpload" -ForegroundColor DarkCyan
+        Invoke-RestMethod -Uri $vcenterCertUri -Method Post -Body ($body | ConvertTo-Json -Compress) -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck
-        Write-Host "Headers: $(ConvertTo-Json $sessionHeaders -Compress)" -ForegroundColor DarkCyan
+        Write-Host "Certificate uploaded successfully." -ForegroundColor Green
-        Write-Host "Body length: $($jsonBody.Length) characters" -ForegroundColor DarkCyan
-
-        $uploadResp = Invoke-RestMethod -Uri $uriUpload -Method Post -Body $jsonBody -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck -Verbose
-        Write-Host "Upload response: $(ConvertTo-Json $uploadResp -Compress)" -ForegroundColor Green
 
         $uriApply = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls?action=apply"
         Write-Host "Applying TLS certificate to vCenter..." -ForegroundColor Cyan
-        Write-Host "URI: $uriApply" -ForegroundColor DarkCyan
+        Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck
-        $applyResp = Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck -Verbose
+        Write-Host "Certificate applied successfully." -ForegroundColor Green
-        Write-Host "Apply response: $(ConvertTo-Json $applyResp -Compress)" -ForegroundColor Green
-
-        Write-Host "Certificate uploaded and applied successfully." -ForegroundColor Green
     } catch {
         Write-Host "Certificate upload/apply failed: $($_.Exception.Message)" -ForegroundColor Red
         $global:helpme = $_.Exception.Message
     }
-} else {
+} elseif ($certSuccess -and -not $updateNeeded) {
-    Write-Host "Skipping certificate upload/apply due to previous errors." -ForegroundColor Yellow
+    Write-Host "Certificate already current, no changes applied." -ForegroundColor Green
 }
 
 # ----------------------------
-# Automatic vpxd restart via REST with retries
+# Automatic vpxd restart via REST
 # ----------------------------
 $maxRetries = 20
 $retryCount = 0
@@ -170,19 +166,17 @@ $restartSucceeded = $false
 
 while ($retryCount -lt $maxRetries -and -not $restartSucceeded) {
     try {
-        # Test if REST endpoint is available
         $healthUri = "https://$VCENTERHOST/rest/appliance/health/system"
         Write-Host "Checking vCenter REST health endpoint..." -ForegroundColor Cyan
-        $resp = Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop
+        Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop
 
-        # Restart vpxd service
         $restartUri = "https://$VCENTERHOST/rest/appliance/system/services/vpxd?action=restart"
         Write-Host "Requesting vpxd service restart via REST..." -ForegroundColor Cyan
         Invoke-RestMethod -Uri $restartUri -Method Post -SkipCertificateCheck -ErrorAction Stop
         Write-Host "vpxd service restart requested successfully." -ForegroundColor Green
         $restartSucceeded = $true
     } catch {
-        Write-Host "vpxd REST endpoint not ready yet, retrying in 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow
+        Write-Host "vpxd REST endpoint not ready, retrying 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow
         Start-Sleep -Seconds 15
         $retryCount++
     }
@@ -194,8 +188,5 @@ if (-not $restartSucceeded) {
     Write-Host "ssh root@$VCENTERHOST 'service-control --stop vpxd; service-control --start vpxd'" -ForegroundColor Red
 }
 
-# ----------------------------
-# Completion message
-# ----------------------------
 Write-Host ""
 Write-Host "Script completed. Check `$global:helpme for any error details." -ForegroundColor Green