159 lines
5.8 KiB
PowerShell
159 lines
5.8 KiB
PowerShell
#!/usr/bin/env pwsh
|
|
# -----------------------------------------------------------------------------------
|
|
# vCenter + Posh-ACME Script using PowerCLI (TLS-safe, ACME fixed)
|
|
# -----------------------------------------------------------------------------------
|
|
|
|
. /opt/idssys/nodemgmt/conf/powerwall/settings.ps1
|
|
|
|
# ----------------------------
|
|
# Global variables for troubleshooting
|
|
# ----------------------------
|
|
$global:helpme = $null
|
|
$global:responseBody = $null
|
|
|
|
# ----------------------------
|
|
# Error handler
|
|
# ----------------------------
|
|
function Show-Failure {
|
|
param([System.Management.Automation.ErrorRecord]$ErrorRecord)
|
|
|
|
$global:responseBody = $ErrorRecord.Exception.Message
|
|
$global:helpme = $global:responseBody
|
|
|
|
Write-Host "----------------------------------------" -ForegroundColor Red
|
|
Write-Host "Status: A system exception was caught." -ForegroundColor Red
|
|
Write-Host $global:responseBody -ForegroundColor Red
|
|
Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red
|
|
Write-Host "----------------------------------------" -ForegroundColor Red
|
|
|
|
exit 1
|
|
}
|
|
|
|
# ----------------------------
|
|
# Ensure PowerCLI module
|
|
# ----------------------------
|
|
if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) {
|
|
Install-Module -Name VMware.PowerCLI -Force -Scope AllUsers
|
|
}
|
|
Import-Module VMware.PowerCLI -ErrorAction Stop
|
|
|
|
# ----------------------------
|
|
# Ignore self-signed cert warnings
|
|
# ----------------------------
|
|
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null
|
|
|
|
# ----------------------------
|
|
# Connect to vCenter
|
|
# ----------------------------
|
|
try {
|
|
Write-Host "Connecting to vCenter at $VCENTERHOST ..." -ForegroundColor Cyan
|
|
$vCenterConn = Connect-VIServer -Server $VCENTERHOST -User $VCENTERUSER -Password $VCENTERPASS -Force
|
|
Write-Host "Connected to vCenter API. Session established." -ForegroundColor Green
|
|
} catch {
|
|
Show-Failure -ErrorRecord $_
|
|
}
|
|
|
|
# ----------------------------
|
|
# Retrieve VM list (optional)
|
|
# ----------------------------
|
|
try {
|
|
$vms = Get-VM
|
|
Write-Host "Retrieved VM list:" -ForegroundColor Cyan
|
|
$vms | ForEach-Object { Write-Host " - $($_.Name)" }
|
|
} catch {
|
|
Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow
|
|
}
|
|
|
|
# ----------------------------
|
|
# Ensure Posh-ACME module
|
|
# ----------------------------
|
|
if (-not (Get-Module -ListAvailable -Name Posh-ACME)) {
|
|
Install-Module -Name Posh-ACME -Force -Scope AllUsers
|
|
}
|
|
Import-Module Posh-ACME -ErrorAction Stop
|
|
|
|
# ----------------------------
|
|
# ACME / PowerDNS certificate request
|
|
# ----------------------------
|
|
$pArgs = @{
|
|
PowerDNSApiHost = $WDNSHOST
|
|
PowerDNSApiKey = $PDNSAPI # Plain string, do NOT convert to SecureString
|
|
PowerDNSUseTLS = $true
|
|
PowerDNSPort = 443
|
|
PowerDNSServerName = 'localhost'
|
|
}
|
|
|
|
$certName = "vcenter-cert"
|
|
$certSuccess = $false
|
|
try {
|
|
Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan
|
|
New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force
|
|
$certSuccess = $true
|
|
} catch {
|
|
Write-Host "ACME certificate request failed: $($_.Exception.Message)" -ForegroundColor Yellow
|
|
$global:helpme = $_.Exception.Message
|
|
}
|
|
|
|
# ----------------------------
|
|
# Collect certificate paths
|
|
# ----------------------------
|
|
if ($certSuccess) {
|
|
$paAccount = Get-PAAccount
|
|
$certFolder = $paAccount.CertFolder
|
|
$certPath = Join-Path $certFolder "$certName\cert.pem"
|
|
$keyPath = Join-Path $certFolder "$certName\privkey.pem"
|
|
$chainPath = Join-Path $certFolder "$certName\chain.pem"
|
|
|
|
foreach ($f in @($certPath, $keyPath, $chainPath)) {
|
|
if (-not (Test-Path $f)) {
|
|
Write-Host "Certificate file missing: $f" -ForegroundColor Yellow
|
|
$certSuccess = $false
|
|
}
|
|
}
|
|
}
|
|
|
|
# ----------------------------
|
|
# Upload and apply certificate via REST (PowerCLI session)
|
|
# ----------------------------
|
|
if ($certSuccess) {
|
|
try {
|
|
$sessionHeaders = @{
|
|
'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId
|
|
}
|
|
|
|
$body = @{
|
|
cert = Get-Content -Path $certPath -Raw
|
|
key = Get-Content -Path $keyPath -Raw
|
|
chain = Get-Content -Path $chainPath -Raw
|
|
}
|
|
|
|
$uriUpload = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls"
|
|
Invoke-RestMethod -Uri $uriUpload -Method Post -Body ($body | ConvertTo-Json -Compress) -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck
|
|
|
|
$uriApply = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls?action=apply"
|
|
Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck
|
|
|
|
Write-Host "TLS certificate uploaded and applied successfully." -ForegroundColor Green
|
|
} catch {
|
|
Write-Host "Certificate upload/apply failed: $($_.Exception.Message)" -ForegroundColor Yellow
|
|
$global:helpme = $_.Exception.Message
|
|
}
|
|
} else {
|
|
Write-Host "Skipping certificate upload/apply due to previous errors." -ForegroundColor Yellow
|
|
}
|
|
|
|
# ----------------------------
|
|
# Restart vpxd service via PowerCLI (safe)
|
|
# ----------------------------
|
|
try {
|
|
Write-Host "Restarting vpxd service..." -ForegroundColor Yellow
|
|
$service = Get-VMHostService -VMHost $VCENTERHOST | Where-Object { $_.Key -eq "vpxd" }
|
|
if ($service) { Restart-VMHostService -HostService $service -Confirm:$false }
|
|
Write-Host "vpxd service restart requested." -ForegroundColor Yellow
|
|
} catch {
|
|
Write-Host "Failed to restart vpxd service: $($_.Exception.Message)" -ForegroundColor Yellow
|
|
$global:helpme = $_.Exception.Message
|
|
}
|
|
|
|
Write-Host "Script completed. Check `$global:helpme for any error details." -ForegroundColor Green
|