Merge d53f1766cab77f7d7e0a1941e89746fd7ea439b3 into 40b6db6a2715628aa977ed1853fe5256704010ae

deploy/ssh_cpanel.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env sh
+
+# Script to deploy certificates to remote cPanel server by SSH
+# This is a rough mashup of deploy/ssh.sh and deploy/cpanel_uapi.sh
+# Note that SSH must be able to login to remote host without a password...
+# SSH Keys must have been exchanged with the remote host.  Validate and
+# test that you can login to USER@SERVER from the host running acme.sh before
+# using this script.
+#
+# The following variables exported from environment will be used.
+# If not set then values previously saved in domain.conf file are used.
+#
+# Only a username is required.  All others are optional.
+#
+# export DEPLOY_SSH_CPANEL_USER="admin"                # required
+# export DEPLOY_SSH_CPANEL_CMD="ssh -i /path/to/key"   # defaults to ssh
+# export DEPLOY_SSH_CPANEL_SERVER="server.example.com" # defaults to domain name
+# export DEPLOY_SSH_CPANEL_UAPIUSER="cPanelUserName"   # defaults to DEPLOY_SSH_CPANEL_USER
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+ssh_cpanel_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+  _cmdstr=""
+
+  if [ -f "$DOMAIN_CONF" ]; then
+    # shellcheck disable=SC1090
+    . "$DOMAIN_CONF"
+  fi
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  # USER is required to login by SSH to remote host.
+  if [ -z "$DEPLOY_SSH_CPANEL_USER" ]; then
+    if [ -z "$Le_Deploy_ssh_cpanel_user" ]; then
+      _err "DEPLOY_SSH_CPANEL_USER not defined."
+      return 1
+    fi
+  else
+    Le_Deploy_ssh_cpanel_user="$DEPLOY_SSH_CPANEL_USER"
+    _savedomainconf Le_Deploy_ssh_cpanel_user "$Le_Deploy_ssh_cpanel_user"
+  fi
+
+  # UAPIUSER is optional. If not provided then use DEPLOY_SSH_CPANEL_USER
+  if [ -z "$DEPLOY_SSH_CPANEL_UAPIUSER" ]; then
+    if [ -z "$Le_Deploy_ssh_cpanel_uapiuser" ]; then
+      Le_Deploy_ssh_cpanel_uapiuser="$Le_Deploy_ssh_cpanel_user"
+    fi
+  else
+    Le_Deploy_ssh_cpanel_uapiuser="$DEPLOY_SSH_CPANEL_UAPIUSER"
+    _savedomainconf Le_Deploy_ssh_cpanel_uapiuser "$Le_Deploy_ssh_cpanel_uapiuser"
+  fi
+
+  # SERVER is optional. If not provided then use _cdomain
+  if [ -n "$DEPLOY_SSH_CPANEL_SERVER" ]; then
+    Le_Deploy_ssh_cpanel_server="$DEPLOY_SSH_CPANEL_SERVER"
+    _savedomainconf Le_Deploy_ssh_cpanel_server "$Le_Deploy_ssh_cpanel_server"
+  elif [ -z "$Le_Deploy_ssh_cpanel_server" ]; then
+    Le_Deploy_ssh_cpanel_server="$_cdomain"
+  fi
+
+  # CMD is optional. If not provided then use ssh
+  if [ -n "$DEPLOY_SSH_CPANEL_CMD" ]; then
+    Le_Deploy_ssh_cpanel_cmd="$DEPLOY_SSH_CPANEL_CMD"
+    _savedomainconf Le_Deploy_ssh_cpanel_cmd "$Le_Deploy_ssh_cpanel_cmd"
+  elif [ -z "$Le_Deploy_ssh_cpanel_cmd" ]; then
+    Le_Deploy_ssh_cpanel_cmd="ssh"
+  fi
+
+  _info "Deploy certificates to remote server $Le_Deploy_ssh_cpanel_user@$Le_Deploy_ssh_cpanel_server"
+
+  # read cert and key files and urlencode both
+  _info "URL Encode Certificate..."
+  _cert=$(_url_encode <"$_ccert")
+
+  _info "URL Encode Key..."
+  _key=$(_url_encode <"$_ckey")
+
+  _secure_debug _cert "$_cert"
+  _secure_debug _key "$_key"
+
+  if [ "$Le_Deploy_ssh_cpanel_uapiuser" = "$Le_Deploy_ssh_cpanel_user" ]; then
+    _cmdstr="uapi SSL install_ssl domain=\"$_cdomain\" cert=\"$_cert\" key=\"$_key\""
+  else
+    _cmdstr="uapi --user=\"$Le_Deploy_ssh_cpanel_uapiuser\" SSL install_ssl domain=\"$_cdomain\" cert=\"$_cert\" key=\"$_key\""
+  fi
+
+  _secure_debug "Remote commands to execute: " "$_cmdstr"
+  _info "Submitting sequence of commands to remote server by ssh"
+  # quotations in bash cmd below intended.  Squash travis spellcheck error
+  # shellcheck disable=SC2029
+  $Le_Deploy_ssh_cpanel_cmd -T "$Le_Deploy_ssh_cpanel_user@$Le_Deploy_ssh_cpanel_server" sh -c "'$_cmdstr'"
+  _ret="$?"
+
+  if [ "$_ret" != "0" ]; then
+    _err "Error code $_ret returned from $Le_Deploy_ssh_cpanel_cmd"
+  fi
+
+  _error_response="status: 0"
+  if test "${_ret#*$_error_response}" != "$_ret"; then
+    _err "Error in deploying certificate:"
+    _err "$_ret"
+    return 1
+  fi
+
+  _debug ret "$_ret"
+  _info "Certificate successfully deployed"
+  return 0
+}