certs-daemon 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960
  1. #!/usr/bin/env bash
  2. if [ `id -gn` != "root" ]; then
  3. echo "Run as root!"
  4. exit 1
  5. fi
  6. source "${SNAP}/init"
  7. DOMAIN=`snapctl get domain`
  8. echo "See log (journal -exf --grep=snap.${SNAP_NAME}*) for result"
  9. if [ "${DOMAIN}" != "--not-set" ]; then
  10. snapctl is-connected certs
  11. if [ $? -ne 0 ]; then
  12. snapctl set domain="--not-set"
  13. exit 0
  14. fi
  15. readarray -d '' DOMAINS < <(find "${CERTS_DIR}" -type d -name "${DOMAIN}" -print0)
  16. if [ "${#DOMAINS[@]}" -ne 0 ]; then
  17. DOMAIN_DIR="${DOMAINS[0]}"
  18. LAST_EDITED=`stat "${DOMAIN_DIR}/.time" --format="%Y" 2> /dev/null || echo 0`
  19. ORIG_EDITED=`stat "${SSL_DIR}/.time" --format="%Y" 2> /dev/null || echo 0`
  20. if [ "${LAST_EDITED}" -le "${ORIG_EDITED}" ]; then
  21. logger "${SNAP_NAME}: Certificate for ${DOMAIN} is not changed"
  22. exit 0
  23. fi
  24. gpg_start_agent
  25. i=0
  26. readarray -d '' CERTIFICATES < <(find "${DOMAIN_DIR}" -type f -name "*.gpg" -print0)
  27. for CERTIFICATE in "${CERTIFICATES[@]}"; do
  28. DEST="${SSL_DIR}/`basename "${CERTIFICATE}" ".gpg"`"
  29. ORIG=""
  30. if [ -f "${DEST}" ]; then
  31. ORIG="`cat "${DEST}"`"
  32. fi
  33. gpg --batch --yes --output "${DEST}" --decrypt "${CERTIFICATE}"
  34. DIFF=`echo "${ORIG}" | diff "${DEST}" -`
  35. RET=$?
  36. if [ "${RET}" -ne 0 ]; then
  37. echo "${ORIG}" > "${DEST}.backup"
  38. (( i = $i + 1 ))
  39. fi
  40. done
  41. if [ "${i}" -ne 0 ]; then
  42. cp -f "${DOMAIN_DIR}/.time" "${SSL_DIR}/.time"
  43. logger "${SNAP_NAME}: Certificates (${DOMAIN}) changed for ${SNAP_NAME}-${UUID}, restart"
  44. snapctl restart "${SNAP_NAME}.hass"
  45. fi
  46. gpg_close_agent
  47. else
  48. logger "No certificate for ${DOMAIN} for ${SNAP_NAME}"
  49. fi
  50. fi