test-certbot (2351B)
1 #!/bin/bash 2 set -euo pipefail 3 4 # Minimal Certbot substitute for the disposable Podman test container. It 5 # supports only the two invocations made by roles/cert and must never be used 6 # on a real deployment. 7 8 certbot_command="" 9 cert_name="" 10 domains=() 11 12 while (( $# > 0 )); do 13 case "$1" in 14 certificates | certonly) 15 certbot_command="$1" 16 shift 17 ;; 18 --cert-name) 19 cert_name="${2:?missing certificate name}" 20 shift 2 21 ;; 22 -d | --domains) 23 domains+=("${2:?missing domain name}") 24 shift 2 25 ;; 26 --email) 27 shift 2 28 ;; 29 *) 30 shift 31 ;; 32 esac 33 done 34 35 if [[ -z "$certbot_command" || -z "$cert_name" ]]; then 36 echo "test-certbot: unsupported invocation" >&2 37 exit 2 38 fi 39 40 if [[ ! "$cert_name" =~ ^[A-Za-z0-9._-]+$ ]]; then 41 echo "test-certbot: invalid certificate name" >&2 42 exit 2 43 fi 44 45 state_dir=/var/lib/test-certbot 46 state_file="$state_dir/$cert_name.domains" 47 certificate_dir="/etc/letsencrypt/live/$cert_name" 48 49 case "$certbot_command" in 50 certificates) 51 if [[ -f "$state_file" ]]; then 52 printf ' Certificate Name: %s\n' "$cert_name" 53 printf ' Domains: %s\n' "$(<"$state_file")" 54 fi 55 ;; 56 certonly) 57 if (( ${#domains[@]} == 0 )); then 58 echo "test-certbot: certonly requires at least one domain" >&2 59 exit 2 60 fi 61 62 requested_domains="${domains[*]}" 63 current_domains="" 64 if [[ -f "$state_file" ]]; then 65 current_domains="$(<"$state_file")" 66 fi 67 68 if [[ "$current_domains" == "$requested_domains" && -f "$certificate_dir/fullchain.pem" ]]; then 69 echo "Certificate not yet due for renewal." 70 exit 0 71 fi 72 73 install -d -m 0755 "$state_dir" "$certificate_dir" 74 subject_alt_name="" 75 for domain in "${domains[@]}"; do 76 subject_alt_name+="${subject_alt_name:+,}DNS:$domain" 77 done 78 79 openssl req \ 80 -x509 \ 81 -newkey rsa:2048 \ 82 -nodes \ 83 -keyout "$certificate_dir/privkey.pem" \ 84 -out "$certificate_dir/fullchain.pem" \ 85 -subj "/CN=${domains[0]}" \ 86 -addext "subjectAltName=$subject_alt_name" \ 87 -days 2 \ 88 >/dev/null 2>&1 89 cp "$certificate_dir/fullchain.pem" "$certificate_dir/chain.pem" 90 chmod 0600 "$certificate_dir/privkey.pem" 91 printf '%s\n' "$requested_domains" > "$state_file" 92 echo "Successfully received test certificate." 93 ;; 94 esac