mirror of
https://github.com/dokku/dokku.git
synced 2026-09-03 12:50:27 +02:00
104 lines
3.7 KiB
Bash
Executable File
104 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
|
|
source "$(dirname $0)/../common/functions"
|
|
source "$(dirname $0)/functions"
|
|
|
|
case "$1" in
|
|
certs:generate)
|
|
[[ -z $2 ]] && echo "Please specify an app to run the command on" && exit 1
|
|
verify_app_name "$2"
|
|
APP="$2"; DOMAIN="$3"; SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
|
|
if [[ ! -f "$SSL_PATH/server.key" ]] && [[ ! -f "$SSL_PATH/server.crt" ]]; then
|
|
TMP_WORK_DIR=$(mktemp -d -t "dokku_certs.XXXXXXXXX")
|
|
trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' INT TERM EXIT
|
|
|
|
pushd $TMP_WORK_DIR > /dev/null
|
|
|
|
openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
|
|
openssl rsa -passin pass:x -in server.pass.key -out server.key
|
|
openssl req -new -key server.key -out server.csr
|
|
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
|
|
|
|
mkdir -p "$DOKKU_ROOT/$APP/tls"
|
|
mv -f $TMP_WORK_DIR/server.key $TMP_WORK_DIR/server.crt $SSL_PATH
|
|
[[ -n "$DOMAIN" ]] && dokku domains:add $APP $DOMAIN || true
|
|
dokku_log_info1 "The following is a certificate signing request that can be used"
|
|
dokku_log_info1 "to generate an 'officially' signed SSL certificate for $APP at $DOMAIN"
|
|
dokku_log_info1 "by a CA of your choosing."
|
|
cat server.csr
|
|
else
|
|
dokku_log_info1 "$APP has an SSL endpoint already defined"
|
|
fi
|
|
;;
|
|
|
|
certs:info)
|
|
[[ -z $2 ]] && echo "Please specify an app to run the command on" && exit 1
|
|
verify_app_name "$2"
|
|
APP="$2"; SSL_TYPE=$(is_ssl_enabled $APP)
|
|
case "$SSL_TYPE" in
|
|
app)
|
|
SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
;;
|
|
|
|
global)
|
|
SSL_PATH="$DOKKU_ROOT/tls"
|
|
;;
|
|
|
|
*)
|
|
;;
|
|
esac
|
|
|
|
if [[ -n "$SSL_PATH" ]]; then
|
|
dokku_log_info1 "Fetching SSL Endpoint info for $APP..."
|
|
dokku_log_info1 "Certificate details:"
|
|
dokku_log_info2 "Common Name(s): "
|
|
|
|
for domain in $(get_ssl_hostnames $APP | xargs); do
|
|
dokku_log_info2 " $domain"
|
|
done
|
|
|
|
dokku_log_info2 "Expires At: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }')"
|
|
dokku_log_info2 "Issuer: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Issuer:" | xargs | sed -e "s/Issuer: //g")"
|
|
dokku_log_info2 "Starts At: $(openssl x509 -in $SSL_PATH/server.crt -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }')"
|
|
dokku_log_info2 "Subject: $(openssl x509 -in $SSL_PATH/server.crt -noout -subject | sed -e "s:subject= ::g"| sed -e "s:^/::g" | sed -e "s:/:; :g")"
|
|
SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver $SSL_PATH/server.crt | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)"
|
|
if [[ "$SSL_VERIFY_OUTPUT" == "OK" ]]; then
|
|
SSL_SELF_SIGNED="verified by a certificate authority."
|
|
else
|
|
SSL_SELF_SIGNED="self signed."
|
|
fi
|
|
dokku_log_info2 "SSL certificate is $SSL_SELF_SIGNED"
|
|
else
|
|
dokku_log_info1 "$APP does not have an SSL endpoint"
|
|
fi
|
|
;;
|
|
|
|
certs:remove)
|
|
[[ -z $2 ]] && echo "Please specify an app to run the command on" && exit 1
|
|
verify_app_name "$2"
|
|
APP="$2"; APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
|
|
if [[ -d "$APP_SSL_PATH" ]]; then
|
|
dokku_log_info1 "Removing SSL endpoint from $APP"
|
|
rm -rf $APP_SSL_PATH
|
|
pluginhook post-domains-update $APP
|
|
else
|
|
dokku_log_info1 "An app-specific SSL endpoint is not defined"
|
|
fi
|
|
;;
|
|
|
|
help | certs:help)
|
|
cat && cat<<EOF
|
|
certs:generate <app> DOMAIN, Generate a key and certificate signing request (and self-signed certificate)
|
|
certs:info <app>, Show certificate information for an ssl endpoint.
|
|
certs:remove <app>, Remove an SSL Endpoint from an app.
|
|
EOF
|
|
;;
|
|
|
|
*)
|
|
exit $DOKKU_NOT_IMPLEMENTED_EXIT
|
|
;;
|
|
|
|
esac
|