diff --git a/deploy/routeros.sh b/deploy/routeros.sh index 2f349999..2dd95af3 100644 --- a/deploy/routeros.sh +++ b/deploy/routeros.sh @@ -18,7 +18,8 @@ # the files on the router. # # Then you need to set the environment variables for the -# deploy script to work. +# deploy script to work. It will store those in the domainconf. +# So there is no need to set them every time. # # ```sh # export ROUTER_OS_USERNAME=certuser @@ -38,13 +39,25 @@ # # At the end of the script, the services that use those certificates # could be updated. Currently only the www-ssl service is beeing -# updated, but more services could be added. +# updated. You can prevent this by setting the following enviroment +# variable: `export ROUTER_OS_WEB_SERVICE="no"`. + +# You can add more services where the certificate should be set by +# adding the neccesary command to the ROUTER_OS_ADDITIONAL_SERVICES +# env var. # -# For instance: +# To change the certificate of the api-ssl service the following +# commad would be helpfull: # ```sh # export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0" # ``` # +# Or to set the ssl-certificate for a hotspot profile the following command +# is useful: +# ```sh +# /ip hotspot profile set [find dns-name=hs.example.com] ssl-certificate=hs.example.com.cer_0 +# ``` +# # One optional thing to do as well is to create a script that updates # all the required services and run that script in a single command. # @@ -66,25 +79,73 @@ routeros_deploy() { _debug _cca "$_cca" _debug _cfullchain "$_cfullchain" - if [ -z "$ROUTER_OS_HOST" ]; then - _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct." - ROUTER_OS_HOST="$_cdomain" - fi - + # ROUTER_OS_USERNAME is required to login to remote host. if [ -z "$ROUTER_OS_USERNAME" ]; then - _err "Need to set the env variable ROUTER_OS_USERNAME" - return 1 + if [ -z "$Le_router_os_username" ]; then + _err "Need to set the env variable ROUTER_OS_USERNAME" + return 1 + fi + else + _info "saving ROUTER_OS_USERNAME in the domainconf" + Le_router_os_username="$ROUTER_OS_USERNAME" + _savedomainconf Le_router_os_username "$Le_router_os_username" fi - if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then - _debug "Not enabling additional services" - ROUTER_OS_ADDITIONAL_SERVICES="" + # ROUTER_OS_HOST is optional. If not provided then use _cdomain + if [ -n "$ROUTER_OS_HOST" ]; then + _info "saving ROUTER_OS_HOST in the domainconf" + Le_router_os_host="$ROUTER_OS_HOST" + _savedomainconf Le_router_os_host "$Le_router_os_host" + elif [ -z "$Le_router_os_host" ]; then + _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct." + Le_router_os_host="$_cdomain" + fi + + # ROUTER_OS_ADDITIONAL_SERVICES is optional. + if [ -n "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then + _info "saving ROUTER_OS_ADDITIONAL_SERVICES in the domainconf" + Le_router_os_additional_services="$ROUTER_OS_ADDITIONAL_SERVICES" + _savedomainconf Le_router_os_additional_services "$Le_router_os_additional_services" + elif [ -z "$Le_router_os_additional_services" ]; then + _info "saving ROUTER_OS_ADDITIONAL_SERVICES in the domainconf" + Le_router_os_additional_services="" + _savedomainconf Le_router_os_additional_services "$Le_router_os_additional_services" + fi + + # ROUTER_OS_WEB_SERVICE is optional. Default is yes + if [ "$ROUTER_OS_WEB_SERVICE" = "no" ]; then + _debug "don't set the certificate for www-ssl service, saving this in the domainconf." + Le_router_os_web_service="no" + _savedomainconf Le_router_os_web_service "$Le_router_os_web_service" + elif [ "$ROUTER_OS_WEB_SERVICE" = "yes" ] || [ -z "$Le_router_os_web_service" ]; then + _debug "setting the certificate for www-ssl service, saving this in the domainconf." + Le_router_os_web_service="yes" + _savedomainconf Le_router_os_web_service "$Le_router_os_web_service" + fi + + router_os_services="" + + if [ "$Le_router_os_web_service" = "yes" ]; then + router_os_services="$router_os_services\n/ip service set www-ssl certificate=$_cdomain.cer_0;" + fi + + if [ ! -z "$Le_router_os_additional_services" ]; then + router_os_services="$router_os_services\n$Le_router_os_additional_services" fi _info "Trying to push key '$_ckey' to router" - scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key" + scp "$_ckey" "$Le_router_os_username@$Le_router_os_host:$_cdomain.key" + if [ $? -ne 0 ]; then + _err "pushing key '$_ckey' wasn't successull. Stopping here" + return 1 + fi + _info "Trying to push cert '$_cfullchain' to router" - scp "$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer" + scp "$_cfullchain" "$Le_router_os_username@$Le_router_os_host:$_cdomain.cer" + if [ $? -ne 0 ]; then + _err "pushing key '$_ckey' wasn't successull. Stopping here" + return 1 + fi DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive \ source=\"## generated by routeros deploy script in acme.sh;\ \n/certificate remove [ find name=$_cdomain.cer_0 ];\ @@ -97,15 +158,16 @@ source=\"## generated by routeros deploy script in acme.sh;\ \n/file remove $_cdomain.key;\ \ndelay 2;\ \n/ip service set www-ssl certificate=$_cdomain.cer_0;\ -\n$ROUTER_OS_ADDITIONAL_SERVICES;\ +\n$router_os_services\ \n\" " + # shellcheck disable=SC2029 - ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "$DEPLOY_SCRIPT_CMD" + ssh "$Le_router_os_username@$Le_router_os_host" "$DEPLOY_SCRIPT_CMD" # shellcheck disable=SC2029 - ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script run \"LE Cert Deploy - $_cdomain\"" + ssh "$Le_router_os_username@$Le_router_os_host" "/system script run \"LE Cert Deploy - $_cdomain\"" # shellcheck disable=SC2029 - ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script remove \"LE Cert Deploy - $_cdomain\"" + ssh "$Le_router_os_username@$Le_router_os_host" "/system script remove \"LE Cert Deploy - $_cdomain\"" return 0 }