114 lines
4.9 KiB
Bash
Executable File
114 lines
4.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# sync-synology-certs.sh
|
|
# -----------------------
|
|
# Pulls the current Let's Encrypt certificate (fullchain + private key) for a
|
|
# given hostname FROM a Synology NAS and installs it into Traefik's tls/ dir,
|
|
# then triggers a Traefik hot-reload (via the file provider watch).
|
|
#
|
|
# WHY: fids/fids2 are Synology backends that obtain their own LE certs. We want
|
|
# Traefik to TERMINATE TLS with a VALID cert (so CrowdSec can still inspect the
|
|
# request) instead of its self-signed default. Rather than have Traefik fetch
|
|
# its own certs, we copy the ones the Synology already manages.
|
|
#
|
|
# RUN AS ROOT (writes under /srv/TRAEFIK, root-owned). Typically via cron.
|
|
#
|
|
# Prereqsuites (see README-cert-sync.md):
|
|
# * passwordless SSH key from this host -> each Synology
|
|
# * the SSH user may sudo-read /usr/syno/etc/certificate (NOPASSWD recommended)
|
|
#
|
|
set -euo pipefail
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# CONFIG ── one line per certificate to sync.
|
|
# Format: "name|ssh_user@host|ssh_port|domain_to_match"
|
|
# name : subdir under $TLS_DIR (and a label)
|
|
# domain : the cert whose SAN contains this DNS name is selected on the NAS
|
|
# ---------------------------------------------------------------------------
|
|
TARGETS=(
|
|
"fids|admin@192.168.0.245|22|fids.famfi.dyndns.org"
|
|
"fids2|admin@192.168.0.234|22|fids2.famfi.dyndns.org"
|
|
)
|
|
|
|
TLS_DIR="/srv/TRAEFIK/etc/traefik/tls/synology" # where certs land (host path)
|
|
TLS_DIR_IN_CONTAINER="/etc/traefik/tls/synology" # same dir as seen by Traefik
|
|
DYN_CONF="/srv/TRAEFIK/etc/traefik/traefik.d/tls-synology.yml" # generated, watched by Traefik
|
|
SSH_OPTS="-o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new"
|
|
|
|
log() { printf '%s [sync-certs] %s\n' "$(date '+%F %T')" "$*"; }
|
|
die() { log "ERROR: $*"; exit 1; }
|
|
|
|
changed=0
|
|
|
|
for entry in "${TARGETS[@]}"; do
|
|
IFS='|' read -r name dest port domain <<<"$entry"
|
|
log "=== $name ($domain via $dest:$port) ==="
|
|
|
|
# 1) Find, on the NAS, the _archive folder whose cert covers $domain, and
|
|
# stream fullchain + privkey back through one sudo'd SSH call (avoids
|
|
# scp-ing root-only files). Delimiters let us split locally.
|
|
remote_cmd='
|
|
set -e
|
|
for d in /usr/syno/etc/certificate/_archive/*/; do
|
|
[ -f "$d/cert.pem" ] || continue
|
|
if openssl x509 -in "$d/cert.pem" -noout -ext subjectAltName 2>/dev/null \
|
|
| grep -q "DNS:'"$domain"'"; then
|
|
echo "===FULLCHAIN==="; cat "$d/fullchain.pem"
|
|
echo "===PRIVKEY==="; cat "$d/privkey.pem"
|
|
exit 0
|
|
fi
|
|
done
|
|
echo "NO_CERT_FOUND_FOR_'"$domain"'" >&2; exit 3'
|
|
|
|
blob="$(ssh $SSH_OPTS -p "$port" "$dest" "sudo sh -c '$remote_cmd'")" \
|
|
|| die "SSH/cert fetch failed for $name (check key, sudo, domain)"
|
|
|
|
# 2) Split the blob into the two PEMs.
|
|
tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
|
|
printf '%s\n' "$blob" | awk '
|
|
/===FULLCHAIN===/ {dst="'"$tmp"'/fullchain.pem"; next}
|
|
/===PRIVKEY===/ {dst="'"$tmp"'/privkey.pem"; next}
|
|
dst {print > dst}'
|
|
[ -s "$tmp/fullchain.pem" ] && [ -s "$tmp/privkey.pem" ] || die "empty cert/key for $name"
|
|
|
|
# 3) Validate: cert/key modulus match + cert not expired.
|
|
cmod="$(openssl x509 -in "$tmp/fullchain.pem" -noout -modulus | openssl md5)"
|
|
kmod="$(openssl rsa -in "$tmp/privkey.pem" -noout -modulus | openssl md5)"
|
|
[ "$cmod" = "$kmod" ] || die "cert/key mismatch for $name"
|
|
openssl x509 -in "$tmp/fullchain.pem" -noout -checkend 0 >/dev/null \
|
|
|| die "fetched cert for $name is EXPIRED — refusing to install"
|
|
|
|
# 4) Install only if different from what's already there.
|
|
d_out="$TLS_DIR/$name"; mkdir -p "$d_out"
|
|
if ! cmp -s "$tmp/fullchain.pem" "$d_out/fullchain.pem" 2>/dev/null \
|
|
|| ! cmp -s "$tmp/privkey.pem" "$d_out/privkey.pem" 2>/dev/null; then
|
|
install -m 0644 "$tmp/fullchain.pem" "$d_out/fullchain.pem"
|
|
install -m 0600 "$tmp/privkey.pem" "$d_out/privkey.pem"
|
|
log "updated cert for $name ($(openssl x509 -in "$d_out/fullchain.pem" -noout -enddate))"
|
|
changed=1
|
|
else
|
|
log "cert for $name already up to date"
|
|
fi
|
|
rm -rf "$tmp"; trap - EXIT
|
|
done
|
|
|
|
# 5) (Re)generate the Traefik dynamic TLS config listing every cert we have.
|
|
# Writing this file (in the watched traefik.d dir) triggers a hot-reload.
|
|
{
|
|
echo "# AUTO-GENERATED by sync-synology-certs.sh — do not edit by hand."
|
|
echo "# Loads the Synology-managed certs so Traefik serves valid certs while"
|
|
echo "# still terminating TLS (CrowdSec stays in the request path)."
|
|
echo "tls:"
|
|
echo " certificates:"
|
|
for entry in "${TARGETS[@]}"; do
|
|
IFS='|' read -r name _ _ _ <<<"$entry"
|
|
if [ -s "$TLS_DIR/$name/fullchain.pem" ]; then
|
|
echo " - certFile: $TLS_DIR_IN_CONTAINER/$name/fullchain.pem"
|
|
echo " keyFile: $TLS_DIR_IN_CONTAINER/$name/privkey.pem"
|
|
fi
|
|
done
|
|
} > "$DYN_CONF"
|
|
log "wrote $DYN_CONF (Traefik will hot-reload)"
|
|
|
|
[ "$changed" -eq 1 ] && log "DONE (certs changed)" || log "DONE (no changes)"
|