blob: b6bd20def8f8c13290c084067543dfd22b6a6d82 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
#!/bin/sh
BASE_D="/var/lib/uacme.d/{{ uacme_cert_name }}"
# split fullchain and fix permissions
awk '{if(length($0) > 0) print} /-----END CERTIFICATE-----/ { exit }' "$BASE_D/{{ uacme_cert_name }}-cert.pem" > "$BASE_D/crt.pem"
awk '(show==1) {if(length($0) > 0) print} /-----END CERTIFICATE-----/ { show=1 }' "$BASE_D/{{ uacme_cert_name }}-cert.pem" > "$BASE_D/chain.pem"
chmod "{{ uacme_cert_config.cert.mode | default('0644') }}" $BASE_D/{{ uacme_cert_name }}-cert.pem $BASE_D/crt.pem $BASE_D/chain.pem
{% if uacme_cert_config.cert.owner is defined %}
chown "{{ uacme_cert_config.cert.owner }}" $BASE_D/{{ uacme_cert_name }}-cert.pem $BASE_D/crt.pem $BASE_D/chain.pem
{% endif %}
{% if uacme_cert_config.cert.group is defined %}
chgrp "{{ uacme_cert_config.cert.group }}" $BASE_D/{{ uacme_cert_name }}-cert.pem $BASE_D/crt.pem $BASE_D/chain.pem
{% endif %}
{% if x509_certificate_renewal is defined and 'install' in x509_certificate_renewal %}
{% for file in x509_certificate_renewal.install %}
install{% if 'mode' in file %} -m {{ file.mode }}{% endif %}{% if 'owner' in file %} -o {{ file.owner }}{% endif %}{% if 'group' in file %} -g {{ file.group }}{% endif %} /dev/null "{{ file.dest }}.new"
{% for src in file.src %}
cat "{{ hostvars[inventory_hostname]['x509_certificate_path_' + src] }}" >> "{{ file.dest }}.new"
{% endfor %}
mv "{{ file.dest }}.new" "{{ file.dest }}"
{% endfor %}
{% endif %}
## reload services
{% for service in (x509_certificate_reload_services | default([])) %}
systemctl reload "{{ service }}.service"
{% endfor %}
{% for service in (x509_certificate_restart_services | default([])) %}
systemctl restart "{{ service }}.service"
{% endfor %}
{% if x509_certificate_renewal is defined and 'reload' in x509_certificate_renewal %}
{{ x509_certificate_renewal.reload | trim }}
{% endif %}
|
