|
|
@ -5,8 +5,8 @@
|
|
|
|
XAPI_SSL_PATH="/etc/xensource/xapi-ssl.pem"
|
|
|
|
XAPI_SSL_PATH="/etc/xensource/xapi-ssl.pem"
|
|
|
|
XCP_NG_BACKUP_DIR="/tmp/$(uuidgen)"
|
|
|
|
XCP_NG_BACKUP_DIR="/tmp/$(uuidgen)"
|
|
|
|
|
|
|
|
|
|
|
|
# xcp-ng_deploy deploys the new certificate to XCP-ng.
|
|
|
|
# xcp_ng_deploy deploys the new certificate to XCP-ng.
|
|
|
|
xcp-ng_deploy() {
|
|
|
|
xcp_ng_deploy() {
|
|
|
|
_cdomain="$1"
|
|
|
|
_cdomain="$1"
|
|
|
|
_ckey="$2"
|
|
|
|
_ckey="$2"
|
|
|
|
_ccert="$3"
|
|
|
|
_ccert="$3"
|
|
|
@ -19,25 +19,25 @@ xcp-ng_deploy() {
|
|
|
|
_debug _cca "$_cca"
|
|
|
|
_debug _cca "$_cca"
|
|
|
|
_debug _cfullchain "$_cfullchain"
|
|
|
|
_debug _cfullchain "$_cfullchain"
|
|
|
|
|
|
|
|
|
|
|
|
if [[ $(_xcp-ng_backup_certificate) -ne 0 ]]; then
|
|
|
|
if [[ $(_xcp_ng_backup_certificate) -ne 0 ]]; then
|
|
|
|
return 1
|
|
|
|
return 1
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
_debug "Deploying certificate with 'xe host-server-certificate-install'"
|
|
|
|
_debug "Deploying certificate with 'xe host-server-certificate-install'"
|
|
|
|
|
|
|
|
|
|
|
|
if [[ $(sudo xe host-server-certificate-install certificate="${_ccert}" private-key="${_ckey}" certificate-chain="${_cca}") -ne 0 ]]; then
|
|
|
|
if [[ $(sudo xe host-server-certificate-install certificate="${_ccert}" private-key="${_ckey}" certificate-chain="${_cca}") -ne 0 ]]; then
|
|
|
|
if [[ $(_xcp-ng_backup_restore) -eq 0 ]]; then
|
|
|
|
if [[ $(_xcp_ng_backup_restore) -eq 0 ]]; then
|
|
|
|
xcp-ng_backup_delete 2>&1
|
|
|
|
xcp_ng_backup_delete 2>&1
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
return 1
|
|
|
|
return 1
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
_info "Certificate was deployed successfully."
|
|
|
|
_info "Certificate was deployed successfully."
|
|
|
|
_xcp-ng_backup_delete 2>&1
|
|
|
|
_xcp_ng_backup_delete 2>&1
|
|
|
|
return 0
|
|
|
|
return 0
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
# _xcp-ng_backup_certificate saves the current certificate to a temporary folder.
|
|
|
|
# _xcp_ng_backup_certificate saves the current certificate to a temporary folder.
|
|
|
|
# The folder can be read/ written by the current user only (chmod 600).
|
|
|
|
# The folder can be read/ written by the current user only (chmod 600).
|
|
|
|
_xcp-ng_backup_certificate() {
|
|
|
|
_xcp_ng_backup_certificate() {
|
|
|
|
if [[ $(whoami) != "root" ]]; then
|
|
|
|
if [[ $(whoami) != "root" ]]; then
|
|
|
|
_debug "Running as non-root user. Certificate backup not supported."
|
|
|
|
_debug "Running as non-root user. Certificate backup not supported."
|
|
|
|
exit 0
|
|
|
|
exit 0
|
|
|
@ -55,20 +55,20 @@ _xcp-ng_backup_certificate() {
|
|
|
|
return 0
|
|
|
|
return 0
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
# _xcp-ng_backup_restore restores the backup made by _xcp-ng_backup_certificate.
|
|
|
|
# _xcp_ng_backup_restore restores the backup made by _xcp_ng_backup_certificate.
|
|
|
|
# It is called when something went wrong deploying the certificate.
|
|
|
|
# It is called when something went wrong deploying the certificate.
|
|
|
|
_xcp-ng_backup_restore() {
|
|
|
|
_xcp_ng_backup_restore() {
|
|
|
|
if [[ $(mv "${XCP_NG_BACKUP_DIR}/xapi-ssl.pem" "${XAPI_SSL_PATH}") -eq 0 ]]; then
|
|
|
|
if [[ $(mv "${XCP_NG_BACKUP_DIR}/xapi-ssl.pem" "${XAPI_SSL_PATH}") -eq 0 ]]; then
|
|
|
|
_info "Certificate restoration successful."
|
|
|
|
_info "Certificate restoration successful."
|
|
|
|
return 0
|
|
|
|
return 0
|
|
|
|
else
|
|
|
|
else
|
|
|
|
_err "Certificate restoration from '${XCP-NG_BACKUP_DIR}' not possible."
|
|
|
|
_err "Certificate restoration from '${XCP_NG_BACKUP_DIR}' not possible."
|
|
|
|
return 1
|
|
|
|
return 1
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
# _xcp-ng_backup_delete deletes the backup folder.
|
|
|
|
# _xcp_ng_backup_delete deletes the backup folder.
|
|
|
|
_xcp-ng_backup_delete() {
|
|
|
|
_xcp_ng_backup_delete() {
|
|
|
|
if [[ $(rm -rf "${XCP_NG_BACKUP_DIR}") -eq 0 ]]; then
|
|
|
|
if [[ $(rm -rf "${XCP_NG_BACKUP_DIR}") -eq 0 ]]; then
|
|
|
|
_debug "Certificate backup deleted."
|
|
|
|
_debug "Certificate backup deleted."
|
|
|
|
else
|
|
|
|
else
|
|
|
@ -76,12 +76,12 @@ _xcp-ng_backup_delete() {
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
# _xcp-ng_xapi_restart restarts the XAPI service the certificate was deployed to.
|
|
|
|
# _xcp_ng_xapi_restart restarts the XAPI service the certificate was deployed to.
|
|
|
|
# This is only neeeded when the old certificate had to be restored.
|
|
|
|
# This is only neeeded when the old certificate had to be restored.
|
|
|
|
_xcp-ng_xapi_restart() {
|
|
|
|
_xcp_ng_xapi_restart() {
|
|
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|
|
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|
|
|
|
_err "XAPI did not restart properly after deployment. Restoring old certificate for now."
|
|
|
|
_err "XAPI did not restart properly after deployment. Restoring old certificate for now."
|
|
|
|
if [[ $(_xcp-ng_backup_restore) -ne 0 ]]; then
|
|
|
|
if [[ $(_xcp_ng_backup_restore) -ne 0 ]]; then
|
|
|
|
_err "Could not restore the old certificate!!!"
|
|
|
|
_err "Could not restore the old certificate!!!"
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|
|
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|