For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/all-tunnel-cert-lib.sh
| 1 | # Shared by all-tunnel-cert-hook and all-tunnel-cert-check (installed next to them in /usr/local/sbin). Sourced, never run. |
| 2 | # |
| 3 | # Everything the node's certificate scripts need comes from the node's own environment file (the one systemd reads), so there is one place that says where the |
| 4 | # certificate is and what the node is called: |
| 5 | # TUNNEL_NODE_HOST the node's own public name TUNNEL_CERT_FILE / TUNNEL_KEY_FILE where the node reads its certificate and key |
| 6 | # TUNNEL_METRICS_ADDR the loopback address of /metrics (default 127.0.0.1:9101) |
| 7 | # Overrides for tests: ALL_TUNNEL_ENV (the file), ALL_TUNNEL_UNIT (the unit to reload), ALL_TUNNEL_LOGGER (the logger command). |
| 8 | |
| 9 | ALL_TUNNEL_ENV="${ALL_TUNNEL_ENV:-/etc/all-tunnel/env}" |
| 10 | ALL_TUNNEL_UNIT="${ALL_TUNNEL_UNIT:-all-tunnel}" |
| 11 | |
| 12 | env_value() { # env_value KEY [DEFAULT]: the last KEY=value line of the environment file (no quotes, no expansion: it is a systemd EnvironmentFile) |
| 13 | value=$(sed -n "s/^$1=//p" "$ALL_TUNNEL_ENV" 2>/dev/null | tail -n 1) |
| 14 | if [ -n "$value" ]; then printf '%s\n' "$value"; else printf '%s\n' "${2:-}"; fi |
| 15 | } |
| 16 | |
| 17 | say() { # say PRIORITY MESSAGE: to the journal when logger exists, always to stderr (what systemd and certbot capture) |
| 18 | printf 'all-tunnel-cert: %s\n' "$2" >&2 |
| 19 | if command -v "${ALL_TUNNEL_LOGGER:-logger}" >/dev/null 2>&1; then "${ALL_TUNNEL_LOGGER:-logger}" -p "daemon.$1" -t all-tunnel-cert "$2" || true; fi |
| 20 | } |
| 21 | |
| 22 | die() { say crit "$1"; exit 1; } |
| 23 | |
| 24 | # not_after_epoch FILE: the end of the certificate in Unix seconds (GNU date on the node, BSD date where a developer runs the tests) |
| 25 | not_after_epoch() { |
| 26 | text=$(openssl x509 -in "$1" -noout -enddate | sed 's/^notAfter=//') |
| 27 | date -u -d "$text" +%s 2>/dev/null || date -u -j -f '%b %e %H:%M:%S %Y %Z' "$text" +%s 2>/dev/null || return 1 |
| 28 | } |
| 29 | |
| 30 | # metric NAME: one value of the node's loopback /metrics, empty when it cannot be read |
| 31 | metric() { |
| 32 | addr=$(env_value TUNNEL_METRICS_ADDR 127.0.0.1:9101) |
| 33 | curl -fsS --max-time 5 "http://$addr/metrics" 2>/dev/null | sed -n "s/^$1 //p" | head -n 1 |
| 34 | } |