84 lines
3.2 KiB
Bash
Executable file
84 lines
3.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
# ===== Minimal logging =====
|
|
if [[ -t 1 ]]; then
|
|
BOLD=$'\e[1m'; RESET=$'\e[0m'
|
|
BLUE=$'\e[34m'; GREEN=$'\e[32m'; YELLOW=$'\e[33m'; RED=$'\e[31m'
|
|
else BOLD=""; RESET=""; BLUE=""; GREEN=""; YELLOW=""; RED=""; fi
|
|
info(){ echo -e "🟦 ${BLUE}${BOLD}[INFO]${RESET} $*"; }
|
|
ok(){ echo -e "🟩 ${GREEN}${BOLD}[ OK ]${RESET} $*"; }
|
|
warn(){ echo -e "🟨 ${YELLOW}${BOLD}[WARN]${RESET} $*"; }
|
|
err(){ echo -e "🟥 ${RED}${BOLD}[FAIL]${RESET} $*" >&2; }
|
|
|
|
# ===== Context =====
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"
|
|
AGENT_DIR="$(dirname -- "$SCRIPT_DIR")" # …/.vault-agent-<app>
|
|
APP_NAME="${APP_NAME:-${AGENT_DIR##*.vault-agent-}}"
|
|
|
|
# Agent renders exactly one JSON:
|
|
JSON_LEAF="${AGENT_DIR}/.issue.json" # contains .private_key for leaf
|
|
JSON_CHAIN="${AGENT_DIR}/.ca.json" # CA chain payload
|
|
JSON="$JSON_LEAF"; [[ -s "$JSON" ]] || JSON="$JSON_CHAIN"
|
|
[[ -s "$JSON" ]] || { err "no render JSON: $JSON_LEAF | $JSON_CHAIN"; exit 1; }
|
|
|
|
# ===== Output targets (simple defaults) =====
|
|
OUTDIR="${OUTDIR:-$HOME/tls}" # for leaf
|
|
CHAIN_FILE="${CHAIN_FILE:-$HOME/nginx/ca/current-ca-chain.pem}" # for chain
|
|
RELOAD_TLS_LABEL="tls=true" # fixed global label (intended)
|
|
|
|
command -v jq >/dev/null || { err "jq not found"; exit 1; }
|
|
umask 077
|
|
mkdir -p "$OUTDIR" 2>/dev/null || true
|
|
mkdir -p "$(dirname "$CHAIN_FILE")" 2>/dev/null || true
|
|
|
|
# ===== Leaf vs Chain =====
|
|
if jq -e 'has("private_key")' "$JSON" >/dev/null 2>&1; then
|
|
# ---- LEAF (key + fullchain) ----
|
|
tmp="$(mktemp -d "$OUTDIR/.staging.XXXX")"; trap 'rm -rf "$tmp"' EXIT
|
|
jq -r .private_key "$JSON" > "$tmp/${APP_NAME}.key"
|
|
jq -r '
|
|
.certificate,
|
|
(if (.ca_chain|type=="array") then (.ca_chain|join("\n"))
|
|
else if (.ca_chain|type=="string") then .ca_chain
|
|
else .issuing_ca end end)
|
|
' "$JSON" > "$tmp/${APP_NAME}.fullchain.pem"
|
|
|
|
install -m 600 "$tmp/${APP_NAME}.key" "$OUTDIR/${APP_NAME}.key"
|
|
install -m 644 "$tmp/${APP_NAME}.fullchain.pem" "$OUTDIR/${APP_NAME}.fullchain.pem"
|
|
ok "leaf → ${OUTDIR}/${APP_NAME}.{key,fullchain.pem}"
|
|
else
|
|
# ---- CA CHAIN (single file) ----
|
|
tmp="$(mktemp "${CHAIN_FILE}.XXXX")"; trap 'rm -f "$tmp"' EXIT
|
|
jq -r '
|
|
if has("ca_chain") then
|
|
(if (.ca_chain|type=="array") then (.ca_chain|join("\n")) else .ca_chain end)
|
|
elif has("issuing_ca") then .issuing_ca
|
|
elif has("certificate") then .certificate
|
|
else empty end
|
|
' "$JSON" > "$tmp"
|
|
[[ -s "$tmp" ]] || { err "empty chain payload"; exit 1; }
|
|
install -m 644 "$tmp" "$CHAIN_FILE"
|
|
ok "chain → ${CHAIN_FILE}"
|
|
fi
|
|
|
|
# ===== Podman label reload (only) =====
|
|
if ! command -v podman >/dev/null 2>&1; then
|
|
warn "podman not found → skip reload"
|
|
exit 0
|
|
fi
|
|
|
|
info "reload label: ${BOLD}${RELOAD_TLS_LABEL}${RESET}"
|
|
mapfile -t CIDS < <(podman ps --filter "label=${RELOAD_TLS_LABEL}" --format '{{.ID}}' | sed '/^$/d') || true
|
|
if (( ${#CIDS[@]} == 0 )); then
|
|
warn "no containers with label ${RELOAD_TLS_LABEL} → skip reload"
|
|
exit 0
|
|
fi
|
|
for cid in "${CIDS[@]}"; do
|
|
if podman exec "$cid" sh -lc 'nginx -t >/dev/null 2>&1 && nginx -s reload' >/dev/null 2>&1; then
|
|
ok "nginx reload OK in ${cid}"
|
|
else
|
|
warn "reload failed in ${cid}"
|
|
fi
|
|
done
|
|
|