Andrey
16c254510a
Refactor README, architecture, and backup documentation to emphasize the use of Vaultwarden for credential management across various services. Update scripts for Nextcloud, Gitea, Paperless, and others to reference Vaultwarden for sensitive information. Remove outdated references to previous backup strategies and ensure clarity on credential retrieval processes. This improves security practices and streamlines backup operations.
117 lines
3.2 KiB
Bash
117 lines
3.2 KiB
Bash
#!/bin/bash
|
|
# deploy-beget-credentials.sh — деплой кредов Beget для certbot DNS-01 в CT 100
|
|
# Секреты из Vaultwarden (объект beget). Атомарная запись beget.ini.
|
|
#
|
|
# Использование:
|
|
# /root/scripts/deploy-beget-credentials.sh # деплой
|
|
# /root/scripts/deploy-beget-credentials.sh --dry-run # проверка без записи
|
|
#
|
|
# Ротация: сменил пароль в Vaultwarden → запустил скрипт → готово.
|
|
#
|
|
# Требования: bw, jq, /root/.bw-master (chmod 600)
|
|
|
|
set -e
|
|
|
|
CT_ID=100
|
|
BEGET_INI_PATH="/root/.secrets/certbot/beget.ini"
|
|
BW_MASTER_FILE="${BW_MASTER_PASSWORD_FILE:-/root/.bw-master}"
|
|
DRY_RUN=false
|
|
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--dry-run) DRY_RUN=true ;;
|
|
esac
|
|
done
|
|
|
|
export PATH="/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH}"
|
|
|
|
log() { echo "[$(date -Iseconds)] $*"; }
|
|
err() { echo "[$(date -Iseconds)] ERROR: $*" >&2; }
|
|
|
|
ensure_bw_unlocked() {
|
|
local status
|
|
status=$(bw status 2>/dev/null | jq -r '.status' 2>/dev/null || echo "unknown")
|
|
if [ "$status" = "unlocked" ]; then
|
|
log "bw already unlocked, reusing session"
|
|
return 0
|
|
fi
|
|
if [ ! -f "$BW_MASTER_FILE" ]; then
|
|
err "Missing $BW_MASTER_FILE"
|
|
exit 1
|
|
fi
|
|
export BW_SESSION=$(bw unlock --passwordfile "$BW_MASTER_FILE" --raw 2>/dev/null) || {
|
|
err "bw unlock failed"
|
|
exit 1
|
|
}
|
|
log "bw unlocked"
|
|
}
|
|
|
|
get_secrets() {
|
|
BEGET_USER=$(bw get username "beget" 2>/dev/null)
|
|
BEGET_PASS=$(bw get password "beget" 2>/dev/null)
|
|
if [ -z "$BEGET_USER" ] || [ -z "$BEGET_PASS" ]; then
|
|
err "beget: missing username or password in Vaultwarden"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
gen_ini() {
|
|
local tmp
|
|
tmp=$(mktemp)
|
|
cat > "$tmp" << EOF
|
|
dns_beget_api_username = ${BEGET_USER}
|
|
dns_beget_api_password = ${BEGET_PASS}
|
|
EOF
|
|
echo "$tmp"
|
|
}
|
|
|
|
push_ini_atomic() {
|
|
local tmp="$1"
|
|
local dir
|
|
dir=$(dirname "$BEGET_INI_PATH")
|
|
pct exec "$CT_ID" -- mkdir -p "$dir"
|
|
pct push "$CT_ID" "$tmp" "${BEGET_INI_PATH}.tmp"
|
|
pct exec "$CT_ID" -- bash -c "mv ${BEGET_INI_PATH}.tmp ${BEGET_INI_PATH} && chmod 600 ${BEGET_INI_PATH} && chown root:root ${BEGET_INI_PATH}"
|
|
log "beget.ini written (atomic), chmod 600, owner root"
|
|
}
|
|
|
|
deploy_pre_hook() {
|
|
local hook_path="/etc/letsencrypt/renewal-hooks/pre/check-beget-credentials.sh"
|
|
local hook_src
|
|
hook_src="$(cd "$(dirname "$0")" && pwd)/certbot-hooks/check-beget-credentials.sh"
|
|
if [ ! -f "$hook_src" ]; then
|
|
log "pre-hook source not found ($hook_src), skip"
|
|
return 0
|
|
fi
|
|
if pct exec "$CT_ID" -- test -f "$hook_path" 2>/dev/null; then
|
|
pct push "$CT_ID" "$hook_src" "$hook_path"
|
|
pct exec "$CT_ID" -- chmod +x "$hook_path"
|
|
log "pre-hook updated"
|
|
else
|
|
pct push "$CT_ID" "$hook_src" "$hook_path"
|
|
pct exec "$CT_ID" -- chmod +x "$hook_path"
|
|
log "pre-hook deployed"
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
log "deploy-beget-credentials start (dry_run=$DRY_RUN)"
|
|
ensure_bw_unlocked
|
|
get_secrets
|
|
|
|
if [ "$DRY_RUN" = true ]; then
|
|
log "DRY-RUN: would push beget.ini and deploy pre-hook"
|
|
log " dns_beget_api_username=$BEGET_USER"
|
|
log " dns_beget_api_password=***"
|
|
exit 0
|
|
fi
|
|
|
|
tmp=$(gen_ini)
|
|
trap "rm -f $tmp" EXIT
|
|
push_ini_atomic "$tmp"
|
|
deploy_pre_hook
|
|
log "done"
|
|
}
|
|
|
|
main
|