amarillo 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2dbdaceaf0eac001e1d7cb1ba63058ce2cee3e81be2c61d08378c3db7db562ae
-  data.tar.gz: b1afafa36c49e473a09bb56de32c354a668516e7fd71ec8770b38b681777c825
+  metadata.gz: 5229f8188b6086ad5c09326cc438d8375703602036e50534cbb69d684a2ec9e7
+  data.tar.gz: b1a7005a37527eb00fd44dbc45cfa0ea3e232f90bbd8ad004f712bb74d8be0a5
 SHA512:
-  metadata.gz: d19987aa6a9c84b92411fc5f5fa99102e9bd0f3abb8fcfb3dcacd8f28bc39a7806a28e932d7e39463680ca1281b701ad30b9a44e54c786918795f12d909d4e10
-  data.tar.gz: 2eef894b6c9ed756249684f31f2b4392ef2a79bd5c281858b64c9615f19bdabe91a46f43cf480fe9e9ff429c1cacc173f6d98b89916ffc21bc82f633906a675f
+  metadata.gz: b167194f5fbb58f945fb5674d9466473cf9777a04536cbb709bdf7e75e018666c7421beb28dfc300ad49c5e522f2250339f8b92c882273608525084708caa088
+  data.tar.gz: 1e40be3bb8babc91470dca9588c51467cd572e99dada1d9e716f4cbe57e669c0731956a3e36598c35a37a9a015369b88b01cb7ffe604442463d6b884dd1d907d

data/bin/amarillo

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 # 
-# Copyright 2021 iAchieved.it LLC
+# Copyright 2022 iAchieved.it LLC
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -35,12 +35,16 @@ OptionParser.new do |opts|
     options[:list] = l
   end
 
-  opts.on("-d", "--delete", "Delete certificate") do |d|
+  opts.on("-d", "--delete COMMONNAME", "Delete certificate specified by COMMONNAME") do |d|
     options[:delete] = d
   end
 
-  opts.on("-r", "--renew", "Renew certificates") do |r|
-    options[:renew] = r
+  opts.on("-r", "--renew [COMMONNAME]", "Renew specific or all certificates") do |r|
+    if r
+      options[:renew] = r
+    else
+      options[:renew] = 'all'
+    end
   end
 
   opts.on("-z", "--zone ZONE", "Hosted zone") do |z|
@@ -55,6 +59,14 @@ OptionParser.new do |opts|
     options[:name] = n
   end
 
+  opts.on("-k", "--keytype KEYTYPE", "Valid key types:  ") do |k|
+    options[:keytype] = k
+  end
+
+  opts.on("-s", "--script SCRIPT", "A script or command to execute after a successful certificate creation or renewal") do |s|
+    options[:script] = s
+  end
+
   opts.on("-a", "--amarillo-home AMARILLO_HOME", "Home directory for configuration, keys, and certificates") do |o|
     options[:amarillo_home] = a
   end
@@ -103,8 +115,8 @@ else
   email = options[:email]
 end
 
-if options[:name].nil? and options[:renew].nil? and options[:list].nil? then
-  puts "Usage:  amarillo --name COMMONNAME [--zone ZONE] [--email EMAIL] [--amarillo-home AMARILLO_HOME]"
+if options[:name].nil? and options[:renew].nil? and options[:list].nil? and options[:delete].nil? then
+  puts "Usage:  amarillo [--name COMMONNAME|--renew|--renew COMMONNAME] [--zone ZONE] [--email EMAIL] [--amarillo-home AMARILLO_HOME]"
   exit -1
 else
   name = options[:name]
@@ -119,13 +131,26 @@ end
 y = Amarillo.new amarillo_home
 
 if options[:renew] then
-  y.renewCertificates
+
+  if options[:renew] != 'all' then
+    y.renewCertificate options[:renew]
+  else
+    y.renewCertificates
+  end
+
 elsif options[:list] then
   y.listCertificates
 elsif options[:delete] then
-  y.deleteCertificate name
+  y.deleteCertificate options[:delete]
 else
-  y.requestCertificate zone, name, email, nil
+  config = {
+    "zone"           => zone,
+    "commonName"     => name,
+    "email"          => email,
+    "key_type"       => options[:keytype],
+    "script"         => options[:script]
+  }
+  y.requestCertificate certConfig:  config
 end
 
 

data/lib/amarillo/environment.rb

@@ -105,7 +105,10 @@ HEREDOC
           "email"       =>  email,
           "zone"        =>  zone,
           "nameservers" =>  ['208.67.222.222', '9.9.9.9'],
-          "key_type"    =>  'ec,secp384r1'
+          "key_type"    =>  'ec,secp384r1',
+          "owner"       =>  'root',
+          "group"       =>  'root',
+          "key_mode"    =>  0660
       }}
       File.write(@configFile, config.to_yaml)
     else

data/lib/amarillo.rb

@@ -3,7 +3,7 @@
 # Inspired by Pete Keen's (pete@petekeen.net) post
 # https://www.petekeen.net/lets-encrypt-without-certbot
 # 
-# Copyright 2021 iAchieved.it LLC
+# Copyright 2022 iAchieved.it LLC
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -86,7 +86,17 @@ class Amarillo
 
   end
 
-  def requestCertificate(zone, commonName, email, key_type)
+  def requestCertificate(configPath:  nil, certConfig:  nil)
+
+    if configPath
+      certConfig = YAML.load(File.read(configPath))
+    end
+    
+    commonName     = certConfig["commonName"]
+    email          = certConfig["email"]
+    zone           = certConfig["zone"]
+    key_type       = certConfig["key_type"]
+    script         = certConfig["script"]
 
     @zone = zone
 
@@ -139,11 +149,16 @@ class Amarillo
 
     @route53.change_resource_record_sets(options)
 
+    at_exit do 
+      self.cleanup label, record_type, challengeValue
+    end
+
+
     nameservers = @environment.get_zone_nameservers
 
     @logger.info "Waiting for DNS record to propagate"
     while !check_dns(commonName, nameservers, challengeValue)
-      sleep 2
+      sleep 5
       @logger.info "Still waiting..."
     end
 
@@ -152,20 +167,13 @@ class Amarillo
     @logger.info "Requesting validation..."
     authorization.dns.reload
     while authorization.dns.status == 'pending'
-    	sleep 2
+    	sleep 5
     	@logger.info "DNS status:  #{authorization.dns.status}"
     	authorization.dns.reload
     end
 
     @logger.info "Generating key"
 
-    # Create certificate yml
-    certConfig = {
-      "commonName"  =>  commonName,
-      "email"       =>  email,
-      "zone"        =>  zone
-    }
-
     if key_type
       certConfig["key_type"] = key_type
     else
@@ -178,16 +186,22 @@ class Amarillo
     if type == 'ec' then
       certPrivateKey = OpenSSL::PKey::EC.new(args).generate_key
     elsif type == 'rsa' then
-      certPrivateKey = OpenSSL::PKey::RSA.new(args)
+      if args.to_i > 0
+        certPrivateKey = OpenSSL::PKey::RSA.new(args.to_i)
+      else
+        @logger.error("Invalid RSA key size:  #{args}")
+      end 
     end
 
     @logger.info "Requesting certificate..."  
     csr = Acme::Client::CertificateRequest.new private_key: certPrivateKey, 
                                                names: [commonName]
 
-    while order.status == 'processing'
+    while order.status != 'ready'
       sleep(1)
+      @logger.info "Order status:  #{order.status}"
       order.reload
+      raise if order.status == 'invalid'
     end
 
     @logger.info "Order status:  #{order.status}"
@@ -196,7 +210,7 @@ class Amarillo
       order.finalize(csr: csr)
     rescue
       @logger.error("Error finalizing certificate order")
-      self.cleanup label, record_type, challengeValue
+      raise 
     end
 
     keyOutputPath =  "#{@keyPath}/#{commonName}.key"
@@ -207,7 +221,13 @@ class Amarillo
     File.open(keyOutputPath, "w") do |f|
     	f.puts certPrivateKey.to_pem.to_s
     end
-    File.chmod(0600, keyOutputPath)
+
+    keyMode = @config["defaults"]["key_mode"] || 0600
+    if keyMode
+      File.chmod(keyMode, keyOutputPath)
+    else
+      File.chmod(0600, keyOutputPath)
+    end
 
     @logger.info "Saving certificate to #{certOutputPath}"
 
@@ -215,10 +235,20 @@ class Amarillo
     	f.puts order.certificate
     end
 
+    owner = certConfig["owner"] || @config["defaults"]["owner"] || "root"
+    group = certConfig["group"] || @config["defaults"]["group"] || "root"
+    begin
+      FileUtils.chown(owner, group, keyOutputPath)
+    rescue
+      @logger.info "Unable to change ownership of key file #{keyOutputPath}"
+    end
+
     certConfigFile = "#{@configsPath}/#{commonName}.yml"
+
+    @logger.info "Saving certificate configuration to #{certConfigFile}"
     File.write(certConfigFile, certConfig.to_yaml)
 
-    self.cleanup label, record_type, challengeValue
+    self.doRenewalAction script
 
   end
 
@@ -247,10 +277,6 @@ class Amarillo
     @route53.change_resource_record_sets(options)
   end
 
-  def renewCertificate(zone, commonName, email)
-
-  end
-
   def listCertificates
 
     rows = []
@@ -284,6 +310,7 @@ class Amarillo
 
   end
 
+  # Renew all certificates
   def renewCertificates
     t = Time.now
     @logger.info "Renewing certificates"
@@ -291,10 +318,7 @@ class Amarillo
     Dir["#{@configsPath}/*.yml"].each do |c|
       config = YAML.load(File.read(c))
 
-      cn       = config["commonName"]
-      email    = config["email"]
-      zone     = config["zone"]
-      key_type = config["key_type"]
+      cn = config["commonName"]
 
       certificatePath = "#{@certificatePath}/#{cn}.crt"
       raw = File.read certificatePath
@@ -303,12 +327,39 @@ class Amarillo
 
       if daysToExpiration < 30 then
         @logger.info "#{cn} certificate needs to be renewed"
-        self.requestCertificate zone, cn, email, key_type
+        self.requestCertificate configPath:  c
       else
         @logger.info "#{cn} certificate does not need to be renewed"
       end
     end
   end
+
+  # Renew specific certificate, implied force
+  def renewCertificate(commonName)
+
+    configPath = "#{@configsPath}/#{commonName}.yml"
+    self.requestCertificate configPath:  configPath
+
+  end
+
+  def doRenewalAction(renewal_action)
+
+    if renewal_action
+
+        @logger.info "Executing certificate renewal action:  #{renewal_action}"
+
+        begin
+          %x( #{renewal_action} )
+          @logger.info "Renewal action returned:  #{$?}"
+        rescue
+          @logger.error("Error executing certificate renewal action")
+          raise
+        end 
+
+    end
+
+  end
+
 end
 
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: amarillo
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - iAchieved.it LLC
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-06-06 00:00:00.000000000 Z
+date: 2022-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
   requirement: !ruby/object:Gem::Requirement
@@ -109,7 +109,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.2.33
 signing_key:
 specification_version: 4
 summary: Amarillo