amarillo 0.3.3 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4e3236346294475f1a163d18a26c6802d203f7fb9d9feb47c24f90ef117e2fb
-  data.tar.gz: c02964b63238765fd4eacc43d61fb7c6aae1aa256374c447efa429d99d4816dd
+  metadata.gz: 5229f8188b6086ad5c09326cc438d8375703602036e50534cbb69d684a2ec9e7
+  data.tar.gz: b1a7005a37527eb00fd44dbc45cfa0ea3e232f90bbd8ad004f712bb74d8be0a5
 SHA512:
-  metadata.gz: e8f1b4dbb46b7c28c3ba1f800e6b625351887e46212bd5dc34ea345ab993b9b4ddb58d664fd4a6504104f101a94cdf3a5e782d5100429e0c124efeaa277c7da7
-  data.tar.gz: 3905e62aae46c7238416fbd60ce58afca677b05b146a3391170dcd99610cc2d086eedfc1972c6355035db49a7193b16a87d8dbd87023ab659329c4b3fdd00012
+  metadata.gz: b167194f5fbb58f945fb5674d9466473cf9777a04536cbb709bdf7e75e018666c7421beb28dfc300ad49c5e522f2250339f8b92c882273608525084708caa088
+  data.tar.gz: 1e40be3bb8babc91470dca9588c51467cd572e99dada1d9e716f4cbe57e669c0731956a3e36598c35a37a9a015369b88b01cb7ffe604442463d6b884dd1d907d

data/bin/amarillo

@@ -35,12 +35,16 @@ OptionParser.new do |opts|
     options[:list] = l
   end
 
-  opts.on("-d", "--delete", "Delete certificate") do |d|
+  opts.on("-d", "--delete COMMONNAME", "Delete certificate specified by COMMONNAME") do |d|
     options[:delete] = d
   end
 
-  opts.on("-r", "--renew", "Renew certificates") do |r|
-    options[:renew] = r
+  opts.on("-r", "--renew [COMMONNAME]", "Renew specific or all certificates") do |r|
+    if r
+      options[:renew] = r
+    else
+      options[:renew] = 'all'
+    end
   end
 
   opts.on("-z", "--zone ZONE", "Hosted zone") do |z|
@@ -59,6 +63,10 @@ OptionParser.new do |opts|
     options[:keytype] = k
   end
 
+  opts.on("-s", "--script SCRIPT", "A script or command to execute after a successful certificate creation or renewal") do |s|
+    options[:script] = s
+  end
+
   opts.on("-a", "--amarillo-home AMARILLO_HOME", "Home directory for configuration, keys, and certificates") do |o|
     options[:amarillo_home] = a
   end
@@ -107,8 +115,8 @@ else
   email = options[:email]
 end
 
-if options[:name].nil? and options[:renew].nil? and options[:list].nil? then
-  puts "Usage:  amarillo --name COMMONNAME [--zone ZONE] [--email EMAIL] [--amarillo-home AMARILLO_HOME]"
+if options[:name].nil? and options[:renew].nil? and options[:list].nil? and options[:delete].nil? then
+  puts "Usage:  amarillo [--name COMMONNAME|--renew|--renew COMMONNAME] [--zone ZONE] [--email EMAIL] [--amarillo-home AMARILLO_HOME]"
   exit -1
 else
   name = options[:name]
@@ -123,13 +131,26 @@ end
 y = Amarillo.new amarillo_home
 
 if options[:renew] then
-  y.renewCertificates
+
+  if options[:renew] != 'all' then
+    y.renewCertificate options[:renew]
+  else
+    y.renewCertificates
+  end
+
 elsif options[:list] then
   y.listCertificates
 elsif options[:delete] then
-  y.deleteCertificate name
+  y.deleteCertificate options[:delete]
 else
-  y.requestCertificate zone, name, email, options[:keytype]
+  config = {
+    "zone"           => zone,
+    "commonName"     => name,
+    "email"          => email,
+    "key_type"       => options[:keytype],
+    "script"         => options[:script]
+  }
+  y.requestCertificate certConfig:  config
 end
 
 

data/lib/amarillo/environment.rb

@@ -105,7 +105,10 @@ HEREDOC
           "email"       =>  email,
           "zone"        =>  zone,
           "nameservers" =>  ['208.67.222.222', '9.9.9.9'],
-          "key_type"    =>  'ec,secp384r1'
+          "key_type"    =>  'ec,secp384r1',
+          "owner"       =>  'root',
+          "group"       =>  'root',
+          "key_mode"    =>  0660
       }}
       File.write(@configFile, config.to_yaml)
     else

data/lib/amarillo.rb

@@ -3,7 +3,7 @@
 # Inspired by Pete Keen's (pete@petekeen.net) post
 # https://www.petekeen.net/lets-encrypt-without-certbot
 # 
-# Copyright 2021 iAchieved.it LLC
+# Copyright 2022 iAchieved.it LLC
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -86,7 +86,17 @@ class Amarillo
 
   end
 
-  def requestCertificate(zone, commonName, email, key_type)
+  def requestCertificate(configPath:  nil, certConfig:  nil)
+
+    if configPath
+      certConfig = YAML.load(File.read(configPath))
+    end
+    
+    commonName     = certConfig["commonName"]
+    email          = certConfig["email"]
+    zone           = certConfig["zone"]
+    key_type       = certConfig["key_type"]
+    script         = certConfig["script"]
 
     @zone = zone
 
@@ -148,7 +158,7 @@ class Amarillo
 
     @logger.info "Waiting for DNS record to propagate"
     while !check_dns(commonName, nameservers, challengeValue)
-      sleep 2
+      sleep 5
       @logger.info "Still waiting..."
     end
 
@@ -157,20 +167,13 @@ class Amarillo
     @logger.info "Requesting validation..."
     authorization.dns.reload
     while authorization.dns.status == 'pending'
-    	sleep 2
+    	sleep 5
     	@logger.info "DNS status:  #{authorization.dns.status}"
     	authorization.dns.reload
     end
 
     @logger.info "Generating key"
 
-    # Create certificate yml
-    certConfig = {
-      "commonName"  =>  commonName,
-      "email"       =>  email,
-      "zone"        =>  zone
-    }
-
     if key_type
       certConfig["key_type"] = key_type
     else
@@ -218,7 +221,13 @@ class Amarillo
     File.open(keyOutputPath, "w") do |f|
     	f.puts certPrivateKey.to_pem.to_s
     end
-    File.chmod(0600, keyOutputPath)
+
+    keyMode = @config["defaults"]["key_mode"] || 0600
+    if keyMode
+      File.chmod(keyMode, keyOutputPath)
+    else
+      File.chmod(0600, keyOutputPath)
+    end
 
     @logger.info "Saving certificate to #{certOutputPath}"
 
@@ -226,9 +235,21 @@ class Amarillo
     	f.puts order.certificate
     end
 
+    owner = certConfig["owner"] || @config["defaults"]["owner"] || "root"
+    group = certConfig["group"] || @config["defaults"]["group"] || "root"
+    begin
+      FileUtils.chown(owner, group, keyOutputPath)
+    rescue
+      @logger.info "Unable to change ownership of key file #{keyOutputPath}"
+    end
+
     certConfigFile = "#{@configsPath}/#{commonName}.yml"
+
+    @logger.info "Saving certificate configuration to #{certConfigFile}"
     File.write(certConfigFile, certConfig.to_yaml)
 
+    self.doRenewalAction script
+
   end
 
   def cleanup(label, record_type, challengeValue)
@@ -256,10 +277,6 @@ class Amarillo
     @route53.change_resource_record_sets(options)
   end
 
-  def renewCertificate(zone, commonName, email)
-
-  end
-
   def listCertificates
 
     rows = []
@@ -293,6 +310,7 @@ class Amarillo
 
   end
 
+  # Renew all certificates
   def renewCertificates
     t = Time.now
     @logger.info "Renewing certificates"
@@ -300,10 +318,7 @@ class Amarillo
     Dir["#{@configsPath}/*.yml"].each do |c|
       config = YAML.load(File.read(c))
 
-      cn       = config["commonName"]
-      email    = config["email"]
-      zone     = config["zone"]
-      key_type = config["key_type"]
+      cn = config["commonName"]
 
       certificatePath = "#{@certificatePath}/#{cn}.crt"
       raw = File.read certificatePath
@@ -312,12 +327,39 @@ class Amarillo
 
       if daysToExpiration < 30 then
         @logger.info "#{cn} certificate needs to be renewed"
-        self.requestCertificate zone, cn, email, key_type
+        self.requestCertificate configPath:  c
       else
         @logger.info "#{cn} certificate does not need to be renewed"
       end
     end
   end
+
+  # Renew specific certificate, implied force
+  def renewCertificate(commonName)
+
+    configPath = "#{@configsPath}/#{commonName}.yml"
+    self.requestCertificate configPath:  configPath
+
+  end
+
+  def doRenewalAction(renewal_action)
+
+    if renewal_action
+
+        @logger.info "Executing certificate renewal action:  #{renewal_action}"
+
+        begin
+          %x( #{renewal_action} )
+          @logger.info "Renewal action returned:  #{$?}"
+        rescue
+          @logger.error("Error executing certificate renewal action")
+          raise
+        end 
+
+    end
+
+  end
+
 end
 
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: amarillo
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.0
 platform: ruby
 authors:
 - iAchieved.it LLC
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-07-24 00:00:00.000000000 Z
+date: 2022-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -109,7 +109,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.2.33
 signing_key:
 specification_version: 4
 summary: Amarillo