certops 1.0.6 → 1.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +131 -0
- package/package.json +1 -1
package/README.md
ADDED
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
# certops
|
|
2
|
+
|
|
3
|
+
CLI for managing and auto-renewing SSL certificates from the [SSL Pilot](https://ssl-manager.dcom.at) platform.
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install -g certops
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Requirements
|
|
12
|
+
|
|
13
|
+
- Node.js 18+
|
|
14
|
+
- An SSL Pilot API key (`sslpilot_...`) from your dashboard
|
|
15
|
+
|
|
16
|
+
## Quick start
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
# Set your API key
|
|
20
|
+
export CERTOPS_API_KEY='sslpilot_...'
|
|
21
|
+
|
|
22
|
+
# List certificates
|
|
23
|
+
certops list
|
|
24
|
+
|
|
25
|
+
# Download a certificate (interactive picker)
|
|
26
|
+
sudo certops download
|
|
27
|
+
|
|
28
|
+
# Download a specific domain
|
|
29
|
+
sudo certops download '*.example.com'
|
|
30
|
+
|
|
31
|
+
# Download by ID
|
|
32
|
+
sudo certops download --id <cert-id>
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
## Commands
|
|
36
|
+
|
|
37
|
+
### `certops list`
|
|
38
|
+
|
|
39
|
+
Lists all certificates in your organisation with status and expiry.
|
|
40
|
+
|
|
41
|
+
### `certops download [certName]`
|
|
42
|
+
|
|
43
|
+
Downloads a certificate to `/etc/certops/<domain>/` in certbot-compatible format:
|
|
44
|
+
|
|
45
|
+
```
|
|
46
|
+
/etc/certops/<domain>/
|
|
47
|
+
├── fullchain.pem # cert + chain
|
|
48
|
+
├── cert.pem # leaf cert only
|
|
49
|
+
├── chain.pem # intermediate chain
|
|
50
|
+
└── privkey.pem # private key (chmod 600)
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
Requires root (`sudo`).
|
|
54
|
+
|
|
55
|
+
Options:
|
|
56
|
+
- `-i, --id <id>` — download by certificate ID
|
|
57
|
+
|
|
58
|
+
### `certops service install`
|
|
59
|
+
|
|
60
|
+
Installs and configures a systemd background service that monitors certificates and auto-renews them before expiry.
|
|
61
|
+
|
|
62
|
+
```bash
|
|
63
|
+
sudo -E certops service install
|
|
64
|
+
```
|
|
65
|
+
|
|
66
|
+
### `certops service <status|start|stop|uninstall|check>`
|
|
67
|
+
|
|
68
|
+
Manage the background renewal service.
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
certops service status
|
|
72
|
+
sudo certops service start
|
|
73
|
+
sudo certops service stop
|
|
74
|
+
sudo certops service check # run one renewal cycle now
|
|
75
|
+
sudo certops service uninstall
|
|
76
|
+
journalctl -u certops -f # follow logs
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
## Auto-renewal service
|
|
80
|
+
|
|
81
|
+
The service polls your SSL Pilot account, checks local expiry state, and re-downloads certificates approaching expiry. Hook scripts in `/etc/certops/hooks/` run after each download.
|
|
82
|
+
|
|
83
|
+
**Hook environment variables:**
|
|
84
|
+
|
|
85
|
+
| Variable | Value |
|
|
86
|
+
|----------|-------|
|
|
87
|
+
| `SSL_PILOT_CERT_NAME` | Certificate name |
|
|
88
|
+
| `SSL_PILOT_DOMAIN` | Domain (certName from API) |
|
|
89
|
+
| `SSL_PILOT_FULLCHAIN_PATH` | Path to `fullchain.pem` |
|
|
90
|
+
| `SSL_PILOT_CERT_PATH` | Path to `cert.pem` |
|
|
91
|
+
| `SSL_PILOT_CHAIN_PATH` | Path to `chain.pem` |
|
|
92
|
+
| `SSL_PILOT_KEY_PATH` | Path to `privkey.pem` |
|
|
93
|
+
|
|
94
|
+
**Example hook** (`/etc/certops/hooks/example.com.sh`):
|
|
95
|
+
|
|
96
|
+
```bash
|
|
97
|
+
#!/usr/bin/env bash
|
|
98
|
+
systemctl reload nginx
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
## File layout
|
|
102
|
+
|
|
103
|
+
```
|
|
104
|
+
/etc/certops/
|
|
105
|
+
config.json # service configuration
|
|
106
|
+
state.json # local expiry cache
|
|
107
|
+
hooks/
|
|
108
|
+
global.sh # runs after every download
|
|
109
|
+
example.com.sh # runs after example.com downloads
|
|
110
|
+
example.com/
|
|
111
|
+
fullchain.pem
|
|
112
|
+
cert.pem
|
|
113
|
+
chain.pem
|
|
114
|
+
privkey.pem
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
## Configuration (`/etc/certops/config.json`)
|
|
118
|
+
|
|
119
|
+
| Field | Default | Description |
|
|
120
|
+
|-------|---------|-------------|
|
|
121
|
+
| `renewalThresholdDays` | `5` | Days before expiry to trigger renewal |
|
|
122
|
+
| `checkIntervalHours` | `12` | How often the daemon checks |
|
|
123
|
+
| `watchDomains` | `[]` | Domains to watch (empty = all active) |
|
|
124
|
+
| `maxDownloadRetries` | `3` | Per-cert retry count on failure |
|
|
125
|
+
| `apiUrl` | ssl-manager.dcom.at | Custom API base URL |
|
|
126
|
+
|
|
127
|
+
## Update
|
|
128
|
+
|
|
129
|
+
```bash
|
|
130
|
+
npm install -g certops@latest
|
|
131
|
+
```
|