github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add support for certificate setting via files on disk (when on server)

Browse Source 
This can be used as an alternative to importing via stdin, which may be preferred when working directly on a server, or via scripted installation/deployments.
This commit is contained in:
Jose Diaz-Gonzalez
2015-09-04 00:13:48 -04:00
parent 71ebf1e476
commit 76cf4d2969
2 changed files with 48 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/deployment/ssl-configuration.md
View File

@@ -5,10 +5,11 @@
Dokku supports SSL/TLS certificate inspection and CSR/Self-signed certificate generation via the `certs` plugin. Note that whenever SSL/TLS support is enabled SPDY is also enabled. Dokku supports SSL/TLS certificate inspection and CSR/Self-signed certificate generation via the `certs` plugin. Note that whenever SSL/TLS support is enabled SPDY is also enabled.
``` ```
certs:add <app> Add an ssl endpoint to an app. Imports a tarball from stdin; should contain server.crt and server.key certs:add <app> CRT KEY Add an ssl endpoint to an app. Can also import from a tarball on stdin.
certs:generate <app> DOMAIN Generate a key and certificate signing request (and self-signed certificate) certs:generate <app> DOMAIN Generate a key and certificate signing request (and self-signed certificate)
certs:info <app> Show certificate information for an ssl endpoint. certs:info <app> Show certificate information for an ssl endpoint.
certs:remove <app> Remove an SSL Endpoint from an app. certs:remove <app> Remove an SSL Endpoint from an app.
certs:update <app> CRT KEY Update an SSL Endpoint on an app. Can also import from a tarball on stdin
``` ```
## Per-application certificate management ## Per-application certificate management
@@ -50,7 +51,7 @@ root@dokku:~/dokku# dokku certs:info node-js-app
=====> SSL certificate is self signed. =====> SSL certificate is self signed.
``` ```
### `certs:remove` command ### Certificate removal
The `certs:remove` command only works on app-specific certificates. It will `rm` the app-specific tls directory, rebuild the nginx configuration, and reload nginx. The `certs:remove` command only works on app-specific certificates. It will `rm` the app-specific tls directory, rebuild the nginx configuration, and reload nginx.

71
plugins/certs/commands
View File

@@ -3,34 +3,53 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
source "$(dirname $0)/../common/functions" source "$(dirname $0)/../common/functions"
source "$(dirname $0)/functions" source "$(dirname $0)/functions"
certs_set() { is_tar_import() {
[[ -z $2 ]] && echo "Please specify an app to run the command on" && exit 1 [[ -t 0 ]] && return 1
verify_app_name "$2" return 0
[[ -t 0 ]] && echo "Tar archive containing server.crt and server.key expected on stdin" && exit 1 }
APP="$2"
TEMP_DIR=$(mktemp -d) is_file_import() {
cd $TEMP_DIR local CRT_FILE="$3"
tar xvf - <&0 local KEY_FILE="$4"
CRT_FILE_SEARCH=$(find . -type f -name "*.crt") if [[ -f $CRT_FILE ]] && [[ -f $KEY_FILE]]; then
CRT_FILE_COUNT=$(printf "%s" "$CRT_FILE_SEARCH" | grep -c '^') return 0
if [[ $CRT_FILE_COUNT -lt 1 ]]; then
echo "Tar archive is missing .crt file" && exit 1
elif [[ $CRT_FILE_COUNT -gt 1 ]]; then
echo "Tar archive contains more than one .crt file" && exit 1
else
CRT_FILE=$CRT_FILE_SEARCH
fi fi
KEY_FILE_SEARCH=$(find . -type f -name "*.key") return 1
KEY_FILE_COUNT=$(printf "%s" "$KEY_FILE_SEARCH" | grep -c '^') }
if [[ $KEY_FILE_COUNT -lt 1 ]]; then
echo "Tar archive is missing .key file" && exit 1 certs_set() {
elif [[ $KEY_FILE_COUNT -gt 1 ]]; then [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on"
echo "Tar archive contains more than one .key file" && exit 1 verify_app_name "$2"
else APP="$2"; CRT_FILE="$3"; KEY_FILE="$4"
KEY_FILE=$KEY_FILE_SEARCH
is_file_import || is_tar_import || dokku_log_fail "Tar archive containing server.crt and server.key expected on stdin"
if is_tar_import
TEMP_DIR=$(mktemp -d)
cd $TEMP_DIR
tar xvf - <&0
CRT_FILE_SEARCH=$(find . -type f -name "*.crt")
CRT_FILE_COUNT=$(printf "%s" "$CRT_FILE_SEARCH" | grep -c '^')
if [[ $CRT_FILE_COUNT -lt 1 ]]; then
dokku_log_fail "Tar archive is missing .crt file"
elif [[ $CRT_FILE_COUNT -gt 1 ]]; then
dokku_log_fail "Tar archive contains more than one .crt file"
else
CRT_FILE=$CRT_FILE_SEARCH
fi
KEY_FILE_SEARCH=$(find . -type f -name "*.key")
KEY_FILE_COUNT=$(printf "%s" "$KEY_FILE_SEARCH" | grep -c '^')
if [[ $KEY_FILE_COUNT -lt 1 ]]; then
dokku_log_fail "Tar archive is missing .key file"
elif [[ $KEY_FILE_COUNT -gt 1 ]]; then
dokku_log_fail "Tar archive contains more than one .key file"
else
KEY_FILE=$KEY_FILE_SEARCH
fi
fi fi
mkdir -p "$DOKKU_ROOT/$APP/tls" mkdir -p "$DOKKU_ROOT/$APP/tls"
@@ -137,11 +156,11 @@ case "$1" in
help | certs:help) help | certs:help)
cat && cat<<EOF cat && cat<<EOF
certs:add <app>, Add an ssl endpoint to an app. Imports a tarball from stdin; should contain server.crt and server.key certs:add <app> CRT KEY, Add an ssl endpoint to an app. Can also import from a tarball on stdin
certs:generate <app> DOMAIN, Generate a key and certificate signing request (and self-signed certificate) certs:generate <app> DOMAIN, Generate a key and certificate signing request (and self-signed certificate)
certs:info <app>, Show certificate information for an ssl endpoint. certs:info <app>, Show certificate information for an ssl endpoint.
certs:remove <app>, Remove an SSL Endpoint from an app. certs:remove <app>, Remove an SSL Endpoint from an app.
certs:update <app>, Update an SSL Endpoint on an app. Imports a tarball from stdin; should contain server.crt and server.key certs:update <app> CRT KEY, Update an SSL Endpoint on an app. Can also import from a tarball on stdin
EOF EOF
;; ;;