From be0ba28570964e3f413048fee299164965f038b5 Mon Sep 17 00:00:00 2001
From: Roland van Laar <roland@rolandvanlaar.nl>
Date: Wed, 1 Jul 2020 15:22:51 +0200
Subject: [PATCH] feat: Add show option to the certs plugin

The 'server.key' and 'server.crt' can printed to stdin.
The two options are:
    `dokku certs:show <app> key > server.key`
    `dokku certs:show <app> crt > server.crt`
This will create two files, `server.key` and `server.crt`.
Those files contain the private key and the certificate.

Includes tests.
---
 docs/configuration/ssl.md      | 11 +++++++++++
 plugins/certs/help-functions   |  1 +
 plugins/certs/subcommands/show | 28 ++++++++++++++++++++++++++++
 tests/unit/certs.bats          | 26 ++++++++++++++++++++++++++
 4 files changed, 66 insertions(+)
 create mode 100755 plugins/certs/subcommands/show

diff --git a/docs/configuration/ssl.md b/docs/configuration/ssl.md
index 8015c7b54..5455ce56a 100644
--- a/docs/configuration/ssl.md
+++ b/docs/configuration/ssl.md
@@ -9,6 +9,7 @@ certs:add <app> CRT KEY                  # Add an ssl endpoint to an app. Can al
 certs:generate <app> DOMAIN              # Generate a key and certificate signing request (and self-signed certificate)
 certs:remove <app>                       # Remove an SSL Endpoint from an app.
 certs:report [<app>] [<flag>]            # Displays an ssl report for one or more apps
+certs:show <app> <crt|key>               # Show the server.crt or server.key on stdout
 certs:update <app> CRT KEY               # Update an SSL Endpoint on an app. Can also import from a tarball on stdin
 ```
 
@@ -56,6 +57,16 @@ If you decide to obtain a CA signed certificate, you can import that certificate
 
 The `certs:remove` command only works on app-specific certificates. It will `rm` the app-specific tls directory, rebuild the nginx configuration, and reload nginx.
 
+### Showing the certificate
+
+The `certs:show` command can be used to show your configured certs for an app. The show command can be used for example to export Let's Encrypt certificates
+after they've been generated. You can export it as follows:
+
+```shell
+dokku certs:show node-js-app crt > server.crt
+dokku certs:show node-js-app key > server.key
+```
+
 ### Displaying certificate reports for an app
 
 > New as of 0.8.1
diff --git a/plugins/certs/help-functions b/plugins/certs/help-functions
index c5d153a85..0aefc2a0b 100755
--- a/plugins/certs/help-functions
+++ b/plugins/certs/help-functions
@@ -34,6 +34,7 @@ fn-help-content() {
     certs:remove <app>, Remove an SSL Endpoint from an app
     certs:report [<app>] [<flag>], Displays an ssl report for one or more apps
     certs:rollback <app>, [NOT IMPLEMENTED] Rollback an SSL Endpoint for an app
+    certs:show <app> <crt|key>, Show the server.crt or server.key on stdout
     certs:update <app> CRT KEY, Update an SSL Endpoint on an app. Can also import from a tarball on stdin
 help_content
 }
diff --git a/plugins/certs/subcommands/show b/plugins/certs/subcommands/show
new file mode 100755
index 000000000..0f3577f58
--- /dev/null
+++ b/plugins/certs/subcommands/show
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
+source "$PLUGIN_AVAILABLE_PATH/certs/functions"
+
+cmd-certs-show() {
+  declare desc="Show the server.crt or server.key on stdout"
+  declare cmd="certs:show"
+  [[ "$1" == "$cmd" ]] && shift 1
+  declare APP="$1" KEY_TYPE="$2"
+
+  [[ -z "$APP" ]] && dokku_log_fail "Please specify an app to run the command on"
+  verify_app_name "$APP"
+  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
+
+  if [[ "$KEY_TYPE" != "key" ]] && [[ "$KEY_TYPE" != "crt" ]]; then
+    dokku_log_fail "specify either 'key' or 'crt'"
+  fi
+
+  if ! is_ssl_enabled "$APP"; then
+    dokku_log_fail "$APP doesn't have an SSL endpoint defined"
+  fi
+
+  cat "$APP_SSL_PATH/server.$KEY_TYPE"
+}
+
+cmd-certs-show "$@"
diff --git a/tests/unit/certs.bats b/tests/unit/certs.bats
index e9bc7481f..a3057508f 100644
--- a/tests/unit/certs.bats
+++ b/tests/unit/certs.bats
@@ -75,3 +75,29 @@ teardown() {
   echo "status: $status"
   assert_success
 }
+
+@test "(certs) certs:show" {
+  run /bin/bash -c "dokku certs:show fake-app-name 2>&1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "App fake-app-name does not exist"
+  assert_failure
+
+  run /bin/bash -c "dokku certs:show $TEST_APP fake-var-name"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "specify either 'key' or 'crt'"
+  assert_failure
+
+  run /bin/bash -c "dokku certs:add $TEST_APP < $BATS_TEST_DIRNAME/server_ssl.tar && dokku certs:show $TEST_APP crt"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "-----END CERTIFICATE-----"
+  assert_success
+
+  run /bin/bash -c "dokku certs:add $TEST_APP < $BATS_TEST_DIRNAME/server_ssl.tar && dokku certs:show $TEST_APP key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_output_contains "-----END RSA PRIVATE KEY-----"
+  assert_success
+}