dokku/plugins/certs/internal-functions

#!/usr/bin/env bash
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/certs/functions"
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x

fn-certs-set() {
  declare desc="installs an SSL cert/key pair onto an app"
  declare APP="$1" CRT_FILE="$2" KEY_FILE="$3"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if [[ -z "$CRT_FILE" ]] || [[ -z "$KEY_FILE" ]]; then
    dokku_log_fail "Both CRT and KEY file paths are required"
  fi

  if [[ ! -r "$CRT_FILE" ]]; then
    dokku_log_fail "CRT file specified not found, please check file paths"
  fi

  if [[ ! -r "$KEY_FILE" ]]; then
    dokku_log_fail "KEY file specified not found, please check file paths"
  fi

  mkdir -p "$APP_SSL_PATH"
  rm -f "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
  cp "$CRT_FILE" "$APP_SSL_PATH/server.crt"
  cp "$KEY_FILE" "$APP_SSL_PATH/server.key"
  chmod 750 "$APP_SSL_PATH"
  chmod 640 "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.key"
  plugn trigger post-certs-update "$APP"
  plugn trigger post-domains-update "$APP"
}

fn-certs-remove() {
  declare desc="removes the SSL cert/key pair from an app"
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if [[ ! -d "$APP_SSL_PATH" ]]; then
    dokku_log_fail "An app-specific SSL endpoint is not defined"
  fi

  dokku_log_info1 "Removing SSL endpoint from $APP"
  rm -rf "$APP_SSL_PATH"
  plugn trigger post-certs-remove "$APP"
  plugn trigger post-domains-update "$APP"
}

cmd-certs-report() {
  declare desc="displays an ssl report for one or more apps"
  declare cmd="certs:report"
  [[ "$1" == "$cmd" ]] && shift 1
  fn-report-parse-args "$@"
  set -- "${REPORT_ARGS[@]}"
  declare APP="${1:-}" INFO_FLAG="${2:-}"

  if [[ -n "$APP" ]] && [[ "$APP" == --* ]]; then
    INFO_FLAG="$APP"
    APP=""
  fi

  if [[ "$REPORT_IS_GLOBAL" == "true" ]]; then
    APP="--global"
  fi

  if [[ -z "$APP" ]] && [[ -z "$INFO_FLAG" ]]; then
    INFO_FLAG="true"
  fi

  if [[ "$APP" == "--global" ]]; then
    cmd-certs-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
  elif [[ -z "$APP" ]]; then
    for app in $(dokku_apps); do
      cmd-certs-report-single "$app" "$INFO_FLAG" "$REPORT_FORMAT" | tee || true
    done
  else
    cmd-certs-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
  fi
}

cmd-certs-report-single() {
  declare APP="$1" INFO_FLAG="$2" FORMAT="${3:-stdout}"
  if [[ "$INFO_FLAG" == "true" ]]; then
    INFO_FLAG=""
  fi
  local flag_map=()
  if [[ "$APP" != "--global" ]]; then
    verify_app_name "$APP"
    flag_map=(
      "--ssl-dir: $DOKKU_ROOT/$APP/tls"
      "--ssl-enabled: $(fn-ssl-enabled "$APP")"
      "--ssl-hostnames: $(fn-ssl-hostnames "$APP")"
      "--ssl-expires-at: $(fn-ssl-expires-at "$APP")"
      "--ssl-issuer: $(fn-ssl-issuer "$APP")"
      "--ssl-starts-at: $(fn-ssl-starts-at "$APP")"
      "--ssl-subject: $(fn-ssl-subject "$APP")"
      "--ssl-verified: $(fn-ssl-verified "$APP")"
    )
  fi

  fn-report-validate-format "$FORMAT" "$INFO_FLAG"

  if [[ "$FORMAT" == "json" ]]; then
    fn-report-emit-json flag_map "ssl"
    return
  fi

  if [[ -z "$INFO_FLAG" ]]; then
    if [[ "$APP" == "--global" ]]; then
      dokku_log_info2_quiet "global ssl information"
    else
      dokku_log_info2_quiet "$APP ssl information"
    fi
    for flag in "${flag_map[@]}"; do
      key="$(echo "${flag#--}" | cut -f1 -d' ' | tr - ' ')"
      dokku_log_verbose "$(printf "%-30s %-25s" "${key^}" "${flag#*: }")"
    done
  else
    local match=false
    for flag in "${flag_map[@]}"; do
      valid_flags="${valid_flags} $(echo "$flag" | cut -d':' -f1)"
      if [[ "$flag" == "${INFO_FLAG}:"* ]]; then
        value=${flag#*: }
        size="${#value}"
        if [[ "$size" -ne 0 ]]; then
          echo "$value" && match=true
        else
          match=true
        fi
      fi
    done
    [[ "$match" == "true" ]] || dokku_log_fail "Invalid flag passed, valid flags:${valid_flags}"
  fi
}

fn-ssl-enabled() {
  declare APP="$1"
  local SSL_ENABLED=false

  if is_ssl_enabled "$APP"; then
    SSL_ENABLED=true
  fi
  echo "$SSL_ENABLED"
}

fn-ssl-expires-at() {
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if is_ssl_enabled "$APP"; then
    openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }'
  fi
}

fn-ssl-hostnames() {
  declare APP="$1"

  if is_ssl_enabled "$APP"; then
    get_ssl_hostnames "$APP" | xargs
  fi
}

fn-ssl-issuer() {
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if is_ssl_enabled "$APP"; then
    openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Issuer:" | head -n1 | sed -e 's/Issuer: //g' -e 's/^[[:space:]]*//'
  fi
}

fn-ssl-starts-at() {
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if is_ssl_enabled "$APP"; then
    openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }'
  fi
}

fn-ssl-subject() {
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"

  if is_ssl_enabled "$APP"; then
    openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -subject | sed -e "s:subject= ::g" | sed -e "s:^/::g" | sed -e "s:/:; :g"
  fi
}

fn-ssl-verified() {
  declare APP="$1"
  local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
  local SSL_VERIFY_OUTPUT=false SSL_SELF_SIGNED="self signed"

  if ! is_ssl_enabled "$APP"; then
    return
  fi

  if [[ -f "$APP_SSL_PATH/server.letsencrypt.crt" ]]; then
    SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver -CAfile "$APP_SSL_PATH/server.crt" "$APP_SSL_PATH/server.letsencrypt.crt" 2>/dev/null | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)"
  else
    SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver "$APP_SSL_PATH/server.crt" 2>/dev/null | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)"
  fi

  if [[ "$SSL_VERIFY_OUTPUT" == "OK" ]]; then
    SSL_SELF_SIGNED="verified by a certificate authority"
  fi

  echo "$SSL_SELF_SIGNED"
}