137 lines
4.4 KiB
Bash
Executable File
137 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
ui_host=oolon.kosherinata.internal
|
|
ws_host=frootmig.kosherinata.internal
|
|
app_fqdn=blekin.kosherinata.internal
|
|
|
|
repo_path=~/git/grenade/blekin
|
|
fedora_trusted_root_path=/etc/pki/ca-trust/source/anchors/root-internal.pem
|
|
fedora_intermediate_path=/etc/pki/ca-trust/source/anchors/intermediate-internal.pem
|
|
|
|
|
|
if ssh ${ws_host} 'id blekin 2> /dev/null || sudo useradd --system --create-home --home-dir /var/lib/blekin --user-group blekin'; then
|
|
echo "blekin system user created or observed on ${ws_host}"
|
|
else
|
|
echo "failed to create blekin system user on ${ws_host}"
|
|
exit 1
|
|
fi
|
|
if rsync \
|
|
--archive \
|
|
--compress \
|
|
--rsync-path 'sudo rsync' \
|
|
--chown root:root \
|
|
${repo_path}/asset/systemd/blekin.service \
|
|
${ws_host}:/etc/systemd/system/blekin.service \
|
|
&& ssh ${ws_host} sudo systemctl daemon-reload; then
|
|
echo "blekin.service synced to ${ws_host}"
|
|
else
|
|
echo "failed to sync blekin.service to ${ws_host}"
|
|
exit 1
|
|
fi
|
|
if ssh ${ws_host} systemctl is-active --quiet blekin.service; then
|
|
if ssh ${ws_host} sudo systemctl restart blekin.service; then
|
|
echo "blekin.service restarted on ${ws_host}"
|
|
else
|
|
echo "failed to restart blekin.service on ${ws_host}"
|
|
exit 1
|
|
fi
|
|
else
|
|
if ssh ${ws_host} sudo systemctl start blekin.service; then
|
|
echo "blekin.service started on ${ws_host}"
|
|
else
|
|
echo "failed to start blekin.service on ${ws_host}"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
app_cert_is_valid=false
|
|
app_cert_remote_path=/etc/nginx/tls/cert/${app_fqdn}.pem
|
|
app_key_remote_path=/etc/nginx/tls/key/${app_fqdn}.pem
|
|
app_cert_local_path=/tmp/${app_fqdn}.pem
|
|
|
|
if rsync \
|
|
--archive \
|
|
--compress \
|
|
--rsync-path 'sudo rsync' \
|
|
${ui_host}:${app_cert_remote_path} \
|
|
${app_cert_local_path} 2> /dev/null; then
|
|
if openssl verify \
|
|
-trusted ${fedora_trusted_root_path} \
|
|
-untrusted ${fedora_intermediate_path} \
|
|
${app_cert_local_path}; then
|
|
echo "verified ${app_fqdn} cert from ${ui_host}"
|
|
app_cert_is_valid=true
|
|
else
|
|
echo "failed to verify ${app_fqdn} cert from ${ui_host}"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "observed missing ${app_fqdn} cert on ${ui_host}"
|
|
fi
|
|
if [ "${app_cert_is_valid}" = "true" ]; then
|
|
echo "observed valid cert for ${app_fqdn} on ${ui_host}"
|
|
else
|
|
if rsync \
|
|
--archive \
|
|
--compress \
|
|
--rsync-path 'sudo rsync' \
|
|
--chmod 600 \
|
|
--chown root:root \
|
|
~/.step/secrets/provisioner \
|
|
${ui_host}:/tmp/provisioner; then
|
|
echo "provisioner secret synced to ${ui_host}"
|
|
else
|
|
echo "failed to sync provisioner secret to ${ui_host}"
|
|
exit 1
|
|
fi
|
|
if ssh ${ui_host} sudo step ca certificate \
|
|
--force \
|
|
--provisioner lair \
|
|
--provisioner-password-file /tmp/provisioner \
|
|
--ca-url https://ca.internal \
|
|
--root /etc/pki/ca-trust/source/anchors/root-internal.pem \
|
|
--san ${app_fqdn} \
|
|
${app_fqdn} \
|
|
${app_cert_remote_path} \
|
|
${app_key_remote_path}; then
|
|
echo "acquired ${app_fqdn} cert on ${ui_host}"
|
|
else
|
|
echo "failed to acquire ${app_fqdn} cert on ${ui_host}"
|
|
fi
|
|
ssh ${ui_host} sudo rm -f /tmp/provisioner
|
|
fi
|
|
|
|
if rsync \
|
|
--archive \
|
|
--compress \
|
|
--rsync-path 'sudo rsync' \
|
|
--chown root:root \
|
|
${repo_path}/asset/nginx/${app_fqdn}.conf \
|
|
${ui_host}:/etc/nginx/sites-available/${app_fqdn}.conf; then
|
|
echo "${app_fqdn}.conf synced to ${ui_host}"
|
|
else
|
|
echo "failed to sync ${app_fqdn}.conf to ${ui_host}"
|
|
fi
|
|
if ssh ${ui_host} sudo ln -sf /etc/nginx/sites-available/${app_fqdn}.conf /etc/nginx/sites-enabled/${app_fqdn}.conf; then
|
|
echo "${app_fqdn} enabled on ${ui_host}"
|
|
else
|
|
echo "failed to enable ${app_fqdn} on ${ui_host}"
|
|
fi
|
|
if ssh ${ui_host} 'sudo nginx -t && sudo systemctl reload nginx.service'; then
|
|
echo "nginx reloaded on ${ui_host}"
|
|
else
|
|
echo "failed to reload nginx on ${ui_host}"
|
|
fi
|
|
|
|
# todo:
|
|
|
|
# frootmig:
|
|
# sudo useradd --system --create-home --home-dir /var/lib/blekin --user-group blekin
|
|
# sync asset/sudoers.d/ws_gitea_ci to /etc/sudoers.d/gitea_ci
|
|
|
|
# oolon:
|
|
# ssh ${ui_host} sudo mkdir -p /etc/nginx/tls/${app_fqdn}
|
|
# sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/blekin.kosherinata.internal(/.*)?"
|
|
# sudo restorecon -Rv /var/www/blekin.kosherinata.internal/
|
|
# sync asset/sudoers.d/ui_gitea_ci to /etc/sudoers.d/gitea_ci
|