121 lines
3.8 KiB
Django/Jinja
121 lines
3.8 KiB
Django/Jinja
#!/bin/bash
|
||
#
|
||
# LetsEncrypt Integration for FreeIPA with Backup and Recovery
|
||
#
|
||
# Linux-Server-Admin.com
|
||
#
|
||
{{ certbot_message | default (admin_message ) | comment }}
|
||
#
|
||
# This script obtains a Let’s Encrypt certificate for FreeIPA and integrates it.
|
||
# It also creates backups and provides instructions for recovery.
|
||
#
|
||
# USAGE:
|
||
# sudo ./letsencrypt-freeipa.sh
|
||
#
|
||
# REQUIREMENTS:
|
||
# - FreeIPA server with ipa-cacert-manage, ipa-certupdate, ipa-server-certinstall, and ipactl available.
|
||
# - Certbot certificates must already be present in /etc/letsencrypt/live/$IPADOMAIN/.
|
||
#
|
||
|
||
set -euo pipefail
|
||
|
||
### VARIABLES ###
|
||
IPADOMAIN="{{ certbot_ipa_domain | default(inventory_hostname) }}"
|
||
TEMP_DIR="{{ certbot_temp_dir | default('/tmp/letsencrypt/') }}"
|
||
ADMIN_EMAIL="{{ certbot_admin_email | default('root@localhost') }}"
|
||
|
||
CERTS_URL="https://letsencrypt.org/certs/"
|
||
CERTS_BASE=("isrgrootx1.pem" "isrg-root-x2.pem")
|
||
|
||
CERTS_EXTRA_URL="https://letsencrypt.org/certs/2024/"
|
||
CERTS_EXTRA=("e5.pem" "e6.pem" "r10.pem" "r11.pem")
|
||
|
||
CERTDIR="/etc/letsencrypt/live/$IPADOMAIN/"
|
||
|
||
TIMESTAMP=$(date +%Y%m%d%H%M%S)
|
||
BACKUP_DIR="/var/lib/ipa-backups/${TIMESTAMP}"
|
||
|
||
### FUNCTIONS ###
|
||
# If something fails after we start modifying certs, you may need to restore.
|
||
restore_instructions() {
|
||
echo "### ERROR DETECTED ###"
|
||
echo "To restore from backups:"
|
||
echo "- If only certs and private directories changed, restore from backups:"
|
||
echo " cp -r /var/lib/ipa/certs.bak.${TIMESTAMP} /var/lib/ipa/certs"
|
||
echo " cp -r /var/lib/ipa/private.bak.${TIMESTAMP} /var/lib/ipa/private"
|
||
echo " ipa-certupdate"
|
||
echo " ipactl restart"
|
||
echo ""
|
||
echo "- If the FreeIPA state is more severely disrupted, use ipa-restore:"
|
||
echo " ipa-restore --from-backup /var/lib/ipa/backup/${TIMESTAMP}"
|
||
echo "You will need to confirm the restore when prompted."
|
||
exit 1
|
||
}
|
||
|
||
trap restore_instructions ERR
|
||
|
||
### MAIN SCRIPT ###
|
||
|
||
echo "### Creating working directory"
|
||
mkdir -p "${TEMP_DIR}"
|
||
cd "${TEMP_DIR}"
|
||
|
||
echo "### Creating timestamped backups for IPA certs and private keys"
|
||
mkdir -p "${BACKUP_DIR}"
|
||
|
||
# Back up existing certs and keys
|
||
cp -r /var/lib/ipa/certs "/var/lib/ipa/certs.bak.${TIMESTAMP}"
|
||
cp -r /var/lib/ipa/private "/var/lib/ipa/private.bak.${TIMESTAMP}"
|
||
|
||
# Optional: Create a full FreeIPA backup for complete rollback if needed.
|
||
# Note: This can be commented out if you do not want a full backup.
|
||
echo "### Performing a full FreeIPA backup"
|
||
ipa-backup
|
||
|
||
echo "### Downloading Let’s Encrypt root certificates"
|
||
for CERT_BASE in "${CERTS_BASE[@]}"; do
|
||
curl -fSLo "${TEMP_DIR}${CERT_BASE}" "${CERTS_URL}${CERT_BASE}"
|
||
done
|
||
|
||
echo "### Downloading additional Let’s Encrypt certificates"
|
||
for CERT_EXTRA in "${CERTS_EXTRA[@]}"; do
|
||
curl -fSLo "${TEMP_DIR}${CERT_EXTRA}" "${CERTS_EXTRA_URL}${CERT_EXTRA}"
|
||
done
|
||
|
||
echo "### Installing Root Certificates into IPA CA Store"
|
||
for CERT_BASE in "${CERTS_BASE[@]}"; do
|
||
ipa-cacert-manage install "${TEMP_DIR}${CERT_BASE}"
|
||
done
|
||
|
||
echo "### Installing Additional Certificates into IPA CA Store"
|
||
for CERT_EXTRA in "${CERTS_EXTRA[@]}"; do
|
||
ipa-cacert-manage install "${TEMP_DIR}${CERT_EXTRA}"
|
||
done
|
||
|
||
echo "### Updating CA certificates in IPA"
|
||
ipa-certupdate
|
||
|
||
echo "### Installing Let’s Encrypt server certificates"
|
||
# Ensure that fullchain.pem and privkey.pem exist
|
||
if [[ ! -f "${CERTDIR}fullchain.pem" || ! -f "${CERTDIR}privkey.pem" ]]; then
|
||
echo "ERROR: The Let's Encrypt certificates are not present in ${CERTDIR}"
|
||
exit 1
|
||
fi
|
||
|
||
ipa-server-certinstall -w -d \
|
||
"${CERTDIR}privkey.pem" \
|
||
"${CERTDIR}fullchain.pem" \
|
||
--pin=''
|
||
|
||
echo "### Restarting IPA services"
|
||
ipactl restart
|
||
|
||
echo "### Cleanup"
|
||
rm -rf "${TEMP_DIR}"
|
||
|
||
echo "### Done!"
|
||
echo "The Let’s Encrypt certificates have been installed successfully."
|
||
echo "If you need to restore at any point, follow the instructions in the error handler above."
|
||
|
||
|