letsencrypt-to-vault

#!/bin/bash
set -eo pipefail

echoerr() {
    >&2 echo "$@"
}

process_args() {
    # Default
    if [[ -z $VAULT_CERT_PATH ]]; then
        VAULT_CERT_PATH="certs"
    fi

    if [[ -z $CERTBOT_FLAGS ]]; then
        CERTBOT_FLAGS="--webroot --webroot-path /webroot-dir --agree-tos --renew-by-default"
    fi

    while [[ $# -gt 0 ]]
    do
        key="$1"

        case $key in
            certonly|renew)
            COMMAND="$1"
            shift
            continue
            ;;
            -h|--help)
            show_help
            exit 0
            ;;
            -t|--vault-token)
            VAULT_TOKEN="$2"
            shift 2
            continue
            ;;
            -a|--vault-addr)
            VAULT_ADDR="$2"
            shift 2
            continue
            ;;
            -p|--vault-cert-path)
            VAULT_CERT_PATH="$2"
            shift 2
            continue
            ;;
            -f|--certbot-flags)
            CERTBOT_FLAGS="$2"
            shift 2
            continue
            ;;
            -*|--*)
            echo "letsencrypt-to-vault: unknown flag: $2"
            show_help
            exit 1
            ;;
            *)
            if [[ "$COMMAND" == "certonly" ]]; then
                DOMAINS="$@"
            fi
            return
        esac
    done

    if [[ -z "$COMMAND" ]]; then
        echoerr "Command wasn't passed to script"
        echo
        show_help
        exit 1
    fi
}

show_help() {
    echo "Let's encrypt to Hashicorp Vault"
    echo
    echo "Renew or get Let's Encrypt certificates and send it to Hashicorp Vault"
    echo
    echo "Usage:"
    echo "  letsencrypt-to-vault command [-flags] [sitesnames]"
    echo
    echo "  Some flags can be set by env vars."
    echo "  Var names for this flags are in parens in flags description below"
    echo
    echo "Flags:"
    echo "      -a, --vaul-addr Address of vault server (VAULT_ADDR)"
    echo "      -f, --certbot-flags Options that are passed to certbot. Overrides default (CERTBOT_FLAGS)"
    echo "      -h, --help Show help"
    echo "      -p, --vault-cert-path Path where certs will be stored (VAULT_CERT_PATH)"
    echo "      -t, --vault-token Vault token (VAULT_TOKEN)"
}

cert_renew() {
    local certbot_domains=""

    for domain in $DOMAINS
    do
        certbot_domains+="-d $domain "
    done
    
    echo "Trying to get or renew certificates..."
    certbot $COMMAND $CERTBOT_FLAGS $certbot_domains || true
    echo "Certificates were renewed"
}

send_to_vault() { 
    local certs_dir="/etc/letsencrypt/live"

    echo "Sending certs to vault..."
    echo

    if [[ $COMMAND == "certonly" ]]; then
        local sitesnames="$DOMAINS"
    else
        local sitesnames=$(find $certs_dir -maxdepth 1 -mindepth 1 -type d -exec basename {} \;)
    fi

    for sitename in $sitesnames
    do
        local cert=$(sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/\\n/g' $certs_dir/$sitename/fullchain.pem)
        local privkey=$(sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/\\n/g' $certs_dir/$sitename/privkey.pem)

        if [[ -z "$cert" || -z "$privkey" ]]; then
            echoerr "Error: can't find cert for $sitename"

            exit 1
        fi

        curl \
            -s \
            -H "X-Vault-Token: $VAULT_TOKEN" \
            -H "Content-Type: application/json" \
            -X POST \
            -d "{\"key\":\"$privkey\", \"cert\": \"$cert\"}" \
            "$VAULT_ADDR/v1/$VAULT_CERT_PATH/$sitename"
    done

    echo "Done. Certificates were sent"
}

main() {
    process_args "$@"
    cert_renew
    send_to_vault
}

main "$@"