From e221d5f48e4ff58efc5ab7f341696f731a662cfe Mon Sep 17 00:00:00 2001 From: Chalith Desaman Date: Wed, 7 Jun 2023 13:59:10 +0530 Subject: [PATCH] Remove existing certbot registrations if created by sashimono (#266) --- installer/sashimono-install.sh | 22 ++++++++++++++++++++-- installer/sashimono-uninstall.sh | 12 ++++++++---- installer/setup.sh | 19 ++++++++++++++----- 3 files changed, 42 insertions(+), 11 deletions(-) diff --git a/installer/sashimono-install.sh b/installer/sashimono-install.sh index 5876b5a..5d14514 100755 --- a/installer/sashimono-install.sh +++ b/installer/sashimono-install.sh @@ -97,8 +97,26 @@ WantedBy=timers.target" >/etc/systemd/system/$EVERNODE_AUTO_UPDATE_SERVICE.timer function setup_certbot() { stage "Setting up letsencrypt certbot" - # Install certbot via snap (https://certbot.eff.org/instructions?ws=other&os=ubuntufocal) - snap install core && snap refresh core && snap install --classic certbot + # Check weather there's an existing certbot installation + if command -v certbot &>/dev/null; then + # Get the current registration email if there's any. + local lenc_acc_email=$(certbot show_account 2>/dev/null | grep "Email contact:" | cut -d ':' -f2 | sed 's/ *//g') + + # If there's an existing registration with a different email and it has certificates, complain and return. + if [[ ! -z $lenc_acc_email ]] && [[ $lenc_acc_email != $email_address ]]; then + # If there are certificates complain and return. Otherwise update email. + local count=$(certbot certificates 2>/dev/null | grep -c "Certificate Name") + [ $count -gt 0 ] && + echo "There's an existing letsencrypt registration with $lenc_acc_email, Please use the same email or update the letsencrypt email with certbot." && + return 1 + + ! certbot -n update_account -m $email_address && ehco "Error when updating the existing letsencrypt account email." && return 1 + fi + else + # Install certbot via snap (https://certbot.eff.org/instructions?ws=other&os=ubuntufocal) + snap install core && snap refresh core && snap install --classic certbot + fi + ! [ -f /snap/bin/certbot ] && echo "certbot not found" && return 1 [ -f /usr/bin/certbot ] || ln -s /snap/bin/certbot /usr/bin/certbot || return 1 diff --git a/installer/sashimono-uninstall.sh b/installer/sashimono-uninstall.sh index 38969a2..c14181c 100755 --- a/installer/sashimono-uninstall.sh +++ b/installer/sashimono-uninstall.sh @@ -50,10 +50,10 @@ function remove_evernode_auto_updater() { function cleanup_certbot_ssl() { # revoke/delete certs if certbot is used. - if command -v certbot &>/dev/null && [ -f "$SASHIMONO_DATA/sa.cfg" ] ; then + if command -v certbot &>/dev/null && [ -f "$SASHIMONO_DATA/sa.cfg" ]; then local inet_addr=$(jq -r '.hp.host_address' $SASHIMONO_DATA/sa.cfg) local deploy_hook_script="/etc/letsencrypt/renewal-hooks/deploy/sashimono-$inet_addr.sh" - if [ -f $deploy_hook_script ] ; then + if [ -f $deploy_hook_script ]; then echo "Cleaning up letsencrypt ssl certs for '$inet_addr'" rm $deploy_hook_script certbot -n revoke --cert-name $inet_addr @@ -62,6 +62,10 @@ function cleanup_certbot_ssl() { echo "Cleaning up firewall rule for SSL validation" ufw delete allow 80/tcp fi + + # If there are no certificates unregister. + local count=$(certbot certificates 2>/dev/null | grep -c "Certificate Name") + [ $count -eq 0 ] && certbot unregister -n fi } @@ -200,9 +204,9 @@ echo "Deleting binaries..." rm -r $SASHIMONO_BIN if [ "$UPGRADE" == "0" ]; then - + cleanup_certbot_ssl - + echo "Deleting data directory..." rm -r $SASHIMONO_DATA fi diff --git a/installer/setup.sh b/installer/setup.sh index 770332b..eb85e60 100755 --- a/installer/setup.sh +++ b/installer/setup.sh @@ -1053,13 +1053,22 @@ function config() { # If sashimono containes the letsencrypt certificates, Update them with new email. if ( [ -f $key_file ] && cmp -s $key_file $sashimono_key_file ) || ( [ -f $renewed_key_file ] && cmp -s $renewed_key_file $sashimono_key_file ) ; then - # Get the current letsencrypt certificate. + # Get the current registration email if there's any. local lenc_acc_email=$(certbot show_account 2>/dev/null | grep "Email contact:" | cut -d ':' -f2 | sed 's/ *//g') - # Update account email only if previously configured email is same ad letsencrypt account email - # To ensure that current account is registered by sashimono - [[ $lenc_acc_email == $cur_email_address ]] && ! certbot -n update_account -m $email_address && - echo "Could not update the letsencrypt email." && return 1 + # If the emails are different, we need to update the letsencrypt email. + if [[ $lenc_acc_email != $email_address ]]; then + # If there are other certificates from this letsencrypt account, + # Complain that sashimono can't update the email since this account is used by other certificates. + local count=$(certbot certificates 2>/dev/null | grep "Certificate Name" | grep -v -c "$inet_addr") + [ $count -gt 0 ] && + echomult "Existing letsencrypt account with $lenc_acc_email has other certificates which are related to sashimono.\n + So letsencrypt email cannot be changed, Please use the same email or update the letsencrypt email with certbot." && + return 1 + + ! certbot -n update_account -m $email_address && + echo "Could not update the letsencrypt email." && return 1 + fi fi fi