bocal-smtpd/cert-fetcher.sh at master · mtlaso/bocal-smtpd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#!/bin/sh

########################################################################################
#### DO NOT CHANGE FILE NAME. USED IN .github/workflows/deploy.yml and other places ####
########################################################################################
########################################################################################
#### DO NOT CHANGE FILE NAME. USED IN .github/workflows/deploy.yml and other places ####
########################################################################################
########################################################################################
#### DO NOT CHANGE FILE NAME. USED IN .github/workflows/deploy.yml and other places ####
########################################################################################
set -e

echo 'Cert-Fetcher Script: Starting...'
ERRPREFIX="Error (.sh): cert-fetcher.sh"

# These environment variables are expected to be set when this script is run
# (i.e., passed from docker-compose to the bitwarden/bws container)
# - BWS_ACCESS_TOKEN
# - BWS_PROJECT_ID
# - BWS_PRIVATEKEY_ID
# - BWS_FULLCHAIN_ID
# - TLS_CERT_PATH (e.g. app/certs/fullchain.pem)
# - TLS_KEY_PATH (e.g. app/certs/privkey.pem)


#####################
#### Install bws ####
#####################
curl https://bws.bitwarden.com/install | sh
export PATH="$PATH:/root/.local/bin"

########################################
#### Validate environment variables ####
########################################
if [ -z "$BWS_ACCESS_TOKEN" ]; then
  echo "$ERRPREFIX BWS_ACCESS_TOKEN environment variable is not set." >&2
  exit 1
fi
if [ -z "$BWS_PROJECT_ID" ]; then
  echo "$ERRPREFIX BWS_PROJECT_ID environment variable is not set." >&2
  exit 1
fi
if [ -z "$BWS_PRIVATEKEY_ID" ]; then
  echo "$ERRPREFIX BWS_PRIVATEKEY_ID environment variable is not set." >&2
  exit 1
fi
if [ -z "$BWS_FULLCHAIN_ID" ]; then
  echo "$ERRPREFIX BWS_FULLCHAIN_ID environment variable is not set." >&2
  exit 1
fi
if [ -z "$TLS_CERT_PATH" ] || [ -z "$TLS_KEY_PATH" ]; then
  echo "$ERRPREFIX TLS_CERT_PATH or TLS_KEY_PATH environment variables are not set." >&2
  exit 1
fi


########################
#### Retreive certs ####
########################
mkdir -p "$(dirname "$TLS_CERT_PATH")"
mkdir -p "$(dirname "$TLS_KEY_PATH")"

FULLCHAIN=$(bws secret get "$BWS_FULLCHAIN_ID" --access-token $BWS_ACCESS_TOKEN | jq -r '.value' | base64 --decode)
if [ -z "$FULLCHAIN" ]; then
  echo "$ERRPREFIX: Failed to fetch fullchain secret or it was empty." >&2
  exit 1
fi
echo "$FULLCHAIN" > "$TLS_CERT_PATH"
if [ $? -ne 0 ]; then
  echo "$ERRPREFIX: Failed to decode or write fullchain." >&2
  exit 1
fi

chmod 600 "$TLS_CERT_PATH"
echo "Fullchain certificate written to $TLS_CERT_PATH"

PRIVKEY=$(bws secret get "$BWS_PRIVATEKEY_ID" --access-token $BWS_ACCESS_TOKEN | jq -r '.value' | base64 --decode)
if [ -z "$PRIVKEY" ]; then
  echo "$ERRPREFIX: Failed to fetch private key secret or it was empty." >&2
  exit 1
fi
echo "$PRIVKEY" > "$TLS_KEY_PATH"
if [ $? -ne 0 ]; then
  echo "$ERRPREFIX: Failed to decode or write private key." >&2
  exit 1
fi

chmod 600 "$TLS_KEY_PATH"
echo "Private key written to $TLS_KEY_PATH"

echo "Cert-Fetcher Script: certificates fetched successfully."
exit 0 # Explicitly exit with success for service_completed_successfully condition