Skip to content
Snippets Groups Projects
Select Git revision
  • master default protected
  • production
  • test
  • uat
4 results
Blame Permalink
geant_acme_uploader.py 3.31 KiB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107 






#!/usr/bin/env python3
#
"""Geant Acme - Uploader

Usage:
  geant_acme_uploader.py --domain DOMAIN --client CLIENT [--verbose]
  geant_acme_uploader.py (-h | --help)

Options:
  -h --help                   Show this screen.
  -d DOMAIN --domain=DOMAIN   Domain
  -c CLIENT --client=CLIENT   Client
  -v --verbose                Print out messages
"""

import os
import configparser
import hvac
import redis
from docopt import docopt


def redis_upload(redis_host, redis_token, key, value):
    """ upload a key """
    r_client = redis.StrictRedis(
        host=redis_host, password=redis_token, port=6379, db=0)

    try:
        _ = r_client.set(key, value)
    except Exception as err:
        print('could not write key {} to Redis {}: {}'.format(key, redis_host, err))
        print('giving up...')
        os.sys.exit(1)


def redis_save(redis_host, redis_token):
    """ run save DB """
    r_client = redis.StrictRedis(
        host=redis_host, password=redis_token, port=6379, db=0)

    try:
        _ = r_client.save()
    except Exception as err:
        print('could not save to disk on Redis {}: {}'.format(redis_host, err))
        print('giving up...')
        os.sys.exit(1)


def vault_upload(vault_host, vault_token, key_name, key_value):
    """ upload key to vault """
    client = hvac.Client()
    client = hvac.Client(
        url='https://{}'.format(vault_host),
        token=vault_token
    )
    try:
        _ = client.write(key_name, value=key_value)
    except Exception as err:
        print('could not write key {} to Vault {}: {}'.format(
            key_name, vault_host, err))
        print('giving up...')
        os.sys.exit(1)


# Here we Go.
if __name__ == "__main__":

    CONFIG = configparser.RawConfigParser()
    CONFIG.read_file(open('/root/.geant_acme.ini'))
    REDIS_TOKEN = CONFIG.get('geant_acme', 'redis_token')
    VAULT_TOKEN = CONFIG.get('geant_acme', 'vault_token')
    REDIS_HOST = CONFIG.get('geant_acme', 'redis_host')
    VAULT_HOST = CONFIG.get('geant_acme', 'vault_host')

    ARGS = docopt(__doc__)
    DOMAIN = ARGS['--domain']
    CLIENT = ARGS['--client']
    VERBOSE = ARGS['--verbose']

    BASEDIR = '/etc/letsencrypt/live'

    for certname in ['cert.pem', 'chain.pem', 'fullchain.pem']:
        with open(os.path.join(BASEDIR, DOMAIN, certname), 'r') as certfile:
            certdata = certfile.read()
            domain_underscored = DOMAIN.replace('.', '_')
            # let's rename everything to .crt, which is what we normally use
            certname_renamed = certname.replace(
                'cert.pem', '.crt').replace('chain.pem', 'chain.crt')
            redis_full_path = '{}:redis_{}_{}'.format(
                CLIENT, domain_underscored, certname_renamed)

            if VERBOSE:
                print('uploading to Redis: {}'.format(redis_full_path))
            redis_upload(REDIS_HOST, REDIS_TOKEN, redis_full_path, certdata)

    with open(os.path.join(BASEDIR, DOMAIN, 'privkey.pem'), 'r') as keyfile:
        KEYDATA = keyfile.read()
        DOMAIN_UNDERSCORED = DOMAIN.replace('.', '_')
        VAULT_FULL_PATH = 'puppet/{}/vault_wildcard_{}.key'.format(
            CLIENT, DOMAIN_UNDERSCORED)

        if VERBOSE:
            print('uploading to Vault: {}'.format(VAULT_FULL_PATH))
        vault_upload(VAULT_HOST, VAULT_TOKEN, VAULT_FULL_PATH, KEYDATA)

    redis_save(REDIS_HOST, REDIS_TOKEN)