Rework letsencrypt

This patch is adding "API layer" to letsencrypt
images which is represented by set of scripts inside.

This scripts are called by kolla-ansible orchestration.

Change-Id: I61b70fb4e12ba03b96e79004e735d2ead0f52319

3 files changed, 140 insertions, 2 deletions

diff --git a/docker/haproxy/haproxy-ssh/Dockerfile.j2 b/docker/haproxy/haproxy-ssh/Dockerfile.j2
index 8eecc8891..b8277a237 100644
--- a/docker/haproxy/haproxy-ssh/Dockerfile.j2
+++ b/docker/haproxy/haproxy-ssh/Dockerfile.j2
@@ -13,6 +13,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
     {% set haproxy_ssh_packages = [
         'openssh-server',
         'openssh-clients',
+        'rsync',
     ] %}
 
 # NOTE(mgoddard): The centos:8 image contains a /run/nologin file, which
@@ -23,6 +24,7 @@ RUN rm -f /run/nologin
     {% set haproxy_ssh_packages = [
         'openssh-server',
         'openssh-client',
+        'rsync',
     ] %}
 
 RUN mkdir -p /var/run/sshd \
@@ -36,5 +38,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd
 
+COPY update-haproxy-cert.sh /usr/bin/update-haproxy-cert
+
 {% block haproxy_ssh_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/haproxy/haproxy-ssh/extend_start.sh b/docker/haproxy/haproxy-ssh/extend_start.sh
index d571e7292..421e4bd6f 100644
--- a/docker/haproxy/haproxy-ssh/extend_start.sh
+++ b/docker/haproxy/haproxy-ssh/extend_start.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-SSH_HOST_KEY_TYPES=( "ecdsa" )
+SSH_HOST_KEY_TYPES=( "rsa" "dsa" "ecdsa" "ed25519" )
 
 for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
     KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
@@ -12,5 +12,26 @@ done
 mkdir -p /var/lib/haproxy/.ssh
 
 if [[ $(stat -c %U:%G /var/lib/haproxy/.ssh) != "haproxy:haproxy" ]]; then
-    sudo chown haproxy: /var/lib/haproxy/.ssh
+    chown haproxy: /var/lib/haproxy/.ssh
 fi
+
+FOLDERS_LEGO="/etc/letsencrypt /etc/letsencrypt/backups"
+USERGROUP="haproxy:haproxy"
+
+for folder in ${FOLDERS_LEGO}; do
+    mkdir -p ${folder}
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP}" ]]; then
+        chown ${USERGROUP} ${folder}
+    fi
+
+    if [[ "${folder}" == "/etc/letsencrypt" ]]; then
+        if [[ $(stat -c %a ${folder}) != "751" ]]; then
+            chmod 751 ${folder}
+        fi
+    else
+        if [[ $(stat -c %a ${folder}) != "755" ]]; then
+            chmod 755 ${folder}
+        fi
+    fi
+done
diff --git a/docker/haproxy/haproxy-ssh/update-haproxy-cert.sh b/docker/haproxy/haproxy-ssh/update-haproxy-cert.sh
new file mode 100755
index 000000000..61a5d0806
--- /dev/null
+++ b/docker/haproxy/haproxy-ssh/update-haproxy-cert.sh
@@ -0,0 +1,113 @@
+#!/bin/bash
+
+function haproxy_transaction_start {
+    local cert_input=${1}
+    local cert_dest=${2}
+
+    local transaction_result=""
+    local transaction_grep_check=""
+
+    transaction_grep_check="Transaction (created|updated) for certificate $(echo $cert_dest | sed -e 's|/|\\/|g')!"
+    transaction_result=$(echo -e "set ssl cert ${cert_dest} <<\n$(cat ${cert_input})\n" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock -)
+    if echo "${transaction_result}" | grep -Pq "${transaction_grep_check}"; then
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [INFO] [${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} started."
+    else
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [ERROR] [${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} failed."
+        exit 1
+    fi
+
+    local cert_input_sha1=""
+    local cert_dest_sha1=""
+
+    cert_input_sha1=$(openssl x509 -noout -fingerprint -sha1 -inform pem -in ${cert_input} | awk -F '=' '{print $2}' | sed -e 's/://g')
+    cert_dest_sha1=$(echo "show ssl cert *${cert_dest}" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock - | awk -F 'SHA1 FingerPrint: ' '{print $2}' | sed '/^$/d')
+    if [ "${cert_input_sha1}" = "${cert_dest_sha1}" ]; then
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [INFO] [${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} successfull."
+    else
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [ERROR] [${cert_dest} - update] Transaction ${cert_input} -> ${cert_dest} failed."
+        exit 1
+    fi
+}
+
+function haproxy_upload_to_memory {
+    local cert_input=${1}
+    local cert_dest=${2}
+
+    local cert_upload_output=""
+
+    cert_upload_output=$(echo "commit ssl cert ${cert_dest}" | socat unix-connect:/var/lib/kolla/haproxy/haproxy.sock -)
+    if echo "${cert_upload_output}" | grep -q "Success!"; then
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [INFO] [${cert_dest} - update] Certificate ${cert_input} uploaded to haproxy memory."
+    else
+        echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [ERROR] [${cert_dest} - update] Certificate ${cert_input} upload to haproxy memory failed."
+        exit 1
+    fi
+}
+
+function haproxy_write_to_disk {
+    local cert_input=${1}
+    local cert_haproxy_path=${2}
+
+    local cert_backup_suffix=""
+    local cert_backup_path=""
+    local cert_backup_name=""
+
+    cert_backup_suffix="-$(date +%Y-%m-%d-%H-%M-%S).pem"
+    cert_backup_path=$(echo "${cert_input}" | awk -v suffix="$cert_backup_suffix" -F '.pem' '{print $1suffix}')
+    cert_backup_name=$(echo ${cert_backup_path} | awk -F '/' '{print $NF}')
+    mkdir -p /etc/letsencrypt/backups
+    echo "$(date +%Y/%m-%d) $(date +%H:%M:%S) [INFO] [${cert_haproxy_path} - update] Backuping currently loaded ${cert_haproxy_path} -> /etc/letsencrypt/backups/${cert_backup_name}"
+    cp -a ${cert_haproxy_path} /etc/letsencrypt/backups/${cert_backup_name}
+    cp -a ${cert_input} ${cert_haproxy_path}
+    rm -f ${cert_input}
+}
+
+
+# Parser
+
+INTERNAL_SET="false"
+EXTERNAL_SET="false"
+
+VALID_ARGS=$(getopt -o ie --long internal,external -- "$@")
+if [[ $? -ne 0 ]]; then
+    exit 1;
+fi
+
+eval set -- "$VALID_ARGS"
+while [ : ]; do
+    case "$1" in
+        -i | --internal)
+            CERT_TYPE="internal"
+            INTERNAL_SET="true"
+            shift
+            ;;
+        -e | --external)
+            CERT_TYPE="external"
+            EXTERNAL_SET="true"
+            shift
+            ;;
+        --) shift;
+            break
+            ;;
+    esac
+done
+
+if [ "${INTERNAL_SET}" = "true" ] || [ "${EXTERNAL_SET}" = "true" ]; then
+    if [ "${INTERNAL_SET}" = "${EXTERNAL_SET}" ]; then
+        echo "[e] Only --internal or --external parameter is allowed at a time"
+        exit 1
+    fi
+    if [ "${INTERNAL_SET}" = "true" ]; then
+        HAPROXY_CERT_INCOMING_PATH="/var/lib/haproxy/haproxy-internal.pem"
+        HAPROXY_CERT_PATH="/etc/haproxy/certificates/haproxy-internal.pem"
+    else
+        HAPROXY_CERT_INCOMING_PATH="/var/lib/haproxy/haproxy.pem"
+        HAPROXY_CERT_PATH="/etc/haproxy/certificates/haproxy.pem"
+    fi
+fi
+
+# Main
+
+haproxy_transaction_start ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}
+haproxy_upload_to_memory ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}
+haproxy_write_to_disk ${HAPROXY_CERT_INCOMING_PATH} ${HAPROXY_CERT_PATH}