mirror of
https://github.com/outbackdingo/labca.git
synced 2026-01-27 10:19:34 +00:00
6d72d32398
Replace openssl certificate / CRL generation with the tool as used by Let's Encrypt, storing the keys on SoftHSMv2, a simulated HSM (Hardware Security Module). Include migration of old setups where key files were also stored on disk.
35 lines
1.3 KiB
Bash
Executable File
35 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
|
|
FILE=/opt/backup/$1
|
|
|
|
[ "$1" != "" ] || (echo "You must provide a backup file name to restore"; exit 1)
|
|
[ -f $FILE ] || (echo "Backup file '$FILE' not found"; exit 1)
|
|
|
|
BASE=$(echo "$FILE" | perl -p0e "s/.*\/(.*).tgz/\1/")
|
|
TMPDIR=/tmp/$BASE
|
|
|
|
cd /tmp
|
|
tar xzf $FILE 2>&1
|
|
|
|
cd /opt/boulder
|
|
[ -f $TMPDIR/boulder_sa_integration.sql ] || (echo "MySQL backup file not found"; exit 1)
|
|
sed -i -e "s/\(INSERT INTO \`gorp_migrations\`.*\)/-- \1/" $TMPDIR/boulder_sa_integration.sql
|
|
docker compose exec bmysql mysql boulder_sa_integration <$TMPDIR/boulder_sa_integration.sql
|
|
|
|
mv -f $TMPDIR/*key* $TMPDIR/*cert.pem $TMPDIR/*.csr /etc/nginx/ssl/
|
|
|
|
[ -d $TMPDIR/data ] || (echo "Data folder backup not found"; exit 1)
|
|
vrs=$(grep version /opt/labca/data/config.json | sed -e 's/.*:[ ]*//' | sed -e 's/\",//g' | sed -e 's/\"//g')
|
|
rm -rf /opt/labca/data/* && mv $TMPDIR/data/* /opt/labca/data/
|
|
sed -i -e "s/\"version\": \".*\"/\"version\": \"$vrs\"/" /opt/labca/data/config.json
|
|
|
|
[ -d $TMPDIR/webpki ] || (echo "Public CA files backup not found"; exit 1)
|
|
rm -rf /opt/boulder/labca/certs/webpki/* && mv $TMPDIR/webpki/* /opt/boulder/labca/certs/webpki/
|
|
|
|
[ -d $TMPDIR/tokens ] || (echo "SoftHSMv2 tokens folder backup not found"; exit 1)
|
|
rm -rf /var/lib/softhsm/tokens/* && mv $TMPDIR/tokens/* /var/lib/softhsm/tokens/
|
|
|
|
rm -rf $TMPDIR
|