###############################################################################
#
# How to gain root privileges on target systems.
#
# - USE_SUDO=true - ssh/scp as *your* username (i.e. the username as which
#   you're running the script) on the target machine, and use 'sudo' to
#   become root
#
# - USE_SUDO=false - ssh/scp directly as root on the target machine

USE_SUDO=false

###############################################################################
#
# certname K  s f   Copy key to server "s" as filename "f".
# certname S  s f   Copy server cert to server "s" as filename "f".
# certname C  s f   Copy ca cert to server "s" as filename "f".
# certname F  s f   Copy fullchain cert to server "s" as filename "f".
# certname KF s f   Copy (key + fullchain cert) as a single file,
#                     to server "s" as filename "f".
# certname R  s c   Run command "c" on server "s".
#                     This is usually to reload a service.
# certname N        Do nothing. This is useful in cases where some of your
#                   certs are deployed using some other mechanism, but you
#                   don't want `push.sh` to throw error messages.
#
#
# NOTE: The SERVER field can have one of three forms:
#
# - user@host   Authenticate as that user on that machine, and don't use sudo.
#               This could be used with machines where a specific username
#               (other than 'root') is needed, or where 'sudo' cannot be used
#               for some reason.
#
# - @host       Authenticate as yourself on that machine, but don't use sudo.
#               This is useful for Mikrotik routers, where 'sudo' is not needed
#               because each user has full access.
#
# - host        See the description of USE_SUDO above.
#
###############################################################################
#
# CERT                  TYPE    SERVER                      FILE/CMD

########################################
# example apache server
# - K filename should match SSLCertificateKeyFile
# - S filename should match SSLCertificateFile
# - C filename should match SSLCertificateChainFile

domain.xyz              K       hostname.domain.xyz         /etc/httpd/certs/domain.xyz.key
domain.xyz              S       hostname.domain.xyz         /etc/httpd/certs/domain.xyz.cer
domain.xyz              C       hostname.domain.xyz         /etc/httpd/certs/domain.xyz.ca-bundle
domain.xyz              R       hostname.domain.xyz         service httpd restart

########################################
# example nginx server
# - K filename should match ssl_certificate_key
# - F filename should match ssl_certificate

domain.xyz              K       hostname.domain.xyz         /etc/nginx/certs/domain.xyz.key
domain.xyz              F       hostname.domain.xyz         /etc/nginx/certs/domain.xyz.cer
domain.xyz              R       hostname.domain.xyz         service nginx reload

########################################
# example qmail server

mail.domain.xyz         KF      hostname.domain.xyz         /var/qmail/control/servercert.pem
mail.domain.xyz         KF      hostname.domain.xyz         /var/qmail/control/clientcert.pem
mail.domain.xyz         R       hostname.domain.xyz         chown root:nofiles /var/qmail/control/servercert.pem
mail.domain.xyz         R       hostname.domain.xyz         chown root:qmail /var/qmail/control/clientcert.pem
mail.domain.xyz         R       hostname.domain.xyz         chmod 0640 /var/qmail/control/{client,server}cert.pem
mail.domain.xyz         R       hostname.domain.xyz         svc -t /service/qmail-smtpssl /service/qmail-smtptls

########################################
# example MikroTik router

gw.domain.xyz           C       user@gw.domain.xyz          leca.cer
gw.domain.xyz           S       user@gw.domain.xyz          lecert.cer
gw.domain.xyz           K       user@gw.domain.xyz          lecert.key
gw.domain.xyz           R       user@gw.domain.xyz          /certificate remove leca.cer_0,lecert.cer_0
gw.domain.xyz           R       user@gw.domain.xyz          /certificate import passphrase="" file-name=leca.cer
gw.domain.xyz           R       user@gw.domain.xyz          /certificate import passphrase="" file-name=lecert.cer
gw.domain.xyz           R       user@gw.domain.xyz          /certificate import passphrase="" file-name=lecert.key
gw.domain.xyz           R       user@gw.domain.xyz          /ip service set www-ssl,api-ssl certificate=lecert.cer_0
gw.domain.xyz           R       user@gw.domain.xyz          /file remove lecert.cer,lecert.key

########################################
# example Synology DS-1019+
# requires `newcerts.sh` script

nas.domain.xyz          S       user@nas.domain.xyz         /root/newcerts/cert.pem
nas.domain.xyz          C       user@nas.domain.xyz         /root/newcerts/chain.pem
nas.domain.xyz          F       user@nas.domain.xyz         /root/newcerts/fullchain.pem
nas.domain.xyz          K       user@nas.domain.xyz         /root/newcerts/privkey.pem
nas.domain.xyz          R       root@nas.domain.xyz         /root/newcerts/newcerts.sh nas.domain.xyz

########################################
# exampe of a cert for which `push.sh` should do nothing

noop.domain.xyz         N