pki: T7953: implement certbot_renew() function to have everything at one place

2 files changed, 38 insertions, 15 deletions

diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index bf44dcfc7..f282eea68 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -159,6 +159,32 @@ def certbot_request(name: str, config: dict, dry_run: bool=True) -> None:
     cmd(tmp, raising=ConfigError, message=f'Certbot request failed for "{name}"!')
     return None
 
+def certbot_renew(config: dict, force: bool=False) -> None:
+    """ Renew all certificates managed via certbot """
+    tmp = f'certbot renew --no-random-sleep-on-renew ' \
+          f'--config-dir {vyos_certbot_dir}'
+
+    # Determine services using ACME based certificates
+    pre_hook_services = []
+    for used_by, _ in dict_search_recursive(config, 'used_by'):
+        pre_hook_services.extend(used_by)
+    # Remove duplicate items from list
+    pre_hook_services = list(set(pre_hook_services))
+    # Automatically add services in use to pre_hook_services depending on service
+    # name in vyos.defaults.systemd_services
+    if pre_hook_services:
+        services = []
+        for service in pre_hook_services:
+            if service in systemd_services:
+                services.append(systemd_services[service])
+        tmp += ' --pre-hook "systemctl stop ' + ' '.join(services) + '"'
+
+    if force:
+        tmp += ' --force-renewal'
+
+    print(cmd(tmp, raising=ConfigError, message=f'Certbot renew failed!'))
+    return None
+
 def get_config(config=None):
     if config:
         conf = config
@@ -172,7 +198,8 @@ def get_config(config=None):
 
     if len(argv) > 1 and argv[1] == 'certbot_renew':
         pki['certbot_renew'] = {}
-
+    elif len(argv) > 1 and argv[1] == 'certbot_renew_force':
+        pki['certbot_renew'] = {'force': {}}
 
     # Walk through the list of sync_translate mapping and build a list
     # which is later used to check if the node was changed in the CLI config
@@ -513,7 +540,8 @@ def generate(pki):
     # Certbot renewal only needs to re-trigger the services to load up the
     # new PEM file
     if 'certbot_renew' in pki:
-        return None
+        force = 'force' in pki['certbot_renew']
+        return certbot_renew(config=pki, force=force)
 
     certbot_list = []
     certbot_list_on_disk = []
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 7ee51a1ae..b84b6f02a 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -1378,7 +1378,7 @@ def renew_certbot(raw: bool, force: typing.Optional[bool] = False):
     from vyos.defaults import directories
 
     certbot_config = directories['certbot']
-    hook_dir = directories['base']
+    vyos_conf_scripts_dir = directories['conf_mode']
 
     if force and not os.path.isdir(f'{certbot_config}'):
         # Assume someone deleted the certbot_config folder, renew alone will not
@@ -1388,18 +1388,13 @@ def renew_certbot(raw: bool, force: typing.Optional[bool] = False):
         # a bad time
         Warning(f'Directory "{certbot_config}" missing. Reinitializing PKI ' \
                 'subsystem...\n\n')
-        vyos_conf_scripts_dir = directories['conf_mode']
-        cmd(f'sudo sg vyattacfg -c {vyos_conf_scripts_dir}/pki.py')
-
-    tmp = f'/usr/bin/certbot renew --no-random-sleep-on-renew ' \
-          f'--config-dir "{certbot_config}" ' \
-          f'--post-hook "{hook_dir}/vyos-certbot-renew-pki.sh"'
-    if force:
-        tmp += ' --force-renewal'
-
-    out = cmd(tmp)
-    if not raw:
-        print(out)
+        out = cmd(f'sudo sg vyattacfg -c "{vyos_conf_scripts_dir}/pki.py"')
+    elif force:
+        out = cmd(f'sudo sg vyattacfg -c "{vyos_conf_scripts_dir}/pki.py certbot_renew_force"')
+    else:
+        out = cmd(f'sudo sg vyattacfg -c "{vyos_conf_scripts_dir}/pki.py certbot_renew"')
+
+    print(out)
 
 if __name__ == '__main__':
     try: