#!/usr/bin/env bash script_name="$(basename $(realpath $0))" working_dir="$(dirname $(realpath $0))" #conf_file="${working_dir}/conf/${script_name%%.*}.conf" conf_file="${working_dir}/conf/keycloak.conf" LOCK_DIR="/tmp/$(basename $0).$$.LOCK" log_file="${LOCK_DIR}/${script_name%%.*}.log" backup_date="$(date +%Y-%m-%d-%H%M)" crontab_backup_file="${working_dir}/crontab-root-${backup_date}" # ---------- # Base Function(s) # ---------- clean_up() { # Perform program exit housekeeping rm -rf "$LOCK_DIR" blank_line exit $1 } echononl(){ if $terminal ; then echo X\\c > /tmp/shprompt$$ if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then echo -e -n " $*\\c" 1>&2 else echo -e -n " $*" 1>&2 fi rm /tmp/shprompt$$ fi } fatal(){ if $terminal ; then echo "" echo -e " [ \033[31m\033[1mFatal\033[m ] $*" echo "" echo -e " \033[1mScript is canceled\033[m.." echo "" else echo "" echo -e " [ Fatal ] $*" echo "" echo -e " Script is canceled.." echo "" fi if [[ -f "${crontab_backup_file}" ]]; then echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.." crontab ${crontab_backup_file} > /dev/null 2>&1 if [[ $? -eq 0 ]]; then echo_ok rm -f ${crontab_backup_file} > /dev/null 2>&11 else echo_failed error "$(cat $log_file)" fi fi rm -rf $LOCK_DIR exit 1 } error (){ echo "" if $terminal ; then echo -e " [ \033[31m\033[1mError\033[m ] $*" else echo " [ Error ] $*" fi echo "" } warn (){ echo "" if $terminal ; then echo -e " [ \033[33m\033[1mWarning\033[m ] $*" else echo " [ Error ] $*" fi echo "" } info (){ if $terminal ; then echo "" if $terminal ; then echo -e " [ \033[32m\033[1mInfo\033[m ] $*" else echo " [ Info ] $*" fi echo "" fi } echo_ok() { if $terminal ; then echo -e "\033[85G[ \033[32mok\033[m ]" fi } echo_failed(){ if $terminal ; then echo -e "\033[85G[ \033[1;31mfailed\033[m ]" fi } echo_skipped() { if $terminal ; then echo -e "\033[85G[ \033[33m\033[1mskipped\033[m ]" fi } echo_wait(){ if $terminal ; then echo -en "\033[85G[ \033[5m\033[1m..\033[m ]" fi } trim() { local var="$*" var="${var#"${var%%[![:space:]]*}"}" # remove leading whitespace characters var="${var%"${var##*[![:space:]]}"}" # remove trailing whitespace characters echo -n "$var" } blank_line() { if $terminal ; then echo "" fi } detect_os () { if $(which lsb_release > /dev/null 2>&1) ; then DIST="$(lsb_release -i | awk '{print tolower($3)}')" DIST_VERSION="$(lsb_release -r | awk '{print tolower($2)}')" DIST_CODENAME="$(lsb_release -c | awk '{print tolower($2)}')" if [[ "$DIST" = "debian" ]]; then if $(echo "$DIST_VERSION" | grep -q '\.') ; then DIST_VERSION=$(echo "$DIST_VERSION" | cut --delimiter='.' -f1) fi fi elif [[ -e "/etc/os-release" ]]; then . /etc/os-release DIST=$ID DIST_VERSION=${VERSION_ID} fi # remove whitespace from DIST and DIST_VERSION DIST="${DIST// /}" DIST_VERSION="${DIST_VERSION// /}" } # Funktion zur Generierung eines zufälligen Zeichens aus einer gegebenen Zeichenmenge random_char() { local chars="$1" echo -n "${chars:RANDOM%${#chars}:1}" } # Funktion zur Generierung eines zufälligen Strings mit den angegebenen Anforderungen generate_random_string() { local length="$1" # Überprüfen, ob die Länge größer als 8 ist if [[ "$length" -le 8 ]]; then echo "Fehler: Die Länge muss größer als 8 Zeichen sein." return 1 fi # Zeichenmengen local lower="abcdefghijklmnopqrstuvwxyz" local upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ" local digits="0123456789" #local special="!@#$%^&*()_+-=[]{}|;:,.<>?/" local special="_+--//...." # Generiere mindestens ein Zeichen aus jeder Kategorie local random_string=$(random_char "$lower") random_string+=$(random_char "$upper") random_string+=$(random_char "$digits") random_string+=$(random_char "$special") random_string+=$(random_char "$special") # Fülle den Rest der Zeichenkette mit zufälligen Zeichen aus allen Kategorien local all_chars="$lower$upper$digits$special" for (( i=${#random_string}; i ${log_file} 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi else echo_skipped warn "No configuration file '$conf_file' present.\n Loading default values.." fi [[ -n "${FQHN_HOSTNAME}" ]] && DEFAULT_FQHN_HOSTNAME="${FQHN_HOSTNAME}" if [[ -n "$DB_TYPE" ]] ; then if [[ "${DB_TYPE,,}" = "postgres" ]] || [[ "${DB_TYPE,,}" = "postgresql" ]] || [[ "${DB_TYPE,,}" = "pgsql" ]] || [[ "${DB_TYPE,,}" = "psql" ]] ; then DEFAULT_DB_TYPE=pgsql elif [[ "${DB_TYPE,,}" = "mysql" ]] ; then DEFAULT_DB_TYPE=mysql else fatal "Wrong or empty Database Type (DB_TYPE) - must be 'mysql' or 'pgsql'." fi fi [[ -n "${DB_NAME}" ]] && DEFAULT_DB_NAME="${DB_NAME}" [[ -n "${DB_USER}" ]] && DEFAULT_DB_NAME="${DB_USER}" [[ -n "${DB_PASS}" ]] && DEFAULT_DB_PASS="${DB_PASS}" [[ -n "${KEYCLOAK_USER}" ]] && DEFAULT_KEYCLOAK_USER="${KEYCLOAK_USER}" if [[ -n "${KEYCLOAK_GROUP}" ]]; then DEFAULT_KEYCLOAK_GROUP="${KEYCLOAK_GROUP}" else DEFAULT_KEYCLOAK_GROUP="$DEFAULT_KEYCLOAK_USER" fi [[ -n "${KEYCLOAK_BASE_INSTALL_PATH}" ]] && DEFAULT_KEYCLOAK_BASE_INSTALL_PATH="${KEYCLOAK_BASE_INSTALL_PATH}" echo -e "\033[32m--\033[m" echo "" echo "Version Number of Keycloak Server to install" echo "" echo " see: https://keycloak.org/downloads" echo "" echo "" KEYCLOAK_VERSION= while [ "X$KEYCLOAK_VERSION" = "X" ] do echononl "KEYCLOAK Server Version: " read KEYCLOAK_VERSION if [ "X$KEYCLOAK_VERSION" = "X" ]; then echo -e "\n\t\033[33m\033[1mA Version number is required!\033[m\n" fi done DOWNLOAD_ARCHIVE="keycloak-${KEYCLOAK_VERSION}.tar.gz" DOWNLOAD_URL="https://github.com/keycloak/keycloak/releases/download/${KEYCLOAK_VERSION}/${DOWNLOAD_ARCHIVE}" KEYCLOAK_BASE_INSTALL_PATH= echo "" echo -e "\033[32m--\033[m" echo "" echo "Specify the base directory in which keycloak is to be installed." echo "" while [[ "X${KEYCLOAK_BASE_INSTALL_PATH}" = "X" ]]; do echononl "Base directory for keycloak installation [${DEFAULT_KEYCLOAK_BASE_INSTALL_PATH}]: " read KEYCLOAK_BASE_INSTALL_PATH if [[ "X${KEYCLOAK_BASE_INSTALL_PATH}" = "X" ]]; then KEYCLOAK_BASE_INSTALL_PATH="${DEFAULT_KEYCLOAK_BASE_INSTALL_PATH}" fi if [[ ! -d "${KEYCLOAK_BASE_INSTALL_PATH}" ]] ; then echo -e "\n\tGiven directory \033[33m\033[1m${KEYCLOAK_BASE_INSTALL_PATH}\033[m does not exist!.\n" KEYCLOAK_BASE_INSTALL_PATH="" fi done KEYCLOAK_INSTALL_DIR="${KEYCLOAK_BASE_INSTALL_PATH}/keycloak-${KEYCLOAK_VERSION}" if [[ -h "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" ]] ; then CUR_INSTALL_DIR="$(realpath "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak")" CUR_VERSION="$(basename "${CUR_INSTALL_DIR}" | sed "s/^keycloak-//")" else fatal "Cannot find a Keycloak installation in the ${KEYCLOAK_BASE_INSTALL_PATH} directory" fi KEYCLOAK_USER="$(stat -c '%U' "${CUR_INSTALL_DIR}")" if [[ -z "${KEYCLOAK_USER}" ]] ; then fatal "Cannot determine the user of the Keycloak installation." fi KEYCLOAK_GROUP="$(stat -c '%G' "${CUR_INSTALL_DIR}")" if [[ -z "${KEYCLOAK_GROUP}" ]] ; then fatal "Cannot determine the group of the Keycloak installation." fi FQHN_HOSTNAME= echo "" echo -e "\033[32m--\033[m" echo "" echo "Insert full qualified hostname for Keycloak Service" echo "" if [[ -n "${DEFAULT_FQHN_HOSTNAME}" ]]; then while [[ "X${FQHN_HOSTNAME}" = "X" ]]; do echononl "Full qualified hostname [${DEFAULT_FQHN_HOSTNAME}]: " read FQHN_HOSTNAME if [[ "X${FQHN_HOSTNAME}" = "X" ]]; then FQHN_HOSTNAME=$DEFAULT_FQHN_HOSTNAME fi if [[ ! ${FQHN_HOSTNAME} =~ \. ]]; then echo -e "\n\tGiven Host \033[33m\033[1m${FQHN_HOSTNAME}\033[m seems not to be a full qualified hostname.\n" FQHN_HOSTNAME="" fi done else while [[ "X${FQHN_HOSTNAME}" = "X" ]]; do echononl "Full qualified hostname: " read FQHN_HOSTNAME if [[ "X${FQHN_HOSTNAME}" = "X" ]]; then echo -e "\n\t\033[33m\033[1mFull qualified hostname is reqired\033[m\n" fi if [[ ! ${FQHN_HOSTNAME} =~ \. ]]; then echo -e "\n\tGiven Host \033[33m\033[1m${FQHN_HOSTNAME}\033[m seems not to be a full qualified hostname.\n" FQHN_HOSTNAME="" fi done fi HOSTNAME="${FQHN_HOSTNAME%%.*}" echo "" echo "" echo -e "\t\033[32mStart upgrade script for Keycloak Service with the following parameters\033[m" echo "" echo -e "\t(New) Keycloak Server Version...: \033[33m\033[1m${KEYCLOAK_VERSION}\033[m" echo "" if [[ -n "${CUR_VERSION}" ]] ; then echo -e "\tCurrent (old) Keycloak Version..: ${CUR_VERSION}" else echo -e "\tCurrent (old) Keycloak Version..: \033[33mkeycloak is currently NOT installed\033[m" fi echo "" echo -e "\tFull qualified Hostname.........: ${FQHN_HOSTNAME}" echo -e "\tHostname........................: ${HOSTNAME}" echo "" echo -e "\tKeycloak user...................: ${KEYCLOAK_USER}" echo -e "\tKeycloak group..................: ${KEYCLOAK_GROUP}" echo "" echo -e "\tKeycloak base install dir.......: ${KEYCLOAK_BASE_INSTALL_PATH}" echo -e "\tKeycloak install dir............: ${KEYCLOAK_INSTALL_DIR}" echo "" echo -e "\tDownload archive................: ${DOWNLOAD_ARCHIVE}" echo -e "\tDownload URL....................: ${DOWNLOAD_URL}" echo "" echo "" echononl "einverstanden (yes/no): " read OK OK=${OK,,} while [ "X$OK" != "Xyes" -a "X$OK" != "Xno" ]; do echononl "Wrong entry! [yes/no]: " read OK OK=${OK,,} done [ $OK = "yes" ] || fatal Repeat with other settings.. echo echo -e "\033[37m\033[1mAdjust configuration file..\033[m" echo _var="KEYCLOAK_USER" _val="${KEYCLOAK_USER}" echononl "Update '${_var}' configuration file .." if ! $(grep -q -E "^\s*${_var}=\"${_val}\"" "${conf_file}" 2> /dev/null) ; then perl -i -n -p -e "s/^\s*${_var}=.*/${_var}=\"${_val}\"/" ${conf_file} > "$log_file" 2>&1 if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi _var="KEYCLOAK_GROUP" _val="${KEYCLOAK_GROUP}" echononl "Update '${_var}' configuration file .." if ! $(grep -q -E "^\s*${_var}=\"${_val}\"" "${conf_file}" 2> /dev/null) ; then perl -i -n -p -e "s/^\s*${_var}=.*/${_var}=\"${_val}\"/" ${conf_file} > "$log_file" 2>&1 if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi _var="FQHN_HOSTNAME" _val="${FQHN_HOSTNAME}" echononl "Update '${_var}' configuration file .." if ! $(grep -q -E "^\s*${_var}=\"${_val}\"" "${conf_file}" 2> /dev/null) ; then perl -i -n -p -e "s/^\s*${_var}=.*/${_var}=\"${_val}\"/" ${conf_file} > "$log_file" 2>&1 if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi _var="KEYCLOAK_BASE_INSTALL_PATH" _val="${KEYCLOAK_BASE_INSTALL_PATH}" echononl "Update '${_var}' configuration file .." if ! $(grep -q -E "^\s*${_var}=\"${_val}\"" "${conf_file}" 2> /dev/null) ; then perl -i -n -p -e "s#^s*${_var}=.*#${_var}=\"${_val}\"#" ${conf_file} > "$log_file" 2>&1 if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi blank_line #echononl "Continue upgrade (yes/no): " #read OK #OK=${OK,,} #while [ "X$OK" != "Xyes" -a "X$OK" != "Xno" ]; do # echononl "Wrong entry! [yes/no]: " # read OK # OK=${OK,,} #done #[ $OK = "yes" ] || fatal Repeat with other settings.. echo echo -e "\033[37m\033[1mSome pre-installation stuff..\033[m" echo echononl "Backup crontab" crontab -u root -l > ${crontab_backup_file} 2> $log_file if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi echononl "Disable crontab for user root" crontab -r -u root > ${log_file} 2>&1 if [[ "$?" = "0" ]]; then echo_ok else echo_failed error "$(cat $tmp_err_msg)" fi blank_line echononl "Stop Keycloak Service.." if $(systemctl is-active --quiet service keycloak.service) ; then systemctl stop keycloak.service > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi else echo_skipped fi blank_line echo echo -e "\033[37m\033[1mInstalling Keycloak Service..\033[m" echo echononl "Download the latest version (${KEYCLOAK_VERSION}) of the Keycloak Server.." if [[ ! -f "${working_dir}/${DOWNLOAD_ARCHIVE}" ]]; then wget -O "${working_dir}/${DOWNLOAD_ARCHIVE}" "${DOWNLOAD_URL}" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi else echo_skipped fi blank_line echononl "Backup Keycloak Installation directory.." if [[ -n "${CUR_INSTALL_DIR}" ]]; then cp -a "${CUR_INSTALL_DIR}" "${CUR_INSTALL_DIR}.${backup_date}" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi else echo_skipped fi echononl "Remove Symlink '${KEYCLOAK_BASE_INSTALL_PATH}/keycloak' .." rm "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi blank_line echononl "Extract the Keycloak Service files.." tar -C "${KEYCLOAK_BASE_INSTALL_PATH}" -xvzf "${working_dir}/${DOWNLOAD_ARCHIVE}" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi blank_line echononl "Copy 'conf/ directory from the previous installation to the new installation." cp -a "${CUR_INSTALL_DIR}/conf" "${KEYCLOAK_INSTALL_DIR}/" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Copy 'providers/ directory from the previous installation to the new installation." cp -a "${CUR_INSTALL_DIR}/providers" "${KEYCLOAK_INSTALL_DIR}/" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Copy 'themes/ directory from the previous installation to the new installation." cp -a "${CUR_INSTALL_DIR}/themes" "${KEYCLOAK_INSTALL_DIR}/" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Set ownbership of installation directory '${KEYCLOAK_INSTALL_DIR}'.." chown -R ${KEYCLOAK_USER}:${KEYCLOAK_GROUP} "${KEYCLOAK_INSTALL_DIR}" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Give write permissions to the keycloak group.." chmod -R g+w "${KEYCLOAK_INSTALL_DIR}" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Symlink keycloak -> keycloak-${KEYCLOAK_VERSION} .." ln -s "keycloak-${KEYCLOAK_VERSION}" "${KEYCLOAK_BASE_INSTALL_PATH}/keycloak" > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi _certs_installed=false echononl "Run script 'check_cert_for_keycloak.sh'.." if [[ -x "/root/bin/monitoring/check_cert_for_keycloak.sh" ]] ; then /root/bin/monitoring/check_cert_for_keycloak.sh > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed cat "$log_file" else echo_ok _certs_installed=true fi else warn "Certificate/Key for ${FQHN_HOSTNAME} cannot be provided." fi echononl "Add a cronjob for checking cert.." if [[ -f "$crontab_backup_file" ]]; then if ! grep -iq -E "/root/bin/monitoring/check_cert_for_keycloak.sh" "$crontab_backup_file" > /dev/null 2>&1; then cat <> $crontab_backup_file # Check if cert for Keycloak service is up-to-date # 51 05 * * * /root/bin/monitoring/check_cert_for_keycloak.sh EOF if [[ "$?" -ne 0 ]] ; then echo_failed else echo_ok fi else echo_skipped fi elif [[ -f "/var/spool/cron/crontabs/root" ]] ; then if ! grep -i -E "/root/bin/monitoring/check_cert_for_keycloak.sh" /var/spool/cron/crontabs/root > /dev/null 2>&1; then installation_failed=false crontab -l > /tmp/tmp_crontab 2> $log_file if [[ "$?" -ne 0 ]] ; then installation_failed=true fi cat << EOF >> /tmp/tmp_crontab 2>> $log_file # Check if cert for Keycloak service is up-to-date # 51 05 * * * /root/bin/monitoring/check_cert_for_keycloak.sh EOF if [[ "$?" -ne 0 ]] ; then installation_failed=true fi crontab /tmp/tmp_crontab > /dev/null 2>> $log_file if [[ "$?" -ne 0 ]] ; then installation_failed=true fi rm /tmp/tmp_crontab > /dev/null 2>> $log_file if [[ "$?" -ne 0 ]] ; then installation_failed=true fi if ! $installation_failed ; then echo_ok else echo_failed error "Adding cronjob for checking cert failed!" fi else echo_skipped fi fi blank_line echononl "Creates a new and optimized server image.." ${KEYCLOAK_BASE_INSTALL_PATH}/keycloak/bin/kc.sh build > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" echononl "\033[1mcontinue anyway\033[m [yes/no]: " read OK while [[ "${OK,,}" != "yes" ]] && [[ "${OK,,}" != "no" ]] ; do echononl "Wrong entry! - repeat [yes/nno]: " read OK done [[ $OK = "yes" ]] || fatal "Abbruch durch User" else echo_ok fi blank_line echononl "Start Keycloak Service" systemctl start keycloak.service > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echononl "Restart NGINX Service.." systemctl restart nginx > "$log_file" 2>&1 if [[ $? -ne 0 ]]; then echo_failed error "$(cat "$log_file")" else echo_ok fi echo echo -e "\033[37m\033[1mSome post-installation stuff..\033[m" echo _cron_reenabled=false echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.." if [[ -f "${crontab_backup_file}" ]] ; then crontab ${crontab_backup_file} > $log_file 2>&1 if [[ $? -eq 0 ]]; then echo_ok _cron_reenabled=true else echo_failed error "$(cat $log_file)" fi else echo_skipped fi blank_line echononl "Wait until the Keycloak service has started completely." echo_wait declare -i index=0 declare -i _max_secs_waiting=40 keycloak_service_started=false while true ; do # Try to establish a connection to localhost:8080 # if $(curl -s -o /dev/null -I http://localhost:8080) ; then echo_ok keycloak_service_started=true break fi if [[ ${index} -gt ${_max_secs_waiting} ]]; then echo_failed error "Could not connect to loacalhost on port 8080 after about 20 seconds!" break fi (( index++ )) sleep 1 done blank_line echononl "Remove previously saved crontab file '$(basename "${crontab_backup_file}")'.." if ${_cron_reenabled} ; then rm "${crontab_backup_file}" > $log_file 2>&1 if [[ $? -eq 0 ]]; then echo_ok else echo_failed error "$(cat $log_file)" fi else echo_skipped fi clean_up 0