credentials.sh

#!/bin/bash
#
#        ▄▄███████▄▄
#     ▄███████████████▄
#   ▄███▐███▀▀▄▄▄▄▀▀████▄
#  ████▐██ ███▀▀▀███▄▀███▌   ▄█████▄ ██▄▄███▌ ▄█████▄  ▄██████▄ ██▌▄████▄▄████▄
# ▐███▌██ ██       ██▌████  ▐███   ▀ ▀███▀▀▀ ███▀  ███ ▀▀   ███  ███▀▀████▀▀███▌
# ▐███▌██ ▀█     █ ▐██▐███  ▐██▌     ▐██▌    █████████ ▄███████▌ ███   ███  ▐██▌
# ▐████▄▀█▄ ▀▀  ▄█ ███▐███  ▐██▌     ▐██▌    ███      ▐███   ██▌ ███   ███  ▐██▌
#  █████▌▀▀████▀▀ ███▐███▌   ▀█████▀ ▐██▌    ▀███████▀ █████████ ███   ██▌   ██▌
#   ▀██████▄▄▄▄█████▐███▀
#     ▀███████████████▀
#        ▀▀███████▀▀
#
# ------------------------------------------------------------------------------
# Cream Cloud Backup - Restic wrapper to back up to OpenStack Object Store
#
# Copyright (C):          Cream Commerce B.V., https://www.cream.nl/
# Based on the work of:   Remy van Elst, https://raymii.org/

set -o pipefail

VERSION="2.0.0"
TITLE="CloudVPS Boss Credentials Config ${VERSION}"

if [[ ${DEBUG} == "1" ]]; then
    set -x
fi

usage() {
    echo "# ./${0} [username] [password] [tenant_id]"
    echo "# Interactive: ./$0"
    echo "# Noninteractive: ./$0 'user@example.org' 'P@ssw0rd' 'aeae1234...'"
    exit 1
}

lecho() {
    logger -t "creamcloud-backup" -- "$1"
    echo "# $1"
}

lerror() {
    logger -t "creamcloud-backup" -- "ERROR - $1"
    echo "$1" 1>&2
}

if [[ "${EUID}" -ne 0 ]]; then
   lerror "This script must be run as root"
   exit 1
fi

if [[ ! -d "/etc/creamcloud-backup" ]]; then
    mkdir -p "/etc/creamcloud-backup"
    if [[ $? -ne 0 ]]; then
        lerror "Cannot create /etc/creamcloud-backup"
        exit 1
    fi
fi

if [[ -f "/etc/creamcloud-backup/auth.conf" ]]; then
    lecho "/etc/creamcloud-backup/auth.conf already exists. Not overwriting it"
    exit
fi

if [[ "${1}" == "help" ]]; then
    usage
elif [[ -z ${2} || -z ${1} || -z ${3} ]]; then
    echo; echo; echo; echo; echo;
    read -e -p "Openstack Username (user@example.org): " USERNAME
    read -e -s -p "Openstack Password (not shown):" PASSWORD
    echo
    read -e -p "Openstack Tenant ID: " TENANT_ID
else
    USERNAME="${1}"
    PASSWORD="${2}"
    TENANT_ID="${3}"
fi

if [[ -z "${USERNAME}" || -z "${PASSWORD}" || -z "${TENANT_ID}" ]]; then
    echo
    lerror "Need username and password and tenant id."
    exit 1
fi

OS_BASE_AUTH_URL="https://identity.stack.cloudvps.com/v2.0"
OS_AUTH_URL="${OS_BASE_AUTH_URL}/tokens"
OS_TENANTS_URL="${OS_BASE_AUTH_URL}/tenants"

command -v curl > /dev/null 2>&1
if [[ $? -ne 0 ]]; then
    command -v wget > /dev/null 2>&1
    if [[ $? -ne 0 ]]; then
        lerror "I require curl or wget but none seem to be installed."
        lerror "Please install curl or wget"
        exit 1
    else
        AUTH_TOKEN=$(wget -q --header="Content-Type: application/json" --header "Accept: application/json" -O - --post-data='{"auth": {"tenantName": "'${TENANT_ID}'", "passwordCredentials": {"username": "'${USERNAME}'", "password": "'${PASSWORD}'"}}}' "${OS_AUTH_URL}" | grep -o '\"id\": \"[^\"]*\"' | awk -F\" '{print $4}' | sed -n 1p)
    fi
else
    AUTH_TOKEN=$(curl -s "${OS_AUTH_URL}" -X POST -H "Content-Type: application/json" -H "Accept: application/json"  -d '{"auth": {"tenantName": "'${TENANT_ID}'", "passwordCredentials": {"username": "'${USERNAME}'", "password": "'${PASSWORD}'"}}}' | grep -o '\"id\": \"[^\"]*\"' | awk -F\" '{print $4}' | sed -n 1p)
fi

if [[ -z "${TENANT_ID}" ]]; then
    lerror "Tenant ID could not be found. Check username, password or network connectivity."
    exit 1
fi

if [[ -z "${AUTH_TOKEN}" ]]; then
    lecho "AUTH_TOKEN empty. Trying again."
    sleep 5
    command -v curl > /dev/null 2>&1
    if [[ $? -ne 0 ]]; then
        command -v wget > /dev/null 2>&1
        if [[ $? -ne 0 ]]; then
            lerror "I require curl or wget but none seem to be installed."
            lerror "Please install curl or wget"
            exit 1
        else
            AUTH_TOKEN=$(wget -q --header="Content-Type: application/json" --header "Accept: application/json" -O - --post-data='{"auth": {"tenantName": "'${TENANT_ID}'", "passwordCredentials": {"username": "'${USERNAME}'", "password": "'${PASSWORD}'"}}}' "${OS_AUTH_URL}" | grep -o '\"id\": \"[^\"]*\"' | awk -F\" '{print $4}' | sed -n 1p)
        fi
    else
        AUTH_TOKEN=$(curl -s "${OS_AUTH_URL}" -X POST -H "Content-Type: application/json" -H "Accept: application/json"  -d '{"auth": {"tenantName": "'${TENANT_ID}'", "passwordCredentials": {"username": "'${USERNAME}'", "password": "'${PASSWORD}'"}}}' | grep -o '\"id\": \"[^\"]*\"' | awk -F\" '{print $4}' | sed -n 1p)
    fi
    if [[ -z "${AUTH_TOKEN}" ]]; then
        lerror "AUTH_TOKEN could not be found after two tries. Check username, password or network connectivity."
        exit 1
    fi
fi

SWIFT_USERNAME="${TENANT_ID}:${USERNAME}"
SWIFT_PASSWORD="${PASSWORD}"
SWIFT_AUTHVERSION="2"
SWIFT_AUTHURL="${OS_BASE_AUTH_URL}"

if [[ ! -f "/etc/creamcloud-backup/auth.conf" ]]; then
    touch "/etc/creamcloud-backup/auth.conf"
    chmod 600 "/etc/creamcloud-backup/auth.conf"
    cat << EOF > /etc/creamcloud-backup/auth.conf
export SWIFT_USERNAME="${SWIFT_USERNAME}"
export SWIFT_PASSWORD="${SWIFT_PASSWORD}"
export SWIFT_AUTHURL="${SWIFT_AUTHURL}"
export SWIFT_AUTHVERSION="${SWIFT_AUTHVERSION}"
export OS_AUTH_URL="${OS_BASE_AUTH_URL}"
export OS_TENANT_NAME="${TENANT_ID}"
export OS_USERNAME="${USERNAME}"
export OS_PASSWORD="${PASSWORD}"
export OS_TENANT_ID="${TENANT_ID}"
EOF
    lecho "Written auth config to /etc/creamcloud-backup/auth.conf."
else
    lecho "/etc/creamcloud-backup/auth.conf already exists. Not overwriting it"
fi

lecho "Username: ${SWIFT_USERNAME}"
lecho "Auth URL: ${SWIFT_AUTHURL}"
lecho "Checking Swift Container for Backups: https://public.objectstore.eu/v1/${TENANT_ID}/creamcloud-backup/"

curl -s -o /dev/null -X PUT -T "/etc/hosts" --user "${USERNAME}:${PASSWORD}" "https://public.objectstore.eu/v1/${TENANT_ID}/creamcloud-backup/"
if [[ $? == 60 ]]; then
    # CentOS 5...
    lecho "Curl error Peer certificate cannot be authenticated with known CA certificates."
    lecho "This is probably CentOS 5. CentOS 5 is deprecated. Exiting"
    exit 1
fi