mrjones-plip / keys-to-the-tunnel Goto Github PK

Right now if you get a big list of users for your org and then 3 months later regenerate this list of users, any users that have left your org and are not in the user.txt file stick around and still can use the service.

We should allow a --delete flag or something to be passed in such that any user not in the user.txt file is deleted (vhost, TLS cert, login, home dir etc.)

Let's add a feature for a way to easily onboard an entire GH org. Given an ORG_NAME, this feature should allow:

• initial load of all members
• still only allow those with SSH keys in
• refresh should not change existing ports of established users
• refresh should both add new users and remove old ones

We have an issue about orgs being larger than 50 b/c of Let's Encrypt API limits, so we should be cognizant of that.

When login in with SSH, some information is printed in the console about the host. Would be great if the URLs can be calculated and printed out in the session console so the user doesn't need to figure out what is the final URL, specially taking into account that the final URL does not have the same domain that the domain used to log in with SSH.

right now we use SAN calls for just 2 per user. However, we could stack them up a LOT more and be able to on-board hundreds of users at once given 100 Names per Certificate.

This code was in there but then I realized you'd have trouble re-running the script for just a user or two b/c they'd be wedged in there with other SANs and you'd end up with a LOT of extra certs. Maybe that'd be ok and it's just work out 🤷 ?

echo ""
echo " ------ Fetching certs from Let's Encrypt... ------ "
echo ""
COUNTER=0
SUBCOUNTER=0
for i in "${VALID_USERS[@]}"; do
  FQDN="${i}.${DOMAIN}"
  FQDN_ssl="${i}-ssl.${DOMAIN}"
  if [[ $COUNTER != 0 ]] ; then
    DOMAINS="${FQDN},${FQDN_ssl},${DOMAINS}"
  else
    DOMAINS="${FQDN},${FQDN_ssl}"
  fi
  let COUNTER++
  let SUBCOUNTER++

  # run certbot with every 40 domains (2 x per user, so SUBCOUNTER
  # at 20) or at end of array
  if [[ ${#VALID_USERS[@]} == $COUNTER ]] || [[ $SUBCOUNTER == 20 ]]; then
    SUBCOUNTER=0
    sudo certbot  --apache   --non-interactive   --agree-tos   --email $EMAIL -d $DOMAINS
  fi
done

The script should be enhanced so that on the N+1 run it detects if a user exists and if so:

• don't try and recreate the local user
• don't add a new vhost
• don't give the user new ports
• don't try and recreate the TLS certificates