fix import key to mikrotik

.gitignore

@@ -9,3 +9,4 @@ config.ini
 venv/
 *.swp
 .DS_Store
+logs/*.log

README.md

@@ -53,12 +53,17 @@ ssh-keygen -t ed25519 -f ~/.ssh/certpusher_key
 ssh-copy-id -i ~/.ssh/certpusher_key.pub user@remote-host
 
 2025-10-26 22:00:00 - CertPusher - INFO - ============================================================
+
 2025-10-26 22:00:00 - CertPusher - INFO - CertPusher - SSL Certificate Distribution Tool
+
 2025-10-26 22:00:00 - CertPusher - INFO - ============================================================
+
 2025-10-26 22:00:01 - CertPusher - INFO - Processing host: webserver1
+
 2025-10-26 22:00:02 - CertPusher - INFO - ✓ Successfully processed webserver1
 
 
+
 ## Security Considerations
 
 - Store SSH private keys securely with proper permissions (chmod 600)

config.ini.example

@@ -1,40 +1,309 @@
+# ╔═══════════════════════════════════════════════════════════╗
+# ║              CertPusher Configuration File                ║
+# ║      SSL Certificate Distribution Configuration           ║
+# ╚═══════════════════════════════════════════════════════════╝
+
 [global]
-# Path to source SSL certificate (can be fullchain or single cert)
+# Global source certificate and private key
 source_cert_path = /etc/letsencrypt/live/example.com/fullchain.pem
+source_key_path = /etc/letsencrypt/live/example.com/privkey.pem
 
 # Default SSH key for all hosts (can be overridden per host)
 default_ssh_key = /root/.ssh/id_rsa
 
-[webserver1]
+# ═══════════════════════════════════════════════════════════
+# MIKROTIK DEVICES
+# ═══════════════════════════════════════════════════════════
+
+[mikrotik_router]
+type = mikrotik
+hostname = 172.16.0.1
+port = 51022
+username = admin
+ssh_key_path = /root/.ssh/id_rsa_proxy
+# Check certificate before upload (default: true)
+check_before_upload = true
+mikrotik_services = www-ssl,api-ssl
+
+
+[mikrotik_switch]
+type = mikrotik
+hostname = 192.168.1.50
+port = 22
+username = admin
+# Always upload without checking
+check_before_upload = false
+mikrotik_services = www-ssl,api-ssl
+
+
+# ═══════════════════════════════════════════════════════════
+# PROXMOX VE SERVERS
+# ═══════════════════════════════════════════════════════════
+
+[proxmox1]
+type = proxmox
+hostname = 10.87.2.150
+port = 11922
+username = root
+check_url = https://10.87.2.150:8006
+check_before_upload = true
+
+[proxmox2]
+type = proxmox
+hostname = 10.87.2.151
+port = 11922
+username = root
+check_url = https://10.87.2.151:8006
+check_before_upload = true
+
+# ═══════════════════════════════════════════════════════════
+# HOME ASSISTANT INSTALLATIONS
+# ═══════════════════════════════════════════════════════════
+
+[homeassistant_supervised]
+type = standard
 hostname = 192.168.1.100
 port = 22
 username = root
-remote_cert_path = /etc/nginx/ssl/certificate.pem
-post_upload_command = systemctl reload nginx
+remote_cert_path = /usr/share/hassio/ssl/fullchain.pem
+remote_key_path = /usr/share/hassio/ssl/privkey.pem
+post_upload_command = ha core restart
+check_url = https://homeassistant.local:8123
+
+[homeassistant_core]
+type = standard
+hostname = 192.168.1.101
+port = 22
+username = homeassistant
+ssh_key_path = /root/.ssh/homeassistant_key
+remote_cert_path = /home/homeassistant/.homeassistant/fullchain.pem
+remote_key_path = /home/homeassistant/.homeassistant/privkey.pem
+post_upload_command = sudo systemctl restart home-assistant@homeassistant
+check_url = https://192.168.1.101:8123
+
+[homeassistant_docker]
+type = standard
+hostname = 192.168.1.102
+port = 22
+username = root
+remote_cert_path = /opt/homeassistant/config/fullchain.pem
+remote_key_path = /opt/homeassistant/config/privkey.pem
+post_upload_command = docker restart homeassistant
+check_url = https://ha.example.com:8123
+
+[homeassistant_haos]
+type = standard
+hostname = 192.168.1.103
+port = 22
+username = root
+remote_cert_path = /ssl/fullchain.pem
+remote_key_path = /ssl/privkey.pem
+post_upload_command = ha core restart
+check_url = https://192.168.1.103:8123
+
+[homeassistant_nginx_proxy]
+type = standard
+hostname = 192.168.1.104
+port = 22
+username = root
+remote_cert_path = /etc/nginx/ssl/homeassistant/fullchain.pem
+remote_key_path = /etc/nginx/ssl/homeassistant/privkey.pem
+post_upload_command = nginx -t && systemctl reload nginx
+check_url = https://ha.example.com
+
+# ═══════════════════════════════════════════════════════════
+# WEB SERVERS (NGINX & APACHE)
+# ═══════════════════════════════════════════════════════════
+
+[webserver_nginx]
+type = standard
+hostname = 192.168.1.110
+port = 22
+username = root
+remote_cert_path = /etc/nginx/ssl/fullchain.pem
+remote_key_path = /etc/nginx/ssl/privkey.pem
+post_upload_command = nginx -t && systemctl reload nginx
 check_url = https://example.com
 
-[webserver2]
-hostname = 192.168.1.101
+[webserver_apache]
+type = standard
+hostname = 192.168.1.111
 port = 2222
 username = admin
-# Override SSH key for this host
-ssh_key_path = /root/.ssh/webserver2_key
+ssh_key_path = /root/.ssh/webserver_key
 remote_cert_path = /etc/apache2/ssl/fullchain.pem
-post_upload_command = systemctl reload apache2
+remote_key_path = /etc/apache2/ssl/privkey.pem
+post_upload_command = apachectl configtest && systemctl reload apache2
 check_url = https://subdomain.example.com
 
-[mailserver]
+# ═══════════════════════════════════════════════════════════
+# MAIL SERVERS (POSTFIX/DOVECOT)
+# ═══════════════════════════════════════════════════════════
+
+[mailserver_postfix]
+type = standard
 hostname = mail.example.com
 port = 22
 username = root
 remote_cert_path = /etc/postfix/ssl/cert.pem
+remote_key_path = /etc/postfix/ssl/privkey.pem
 post_upload_command = systemctl restart postfix && systemctl restart dovecot
-# No check_url - always upload
+check_url = https://mail.example.com:587
 
-[proxmox]
-hostname = 10.0.0.50
+# ═══════════════════════════════════════════════════════════
+# DOCKER / CONTAINER PLATFORMS
+# ═══════════════════════════════════════════════════════════
+
+[docker_traefik]
+type = standard
+hostname = 10.0.0.60
 port = 22
 username = root
-remote_cert_path = /etc/pve/local/pveproxy-ssl.pem
-post_upload_command = systemctl restart pveproxy
-check_url = https://10.0.0.50:8006
+remote_cert_path = /opt/docker/traefik/certs/fullchain.pem
+remote_key_path = /opt/docker/traefik/certs/privkey.pem
+post_upload_command = docker restart traefik
+check_url = https://traefik.example.com
+
+[docker_nginx_proxy_manager]
+type = standard
+hostname = 10.0.0.61
+port = 22
+username = root
+remote_cert_path = /opt/docker/npm/ssl/fullchain.pem
+remote_key_path = /opt/docker/npm/ssl/privkey.pem
+post_upload_command = docker exec nginx-proxy-manager nginx -s reload
+check_url = https://npm.example.com
+
+# ═══════════════════════════════════════════════════════════
+# STORAGE / NAS DEVICES
+# ═══════════════════════════════════════════════════════════
+
+[truenas_scale]
+type = standard
+hostname = 10.0.0.70
+port = 22
+username = root
+remote_cert_path = /etc/certificates/truenas_cert.crt
+remote_key_path = /etc/certificates/truenas_cert.key
+post_upload_command = midclt call system.general.ui_restart
+check_url = https://truenas.local
+
+[synology_nas]
+type = standard
+hostname = 10.0.0.71
+port = 22
+username = root
+remote_cert_path = /usr/syno/etc/certificate/system/default/fullchain.pem
+remote_key_path = /usr/syno/etc/certificate/system/default/privkey.pem
+post_upload_command = /usr/syno/sbin/synoservicectl --reload nginx
+check_url = https://synology.local:5001
+
+# ═══════════════════════════════════════════════════════════
+# HOSTS WITH CUSTOM CERTIFICATES
+# ═══════════════════════════════════════════════════════════
+
+[mailserver_custom_domain]
+type = standard
+hostname = mail.company.com
+port = 22
+username = root
+# Override global certificate with domain-specific cert
+source_cert_path = /etc/letsencrypt/live/mail.company.com/fullchain.pem
+source_key_path = /etc/letsencrypt/live/mail.company.com/privkey.pem
+remote_cert_path = /etc/postfix/ssl/cert.pem
+remote_key_path = /etc/postfix/ssl/privkey.pem
+post_upload_command = systemctl restart postfix && systemctl restart dovecot
+check_url = https://mail.company.com:465
+
+[api_server_subdomain]
+type = standard
+hostname = 192.168.1.200
+port = 22
+username = ubuntu
+ssh_key_path = /root/.ssh/api_key
+# API server with its own certificate
+source_cert_path = /etc/letsencrypt/live/api.subdomain.org/fullchain.pem
+source_key_path = /etc/letsencrypt/live/api.subdomain.org/privkey.pem
+remote_cert_path = /etc/nginx/ssl/api/fullchain.pem
+remote_key_path = /etc/nginx/ssl/api/privkey.pem
+post_upload_command = systemctl reload nginx
+check_url = https://api.subdomain.org
+
+[client_website]
+type = standard
+hostname = 203.0.113.50
+port = 2222
+username = admin
+# Client's own domain and certificate
+source_cert_path = /etc/letsencrypt/live/client-domain.com/fullchain.pem
+source_key_path = /etc/letsencrypt/live/client-domain.com/privkey.pem
+remote_cert_path = /var/www/ssl/fullchain.pem
+remote_key_path = /var/www/ssl/privkey.pem
+post_upload_command = systemctl reload apache2
+check_url = https://www.client-domain.com
+
+[client_mikrotik]
+type = mikrotik
+hostname = 203.0.113.51
+port = 22
+username = admin
+ssh_key_path = /root/.ssh/client_key
+# Client's MikroTik with custom certificate
+source_cert_path = /etc/letsencrypt/live/client-domain.com/fullchain.pem
+source_key_path = /etc/letsencrypt/live/client-domain.com/privkey.pem
+check_before_upload = true
+
+# ═══════════════════════════════════════════════════════════
+# DEVELOPMENT / STAGING SERVERS
+# ═══════════════════════════════════════════════════════════
+
+[dev_server]
+type = standard
+hostname = dev.local
+port = 22
+username = developer
+# Dev server with staging certificate
+source_cert_path = /etc/letsencrypt-staging/live/dev.example.com/fullchain.pem
+source_key_path = /etc/letsencrypt-staging/live/dev.example.com/privkey.pem
+remote_cert_path = /opt/app/ssl/fullchain.pem
+remote_key_path = /opt/app/ssl/privkey.pem
+post_upload_command = docker-compose restart nginx
+# No check_url - always upload to dev environment
+
+# ═══════════════════════════════════════════════════════════
+# ADVANCED EXAMPLES
+# ═══════════════════════════════════════════════════════════
+
+[nginx_with_chain]
+type = standard
+hostname = 192.168.1.120
+port = 22
+username = root
+remote_cert_path = /etc/nginx/ssl/cert.pem
+remote_key_path = /etc/nginx/ssl/private/key.pem
+# Upload additional chain file
+additional_files = /etc/letsencrypt/live/example.com/chain.pem:/etc/nginx/ssl/chain.pem
+post_upload_command = nginx -t && systemctl reload nginx
+check_url = https://example.com
+
+[apache_separate_dirs]
+type = standard
+hostname = 192.168.1.121
+port = 22
+username = root
+# Certificate and key in completely different directories
+remote_cert_path = /etc/ssl/certs/apache-cert.pem
+remote_key_path = /etc/ssl/private/apache-key.pem
+post_upload_command = apachectl configtest && systemctl reload apache2
+
+[multi_service_host]
+type = standard
+hostname = 192.168.1.130
+port = 22
+username = root
+remote_cert_path = /etc/ssl/certs/fullchain.pem
+remote_key_path = /etc/ssl/private/privkey.pem
+# Deploy cert to multiple services
+additional_files = /etc/letsencrypt/live/example.com/fullchain.pem:/opt/app1/ssl/cert.pem,/etc/letsencrypt/live/example.com/privkey.pem:/opt/app1/ssl/key.pem,/etc/letsencrypt/live/example.com/fullchain.pem:/opt/app2/ssl/cert.pem
+post_upload_command = systemctl reload nginx && systemctl restart app1 && systemctl restart app2
+check_url = https://example.com

logrotate_certpusher

@@ -0,0 +1,16 @@
+/opt/certpusher/logs/*.log {
+    daily
+    rotate 7
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 0644 root root
+    dateext
+    dateformat -%Y%m%d
+    extension .log
+    nomail
+    postrotate
+        find /opt/certpusher/logs -name "*.log*" -type f -mtime +3 -delete
+    endscript
+}