Add deploy script for Kemp Loadmaster

[ecm75]

This is a small script to deploy certs to a Kemp Loadmaster via API.

• Adds kemplm_deploy function to list existing certificates and upload new ones.
• Handles wildcard certificate renaming, config persistence, and success/error reporting.
• Encodes fullchain and key into base64 for the API request.

[Neilpang]

add return 1 here if jq is not fuond.

[Neilpang]

why to replace with wildcard?

[Neilpang]

why to clear the account conf ?

[Copilot]

Pull Request Overview

A script to automate certificate deployment to a Kemp Loadmaster via its API.

• Adds kemplm_deploy function to list existing certificates and upload new ones.
• Handles wildcard certificate renaming, config persistence, and success/error reporting.
• Encodes fullchain and key into base64 for the API request.

Comments suppressed due to low confidence (2)

deploy/kemplm.sh:50

• [nitpick] In the error message, capitalize “URL” for consistency (...Loadmaster URL is not found...).

_err "Kemp Loadmaster url is not found, please define DEPLOY_KEMP_URL."

deploy/kemplm.sh:14

• [nitpick] Variables like _cdomain, _ckey, _ccert, etc., are terse and may be unclear. Consider renaming to more descriptive names such as domain, key_file, cert_file, ca_file, and fullchain_file.

_cdomain="$1"

[Copilot]

After logging the missing jq error, the function should immediately exit. Add return 1 (or exit 1) after _err to prevent further execution when jq is not installed.

Suggested change

	_err "jq not found"
	_err "jq not found"
	return 1

[Copilot]

[nitpick] The -w 0 flag for base64 is GNU-specific and may not work in all /bin/sh environments. Consider either switching the shebang to bash or using a more portable base64 invocation (e.g., without -w).

Suggested change

	cat "${_cfullchain}" "${_ckey}" | base64 -w 0 >"${_kemp_upload_cert}"
	cat "${_cfullchain}" "${_ckey}" | base64 | tr -d '\n' >"${_kemp_upload_cert}"

[Copilot]

[nitpick] The _post_request variable is reused for both listing and adding certificates, which can be confusing. Use distinct names (e.g., _list_request and _add_request) to improve readability.

Suggested change

	_post_request="{\"cmd\": \"addcert\", \"apikey\": \"${DEPLOY_KEMP_TOKEN}\", \"replace\": ${_kemp_replace_cert}, \"cert\": \"${_kemp_domain}\", \"data\": \"${_post_data}\"}"
	_debug3 _post_request "${_post_request}"
	_kemp_post_result=$(_post "${_post_request}" "${DEPLOY_KEMP_URL}/accessv2")
	_add_request="{\"cmd\": \"addcert\", \"apikey\": \"${DEPLOY_KEMP_TOKEN}\", \"replace\": ${_kemp_replace_cert}, \"cert\": \"${_kemp_domain}\", \"data\": \"${_post_data}\"}"
	_debug3 _add_request "${_add_request}"
	_kemp_post_result=$(_post "${_add_request}" "${DEPLOY_KEMP_URL}/accessv2")

[Copilot]

Exporting HTTPS_INSECURE=1 disables SSL verification globally, which can introduce security risks elsewhere. Consider passing an explicit --insecure flag (or equivalent) to only the API client command, or scope the environment variable more narrowly.

Suggested change

	# Do not check for a valid SSL certificate
	export HTTPS_INSECURE=1
	# Check if certificate is already installed
	_info "Check if certificate is already present"
	_post_request="{\"cmd\": \"listcert\", \"apikey\": \"${DEPLOY_KEMP_TOKEN}\"}"
	_debug3 _post_request "${_post_request}"
	_kemp_cert_count=$(_post "${_post_request}" "${DEPLOY_KEMP_URL}/accessv2" | jq -r '.cert[] | .name' | grep -c "${_kemp_domain}")
	# Check if certificate is already installed
	_info "Check if certificate is already present"
	_post_request="{\"cmd\": \"listcert\", \"apikey\": \"${DEPLOY_KEMP_TOKEN}\"}"
	_debug3 _post_request "${_post_request}"
	_kemp_cert_count=$(HTTPS_INSECURE=1 _post "${_post_request}" "${DEPLOY_KEMP_URL}/accessv2" | jq -r '.cert[] | .name' | grep -c "${_kemp_domain}")

[ecm75]

Thank you for the feedback and I'm sorry if this script is not up with the standards, I'm not a developer and this is my first contribution to this project.

I implemented all the givem suggestions.

[Neilpang]

add the usage here:
https://github.com/acmesh-official/acme.sh/wiki/deployhooks

[ecm75]

add the usage here: https://github.com/acmesh-official/acme.sh/wiki/deployhooks

I've added the usage to the wiki page: https://github.com/acmesh-official/acme.sh/wiki/deployhooks#38-deploy-to-kemp-loadmaster-load-balancer