From 3d9608faa086890321ba8d9d630c5b659f89ed46 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 20:09:24 -0500
Subject: [PATCH 01/11] Move -T parameter into default ssh command variable

---
 deploy/ssh.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 9cb0af9e..783e6f7b 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -12,7 +12,7 @@
 # Only a username is required.  All others are optional.
 #
 # The following examples are for QNAP NAS running QTS 4.2
-# export DEPLOY_SSH_CMD=""  # defaults to ssh
+# export DEPLOY_SSH_CMD=""  # defaults to "ssh -T"
 # export DEPLOY_SSH_USER="admin"  # required
 # export DEPLOY_SSH_SERVER="qnap"  # defaults to domain name
 # export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
@@ -71,7 +71,7 @@ ssh_deploy() {
     Le_Deploy_ssh_cmd="$DEPLOY_SSH_CMD"
     _savedomainconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
   elif [ -z "$Le_Deploy_ssh_cmd" ]; then
-    Le_Deploy_ssh_cmd="ssh"
+    Le_Deploy_ssh_cmd="ssh -T"
   fi
 
   # BACKUP is optional. If not provided then default to yes
@@ -194,7 +194,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _info "Submitting sequence of commands to remote server by ssh"
   # quotations in bash cmd below intended.  Squash travis spellcheck error
   # shellcheck disable=SC2029
-  $Le_Deploy_ssh_cmd -T "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmdstr'"
+  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmdstr'"
   _ret="$?"
 
   if [ "$_ret" != "0" ]; then

From 04771e5a4ae243cdc757b7d3159cef92fce40605 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 20:16:36 -0500
Subject: [PATCH 02/11] Move call to remote system into separate function

---
 deploy/ssh.sh | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 783e6f7b..8c83f0b3 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -31,6 +31,7 @@ ssh_deploy() {
   _ccert="$3"
   _cca="$4"
   _cfullchain="$5"
+  _err_code=0
   _cmdstr=""
   _homedir='~'
   _backupprefix="$_homedir/.acme_ssh_deploy/$_cdomain-backup"
@@ -190,16 +191,25 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     _info "Backup directories erased after 180 days."
   fi
 
-  _secure_debug "Remote commands to execute: " "$_cmdstr"
-  _info "Submitting sequence of commands to remote server by ssh"
-  # quotations in bash cmd below intended.  Squash travis spellcheck error
-  # shellcheck disable=SC2029
-  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmdstr'"
-  _ret="$?"
-
-  if [ "$_ret" != "0" ]; then
-    _err "Error code $_ret returned from $Le_Deploy_ssh_cmd"
+  if ! _ssh_remote_cmd "$_cmdstr"; then
+    return $_err_code
   fi
 
-  return $_ret
+  return 0
+}
+
+#cmd
+_ssh_remote_cmd() {
+  _secure_debug "Remote commands to execute: $_cmd"
+  _info "Submitting sequence of commands to remote server by $Le_Deploy_ssh_cmd"
+  # quotations in bash cmd below intended.  Squash travis spellcheck error
+  # shellcheck disable=SC2029
+  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmd'"
+  _err_code="$?"
+
+  if [ "$_err_code" != "0" ]; then
+    _err "Error code $_err_code returned from $Le_Deploy_ssh_cmd"
+  fi
+
+  return $_err_code
 }

From 6420d1239fda00fb5d40299bfbf1b22c4af4762f Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 20:31:52 -0500
Subject: [PATCH 03/11] Move call to remote system into separate function

---
 deploy/ssh.sh | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 783e6f7b..00d9d21d 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -31,6 +31,7 @@ ssh_deploy() {
   _ccert="$3"
   _cca="$4"
   _cfullchain="$5"
+  _err_code=0
   _cmdstr=""
   _homedir='~'
   _backupprefix="$_homedir/.acme_ssh_deploy/$_cdomain-backup"
@@ -190,16 +191,26 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     _info "Backup directories erased after 180 days."
   fi
 
-  _secure_debug "Remote commands to execute: " "$_cmdstr"
-  _info "Submitting sequence of commands to remote server by ssh"
-  # quotations in bash cmd below intended.  Squash travis spellcheck error
-  # shellcheck disable=SC2029
-  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmdstr'"
-  _ret="$?"
-
-  if [ "$_ret" != "0" ]; then
-    _err "Error code $_ret returned from $Le_Deploy_ssh_cmd"
+  if ! _ssh_remote_cmd "$_cmdstr"; then
+    return $_err_code
   fi
 
-  return $_ret
+  return 0
+}
+
+#cmd
+_ssh_remote_cmd() {
+  _cmd="$1"
+  _secure_debug "Remote commands to execute: $_cmd"
+  _info "Submitting sequence of commands to remote server by $Le_Deploy_ssh_cmd"
+  # quotations in bash cmd below intended.  Squash travis spellcheck error
+  # shellcheck disable=SC2029
+  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmd'"
+  _err_code="$?"
+
+  if [ "$_err_code" != "0" ]; then
+    _err "Error code $_err_code returned from $Le_Deploy_ssh_cmd"
+  fi
+
+  return $_err_code
 }

From 283b04df739dff70ed22ee20ffac6a1c576db842 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 20:43:28 -0500
Subject: [PATCH 04/11] Move cleanup of backup directory to first step in the
 function.

---
 deploy/ssh.sh | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 00d9d21d..39a0a218 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -85,6 +85,19 @@ ssh_deploy() {
 
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
 
+  if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
+    # run cleanup on the backup directory, erase all older
+    # than 180 days (15552000 seconds).
+    _cmdstr="{ now=\"\$(date -u +%s)\"; for fn in $_backupprefix*; \
+do if [ -d \"\$fn\" ] && [ \"\$(expr \$now - \$(date -ur \$fn +%s) )\" -ge \"15552000\" ]; \
+then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; done; }; $_cmdstr"
+    # Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
+    # Create our backup directory for overwritten cert files.
+    _cmdstr="mkdir -p $_backupdir; $_cmdstr"
+    _info "Backup of old certificate files will be placed in remote directory $_backupdir"
+    _info "Backup directories erased after 180 days."
+  fi
+
   # KEYFILE is optional.
   # If provided then private key will be copied to provided filename.
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
@@ -178,17 +191,6 @@ ssh_deploy() {
   if [ -z "$_cmdstr" ]; then
     _err "No remote commands to excute. Failed to deploy certificates to remote server"
     return 1
-  elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
-    # run cleanup on the backup directory, erase all older
-    # than 180 days (15552000 seconds).
-    _cmdstr="{ now=\"\$(date -u +%s)\"; for fn in $_backupprefix*; \
-do if [ -d \"\$fn\" ] && [ \"\$(expr \$now - \$(date -ur \$fn +%s) )\" -ge \"15552000\" ]; \
-then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; done; }; $_cmdstr"
-    # Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
-    # Create our backup directory for overwritten cert files.
-    _cmdstr="mkdir -p $_backupdir; $_cmdstr"
-    _info "Backup of old certificate files will be placed in remote directory $_backupdir"
-    _info "Backup directories erased after 180 days."
   fi
 
   if ! _ssh_remote_cmd "$_cmdstr"; then

From cc820e97c6e7cea1d5de0165bd5b7b5d84249843 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 21:10:42 -0500
Subject: [PATCH 05/11] Add support for DEPLOY_SSH_BATCH_MODE with default of
 yes. Before this update all remote commands were bunched together and sent to
 the remote host in a single SSH command.  This could result in a very long
 sequence of commands that might be rejected by a remote host (example is
 VMware ESXi that uses busybox sh). With this update you can set
 DEPLOY_SSH_BATCH_MODE="no" and each remote command is sent as a separate SSH
 call so now we do not have big long sequence of commands.  Defaults to same
 behaviour as before this update.

---
 deploy/ssh.sh | 63 ++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 55 insertions(+), 8 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 39a0a218..92aa43d9 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -21,6 +21,7 @@
 # export DEPLOY_SSH_FULLCHAIN=""
 # export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
 # export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes
+# export DEPLOY_SSH_BATCH_MODE="yes"  # yes or no, default to yes
 #
 ########  Public functions #####################
 
@@ -83,7 +84,20 @@ ssh_deploy() {
   fi
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
+  # BATCH_MODE is optional. If not provided then default to yes
+  if [ "$DEPLOY_SSH_BATCH_MODE" = "no" ]; then
+    Le_Deploy_ssh_batch_mode="no"
+  elif [ -z "$Le_Deploy_ssh_batch_mode" ]; then
+    Le_Deploy_ssh_batch_mode="yes"
+  fi
+  _savedomainconf Le_Deploy_ssh_batch_mode "$Le_Deploy_ssh_batch_mode"
+  
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
+  if [ "$Le_Deploy_ssh_batch_mode" = "yes" ]; then
+    _info "Using BATCH MODE... Multiple commands sent in single call to remote host"
+  else
+    _info "Commands sent individually in multiple calls to remote host"
+  fi
 
   if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
     # run cleanup on the backup directory, erase all older
@@ -96,6 +110,12 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     _cmdstr="mkdir -p $_backupdir; $_cmdstr"
     _info "Backup of old certificate files will be placed in remote directory $_backupdir"
     _info "Backup directories erased after 180 days."
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
   # KEYFILE is optional.
@@ -112,6 +132,12 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
     _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
   # CERTFILE is optional.
@@ -132,6 +158,12 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
     _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
   # CAFILE is optional.
@@ -153,6 +185,12 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
     _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
   # FULLCHAIN is optional.
@@ -175,6 +213,12 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
     _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
   # REMOTE_CMD is optional.
@@ -186,17 +230,20 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
     _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd;"
     _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
+    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+      if ! _ssh_remote_cmd "$_cmdstr"; then
+        return $_err_code
+      fi
+      _cmdstr=""
+    fi
   fi
 
-  if [ -z "$_cmdstr" ]; then
-    _err "No remote commands to excute. Failed to deploy certificates to remote server"
-    return 1
+  # if running as batch mode then all commands sent in a single SSH call now...
+  if [ -n "$_cmdstr" ]; then
+    if ! _ssh_remote_cmd "$_cmdstr"; then
+      return $_err_code
+    fi
   fi
-
-  if ! _ssh_remote_cmd "$_cmdstr"; then
-    return $_err_code
-  fi
-
   return 0
 }
 

From 806b746fc0522bed79a1b51f3c0137a0fa721dc5 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 21:23:59 -0500
Subject: [PATCH 06/11] Fix bug where backup and batch_mode yes/no values could
 not be changed. Once set to "no" then they could never be set back to "yes"

---
 deploy/ssh.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 92aa43d9..113ae23e 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -79,7 +79,7 @@ ssh_deploy() {
   # BACKUP is optional. If not provided then default to yes
   if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
     Le_Deploy_ssh_backup="no"
-  elif [ -z "$Le_Deploy_ssh_backup" ]; then
+  elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
     Le_Deploy_ssh_backup="yes"
   fi
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
@@ -87,7 +87,7 @@ ssh_deploy() {
   # BATCH_MODE is optional. If not provided then default to yes
   if [ "$DEPLOY_SSH_BATCH_MODE" = "no" ]; then
     Le_Deploy_ssh_batch_mode="no"
-  elif [ -z "$Le_Deploy_ssh_batch_mode" ]; then
+  elif [ -z "$Le_Deploy_ssh_batch_mode" ] || [ "$DEPLOY_SSH_BATCH_MODE" = "yes" ]; then
     Le_Deploy_ssh_batch_mode="yes"
   fi
   _savedomainconf Le_Deploy_ssh_batch_mode "$Le_Deploy_ssh_batch_mode"

From 46ee74ed1687bcc5dbb7732bf7483e6c793ec253 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 22:05:06 -0500
Subject: [PATCH 07/11] Remove variable from info/error printout that could
 potentially expose login credentials.

---
 deploy/ssh.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 113ae23e..b68dad7e 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -251,14 +251,14 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 _ssh_remote_cmd() {
   _cmd="$1"
   _secure_debug "Remote commands to execute: $_cmd"
-  _info "Submitting sequence of commands to remote server by $Le_Deploy_ssh_cmd"
+  _info "Submitting sequence of commands to remote server by ssh"
   # quotations in bash cmd below intended.  Squash travis spellcheck error
   # shellcheck disable=SC2029
   $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmd'"
   _err_code="$?"
 
   if [ "$_err_code" != "0" ]; then
-    _err "Error code $_err_code returned from $Le_Deploy_ssh_cmd"
+    _err "Error code $_err_code returned from ssh"
   fi
 
   return $_err_code

From f73a49440790018aacff9e1d540c937f481cfc20 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 22 Feb 2020 22:09:28 -0500
Subject: [PATCH 08/11] Remove spaces on blank line to fix travis error

---
 deploy/ssh.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index b68dad7e..b3e040b3 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -91,7 +91,7 @@ ssh_deploy() {
     Le_Deploy_ssh_batch_mode="yes"
   fi
   _savedomainconf Le_Deploy_ssh_batch_mode "$Le_Deploy_ssh_batch_mode"
-  
+
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
   if [ "$Le_Deploy_ssh_batch_mode" = "yes" ]; then
     _info "Using BATCH MODE... Multiple commands sent in single call to remote host"

From 8ba573d1967e13dcdc03631308f5dbdd3acf565c Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Tue, 3 Mar 2020 13:40:33 -0500
Subject: [PATCH 09/11] Change variable name to MULTI_CALL so default can be
 "no"

---
 deploy/ssh.sh | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index b3e040b3..7eed8a34 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -21,7 +21,7 @@
 # export DEPLOY_SSH_FULLCHAIN=""
 # export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
 # export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes
-# export DEPLOY_SSH_BATCH_MODE="yes"  # yes or no, default to yes
+# export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no
 #
 ########  Public functions #####################
 
@@ -84,19 +84,19 @@ ssh_deploy() {
   fi
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
-  # BATCH_MODE is optional. If not provided then default to yes
-  if [ "$DEPLOY_SSH_BATCH_MODE" = "no" ]; then
-    Le_Deploy_ssh_batch_mode="no"
-  elif [ -z "$Le_Deploy_ssh_batch_mode" ] || [ "$DEPLOY_SSH_BATCH_MODE" = "yes" ]; then
-    Le_Deploy_ssh_batch_mode="yes"
+  # MULTI_CALL is optional. If not provided then default to no
+  if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
+    Le_Deploy_ssh_multi_call="yes"
+  elif [ -z "$Le_Deploy_ssh_multi_call" ] || [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
+    Le_Deploy_ssh_multi_call="no"
   fi
-  _savedomainconf Le_Deploy_ssh_batch_mode "$Le_Deploy_ssh_batch_mode"
+  _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
 
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
-  if [ "$Le_Deploy_ssh_batch_mode" = "yes" ]; then
-    _info "Using BATCH MODE... Multiple commands sent in single call to remote host"
+  if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+    _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
   else
-    _info "Commands sent individually in multiple calls to remote host"
+    _info "Required commands batched and sent in single call to remote host"
   fi
 
   if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
@@ -110,7 +110,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     _cmdstr="mkdir -p $_backupdir; $_cmdstr"
     _info "Backup of old certificate files will be placed in remote directory $_backupdir"
     _info "Backup directories erased after 180 days."
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -132,7 +132,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
     _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -158,7 +158,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
     _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -185,7 +185,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
     _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -213,7 +213,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     # copy new certificate into file.
     _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
     _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -230,7 +230,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
     _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd;"
     _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
-    if [ "$Le_Deploy_ssh_batch_mode" = "no" ]; then
+    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -238,7 +238,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
   fi
 
-  # if running as batch mode then all commands sent in a single SSH call now...
+  # if commands not all sent in multiple calls then all commands sent in a single SSH call now...
   if [ -n "$_cmdstr" ]; then
     if ! _ssh_remote_cmd "$_cmdstr"; then
       return $_err_code

From 554e083f3d387baacbc151b98463efc697091706 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Wed, 11 Mar 2020 10:58:36 -0400
Subject: [PATCH 10/11] For MULTI_CALL default to undefined, deleting entry in
 config file if set to "no"

---
 deploy/ssh.sh | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 7eed8a34..5d1ee805 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -20,8 +20,8 @@
 # export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
 # export DEPLOY_SSH_FULLCHAIN=""
 # export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
-# export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes
-# export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no
+# export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes or previously saved value
+# export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no or previously saved value
 #
 ########  Public functions #####################
 
@@ -76,7 +76,7 @@ ssh_deploy() {
     Le_Deploy_ssh_cmd="ssh -T"
   fi
 
-  # BACKUP is optional. If not provided then default to yes
+  # BACKUP is optional. If not provided then default to previously saved value or yes.
   if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
     Le_Deploy_ssh_backup="no"
   elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
@@ -84,13 +84,15 @@ ssh_deploy() {
   fi
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
-  # MULTI_CALL is optional. If not provided then default to no
+  # MULTI_CALL is optional. If not provided then default to previously saved
+  # value (which may be undefined... equivalent to "no").
   if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
     Le_Deploy_ssh_multi_call="yes"
-  elif [ -z "$Le_Deploy_ssh_multi_call" ] || [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
-    Le_Deploy_ssh_multi_call="no"
+    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+  elif [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
+    Le_Deploy_ssh_multi_call=""
+    _cleardomainconf Le_Deploy_ssh_multi_call
   fi
-  _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
 
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
   if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then

From f38df4df1151822d50628be22f27ab3eb20429f4 Mon Sep 17 00:00:00 2001
From: dkerr64 <david@kerr.net>
Date: Sat, 14 Mar 2020 21:51:21 -0400
Subject: [PATCH 11/11] Make remote backup directory path user configurable.

---
 deploy/ssh.sh | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 5d1ee805..d71637a1 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -21,6 +21,7 @@
 # export DEPLOY_SSH_FULLCHAIN=""
 # export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
 # export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes or previously saved value
+# export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy"  # path on remote system. Defaults to .acme_ssh_deploy
 # export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no or previously saved value
 #
 ########  Public functions #####################
@@ -34,9 +35,8 @@ ssh_deploy() {
   _cfullchain="$5"
   _err_code=0
   _cmdstr=""
-  _homedir='~'
-  _backupprefix="$_homedir/.acme_ssh_deploy/$_cdomain-backup"
-  _backupdir="$_backupprefix-$(_utc_date | tr ' ' '-')"
+  _backupprefix=""
+  _backupdir=""
 
   if [ -f "$DOMAIN_CONF" ]; then
     # shellcheck disable=SC1090
@@ -84,6 +84,14 @@ ssh_deploy() {
   fi
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
+  # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
+  if [ -n "$DEPLOY_SSH_BACKUP_PATH" ]; then
+    Le_Deploy_ssh_backup_path="$DEPLOY_SSH_BACKUP_PATH"
+  elif [ -z "$Le_Deploy_ssh_backup_path" ]; then
+    Le_Deploy_ssh_backup_path=".acme_ssh_deploy"
+  fi
+  _savedomainconf Le_Deploy_ssh_backup_path "$Le_Deploy_ssh_backup_path"
+
   # MULTI_CALL is optional. If not provided then default to previously saved
   # value (which may be undefined... equivalent to "no").
   if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
@@ -102,6 +110,8 @@ ssh_deploy() {
   fi
 
   if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
+    _backupprefix="$Le_Deploy_ssh_backup_path/$_cdomain-backup"
+    _backupdir="$_backupprefix-$(_utc_date | tr ' ' '-')"
     # run cleanup on the backup directory, erase all older
     # than 180 days (15552000 seconds).
     _cmdstr="{ now=\"\$(date -u +%s)\"; for fn in $_backupprefix*; \