Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
0a3ac1f5
Commit
0a3ac1f5
authored
May 25, 2018
by
Janos Lenart
Browse files
Added support for Google Cloud DNS API (dns_gcloud)
parent
9173140d
Changes
3
Hide whitespace changes
Inline
Side-by-side
README.md
View file @
0a3ac1f5
...
@@ -274,6 +274,7 @@ You don't have to do anything manually!
...
@@ -274,6 +274,7 @@ You don't have to do anything manually!
### Currently acme.sh supports:
### Currently acme.sh supports:
1.
Google Cloud DNS API
1.
CloudFlare.com API
1.
CloudFlare.com API
1.
DNSPod.cn API
1.
DNSPod.cn API
1.
CloudXNS.com API
1.
CloudXNS.com API
...
...
dnsapi/README.md
View file @
0a3ac1f5
...
@@ -4,6 +4,27 @@ If your dns provider doesn't provide api access, you can use our dns alias mode:
...
@@ -4,6 +4,27 @@ If your dns provider doesn't provide api access, you can use our dns alias mode:
https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
## 1. Use Google Cloud DNS API to automatically issue cert
First you need to authenticate to gcloud.
```
gcloud init
```
**The `dns_gcloud` script uses the active gcloud configuration and credentials.**
There is no logic inside
`dns_gcloud`
to override the project and other settings.
If needed, create additional
[
gcloud configurations
](
https://cloud.google.com/sdk/gcloud/reference/topic/configurations
)
.
You can change the configuration being used without
*activating*
it; simply set the
`CLOUDSDK_ACTIVE_CONFIG_NAME`
environment variable.
To issue a certificate you can:
```
export CLOUDSDK_ACTIVE_CONFIG_NAME=default # see the note above
acme.sh --issue --dns dns_gcloud -d example.com -d '*.example.com'
```
`dns_gcloud`
also supports
[
DNS alias mode
](
https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
)
.
## 1. Use CloudFlare domain API to automatically issue cert
## 1. Use CloudFlare domain API to automatically issue cert
First you need to login to your CloudFlare account to get your API key.
First you need to login to your CloudFlare account to get your API key.
...
...
dnsapi/dns_gcloud.sh
0 → 100755
View file @
0a3ac1f5
#!/usr/bin/env sh
# Author: Janos Lenart <janos@lenart.io>
######## Public functions #####################
# Usage: dns_gcloud_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_gcloud_add
()
{
fulldomain
=
$1
txtvalue
=
$2
_info
"Using gcloud"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
_dns_gcloud_find_zone
||
return
$?
# Add an extra RR
_dns_gcloud_start_tr
||
return
$?
_dns_gcloud_get_rrdatas
||
return
$?
echo
"
$rrdatas
"
| _dns_gcloud_remove_rrs
||
return
$?
echo
-e
"
$rrdatas
\n\"
$txtvalue
\"
"
|
grep
-v
'^$'
| _dns_gcloud_add_rrs
||
return
$?
_dns_gcloud_execute_tr
||
return
$?
_info
"
$fulldomain
record added"
}
# Usage: dns_gcloud_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
# Remove the txt record after validation.
dns_gcloud_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
_info
"Using gcloud"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
_dns_gcloud_find_zone
||
return
$?
# Remove one RR
_dns_gcloud_start_tr
||
return
$?
_dns_gcloud_get_rrdatas
||
return
$?
echo
"
$rrdatas
"
| _dns_gcloud_remove_rrs
||
return
$?
echo
"
$rrdatas
"
| fgrep
-v
"
\"
$txtvalue
\"
"
| _dns_gcloud_add_rrs
||
return
$?
_dns_gcloud_execute_tr
||
return
$?
_info
"
$fulldomain
record added"
}
#################### Private functions below ##################################
_dns_gcloud_start_tr
()
{
if
!
trd
=
`
mktemp
-d
`
;
then
_err
"_dns_gcloud_start_tr: failed to create temporary directory"
return
1
fi
tr
=
"
$trd
/tr.yaml"
_debug
tr
"
$tr
"
if
!
gcloud dns record-sets transaction start
\
--transaction-file
=
"
$tr
"
\
--zone
=
"
$managedZone
"
;
then
rm
-r
"
$trd
"
_err
"_dns_gcloud_start_tr: failed to execute transaction"
return
1
fi
}
_dns_gcloud_execute_tr
()
{
if
!
gcloud dns record-sets transaction execute
\
--transaction-file
=
"
$tr
"
\
--zone
=
"
$managedZone
"
;
then
_debug
tr
"
`
cat
\"
$tr
\"
`
"
rm
-r
"
$trd
"
_err
"_dns_gcloud_execute_tr: failed to execute transaction"
return
1
fi
rm
-r
"
$trd
"
for
i
in
`
seq
1 120
`
;
do
if
gcloud dns record-sets changes list
\
--zone
=
lenart
\
--filter
=
'status != done'
\
|
grep
-q
'.*'
;
then
_info
"_dns_gcloud_execute_tr: waiting for transaction to be comitted ..."
sleep
5
else
return
0
fi
done
_err
"_dns_gcloud_execute_tr: transaction is still pending after 10 minutes"
rm
-r
"
$trd
"
return
1
}
_dns_gcloud_remove_rrs
()
{
if
!
xargs
--no-run-if-empty
gcloud dns record-sets transaction remove
\
--name
=
"
$fulldomain
."
\
--ttl
=
"
$ttl
"
\
--type
=
TXT
\
--zone
=
"
$managedZone
"
\
--transaction-file
=
"
$tr
"
;
then
_debug
tr
"
`
cat
\"
$tr
\"
`
"
rm
-r
"
$trd
"
_err
"_dns_gcloud_remove_rrs: failed to remove RRs"
return
1
fi
}
_dns_gcloud_add_rrs
()
{
ttl
=
60
if
!
xargs
--no-run-if-empty
gcloud dns record-sets transaction add
\
--name
=
"
$fulldomain
."
\
--ttl
=
"
$ttl
"
\
--type
=
TXT
\
--zone
=
"
$managedZone
"
\
--transaction-file
=
"
$tr
"
;
then
_debug
tr
"
`
cat
\"
$tr
\"
`
"
rm
-r
"
$trd
"
_err
"_dns_gcloud_add_rrs: failed to add RRs"
return
1
fi
}
_dns_gcloud_find_zone
()
{
# Prepare a filter that matches zones that are suiteable for this entry.
# For example, _acme-challenge.something.domain.com might need to go into something.domain.com or domain.com;
# this function finds the longest postfix that has a managed zone.
part
=
"
$fulldomain
"
filter
=
"dnsName=( "
while
[
"
$part
"
!=
""
]
;
do
filter
=
"
$filter$part
. "
part
=
"
`
echo
\"
$part
\"
|
sed
's/[^.]*\.*//'
`
"
done
filter
=
"
$filter
)"
_debug filter
"
$filter
"
# List domains and find the longest match (in case of some levels of delegation)
if
!
match
=
$(
gcloud dns managed-zones list
\
--format
=
"value(name, dnsName)"
\
--filter
=
"
$filter
"
\
|
while
read
dnsName name
;
do
echo
-e
"
${#
dnsName
}
\t
$dnsName
\t
$name
"
done
\
|
sort
-n
-r
|
head
-n1
|
cut
-f2
,3 |
grep
'.*'
)
;
then
_err
"_dns_gcloud_find_zone: Can't find a matching managed zone! Perhaps wrong project or gcloud credentials?"
return
1
fi
dnsName
=
$(
echo
"
$match
"
|
cut
-f2
)
_debug dnsName
"
$dnsName
"
managedZone
=
$(
echo
"
$match
"
|
cut
-f1
)
_debug managedZone
"
$managedZone
"
}
_dns_gcloud_get_rrdatas
()
{
if
!
rrdatas
=
$(
gcloud dns record-sets list
\
--zone
=
"
$managedZone
"
\
--name
=
"
$fulldomain
."
\
--type
=
TXT
\
--format
=
"value(ttl,rrdatas)"
)
;
then
_err
"_dns_gcloud_get_rrdatas: Failed to list record-sets"
rm
-r
"
$trd
"
return
1
fi
ttl
=
$(
echo
"
$rrdatas
"
|
cut
-f1
)
rrdatas
=
$(
echo
"
$rrdatas
"
|
cut
-f2
|
sed
's/","/"\n"/g'
)
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment