Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
429b18ed
Unverified
Commit
429b18ed
authored
Jan 28, 2023
by
neil
Committed by
GitHub
Jan 28, 2023
Browse files
Merge pull request #4475 from acmesh-official/dev
sync
parents
16dc21af
2690c057
Changes
15
Expand all
Hide whitespace changes
Inline
Side-by-side
.github/workflows/DNS.yml
View file @
429b18ed
...
@@ -121,19 +121,19 @@ jobs:
...
@@ -121,19 +121,19 @@ jobs:
-
name
:
Run acmetest
-
name
:
Run acmetest
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -184,19 +184,19 @@ jobs:
...
@@ -184,19 +184,19 @@ jobs:
shell
:
bash
shell
:
bash
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -234,19 +234,19 @@ jobs:
...
@@ -234,19 +234,19 @@ jobs:
copyback
:
false
copyback
:
false
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -285,19 +285,19 @@ jobs:
...
@@ -285,19 +285,19 @@ jobs:
copyback
:
false
copyback
:
false
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -337,19 +337,19 @@ jobs:
...
@@ -337,19 +337,19 @@ jobs:
copyback
:
false
copyback
:
false
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -389,19 +389,19 @@ jobs:
...
@@ -389,19 +389,19 @@ jobs:
copyback
:
false
copyback
:
false
run
:
|
run
:
|
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
@@ -445,19 +445,19 @@ jobs:
...
@@ -445,19 +445,19 @@ jobs:
pkg set-mediator -v -I default@1.1 openssl
pkg set-mediator -v -I default@1.1 openssl
export PATH=/usr/gnu/bin:$PATH
export PATH=/usr/gnu/bin:$PATH
if [ "${{ secrets.TokenName1}}" ] ; then
if [ "${{ secrets.TokenName1}}" ] ; then
export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
export ${{ secrets.TokenName1}}=
"
${{ secrets.TokenValue1}}
"
fi
fi
if [ "${{ secrets.TokenName2}}" ] ; then
if [ "${{ secrets.TokenName2}}" ] ; then
export ${{ secrets.TokenName2}}=${{ secrets.TokenValue2}}
export ${{ secrets.TokenName2}}=
"
${{ secrets.TokenValue2}}
"
fi
fi
if [ "${{ secrets.TokenName3}}" ] ; then
if [ "${{ secrets.TokenName3}}" ] ; then
export ${{ secrets.TokenName3}}=${{ secrets.TokenValue3}}
export ${{ secrets.TokenName3}}=
"
${{ secrets.TokenValue3}}
"
fi
fi
if [ "${{ secrets.TokenName4}}" ] ; then
if [ "${{ secrets.TokenName4}}" ] ; then
export ${{ secrets.TokenName4}}=${{ secrets.TokenValue4}}
export ${{ secrets.TokenName4}}=
"
${{ secrets.TokenValue4}}
"
fi
fi
if [ "${{ secrets.TokenName5}}" ] ; then
if [ "${{ secrets.TokenName5}}" ] ; then
export ${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}
export ${{ secrets.TokenName5}}=
"
${{ secrets.TokenValue5}}
"
fi
fi
cd ../acmetest
cd ../acmetest
./letest.sh
./letest.sh
...
...
.github/workflows/NetBSD.yml
View file @
429b18ed
...
@@ -61,7 +61,6 @@ jobs:
...
@@ -61,7 +61,6 @@ jobs:
nat
:
|
nat
:
|
"8080": "80"
"8080": "80"
prepare
:
|
prepare
:
|
export PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r|cut -f '1 2' -d.)/All/"
pkg_add curl socat
pkg_add curl socat
usesh
:
true
usesh
:
true
copyback
:
false
copyback
:
false
...
...
.github/workflows/Ubuntu.yml
View file @
429b18ed
...
@@ -80,9 +80,14 @@ jobs:
...
@@ -80,9 +80,14 @@ jobs:
-p 9000:9000 \
-p 9000:9000 \
-e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
-e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT=true" \
-e "DOCKER_STEPCA_INIT_PASSWORD=test" \
--name stepca \
--name stepca \
smallstep/step-ca \
smallstep/step-ca:0.23.1
&& sleep 5 && docker exec stepca step ca provisioner add acme --type ACME \
sleep
5
docker exec stepca bash -c "echo test >test" \
&& docker exec stepca step ca provisioner add acme --type ACME --admin-subject step --admin-password-file=/home/step/test \
&& docker exec stepca kill -1 1 \
&& docker exec stepca kill -1 1 \
&& docker exec stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
&& docker exec stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
- name
:
Clone acmetest
- name
:
Clone acmetest
...
...
Dockerfile
View file @
429b18ed
FROM
alpine:3.1
6.3
FROM
alpine:3.1
7
RUN
apk
--no-cache
add
-f
\
RUN
apk
--no-cache
add
-f
\
openssl
\
openssl
\
...
@@ -12,7 +12,8 @@ RUN apk --no-cache add -f \
...
@@ -12,7 +12,8 @@ RUN apk --no-cache add -f \
oath-toolkit-oathtool
\
oath-toolkit-oathtool
\
tar
\
tar
\
libidn
\
libidn
\
jq
jq
\
cronie
ENV
LE_CONFIG_HOME /acme.sh
ENV
LE_CONFIG_HOME /acme.sh
...
@@ -64,12 +65,10 @@ RUN for verb in help \
...
@@ -64,12 +65,10 @@ RUN for verb in help \
RUN
printf
"%b"
'#!'
"/usr/bin/env sh
\n
\
RUN
printf
"%b"
'#!'
"/usr/bin/env sh
\n
\
if [
\"\$
1
\"
=
\"
daemon
\"
]; then
\n
\
if [
\"\$
1
\"
=
\"
daemon
\"
]; then
\n
\
trap
\"
echo stop && killall crond && exit 0
\"
SIGTERM SIGINT
\n
\
exec crond -n
\n
\
crond && sleep infinity &
\n
\
wait
\n
\
else
\n
\
else
\n
\
exec --
\"\$
@
\"\n
\
exec --
\"\$
@
\"\n
\
fi"
>
/entry.sh
&&
chmod
+x /entry.sh
fi
\n
"
>
/entry.sh
&&
chmod
+x /entry.sh
VOLUME
/acme.sh
VOLUME
/acme.sh
...
...
README.md
View file @
429b18ed
...
@@ -361,10 +361,6 @@ Ok, it's done.
...
@@ -361,10 +361,6 @@ Ok, it's done.
# 10. Issue ECC certificates
# 10. Issue ECC certificates
`Let's Encrypt`
can now issue
**ECDSA**
certificates.
And we support them too!
Just set the
`keylength`
parameter with a prefix
`ec-`
.
Just set the
`keylength`
parameter with a prefix
`ec-`
.
For example:
For example:
...
@@ -385,10 +381,12 @@ Please look at the `keylength` parameter above.
...
@@ -385,10 +381,12 @@ Please look at the `keylength` parameter above.
Valid values are:
Valid values are:
1.
**ec-256 (prime256v1, "ECDSA P-256")**
1.
**ec-256 (prime256v1, "ECDSA P-256"
, which is the default key type
)**
2.
**ec-384 (secp384r1, "ECDSA P-384")**
2.
**ec-384 (secp384r1, "ECDSA P-384")**
3.
**ec-521 (secp521r1, "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
3.
**ec-521 (secp521r1, "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
4.
**2048 (RSA2048)**
5.
**3072 (RSA3072)**
6.
**4096 (RSA4096)**
# 11. Issue Wildcard certificates
# 11. Issue Wildcard certificates
...
...
acme.sh
View file @
429b18ed
#!/usr/bin/env sh
#!/usr/bin/env sh
VER
=
3.0.
5
VER
=
3.0.
6
PROJECT_NAME
=
"acme.sh"
PROJECT_NAME
=
"acme.sh"
...
@@ -53,8 +53,8 @@ CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$
...
@@ -53,8 +53,8 @@ CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
DEFAULT_ACCOUNT_KEY_LENGTH
=
2048
DEFAULT_ACCOUNT_KEY_LENGTH
=
ec-256
DEFAULT_DOMAIN_KEY_LENGTH
=
2048
DEFAULT_DOMAIN_KEY_LENGTH
=
ec-256
DEFAULT_OPENSSL_BIN
=
"openssl"
DEFAULT_OPENSSL_BIN
=
"openssl"
...
@@ -1637,7 +1637,7 @@ _stat() {
...
@@ -1637,7 +1637,7 @@ _stat() {
#keyfile
#keyfile
_isRSA
()
{
_isRSA
()
{
keyfile
=
$1
keyfile
=
$1
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
|
grep
"^publicExponent:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
2>&1
|
grep
"^publicExponent:"
2>&1
>
/dev/null
;
then
return
0
return
0
fi
fi
return
1
return
1
...
@@ -1646,7 +1646,7 @@ _isRSA() {
...
@@ -1646,7 +1646,7 @@ _isRSA() {
#keyfile
#keyfile
_isEcc
()
{
_isEcc
()
{
keyfile
=
$1
keyfile
=
$1
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
2>&1
>
/dev/null
;
then
return
0
return
0
fi
fi
return
1
return
1
...
@@ -1744,7 +1744,7 @@ _calcjwk() {
...
@@ -1744,7 +1744,7 @@ _calcjwk() {
_debug3 x64
"
$x64
"
_debug3 x64
"
$x64
"
xend
=
$(
_math
"
$xend
"
+ 1
)
xend
=
$(
_math
"
$xend
"
+ 1
)
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
10000
)
"
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
2048
)
"
_debug3 y
"
$y
"
_debug3 y
"
$y
"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url_replace
)
"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url_replace
)
"
...
@@ -2058,7 +2058,7 @@ _get() {
...
@@ -2058,7 +2058,7 @@ _get() {
fi
fi
_debug
"_WGET"
"
$_WGET
"
_debug
"_WGET"
"
$_WGET
"
if
[
"
$onlyheader
"
]
;
then
if
[
"
$onlyheader
"
]
;
then
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
if
_contains
"
$_WGET
"
" -d "
;
then
if
_contains
"
$_WGET
"
" -d "
;
then
# Demultiplex wget debug output
# Demultiplex wget debug output
echo
"
$_wget_out
"
>
&2
echo
"
$_wget_out
"
>
&2
...
@@ -2352,6 +2352,26 @@ _readdomainconf() {
...
@@ -2352,6 +2352,26 @@ _readdomainconf() {
_read_conf
"
$DOMAIN_CONF
"
"
$1
"
_read_conf
"
$DOMAIN_CONF
"
"
$1
"
}
}
#_migratedomainconf oldkey newkey base64encode
_migratedomainconf
()
{
_old_key
=
"
$1
"
_new_key
=
"
$2
"
_b64encode
=
"
$3
"
_value
=
$(
_readdomainconf
"
$_old_key
"
)
if
[
-z
"
$_value
"
]
;
then
return
1
# oldkey is not found
fi
_savedomainconf
"
$_new_key
"
"
$_value
"
"
$_b64encode
"
_cleardomainconf
"
$_old_key
"
_debug
"Domain config
$_old_key
has been migrated to
$_new_key
"
}
#_migratedeployconf oldkey newkey base64encode
_migratedeployconf
()
{
_migratedomainconf
"
$1
"
"SAVED_
$2
"
"
$3
"
||
_migratedomainconf
"SAVED_
$1
"
"SAVED_
$2
"
"
$3
"
# try only when oldkey itself is not found
}
#key value base64encode
#key value base64encode
_savedeployconf
()
{
_savedeployconf
()
{
_savedomainconf
"SAVED_
$1
"
"
$2
"
"
$3
"
_savedomainconf
"SAVED_
$1
"
"
$2
"
"
$3
"
...
@@ -2366,12 +2386,14 @@ _getdeployconf() {
...
@@ -2366,12 +2386,14 @@ _getdeployconf() {
if
[
"
$_rac_value
"
]
;
then
if
[
"
$_rac_value
"
]
;
then
if
_startswith
"
$_rac_value
"
'"'
&&
_endswith
"
$_rac_value
"
'"'
;
then
if
_startswith
"
$_rac_value
"
'"'
&&
_endswith
"
$_rac_value
"
'"'
;
then
_debug2
"trim quotation marks"
_debug2
"trim quotation marks"
eval
"export
$_rac_key
=
$_rac_value
"
eval
$_rac_key
=
$_rac_value
export
$_rac_key
fi
fi
return
0
# do nothing
return
0
# do nothing
fi
fi
_saved
=
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
_saved
=
"
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
"
eval
"export
$_rac_key
=
\"\$
_saved
\"
"
eval
$_rac_key
=
"
$_saved
"
export
$_rac_key
}
}
#_saveaccountconf key value base64encode
#_saveaccountconf key value base64encode
...
@@ -2837,7 +2859,8 @@ _initpath() {
...
@@ -2837,7 +2859,8 @@ _initpath() {
DOMAIN_PATH
=
"
$domainhomeecc
"
DOMAIN_PATH
=
"
$domainhomeecc
"
else
else
if
[
!
-d
"
$domainhome
"
]
&&
[
-d
"
$domainhomeecc
"
]
;
then
if
[
!
-d
"
$domainhome
"
]
&&
[
-d
"
$domainhomeecc
"
]
;
then
_info
"The domain '
$domain
' seems to have a ECC cert already, please add '
$(
__red
"--ecc"
)
' parameter if you want to use that cert."
_info
"The domain '
$domain
' seems to have a ECC cert already, lets use ecc cert."
DOMAIN_PATH
=
"
$domainhomeecc
"
fi
fi
fi
fi
_debug DOMAIN_PATH
"
$DOMAIN_PATH
"
_debug DOMAIN_PATH
"
$DOMAIN_PATH
"
...
@@ -6707,6 +6730,13 @@ _send_notify() {
...
@@ -6707,6 +6730,13 @@ _send_notify() {
return
0
return
0
fi
fi
_nsource
=
"
$NOTIFY_SOURCE
"
if
[
-z
"
$_nsource
"
]
;
then
_nsource
=
"
$(
hostname
)
"
fi
_nsubject
=
"
$_nsubject
by
$_nsource
"
_send_err
=
0
_send_err
=
0
for
_n_hook
in
$(
echo
"
$_nhooks
"
|
tr
','
" "
)
;
do
for
_n_hook
in
$(
echo
"
$_nhooks
"
|
tr
','
" "
)
;
do
_n_hook_file
=
"
$(
_findHook
""
$_SUB_FOLDER_NOTIFY
"
$_n_hook
"
)
"
_n_hook_file
=
"
$(
_findHook
""
$_SUB_FOLDER_NOTIFY
"
$_n_hook
"
)
"
...
@@ -6761,11 +6791,12 @@ setnotify() {
...
@@ -6761,11 +6791,12 @@ setnotify() {
_nhook
=
"
$1
"
_nhook
=
"
$1
"
_nlevel
=
"
$2
"
_nlevel
=
"
$2
"
_nmode
=
"
$3
"
_nmode
=
"
$3
"
_nsource
=
"
$4
"
_initpath
_initpath
if
[
-z
"
$_nhook$_nlevel$_nmode
"
]
;
then
if
[
-z
"
$_nhook$_nlevel$_nmode
$_nsource
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]"
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]
[--notify-source <hostname>]
"
_usage
"
$_NOTIFY_WIKI
"
_usage
"
$_NOTIFY_WIKI
"
return
1
return
1
fi
fi
...
@@ -6782,6 +6813,12 @@ setnotify() {
...
@@ -6782,6 +6813,12 @@ setnotify() {
_saveaccountconf
"NOTIFY_MODE"
"
$NOTIFY_MODE
"
_saveaccountconf
"NOTIFY_MODE"
"
$NOTIFY_MODE
"
fi
fi
if
[
"
$_nsource
"
]
;
then
_info
"Set notify source to:
$_nsource
"
export
"NOTIFY_SOURCE=
$_nsource
"
_saveaccountconf
"NOTIFY_SOURCE"
"
$NOTIFY_SOURCE
"
fi
if
[
"
$_nhook
"
]
;
then
if
[
"
$_nhook
"
]
;
then
_info
"Set notify hook to:
$_nhook
"
_info
"Set notify hook to:
$_nhook
"
if
[
"
$_nhook
"
=
"
$NO_VALUE
"
]
;
then
if
[
"
$_nhook
"
=
"
$NO_VALUE
"
]
;
then
...
@@ -6942,6 +6979,7 @@ Parameters:
...
@@ -6942,6 +6979,7 @@ Parameters:
0: Bulk mode. Send all the domain's notifications in one message(mail).
0: Bulk mode. Send all the domain's notifications in one message(mail).
1: Cert mode. Send a message for every single cert.
1: Cert mode. Send a message for every single cert.
--notify-hook <hookname> Set the notify hook
--notify-hook <hookname> Set the notify hook
--notify-source <server name> Set the server name in the notification message
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
See:
$_REVOKE_WIKI
See:
$_REVOKE_WIKI
...
@@ -7099,7 +7137,9 @@ _selectServer() {
...
@@ -7099,7 +7137,9 @@ _selectServer() {
_getCAShortName
()
{
_getCAShortName
()
{
caurl
=
"
$1
"
caurl
=
"
$1
"
if
[
-z
"
$caurl
"
]
;
then
if
[
-z
"
$caurl
"
]
;
then
caurl
=
"
$DEFAULT_CA
"
#use letsencrypt as default value if the Le_API is empty
#this case can only come from the old upgrading.
caurl
=
"
$CA_LETSENCRYPT_V2
"
fi
fi
if
[
"
$CA_SSLCOM_ECC
"
=
"
$caurl
"
]
;
then
if
[
"
$CA_SSLCOM_ECC
"
=
"
$caurl
"
]
;
then
caurl
=
"
$CA_SSLCOM_RSA
"
#just hack to get the short name
caurl
=
"
$CA_SSLCOM_RSA
"
#just hack to get the short name
...
@@ -7216,6 +7256,7 @@ _process() {
...
@@ -7216,6 +7256,7 @@ _process() {
_notify_hook
=
""
_notify_hook
=
""
_notify_level
=
""
_notify_level
=
""
_notify_mode
=
""
_notify_mode
=
""
_notify_source
=
""
_revoke_reason
=
""
_revoke_reason
=
""
_eab_kid
=
""
_eab_kid
=
""
_eab_hmac_key
=
""
_eab_hmac_key
=
""
...
@@ -7496,7 +7537,7 @@ _process() {
...
@@ -7496,7 +7537,7 @@ _process() {
shift
shift
;;
;;
--home
)
--home
)
export
LE_WORKING_DIR
=
"
$
2
"
export
LE_WORKING_DIR
=
"
$
(
echo
"
$2
"
|
sed
's|/$||'
)
"
shift
shift
;;
;;
--cert-home
|
--certhome
)
--cert-home
|
--certhome
)
...
@@ -7708,6 +7749,15 @@ _process() {
...
@@ -7708,6 +7749,15 @@ _process() {
_notify_mode
=
"
$_nmode
"
_notify_mode
=
"
$_nmode
"
shift
shift
;;
;;
--notify-source
)
_nsource
=
"
$2
"
if
_startswith
"
$_nsource
"
"-"
;
then
_err
"'
$_nsource
' is not valid host name for '
$1
'"
return
1
fi
_notify_source
=
"
$_nsource
"
shift
;;
--revoke-reason
)
--revoke-reason
)
_revoke_reason
=
"
$2
"
_revoke_reason
=
"
$2
"
if
_startswith
"
$_revoke_reason
"
"-"
;
then
if
_startswith
"
$_revoke_reason
"
"-"
;
then
...
@@ -7862,7 +7912,7 @@ _process() {
...
@@ -7862,7 +7912,7 @@ _process() {
createCSR
"
$_domain
"
"
$_altdomains
"
"
$_ecc
"
createCSR
"
$_domain
"
"
$_altdomains
"
"
$_ecc
"
;;
;;
setnotify
)
setnotify
)
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
"
$_notify_source
"
;;
;;
setdefaultca
)
setdefaultca
)
setdefaultca
setdefaultca
...
...
deploy/gcore_cdn.sh
View file @
429b18ed
#!/usr/bin/env sh
#!/usr/bin/env sh
# Here is the script to deploy the cert to G-Core CDN service (https://gcore
labs
.com/
ru/
) using the G-Core Labs API (https://docs.gcore
labs
.com/cdn
/
).
# Here is the script to deploy the cert to G-Core CDN service (https://gcore.com/) using the G-Core Labs API (https://
api
docs.gcore.com/cdn).
# Returns 0 when success.
# Returns 0 when success.
#
#
# Written by temoffey <temofffey@gmail.com>
# Written by temoffey <temofffey@gmail.com>
# Public domain, 2019
# Public domain, 2019
# Update by DreamOfIce <admin@dreamofice.cn> in 2023
#export DEPLOY_GCORE_CDN_USERNAME=myusername
#export DEPLOY_GCORE_CDN_USERNAME=myusername
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
...
@@ -56,7 +57,7 @@ gcore_cdn_deploy() {
...
@@ -56,7 +57,7 @@ gcore_cdn_deploy() {
_request
=
"{
\"
username
\"
:
\"
$Le_Deploy_gcore_cdn_username
\"
,
\"
password
\"
:
\"
$Le_Deploy_gcore_cdn_password
\"
}"
_request
=
"{
\"
username
\"
:
\"
$Le_Deploy_gcore_cdn_username
\"
,
\"
password
\"
:
\"
$Le_Deploy_gcore_cdn_password
\"
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
export
_H1
=
"Content-Type:application/json"
export
_H1
=
"Content-Type:application/json"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn
.co/auth/jwt/login"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore
.co
m
/auth/jwt/login"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
access
\"
:
\"\(
[-._0-9A-Za-z]*
\)\"
.*$"
_regex
=
".*
\"
access
\"
:
\"\(
[-._0-9A-Za-z]*
\)\"
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -69,8 +70,8 @@ gcore_cdn_deploy() {
...
@@ -69,8 +70,8 @@ gcore_cdn_deploy() {
fi
fi
_info
"Find CDN resource with cname
$_cdomain
"
_info
"Find CDN resource with cname
$_cdomain
"
export
_H2
=
"Authorization:
Token
$_token
"
export
_H2
=
"Authorization:
Bearer
$_token
"
_response
=
$(
_get
"https://api.gc
dn.co
/resources"
)
_response
=
$(
_get
"https://api.gc
ore.com/cdn
/resources"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
"
\"
primary_resource
\"
:null},"
_regex
=
"
\"
primary_resource
\"
:null},"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -102,7 +103,7 @@ gcore_cdn_deploy() {
...
@@ -102,7 +103,7 @@ gcore_cdn_deploy() {
_date
=
$(
date
"+%d.%m.%Y %H:%M:%S"
)
_date
=
$(
date
"+%d.%m.%Y %H:%M:%S"
)
_request
=
"{
\"
name
\"
:
\"
$_cdomain
(
$_date
)
\"
,
\"
sslCertificate
\"
:
\"
$_fullchain
\"
,
\"
sslPrivateKey
\"
:
\"
$_key
\"
}"
_request
=
"{
\"
name
\"
:
\"
$_cdomain
(
$_date
)
\"
,
\"
sslCertificate
\"
:
\"
$_fullchain
\"
,
\"
sslPrivateKey
\"
:
\"
$_key
\"
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/sslData"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/sslData"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
id
\"
:
\(
[0-9]*
\)
.*$"
_regex
=
".*
\"
id
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -117,7 +118,7 @@ gcore_cdn_deploy() {
...
@@ -117,7 +118,7 @@ gcore_cdn_deploy() {
_info
"Update CDN resource"
_info
"Update CDN resource"
_request
=
"{
\"
originGroup
\"
:
$_originGroup
,
\"
sslData
\"
:
$_sslDataAdd
}"
_request
=
"{
\"
originGroup
\"
:
$_originGroup
,
\"
sslData
\"
:
$_sslDataAdd
}"
_debug _request
"
$_request
"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/resources/
$_resourceId
"
''
"PUT"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/resources/
$_resourceId
"
''
"PUT"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
_regex
=
".*
\"
sslData
\"
:
\(
[0-9]*
\)
.*$"
_regex
=
".*
\"
sslData
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
_debug _regex
"
$_regex
"
...
@@ -133,7 +134,7 @@ gcore_cdn_deploy() {
...
@@ -133,7 +134,7 @@ gcore_cdn_deploy() {
_info
"Not found old SSL certificate"
_info
"Not found old SSL certificate"
else
else
_info
"Delete old SSL certificate"
_info
"Delete old SSL certificate"
_response
=
$(
_post
''
"https://api.gc
dn.co
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_response
=
$(
_post
''
"https://api.gc
ore.com/cdn
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_debug _response
"
$_response
"
_debug _response
"
$_response
"
fi
fi
...
...
deploy/ssh.sh
View file @
429b18ed
This diff is collapsed.
Click to expand it.
deploy/truenas.sh
View file @
429b18ed
...
@@ -184,6 +184,27 @@ truenas_deploy() {
...
@@ -184,6 +184,27 @@ truenas_deploy() {
_info
"S3 certificate is not configured or is not the same as TrueNAS web UI"
_info
"S3 certificate is not configured or is not the same as TrueNAS web UI"
fi
fi
_info
"Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
if
_exists jq
;
then
_info
"Query all chart release"
_release_list
=
$(
_get
"
$_api_url
/chart/release"
)
_related_name_list
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
"[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==
$_active_cert_id
) | .name ] | unique"
)
_release_length
=
$(
printf
"%s"
"
$_related_name_list
"
| jq
-r
"length"
)
_info
"Found
$_release_length
related chart release in list:
$_related_name_list
"
for
i
in
$(
seq
0
$((
_release_length
-
1
))
)
;
do
_release_name
=
$(
echo
"
$_related_name_list
"
| jq
-r
".[
$i
]"
)
_info
"Updating certificate from
$_active_cert_id
to
$_cert_id
for chart release:
$_release_name
"
#Read the chart release configuration
_chart_config
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
".[] | select(.name==
\"
$_release_name
\"
)"
)
#Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
_updated_chart_config
=
$(
printf
"%s"
"
$_chart_config
"
| jq
"(.config.ingress?.main.tls[]? | select(.scaleCert==
$_active_cert_id
) | .scaleCert ) |=
$_cert_id
| .config.ingress "
)
_update_chart_result
=
"
$(
_post
"{
\"
values
\"
: {
\"
ingress
\"
:
$_updated_chart_config
} }"
"
$_api_url
/chart/release/id/
$_release_name
"
""
"PUT"
"application/json"
)
"
_debug3 _update_chart_result
"
$_update_chart_result
"
done
else
_info
"Tool 'jq' does not exists, skip chart release checking"
fi
_info
"Deleting old certificate"
_info
"Deleting old certificate"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
...
...
deploy/vault.sh
View file @
429b18ed
...
@@ -7,13 +7,16 @@
...
@@ -7,13 +7,16 @@
#
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
# VAULT_KV_V2 - set to anything if you are using v2 of the kv engine
#
#
# additionally, you need to ensure that VAULT_TOKEN is avialable
# additionally, you need to ensure that VAULT_TOKEN is avialable
# to access the vault server
# to access the vault server
#returns 0 means success, otherwise error.
#returns 0 means success, otherwise error.
########
Public functions #####################
######## Public functions #####################
#domain keyfile certfile cafile fullchain
#domain keyfile certfile cafile fullchain
vault_deploy
()
{
vault_deploy
()
{
...
@@ -45,6 +48,26 @@ vault_deploy() {
...
@@ -45,6 +48,26 @@ vault_deploy() {
fi
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_KV_V2
_savedeployconf VAULT_KV_V2
"
$VAULT_KV_V2
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
# JSON does not allow multiline strings.
# JSON does not allow multiline strings.
# So replacing new-lines with "\n" here
# So replacing new-lines with "\n" here
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
...
@@ -52,26 +75,56 @@ vault_deploy() {
...
@@ -52,26 +75,56 @@ vault_deploy() {
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
URL
=
"
$VAULT_ADDR
/v1/auth/token/renew-self"
_info
"Renew the Vault token to default TTL"
if
!
_post
""
"
$URL
"
>
/dev/null
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
$URL
in Fabio mode"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
>
/dev/null
||
return
1
else
else
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
>
/dev/null
||
return
1
fi
fi
else
else
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
else
else
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
fi
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
_contains
"
$(
_get
"
$URL
/chain.pem"
)
"
"-----BEGIN CERTIFICATE-----"
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
$URL
/chain.pem for backward compatibility"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
else
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
fi
fi
fi
fi
fi
...
...
deploy/vault_cli.sh
View file @
429b18ed
...
@@ -8,6 +8,8 @@
...
@@ -8,6 +8,8 @@
#
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
#
#
# additionally, you need to ensure that VAULT_TOKEN is avialable or
# additionally, you need to ensure that VAULT_TOKEN is avialable or
# `vault auth` has applied the appropriate authorization for the vault binary
# `vault auth` has applied the appropriate authorization for the vault binary
...
@@ -33,15 +35,36 @@ vault_cli_deploy() {
...
@@ -33,15 +35,36 @@ vault_cli_deploy() {
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
# validate required env vars
# validate required env vars
_getdeployconf VAULT_PREFIX
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
return
1
return
1
fi
fi
_savedeployconf VAULT_PREFIX
"
$VAULT_PREFIX
"
_getdeployconf VAULT_ADDR
if
[
-z
"
$VAULT_ADDR
"
]
;
then
if
[
-z
"
$VAULT_ADDR
"
]
;
then
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
return
1
return
1
fi
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
VAULT_CMD
=
$(
command
-v
vault
)
VAULT_CMD
=
$(
command
-v
vault
)
if
[
!
$?
]
;
then
if
[
!
$?
]
;
then
...
@@ -49,13 +72,33 @@ vault_cli_deploy() {
...
@@ -49,13 +72,33 @@ vault_cli_deploy() {
return
1
return
1
fi
fi
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
_info
"Renew the Vault token to default TTL"
if
!
$VAULT_CMD
token renew
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
in Fabio mode"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
else
else
_info
"Writing certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
_info
"Writing key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing full-chain certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
$VAULT_CMD
kv get
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
>
/dev/null
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem for backward compatibility"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
fi
fi
fi
}
}
dnsapi/dns_arvan.sh
View file @
429b18ed
#!/usr/bin/env sh
#!/usr/bin/env sh
#Arvan_Token="Apikey xxxx"
#
Arvan_Token="Apikey xxxx"
ARVAN_API_URL
=
"https://napi.arvancloud.
com
/cdn/4.0/domains"
ARVAN_API_URL
=
"https://napi.arvancloud.
ir
/cdn/4.0/domains"
#Author: Vahid Fardi
#
Author: Vahid Fardi
#Report Bugs here: https://github.com/Neilpang/acme.sh
#
Report Bugs here: https://github.com/Neilpang/acme.sh
#
#
######## Public functions #####################
######## Public functions #####################
...
@@ -18,7 +18,7 @@ dns_arvan_add() {
...
@@ -18,7 +18,7 @@ dns_arvan_add() {
if
[
-z
"
$Arvan_Token
"
]
;
then
if
[
-z
"
$Arvan_Token
"
]
;
then
_err
"You didn't specify
\"
Arvan_Token
\"
token yet."
_err
"You didn't specify
\"
Arvan_Token
\"
token yet."
_err
"You can get yours from here https://npanel.arvancloud.
com
/profile/api-keys"
_err
"You can get yours from here https://npanel.arvancloud.
ir
/profile/api-keys"
return
1
return
1
fi
fi
#save the api token to the account conf file.
#save the api token to the account conf file.
...
@@ -40,7 +40,7 @@ dns_arvan_add() {
...
@@ -40,7 +40,7 @@ dns_arvan_add() {
_info
"response id is
$response
"
_info
"response id is
$response
"
_info
"Added, OK"
_info
"Added, OK"
return
0
return
0
elif
_contains
"
$response
"
"Record Data is
D
uplicate
d
"
;
then
elif
_contains
"
$response
"
"Record Data is
d
uplicate"
;
then
_info
"Already exists, OK"
_info
"Already exists, OK"
return
0
return
0
else
else
...
@@ -141,6 +141,7 @@ _arvan_rest() {
...
@@ -141,6 +141,7 @@ _arvan_rest() {
response
=
"
$(
_post
"
$data
"
"
$ARVAN_API_URL
/
$ep
"
""
"
$mtd
"
)
"
response
=
"
$(
_post
"
$data
"
"
$ARVAN_API_URL
/
$ep
"
""
"
$mtd
"
)
"
elif
[
"
$mtd
"
=
"POST"
]
;
then
elif
[
"
$mtd
"
=
"POST"
]
;
then
export
_H2
=
"Content-Type: application/json"
export
_H2
=
"Content-Type: application/json"
export
_H3
=
"Accept: application/json"
_debug data
"
$data
"
_debug data
"
$data
"
response
=
"
$(
_post
"
$data
"
"
$ARVAN_API_URL
/
$ep
"
""
"
$mtd
"
)
"
response
=
"
$(
_post
"
$data
"
"
$ARVAN_API_URL
/
$ep
"
""
"
$mtd
"
)
"
else
else
...
...
dnsapi/dns_gcore.sh
0 → 100755
View file @
429b18ed
#!/usr/bin/env sh
#
#GCORE_Key='773$7b7adaf2a2b32bfb1b83787b4ff32a67eb178e3ada1af733e47b1411f2461f7f4fa7ed7138e2772a46124377bad7384b3bb8d87748f87b3f23db4b8bbe41b2bb'
#
GCORE_Api
=
"https://api.gcorelabs.com/dns/v2"
GCORE_Doc
=
"https://apidocs.gcore.com/dns"
######## Public functions #####################
#Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_gcore_add
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
if
[
-z
"
$GCORE_Key
"
]
;
then
GCORE_Key
=
""
_err
"You didn't specify a Gcore api key yet."
_err
"You can get yours from here
$GCORE_Doc
"
return
1
fi
#save the api key to the account conf file.
_saveaccountconf_mutable GCORE_Key
"
$GCORE_Key
"
_debug
"First detect the zone name"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
payload
=
""
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"Record doesn't exists"
payload
=
"{
\"
resource_records
\"
:[{
\"
content
\"
:[
\"
$txtvalue
\"
],
\"
enabled
\"
:true}],
\"
ttl
\"
:120}"
elif
echo
"
$response
"
|
grep
"
$txtvalue
"
>
/dev/null
;
then
_info
"Already exists, OK"
return
0
elif
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_info
"Record with mismatch txtvalue, try update it"
payload
=
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/"meta":{}}]}/"meta":{}},{"content":['
\"
"
$txtvalue
"
\"
'],"enabled":true}]}/'
)
fi
# For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
# we can not use updating anymore.
# count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
# _debug count "$count"
# if [ "$count" = "0" ]; then
_info
"Adding record"
if
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Added, OK"
return
0
elif
_contains
"
$response
"
"rrset is already exists"
;
then
_info
"Already exists, OK"
return
0
else
_err
"Add txt record error."
return
1
fi
fi
_err
"Add txt record error."
return
1
}
#fulldomain txtvalue
dns_gcore_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_err
"Error:
$response
"
return
1
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
"
$txtvalue
"
\"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
count
=
"
$(
echo
"
$response
"
|
grep
-o
"content"
|
wc
-l
)
"
if
[
"
$count
"
=
"1"
]
;
then
if
!
_gcore_rest DELETE
"zones/
$_zone_name
/
$fulldomain
/TXT"
;
then
_err
"Delete record error.
$response
"
return
1
fi
return
0
fi
payload
=
"
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/{"id":[0-9]\+,"content":\["'
"
$txtvalue
"
'"\],"enabled":true,"meta":{}}//'
|
sed
's/\[,/\[/'
|
sed
's/,,/,/'
|
sed
's/,\]/\]/'
)
"
if
!
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
_err
"Delete record error.
$response
"
fi
}
#################### Private functions below ##################################
#_acme-challenge.sub.domain.com
#returns
# _sub_domain=_acme-challenge.sub or _acme-challenge
# _domain=domain.com
# _zone_name=domain.com or sub.domain.com
_get_root
()
{
domain
=
$1
i
=
1
p
=
1
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
if
[
-z
"
$h
"
]
;
then
#not valid
return
1
fi
if
!
_gcore_rest GET
"zones/
$h
"
;
then
return
1
fi
if
_contains
"
$response
"
"
\"
name
\"
:
\"
$h
\"
"
;
then
_zone_name
=
$h
if
[
"
$_zone_name
"
]
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
return
0
fi
return
1
fi
p
=
$i
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
}
_gcore_rest
()
{
m
=
$1
ep
=
"
$2
"
data
=
"
$3
"
_debug
"
$ep
"
key_trimmed
=
$(
echo
"
$GCORE_Key
"
|
tr
-d
'"'
)
export
_H1
=
"Content-Type: application/json"
export
_H2
=
"Authorization: APIKey
$key_trimmed
"
if
[
"
$m
"
!=
"GET"
]
;
then
_debug data
"
$data
"
response
=
"
$(
_post
"
$data
"
"
$GCORE_Api
/
$ep
"
""
"
$m
"
)
"
else
response
=
"
$(
_get
"
$GCORE_Api
/
$ep
"
)
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
_err
"error
$ep
"
return
1
fi
_debug2 response
"
$response
"
return
0
}
dnsapi/dns_gd.sh
View file @
429b18ed
...
@@ -22,8 +22,8 @@ dns_gd_add() {
...
@@ -22,8 +22,8 @@ dns_gd_add() {
if
[
-z
"
$GD_Key
"
]
||
[
-z
"
$GD_Secret
"
]
;
then
if
[
-z
"
$GD_Key
"
]
||
[
-z
"
$GD_Secret
"
]
;
then
GD_Key
=
""
GD_Key
=
""
GD_Secret
=
""
GD_Secret
=
""
_err
"You d
o
n't specify godaddy api key and secret yet."
_err
"You d
id
n't specify godaddy api key and secret yet."
_err
"Please create you key and try again."
_err
"Please create you
r
key and try again."
return
1
return
1
fi
fi
...
@@ -46,7 +46,7 @@ dns_gd_add() {
...
@@ -46,7 +46,7 @@ dns_gd_add() {
fi
fi
if
_contains
"
$response
"
"
$txtvalue
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Th
e
record
is
exist
ing
, skip"
_info
"Th
is
record
already
exist
s
, skip
ping
"
return
0
return
0
fi
fi
...
...
dnsapi/dns_openstack.sh
View file @
429b18ed
...
@@ -57,16 +57,16 @@ _dns_openstack_create_recordset() {
...
@@ -57,16 +57,16 @@ _dns_openstack_create_recordset() {
if
[
-z
"
$_recordset_id
"
]
;
then
if
[
-z
"
$_recordset_id
"
]
;
then
_info
"Creating a new recordset"
_info
"Creating a new recordset"
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
=
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"No recordset ID found after create"
_err
"No recordset ID found after create"
return
1
return
1
fi
fi
else
else
_info
"Updating existing recordset"
_info
"Updating existing recordset"
# Build new list of --record
<rec> args for update
# Build new list of --record
=
<rec> args for update
_record_args
=
"--record
$txtvalue
"
_record_args
=
"--record
=
$txtvalue
"
for
_rec
in
$_records
;
do
for
_rec
in
$_records
;
do
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
done
# shellcheck disable=SC2086
# shellcheck disable=SC2086
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
...
@@ -107,13 +107,13 @@ _dns_openstack_delete_recordset() {
...
@@ -107,13 +107,13 @@ _dns_openstack_delete_recordset() {
fi
fi
else
else
_info
"Found existing records, updating recordset"
_info
"Found existing records, updating recordset"
# Build new list of --record
<rec> args for update
# Build new list of --record
=
<rec> args for update
_record_args
=
""
_record_args
=
""
for
_rec
in
$_records
;
do
for
_rec
in
$_records
;
do
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
continue
continue
fi
fi
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
done
# shellcheck disable=SC2086
# shellcheck disable=SC2086
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment