Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
4c32bc8e
Commit
4c32bc8e
authored
Jan 19, 2022
by
neilpang
Browse files
Merge branch 'dev'
parents
c0cb3945
df671a77
Changes
4
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
4c32bc8e
...
...
@@ -1053,9 +1053,9 @@ _sign() {
_sign_openssl
=
"
${
ACME_OPENSSL_BIN
:-
openssl
}
dgst -sign
$keyfile
"
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
grep
"BEGIN PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
if
_isRSA
"
$keyfile
"
>
/dev/null 2>&1
;
then
$_sign_openssl
-
$alg
| _base64
elif
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
elif
_isEcc
"
$keyfile
"
>
/dev/null 2>&1
;
then
if
!
_signedECText
=
"
$(
$_sign_openssl
-sha
$__ECC_KEY_LEN
|
${
ACME_OPENSSL_BIN
:-
openssl
}
asn1parse
-inform
DER
)
"
;
then
_err
"Sign failed:
$_sign_openssl
"
_err
"Key file:
$keyfile
"
...
...
deploy/routeros.sh
View file @
4c32bc8e
...
...
@@ -66,21 +66,31 @@ routeros_deploy() {
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_getdeployconf ROUTER_OS_HOST
if
[
-z
"
$ROUTER_OS_HOST
"
]
;
then
_debug
"Using _cdomain as ROUTER_OS_HOST, please set if not correct."
ROUTER_OS_HOST
=
"
$_cdomain
"
fi
_getdeployconf ROUTER_OS_USERNAME
if
[
-z
"
$ROUTER_OS_USERNAME
"
]
;
then
_err
"Need to set the env variable ROUTER_OS_USERNAME"
return
1
fi
_getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
if
[
-z
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
]
;
then
_debug
"Not enabling additional services"
ROUTER_OS_ADDITIONAL_SERVICES
=
""
fi
_savedeployconf ROUTER_OS_HOST
"
$ROUTER_OS_HOST
"
_savedeployconf ROUTER_OS_USERNAME
"
$ROUTER_OS_USERNAME
"
_savedeployconf ROUTER_OS_ADDITIONAL_SERVICES
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
_info
"Trying to push key '
$_ckey
' to router"
scp
"
$_ckey
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.key"
_info
"Trying to push cert '
$_cfullchain
' to router"
...
...
deploy/truenas.sh
0 → 100644
View file @
4c32bc8e
#!/usr/bin/env sh
# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
#
# Written by Frank Plass github@f-plass.de
# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
# Thanks to danb35 for your template!
#
# Following environment variables must be set:
#
# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
#
# The following environmental variables may be set if you don't like their
# default values:
#
# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
#
#returns 0 means success, otherwise error.
######## Public functions #####################
#domain keyfile certfile cafile fullchain
truenas_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_getdeployconf DEPLOY_TRUENAS_APIKEY
if
[
-z
"
$DEPLOY_TRUENAS_APIKEY
"
]
;
then
_err
"TrueNAS Api Key is not found, please define DEPLOY_TRUENAS_APIKEY."
return
1
fi
_secure_debug2 DEPLOY_TRUENAS_APIKEY
"
$DEPLOY_TRUENAS_APIKEY
"
# Optional hostname, scheme for TrueNAS
_getdeployconf DEPLOY_TRUENAS_HOSTNAME
_getdeployconf DEPLOY_TRUENAS_SCHEME
# default values for hostname and scheme
[
-n
"
${
DEPLOY_TRUENAS_HOSTNAME
}
"
]
||
DEPLOY_TRUENAS_HOSTNAME
=
"localhost"
[
-n
"
${
DEPLOY_TRUENAS_SCHEME
}
"
]
||
DEPLOY_TRUENAS_SCHEME
=
"http"
_debug2 DEPLOY_TRUENAS_HOSTNAME
"
$DEPLOY_TRUENAS_HOSTNAME
"
_debug2 DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
_api_url
=
"
$DEPLOY_TRUENAS_SCHEME
://
$DEPLOY_TRUENAS_HOSTNAME
/api/v2.0"
_debug _api_url
"
$_api_url
"
_H1
=
"Authorization: Bearer
$DEPLOY_TRUENAS_APIKEY
"
_secure_debug3 _H1
"
$_H1
"
_info
"Testing Connection TrueNAS"
_response
=
$(
_get
"
$_api_url
/system/state"
)
_info
"TrueNAS System State:
$_response
."
if
[
-z
"
$_response
"
]
;
then
_err
"Unable to authenticate to
$_api_url
."
_err
'Check your Connection and set DEPLOY_TRUENAS_HOSTNAME="192.168.178.x".'
_err
'or'
_err
'set DEPLOY_TRUENAS_HOSTNAME="<truenas_dnsname>".'
_err
'Check your Connection and set DEPLOY_TRUENAS_SCHEME="https".'
_err
"Check your Api Key."
return
1
fi
_savedeployconf DEPLOY_TRUENAS_APIKEY
"
$DEPLOY_TRUENAS_APIKEY
"
_savedeployconf DEPLOY_TRUENAS_HOSTNAME
"
$DEPLOY_TRUENAS_HOSTNAME
"
_savedeployconf DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
_info
"Getting active certificate from TrueNAS"
_response
=
$(
_get
"
$_api_url
/system/general"
)
_active_cert_id
=
$(
echo
"
$_response
"
|
grep
-B2
'"name":'
|
grep
'id'
|
tr
-d
--
'"id: ,'
)
_active_cert_name
=
$(
echo
"
$_response
"
|
grep
'"name":'
|
sed
-n
's/.*: "\(.\{1,\}\)",$/\1/p'
)
_param_httpsredirect
=
$(
echo
"
$_response
"
|
grep
'"ui_httpsredirect":'
|
sed
-n
's/.*": \(.\{1,\}\),$/\1/p'
)
_debug Active_UI_Certificate_ID
"
$_active_cert_id
"
_debug Active_UI_Certificate_Name
"
$_active_cert_name
"
_debug Active_UI_http_redirect
"
$_param_httpsredirect
"
if
[
"
$DEPLOY_TRUENAS_SCHEME
"
=
"http"
]
&&
[
"
$_param_httpsredirect
"
=
"true"
]
;
then
_info
"http Redirect active"
_info
"Setting DEPLOY_TRUENAS_SCHEME to 'https'"
DEPLOY_TRUENAS_SCHEME
=
"https"
_api_url
=
"
$DEPLOY_TRUENAS_SCHEME
://
$DEPLOY_TRUENAS_HOSTNAME
/api/v2.0"
_savedeployconf DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
fi
_info
"Upload new certifikate to TrueNAS"
_certname
=
"Letsencrypt_
$(
_utc_date |
tr
' '
'_'
|
tr
-d
--
':'
)
"
_debug3 _certname
"
$_certname
"
_certData
=
"{
\"
create_type
\"
:
\"
CERTIFICATE_CREATE_IMPORTED
\"
,
\"
name
\"
:
\"
${
_certname
}
\"
,
\"
certificate
\"
:
\"
$(
_json_encode <
"
$_cfullchain
"
)
\"
,
\"
privatekey
\"
:
\"
$(
_json_encode <
"
$_ckey
"
)
\"
}"
_add_cert_result
=
"
$(
_post
"
$_certData
"
"
$_api_url
/certificate"
""
"POST"
"application/json"
)
"
_debug3 _add_cert_result
"
$_add_cert_result
"
_info
"Getting Certificate list to get new Cert ID"
_cert_list
=
$(
_get
"
$_api_url
/system/general/ui_certificate_choices"
)
_cert_id
=
$(
echo
"
$_cert_list
"
|
grep
"
$_certname
"
|
sed
-n
's/.*"\([0-9]\{1,\}\)".*$/\1/p'
)
_debug3 _cert_id
"
$_cert_id
"
_info
"Activate Certificate ID:
$_cert_id
"
_activateData
=
"{
\"
ui_certificate
\"
:
\"
${
_cert_id
}
\"
}"
_activate_result
=
"
$(
_post
"
$_activateData
"
"
$_api_url
/system/general"
""
"PUT"
"application/json"
)
"
_debug3 _activate_result
"
$_activate_result
"
_info
"Check if WebDAV certificate is the same as the WEB UI"
_webdav_list
=
$(
_get
"
$_api_url
/webdav"
)
_webdav_cert_id
=
$(
echo
"
$_webdav_list
"
|
grep
'"certssl":'
|
tr
-d
--
'"certsl: ,'
)
if
[
"
$_webdav_cert_id
"
=
"
$_active_cert_id
"
]
;
then
_info
"Update the WebDAV Certificate"
_debug _webdav_cert_id
"
$_webdav_cert_id
"
_webdav_data
=
"{
\"
certssl
\"
:
\"
${
_cert_id
}
\"
}"
_activate_webdav_cert
=
"
$(
_post
"
$_webdav_data
"
"
$_api_url
/webdav"
""
"PUT"
"application/json"
)
"
_webdav_new_cert_id
=
$(
echo
"
$_activate_webdav_cert
"
| _json_decode |
sed
-n
's/.*: \([0-9]\{1,\}\) }$/\1/p'
)
if
[
"
$_webdav_new_cert_id
"
-eq
"
$_cert_id
"
]
;
then
_info
"WebDAV Certificate update successfully"
else
_err
"Unable to set WebDAV certificate"
_debug3 _activate_webdav_cert
"
$_activate_webdav_cert
"
_debug3 _webdav_new_cert_id
"
$_webdav_new_cert_id
"
return
1
fi
_debug3 _webdav_new_cert_id
"
$_webdav_new_cert_id
"
else
_info
"WebDAV certificate not set or not the same as Web UI"
fi
_info
"Check if FTP certificate is the same as the WEB UI"
_ftp_list
=
$(
_get
"
$_api_url
/ftp"
)
_ftp_cert_id
=
$(
echo
"
$_ftp_list
"
|
grep
'"ssltls_certificate":'
|
tr
-d
--
'"certislfa:_ ,'
)
if
[
"
$_ftp_cert_id
"
=
"
$_active_cert_id
"
]
;
then
_info
"Update the FTP Certificate"
_debug _ftp_cert_id
"
$_ftp_cert_id
"
_ftp_data
=
"{
\"
ssltls_certificate
\"
:
\"
${
_cert_id
}
\"
}"
_activate_ftp_cert
=
"
$(
_post
"
$_ftp_data
"
"
$_api_url
/ftp"
""
"PUT"
"application/json"
)
"
_ftp_new_cert_id
=
$(
echo
"
$_activate_ftp_cert
"
| _json_decode |
sed
-n
's/.*: \([0-9]\{1,\}\) }$/\1/p'
)
if
[
"
$_ftp_new_cert_id
"
-eq
"
$_cert_id
"
]
;
then
_info
"FTP Certificate update successfully"
else
_err
"Unable to set FTP certificate"
_debug3 _activate_ftp_cert
"
$_activate_ftp_cert
"
_debug3 _ftp_new_cert_id
"
$_ftp_new_cert_id
"
return
1
fi
_debug3 _activate_ftp_cert
"
$_activate_ftp_cert
"
else
_info
"FTP certificate not set or not the same as Web UI"
fi
_info
"Delete old Certificate"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
_debug3 _delete_result
"
$_delete_result
"
_info
"Reload WebUI from TrueNAS"
_restart_UI
=
$(
_get
"
$_api_url
/system/general/ui_restart"
)
_debug2 _restart_UI
"
$_restart_UI
"
if
[
-n
"
$_add_cert_result
"
]
&&
[
-n
"
$_activate_result
"
]
;
then
return
0
else
_err
"Certupdate was not succesfull, please use --debug"
return
1
fi
}
dnsapi/dns_huaweicloud.sh
View file @
4c32bc8e
...
...
@@ -35,7 +35,7 @@ dns_huaweicloud_add() {
_err
"dns_api(dns_huaweicloud): Error getting token."
return
1
fi
_debug
"Access token is:
${
token
}
"
_secure
_debug
"Access token is:
"
"
${
token
}
"
unset
zoneid
zoneid
=
"
$(
_get_zoneid
"
${
token
}
"
"
${
fulldomain
}
"
)
"
...
...
@@ -43,7 +43,7 @@ dns_huaweicloud_add() {
_err
"dns_api(dns_huaweicloud): Error getting zone id."
return
1
fi
_debug
"Zone ID is:
${
zoneid
}
"
_debug
"Zone ID is:
"
"
${
zoneid
}
"
_debug
"Adding Record"
_add_record
"
${
token
}
"
"
${
fulldomain
}
"
"
${
txtvalue
}
"
...
...
@@ -86,7 +86,7 @@ dns_huaweicloud_rm() {
_err
"dns_api(dns_huaweicloud): Error getting token."
return
1
fi
_debug
"Access token is:
${
token
}
"
_secure
_debug
"Access token is:
"
"
${
token
}
"
unset
zoneid
zoneid
=
"
$(
_get_zoneid
"
${
token
}
"
"
${
fulldomain
}
"
)
"
...
...
@@ -94,7 +94,7 @@ dns_huaweicloud_rm() {
_err
"dns_api(dns_huaweicloud): Error getting zone id."
return
1
fi
_debug
"Zone ID is:
${
zoneid
}
"
_debug
"Zone ID is:
"
"
${
zoneid
}
"
# Remove all records
# Therotically HuaweiCloud does not allow more than one record set
...
...
@@ -129,14 +129,25 @@ _get_zoneid() {
fi
_debug
"
$h
"
response
=
$(
_get
"
${
dns_api
}
/v2/zones?name=
${
h
}
"
)
if
_contains
"
${
response
}
"
"id"
;
then
_debug
"Get Zone ID Success."
_zoneid
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
printf
"%s"
"
${
_zoneid
}
"
return
0
_debug2
"
$response
"
if
_contains
"
${
response
}
"
'"id"'
;
then
zoneidlist
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
zonenamelist
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
name
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
_debug2
"Return Zone ID(s):"
"
${
zoneidlist
}
"
_debug2
"Return Zone Name(s):"
"
${
zonenamelist
}
"
zoneidnum
=
0
echo
"
${
zonenamelist
}
"
|
while
read
-r
zonename
;
do
zoneidnum
=
$(
_math
"
$zoneidnum
"
+ 1
)
_debug
"Check Zone Name"
"
${
zonename
}
"
if
[
"
${
zonename
}
"
=
"
${
h
}
."
]
;
then
_debug
"Get Zone ID Success."
_zoneid
=
$(
echo
"
${
zoneidlist
}
"
|
sed
-n
"
${
zoneidnum
}
p"
)
_debug2
"ZoneID:"
"
${
_zoneid
}
"
printf
"%s"
"
${
_zoneid
}
"
return
0
fi
done
fi
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
...
...
@@ -149,7 +160,7 @@ _get_recordset_id() {
export
_H1
=
"X-Auth-Token:
${
_token
}
"
response
=
$(
_get
"
${
dns_api
}
/v2/zones/
${
_zoneid
}
/recordsets?name=
${
_domain
}
"
)
if
_contains
"
${
response
}
"
"id"
;
then
if
_contains
"
${
response
}
"
'
"id"
'
;
then
_id
=
"
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
"
printf
"%s"
"
${
_id
}
"
return
0
...
...
@@ -197,7 +208,7 @@ _add_record() {
fi
_record_id
=
"
$(
_get_recordset_id
"
${
_token
}
"
"
${
_domain
}
"
"
${
zoneid
}
"
)
"
_debug
"Record Set ID is:
${
_record_id
}
"
_debug
"Record Set ID is:
"
"
${
_record_id
}
"
# Remove all records
while
[
"
${
_record_id
}
"
!=
"0"
]
;
do
...
...
@@ -269,7 +280,7 @@ _get_token() {
_post
"
${
body
}
"
"
${
iam_api
}
/v3/auth/tokens"
>
/dev/null
_code
=
$(
grep
"^HTTP"
"
$HTTP_HEADER
"
| _tail_n 1 |
cut
-d
" "
-f
2 |
tr
-d
"
\\
r
\\
n"
)
_token
=
$(
grep
"^X-Subject-Token"
"
$HTTP_HEADER
"
|
cut
-d
" "
-f
2-
)
_debug
2
"
${
_code
}
"
_secure
_debug
"
${
_code
}
"
printf
"%s"
"
${
_token
}
"
return
0
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment