Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
4c32bc8e
Commit
4c32bc8e
authored
Jan 19, 2022
by
neilpang
Browse files
Merge branch 'dev'
parents
c0cb3945
df671a77
Changes
4
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
4c32bc8e
...
...
@@ -1053,9 +1053,9 @@ _sign() {
_sign_openssl
=
"
${
ACME_OPENSSL_BIN
:-
openssl
}
dgst -sign
$keyfile
"
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
grep
"BEGIN PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
if
_isRSA
"
$keyfile
"
>
/dev/null 2>&1
;
then
$_sign_openssl
-
$alg
| _base64
elif
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
elif
_isEcc
"
$keyfile
"
>
/dev/null 2>&1
;
then
if
!
_signedECText
=
"
$(
$_sign_openssl
-sha
$__ECC_KEY_LEN
|
${
ACME_OPENSSL_BIN
:-
openssl
}
asn1parse
-inform
DER
)
"
;
then
_err
"Sign failed:
$_sign_openssl
"
_err
"Key file:
$keyfile
"
...
...
deploy/routeros.sh
View file @
4c32bc8e
...
...
@@ -66,21 +66,31 @@ routeros_deploy() {
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_getdeployconf ROUTER_OS_HOST
if
[
-z
"
$ROUTER_OS_HOST
"
]
;
then
_debug
"Using _cdomain as ROUTER_OS_HOST, please set if not correct."
ROUTER_OS_HOST
=
"
$_cdomain
"
fi
_getdeployconf ROUTER_OS_USERNAME
if
[
-z
"
$ROUTER_OS_USERNAME
"
]
;
then
_err
"Need to set the env variable ROUTER_OS_USERNAME"
return
1
fi
_getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
if
[
-z
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
]
;
then
_debug
"Not enabling additional services"
ROUTER_OS_ADDITIONAL_SERVICES
=
""
fi
_savedeployconf ROUTER_OS_HOST
"
$ROUTER_OS_HOST
"
_savedeployconf ROUTER_OS_USERNAME
"
$ROUTER_OS_USERNAME
"
_savedeployconf ROUTER_OS_ADDITIONAL_SERVICES
"
$ROUTER_OS_ADDITIONAL_SERVICES
"
_info
"Trying to push key '
$_ckey
' to router"
scp
"
$_ckey
"
"
$ROUTER_OS_USERNAME
@
$ROUTER_OS_HOST
:
$_cdomain
.key"
_info
"Trying to push cert '
$_cfullchain
' to router"
...
...
deploy/truenas.sh
0 → 100644
View file @
4c32bc8e
#!/usr/bin/env sh
# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
#
# Written by Frank Plass github@f-plass.de
# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
# Thanks to danb35 for your template!
#
# Following environment variables must be set:
#
# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
#
# The following environmental variables may be set if you don't like their
# default values:
#
# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
#
#returns 0 means success, otherwise error.
######## Public functions #####################
#domain keyfile certfile cafile fullchain
truenas_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_getdeployconf DEPLOY_TRUENAS_APIKEY
if
[
-z
"
$DEPLOY_TRUENAS_APIKEY
"
]
;
then
_err
"TrueNAS Api Key is not found, please define DEPLOY_TRUENAS_APIKEY."
return
1
fi
_secure_debug2 DEPLOY_TRUENAS_APIKEY
"
$DEPLOY_TRUENAS_APIKEY
"
# Optional hostname, scheme for TrueNAS
_getdeployconf DEPLOY_TRUENAS_HOSTNAME
_getdeployconf DEPLOY_TRUENAS_SCHEME
# default values for hostname and scheme
[
-n
"
${
DEPLOY_TRUENAS_HOSTNAME
}
"
]
||
DEPLOY_TRUENAS_HOSTNAME
=
"localhost"
[
-n
"
${
DEPLOY_TRUENAS_SCHEME
}
"
]
||
DEPLOY_TRUENAS_SCHEME
=
"http"
_debug2 DEPLOY_TRUENAS_HOSTNAME
"
$DEPLOY_TRUENAS_HOSTNAME
"
_debug2 DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
_api_url
=
"
$DEPLOY_TRUENAS_SCHEME
://
$DEPLOY_TRUENAS_HOSTNAME
/api/v2.0"
_debug _api_url
"
$_api_url
"
_H1
=
"Authorization: Bearer
$DEPLOY_TRUENAS_APIKEY
"
_secure_debug3 _H1
"
$_H1
"
_info
"Testing Connection TrueNAS"
_response
=
$(
_get
"
$_api_url
/system/state"
)
_info
"TrueNAS System State:
$_response
."
if
[
-z
"
$_response
"
]
;
then
_err
"Unable to authenticate to
$_api_url
."
_err
'Check your Connection and set DEPLOY_TRUENAS_HOSTNAME="192.168.178.x".'
_err
'or'
_err
'set DEPLOY_TRUENAS_HOSTNAME="<truenas_dnsname>".'
_err
'Check your Connection and set DEPLOY_TRUENAS_SCHEME="https".'
_err
"Check your Api Key."
return
1
fi
_savedeployconf DEPLOY_TRUENAS_APIKEY
"
$DEPLOY_TRUENAS_APIKEY
"
_savedeployconf DEPLOY_TRUENAS_HOSTNAME
"
$DEPLOY_TRUENAS_HOSTNAME
"
_savedeployconf DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
_info
"Getting active certificate from TrueNAS"
_response
=
$(
_get
"
$_api_url
/system/general"
)
_active_cert_id
=
$(
echo
"
$_response
"
|
grep
-B2
'"name":'
|
grep
'id'
|
tr
-d
--
'"id: ,'
)
_active_cert_name
=
$(
echo
"
$_response
"
|
grep
'"name":'
|
sed
-n
's/.*: "\(.\{1,\}\)",$/\1/p'
)
_param_httpsredirect
=
$(
echo
"
$_response
"
|
grep
'"ui_httpsredirect":'
|
sed
-n
's/.*": \(.\{1,\}\),$/\1/p'
)
_debug Active_UI_Certificate_ID
"
$_active_cert_id
"
_debug Active_UI_Certificate_Name
"
$_active_cert_name
"
_debug Active_UI_http_redirect
"
$_param_httpsredirect
"
if
[
"
$DEPLOY_TRUENAS_SCHEME
"
=
"http"
]
&&
[
"
$_param_httpsredirect
"
=
"true"
]
;
then
_info
"http Redirect active"
_info
"Setting DEPLOY_TRUENAS_SCHEME to 'https'"
DEPLOY_TRUENAS_SCHEME
=
"https"
_api_url
=
"
$DEPLOY_TRUENAS_SCHEME
://
$DEPLOY_TRUENAS_HOSTNAME
/api/v2.0"
_savedeployconf DEPLOY_TRUENAS_SCHEME
"
$DEPLOY_TRUENAS_SCHEME
"
fi
_info
"Upload new certifikate to TrueNAS"
_certname
=
"Letsencrypt_
$(
_utc_date |
tr
' '
'_'
|
tr
-d
--
':'
)
"
_debug3 _certname
"
$_certname
"
_certData
=
"{
\"
create_type
\"
:
\"
CERTIFICATE_CREATE_IMPORTED
\"
,
\"
name
\"
:
\"
${
_certname
}
\"
,
\"
certificate
\"
:
\"
$(
_json_encode <
"
$_cfullchain
"
)
\"
,
\"
privatekey
\"
:
\"
$(
_json_encode <
"
$_ckey
"
)
\"
}"
_add_cert_result
=
"
$(
_post
"
$_certData
"
"
$_api_url
/certificate"
""
"POST"
"application/json"
)
"
_debug3 _add_cert_result
"
$_add_cert_result
"
_info
"Getting Certificate list to get new Cert ID"
_cert_list
=
$(
_get
"
$_api_url
/system/general/ui_certificate_choices"
)
_cert_id
=
$(
echo
"
$_cert_list
"
|
grep
"
$_certname
"
|
sed
-n
's/.*"\([0-9]\{1,\}\)".*$/\1/p'
)
_debug3 _cert_id
"
$_cert_id
"
_info
"Activate Certificate ID:
$_cert_id
"
_activateData
=
"{
\"
ui_certificate
\"
:
\"
${
_cert_id
}
\"
}"
_activate_result
=
"
$(
_post
"
$_activateData
"
"
$_api_url
/system/general"
""
"PUT"
"application/json"
)
"
_debug3 _activate_result
"
$_activate_result
"
_info
"Check if WebDAV certificate is the same as the WEB UI"
_webdav_list
=
$(
_get
"
$_api_url
/webdav"
)
_webdav_cert_id
=
$(
echo
"
$_webdav_list
"
|
grep
'"certssl":'
|
tr
-d
--
'"certsl: ,'
)
if
[
"
$_webdav_cert_id
"
=
"
$_active_cert_id
"
]
;
then
_info
"Update the WebDAV Certificate"
_debug _webdav_cert_id
"
$_webdav_cert_id
"
_webdav_data
=
"{
\"
certssl
\"
:
\"
${
_cert_id
}
\"
}"
_activate_webdav_cert
=
"
$(
_post
"
$_webdav_data
"
"
$_api_url
/webdav"
""
"PUT"
"application/json"
)
"
_webdav_new_cert_id
=
$(
echo
"
$_activate_webdav_cert
"
| _json_decode |
sed
-n
's/.*: \([0-9]\{1,\}\) }$/\1/p'
)
if
[
"
$_webdav_new_cert_id
"
-eq
"
$_cert_id
"
]
;
then
_info
"WebDAV Certificate update successfully"
else
_err
"Unable to set WebDAV certificate"
_debug3 _activate_webdav_cert
"
$_activate_webdav_cert
"
_debug3 _webdav_new_cert_id
"
$_webdav_new_cert_id
"
return
1
fi
_debug3 _webdav_new_cert_id
"
$_webdav_new_cert_id
"
else
_info
"WebDAV certificate not set or not the same as Web UI"
fi
_info
"Check if FTP certificate is the same as the WEB UI"
_ftp_list
=
$(
_get
"
$_api_url
/ftp"
)
_ftp_cert_id
=
$(
echo
"
$_ftp_list
"
|
grep
'"ssltls_certificate":'
|
tr
-d
--
'"certislfa:_ ,'
)
if
[
"
$_ftp_cert_id
"
=
"
$_active_cert_id
"
]
;
then
_info
"Update the FTP Certificate"
_debug _ftp_cert_id
"
$_ftp_cert_id
"
_ftp_data
=
"{
\"
ssltls_certificate
\"
:
\"
${
_cert_id
}
\"
}"
_activate_ftp_cert
=
"
$(
_post
"
$_ftp_data
"
"
$_api_url
/ftp"
""
"PUT"
"application/json"
)
"
_ftp_new_cert_id
=
$(
echo
"
$_activate_ftp_cert
"
| _json_decode |
sed
-n
's/.*: \([0-9]\{1,\}\) }$/\1/p'
)
if
[
"
$_ftp_new_cert_id
"
-eq
"
$_cert_id
"
]
;
then
_info
"FTP Certificate update successfully"
else
_err
"Unable to set FTP certificate"
_debug3 _activate_ftp_cert
"
$_activate_ftp_cert
"
_debug3 _ftp_new_cert_id
"
$_ftp_new_cert_id
"
return
1
fi
_debug3 _activate_ftp_cert
"
$_activate_ftp_cert
"
else
_info
"FTP certificate not set or not the same as Web UI"
fi
_info
"Delete old Certificate"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
_debug3 _delete_result
"
$_delete_result
"
_info
"Reload WebUI from TrueNAS"
_restart_UI
=
$(
_get
"
$_api_url
/system/general/ui_restart"
)
_debug2 _restart_UI
"
$_restart_UI
"
if
[
-n
"
$_add_cert_result
"
]
&&
[
-n
"
$_activate_result
"
]
;
then
return
0
else
_err
"Certupdate was not succesfull, please use --debug"
return
1
fi
}
dnsapi/dns_huaweicloud.sh
View file @
4c32bc8e
...
...
@@ -35,7 +35,7 @@ dns_huaweicloud_add() {
_err
"dns_api(dns_huaweicloud): Error getting token."
return
1
fi
_debug
"Access token is:
${
token
}
"
_secure
_debug
"Access token is:
"
"
${
token
}
"
unset
zoneid
zoneid
=
"
$(
_get_zoneid
"
${
token
}
"
"
${
fulldomain
}
"
)
"
...
...
@@ -43,7 +43,7 @@ dns_huaweicloud_add() {
_err
"dns_api(dns_huaweicloud): Error getting zone id."
return
1
fi
_debug
"Zone ID is:
${
zoneid
}
"
_debug
"Zone ID is:
"
"
${
zoneid
}
"
_debug
"Adding Record"
_add_record
"
${
token
}
"
"
${
fulldomain
}
"
"
${
txtvalue
}
"
...
...
@@ -86,7 +86,7 @@ dns_huaweicloud_rm() {
_err
"dns_api(dns_huaweicloud): Error getting token."
return
1
fi
_debug
"Access token is:
${
token
}
"
_secure
_debug
"Access token is:
"
"
${
token
}
"
unset
zoneid
zoneid
=
"
$(
_get_zoneid
"
${
token
}
"
"
${
fulldomain
}
"
)
"
...
...
@@ -94,7 +94,7 @@ dns_huaweicloud_rm() {
_err
"dns_api(dns_huaweicloud): Error getting zone id."
return
1
fi
_debug
"Zone ID is:
${
zoneid
}
"
_debug
"Zone ID is:
"
"
${
zoneid
}
"
# Remove all records
# Therotically HuaweiCloud does not allow more than one record set
...
...
@@ -129,14 +129,25 @@ _get_zoneid() {
fi
_debug
"
$h
"
response
=
$(
_get
"
${
dns_api
}
/v2/zones?name=
${
h
}
"
)
if
_contains
"
${
response
}
"
"id"
;
then
_debug
"Get Zone ID Success."
_zoneid
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
printf
"%s"
"
${
_zoneid
}
"
return
0
_debug2
"
$response
"
if
_contains
"
${
response
}
"
'"id"'
;
then
zoneidlist
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
zonenamelist
=
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
name
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
_debug2
"Return Zone ID(s):"
"
${
zoneidlist
}
"
_debug2
"Return Zone Name(s):"
"
${
zonenamelist
}
"
zoneidnum
=
0
echo
"
${
zonenamelist
}
"
|
while
read
-r
zonename
;
do
zoneidnum
=
$(
_math
"
$zoneidnum
"
+ 1
)
_debug
"Check Zone Name"
"
${
zonename
}
"
if
[
"
${
zonename
}
"
=
"
${
h
}
."
]
;
then
_debug
"Get Zone ID Success."
_zoneid
=
$(
echo
"
${
zoneidlist
}
"
|
sed
-n
"
${
zoneidnum
}
p"
)
_debug2
"ZoneID:"
"
${
_zoneid
}
"
printf
"%s"
"
${
_zoneid
}
"
return
0
fi
done
fi
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
...
...
@@ -149,7 +160,7 @@ _get_recordset_id() {
export
_H1
=
"X-Auth-Token:
${
_token
}
"
response
=
$(
_get
"
${
dns_api
}
/v2/zones/
${
_zoneid
}
/recordsets?name=
${
_domain
}
"
)
if
_contains
"
${
response
}
"
"id"
;
then
if
_contains
"
${
response
}
"
'
"id"
'
;
then
_id
=
"
$(
echo
"
${
response
}
"
| _egrep_o
"
\"
id
\"
: *
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
tr
-d
" "
)
"
printf
"%s"
"
${
_id
}
"
return
0
...
...
@@ -197,7 +208,7 @@ _add_record() {
fi
_record_id
=
"
$(
_get_recordset_id
"
${
_token
}
"
"
${
_domain
}
"
"
${
zoneid
}
"
)
"
_debug
"Record Set ID is:
${
_record_id
}
"
_debug
"Record Set ID is:
"
"
${
_record_id
}
"
# Remove all records
while
[
"
${
_record_id
}
"
!=
"0"
]
;
do
...
...
@@ -269,7 +280,7 @@ _get_token() {
_post
"
${
body
}
"
"
${
iam_api
}
/v3/auth/tokens"
>
/dev/null
_code
=
$(
grep
"^HTTP"
"
$HTTP_HEADER
"
| _tail_n 1 |
cut
-d
" "
-f
2 |
tr
-d
"
\\
r
\\
n"
)
_token
=
$(
grep
"^X-Subject-Token"
"
$HTTP_HEADER
"
|
cut
-d
" "
-f
2-
)
_debug
2
"
${
_code
}
"
_secure
_debug
"
${
_code
}
"
printf
"%s"
"
${
_token
}
"
return
0
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment