Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
979e10f9
Unverified
Commit
979e10f9
authored
Feb 15, 2021
by
neil
Committed by
GitHub
Feb 15, 2021
Browse files
Merge pull request #3410 from acmesh-official/dev
sync
parents
deac3fc9
bf8c3370
Changes
6
Hide whitespace changes
Inline
Side-by-side
.github/workflows/LetsEncrypt.yml
View file @
979e10f9
...
@@ -111,7 +111,7 @@ jobs:
...
@@ -111,7 +111,7 @@ jobs:
-
uses
:
actions/checkout@v2
-
uses
:
actions/checkout@v2
-
name
:
Clone acmetest
-
name
:
Clone acmetest
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
-
uses
:
vmactions/freebsd-vm@v0.
0.7
-
uses
:
vmactions/freebsd-vm@v0.
1.2
with
:
with
:
envs
:
'
NGROK_TOKEN
TEST_LOCAL'
envs
:
'
NGROK_TOKEN
TEST_LOCAL'
prepare
:
pkg install -y socat curl
prepare
:
pkg install -y socat curl
...
@@ -136,7 +136,7 @@ jobs:
...
@@ -136,7 +136,7 @@ jobs:
run
:
echo "TestingDomain=${{steps.ngrok.outputs.server}}" >> $GITHUB_ENV
run
:
echo "TestingDomain=${{steps.ngrok.outputs.server}}" >> $GITHUB_ENV
-
name
:
Clone acmetest
-
name
:
Clone acmetest
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
run
:
cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
-
uses
:
vmactions/solaris-vm@v0.0.
1
-
uses
:
vmactions/solaris-vm@v0.0.
3
with
:
with
:
envs
:
'
TEST_LOCAL
TestingDomain'
envs
:
'
TEST_LOCAL
TestingDomain'
nat
:
|
nat
:
|
...
...
acme.sh
View file @
979e10f9
...
@@ -4009,12 +4009,42 @@ _check_dns_entries() {
...
@@ -4009,12 +4009,42 @@ _check_dns_entries() {
}
}
#file
#file
_get_c
ert
_issuers
()
{
_get_c
hain
_issuers
()
{
_cfile
=
"
$1
"
_cfile
=
"
$1
"
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
help
2>&1
)
"
"unknown option help"
;
then
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-help
2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
help
2>&1
)
"
"unknown option help"
;
then
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-nocrl
-certfile
$_cfile
|
${
ACME_OPENSSL_BIN
:-
openssl
}
pkcs7
-print_certs
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-nocrl
-certfile
$_cfile
|
${
ACME_OPENSSL_BIN
:-
openssl
}
pkcs7
-print_certs
-text
-noout
|
grep
-i
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
else
else
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
$_cfile
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
_cindex
=
1
for
_startn
in
$(
grep
-n
--
"
$BEGIN_CERT
"
"
$_cfile
"
|
cut
-d
:
-f
1
)
;
do
_endn
=
"
$(
grep
-n
--
"
$END_CERT
"
"
$_cfile
"
|
cut
-d
:
-f
1 | _head_n
$_cindex
| _tail_n 1
)
"
_debug2
"_startn"
"
$_startn
"
_debug2
"_endn"
"
$_endn
"
if
[
"
$DEBUG
"
]
;
then
_debug2
"cert
$_cindex
"
"
$(
sed
-n
"
$_startn
,
${
_endn
}
p"
"
$_cfile
"
)
"
fi
sed
-n
"
$_startn
,
${
_endn
}
p"
"
$_cfile
"
|
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2 |
sed
"s/ *
\(
.*
\)
/
\1
/"
_cindex
=
$(
_math
$_cindex
+ 1
)
done
fi
}
#
_get_chain_subjects
()
{
_cfile
=
"
$1
"
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-help
2>&1
)
"
"Usage: crl2pkcs7"
||
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
help
2>&1
)
"
"unknown option help"
;
then
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-nocrl
-certfile
$_cfile
|
${
ACME_OPENSSL_BIN
:-
openssl
}
pkcs7
-print_certs
-text
-noout
|
grep
-i
'Subject:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
else
_cindex
=
1
for
_startn
in
$(
grep
-n
--
"
$BEGIN_CERT
"
"
$_cfile
"
|
cut
-d
:
-f
1
)
;
do
_endn
=
"
$(
grep
-n
--
"
$END_CERT
"
"
$_cfile
"
|
cut
-d
:
-f
1 | _head_n
$_cindex
| _tail_n 1
)
"
_debug2
"_startn"
"
$_startn
"
_debug2
"_endn"
"
$_endn
"
if
[
"
$DEBUG
"
]
;
then
_debug2
"cert
$_cindex
"
"
$(
sed
-n
"
$_startn
,
${
_endn
}
p"
"
$_cfile
"
)
"
fi
sed
-n
"
$_startn
,
${
_endn
}
p"
"
$_cfile
"
|
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-text
-noout
|
grep
-i
'Subject:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2 |
sed
"s/ *
\(
.*
\)
/
\1
/"
_cindex
=
$(
_math
$_cindex
+ 1
)
done
fi
fi
}
}
...
@@ -4022,14 +4052,12 @@ _get_cert_issuers() {
...
@@ -4022,14 +4052,12 @@ _get_cert_issuers() {
_match_issuer
()
{
_match_issuer
()
{
_cfile
=
"
$1
"
_cfile
=
"
$1
"
_missuer
=
"
$2
"
_missuer
=
"
$2
"
_fissuers
=
"
$(
_get_c
ert
_issuers
$_cfile
)
"
_fissuers
=
"
$(
_get_c
hain
_issuers
$_cfile
)
"
_debug2 _fissuers
"
$_fissuers
"
_debug2 _fissuers
"
$_fissuers
"
if
_contains
"
$_fissuers
"
"
$_missuer
"
;
then
_rootissuer
=
"
$(
echo
"
$_fissuers
"
| _lower_case | _tail_n 1
)
"
return
0
_debug2 _rootissuer
"
$_rootissuer
"
fi
_fissuers
=
"
$(
echo
"
$_fissuers
"
| _lower_case
)
"
_missuer
=
"
$(
echo
"
$_missuer
"
| _lower_case
)
"
_missuer
=
"
$(
echo
"
$_missuer
"
| _lower_case
)
"
_contains
"
$_
f
issuer
s
"
"
$_missuer
"
_contains
"
$_
root
issuer
"
"
$_missuer
"
}
}
#webroot, domain domainlist keylength
#webroot, domain domainlist keylength
...
@@ -4803,6 +4831,9 @@ $_authorizations_map"
...
@@ -4803,6 +4831,9 @@ $_authorizations_map"
_split_cert_chain
"
$CERT_PATH
"
"
$CERT_FULLCHAIN_PATH
"
"
$CA_CERT_PATH
"
_split_cert_chain
"
$CERT_PATH
"
"
$CERT_FULLCHAIN_PATH
"
"
$CA_CERT_PATH
"
if
[
"
$_preferred_chain
"
]
&&
[
-f
"
$CERT_FULLCHAIN_PATH
"
]
;
then
if
[
"
$_preferred_chain
"
]
&&
[
-f
"
$CERT_FULLCHAIN_PATH
"
]
;
then
if
[
"
$DEBUG
"
]
;
then
_debug
"default chain issuers: "
"
$(
_get_chain_issuers
"
$CERT_FULLCHAIN_PATH
"
)
"
fi
if
!
_match_issuer
"
$CERT_FULLCHAIN_PATH
"
"
$_preferred_chain
"
;
then
if
!
_match_issuer
"
$CERT_FULLCHAIN_PATH
"
"
$_preferred_chain
"
;
then
rels
=
"
$(
echo
"
$responseHeaders
"
|
tr
-d
' <>'
|
grep
-i
"^link:"
|
grep
-i
'rel="alternate"'
|
cut
-d
:
-f
2- |
cut
-d
';'
-f
1
)
"
rels
=
"
$(
echo
"
$responseHeaders
"
|
tr
-d
' <>'
|
grep
-i
"^link:"
|
grep
-i
'rel="alternate"'
|
cut
-d
:
-f
2- |
cut
-d
';'
-f
1
)
"
_debug2
"rels"
"
$rels
"
_debug2
"rels"
"
$rels
"
...
@@ -4818,13 +4849,22 @@ $_authorizations_map"
...
@@ -4818,13 +4849,22 @@ $_authorizations_map"
_relca
=
"
$CA_CERT_PATH
.alt"
_relca
=
"
$CA_CERT_PATH
.alt"
echo
"
$response
"
>
"
$_relcert
"
echo
"
$response
"
>
"
$_relcert
"
_split_cert_chain
"
$_relcert
"
"
$_relfullchain
"
"
$_relca
"
_split_cert_chain
"
$_relcert
"
"
$_relfullchain
"
"
$_relca
"
if
[
"
$DEBUG
"
]
;
then
_debug
"rel chain issuers: "
"
$(
_get_chain_issuers
"
$_relfullchain
"
)
"
fi
if
_match_issuer
"
$_relfullchain
"
"
$_preferred_chain
"
;
then
if
_match_issuer
"
$_relfullchain
"
"
$_preferred_chain
"
;
then
_info
"Matched issuer in:
$rel
"
_info
"Matched issuer in:
$rel
"
cat
$_relcert
>
"
$CERT_PATH
"
cat
$_relcert
>
"
$CERT_PATH
"
cat
$_relfullchain
>
"
$CERT_FULLCHAIN_PATH
"
cat
$_relfullchain
>
"
$CERT_FULLCHAIN_PATH
"
cat
$_relca
>
"
$CA_CERT_PATH
"
cat
$_relca
>
"
$CA_CERT_PATH
"
rm
-f
"
$_relcert
"
rm
-f
"
$_relfullchain
"
rm
-f
"
$_relca
"
break
break
fi
fi
rm
-f
"
$_relcert
"
rm
-f
"
$_relfullchain
"
rm
-f
"
$_relca
"
done
done
fi
fi
fi
fi
...
...
deploy/unifi.sh
View file @
979e10f9
#!/usr/bin/env sh
#!/usr/bin/env sh
#Here is a script to deploy cert to unifi server.
# Here is a script to deploy cert on a Unifi Controller or Cloud Key device.
# It supports:
# - self-hosted Unifi Controller
# - Unifi Cloud Key (Gen1/2/2+)
# - Unifi Cloud Key running UnifiOS (v2.0.0+, Gen2/2+ only)
# Please report bugs to https://github.com/acmesh-official/acme.sh/issues/3359
#returns 0 means success, otherwise error.
#returns 0 means success, otherwise error.
# The deploy-hook automatically detects standard Unifi installations
# for each of the supported environments. Most users should not need
# to set any of these variables, but if you are running a self-hosted
# Controller with custom locations, set these as necessary before running
# the deploy hook. (Defaults shown below.)
#
# Settings for Unifi Controller:
# Location of Java keystore or unifi.keystore.jks file:
#DEPLOY_UNIFI_KEYSTORE="/usr/lib/unifi/data/keystore"
#DEPLOY_UNIFI_KEYSTORE="/usr/lib/unifi/data/keystore"
# Keystore password (built into Unifi Controller, not a user-set password):
#DEPLOY_UNIFI_KEYPASS="aircontrolenterprise"
#DEPLOY_UNIFI_KEYPASS="aircontrolenterprise"
# Command to restart Unifi Controller:
#DEPLOY_UNIFI_RELOAD="service unifi restart"
#DEPLOY_UNIFI_RELOAD="service unifi restart"
#
# Settings for Unifi Cloud Key Gen1 (nginx admin pages):
# Directory where cloudkey.crt and cloudkey.key live:
#DEPLOY_UNIFI_CLOUDKEY_CERTDIR="/etc/ssl/private"
# Command to restart maintenance pages and Controller
# (same setting as above, default is updated when running on Cloud Key Gen1):
#DEPLOY_UNIFI_RELOAD="service nginx restart && service unifi restart"
#
# Settings for UnifiOS (Cloud Key Gen2):
# Directory where unifi-core.crt and unifi-core.key live:
#DEPLOY_UNIFI_CORE_CONFIG="/data/unifi-core/config/"
# Command to restart unifi-core:
#DEPLOY_UNIFI_RELOAD="systemctl restart unifi-core"
#
# At least one of DEPLOY_UNIFI_KEYSTORE, DEPLOY_UNIFI_CLOUDKEY_CERTDIR,
# or DEPLOY_UNIFI_CORE_CONFIG must exist to receive the deployed certs.
######## Public functions #####################
######## Public functions #####################
...
@@ -24,77 +55,160 @@ unifi_deploy() {
...
@@ -24,77 +55,160 @@ unifi_deploy() {
_debug _cca
"
$_cca
"
_debug _cca
"
$_cca
"
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
if
!
_exists keytool
;
then
_getdeployconf DEPLOY_UNIFI_KEYSTORE
_err
"keytool not found"
_getdeployconf DEPLOY_UNIFI_KEYPASS
return
1
_getdeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR
fi
_getdeployconf DEPLOY_UNIFI_CORE_CONFIG
_getdeployconf DEPLOY_UNIFI_RELOAD
_debug2 DEPLOY_UNIFI_KEYSTORE
"
$DEPLOY_UNIFI_KEYSTORE
"
_debug2 DEPLOY_UNIFI_KEYPASS
"
$DEPLOY_UNIFI_KEYPASS
"
_debug2 DEPLOY_UNIFI_CLOUDKEY_CERTDIR
"
$DEPLOY_UNIFI_CLOUDKEY_CERTDIR
"
_debug2 DEPLOY_UNIFI_CORE_CONFIG
"
$DEPLOY_UNIFI_CORE_CONFIG
"
_debug2 DEPLOY_UNIFI_RELOAD
"
$DEPLOY_UNIFI_RELOAD
"
# Space-separated list of environments detected and installed:
_services_updated
=
""
# Default reload commands accumulated as we auto-detect environments:
_reload_cmd
=
""
# Unifi Controller environment (self hosted or any Cloud Key) --
# auto-detect by file /usr/lib/unifi/data/keystore:
_unifi_keystore
=
"
${
DEPLOY_UNIFI_KEYSTORE
:-
/usr/lib/unifi/data/keystore
}
"
if
[
-f
"
$_unifi_keystore
"
]
;
then
_info
"Installing certificate for Unifi Controller (Java keystore)"
_debug _unifi_keystore
"
$_unifi_keystore
"
if
!
_exists keytool
;
then
_err
"keytool not found"
return
1
fi
if
[
!
-w
"
$_unifi_keystore
"
]
;
then
_err
"The file
$_unifi_keystore
is not writable, please change the permission."
return
1
fi
_unifi_keypass
=
"
${
DEPLOY_UNIFI_KEYPASS
:-
aircontrolenterprise
}
"
DEFAULT_UNIFI_KEYSTORE
=
"/usr/lib/unifi/data/keystore"
_debug
"Generate import pkcs12"
_unifi_keystore
=
"
${
DEPLOY_UNIFI_KEYSTORE
:-
$DEFAULT_UNIFI_KEYSTORE
}
"
_import_pkcs12
=
"
$(
_mktemp
)
"
DEFAULT_UNIFI_KEYPASS
=
"aircontrolenterprise"
_toPkcs
"
$_import_pkcs12
"
"
$_ckey
"
"
$_ccert
"
"
$_cca
"
"
$_unifi_keypass
"
unifi root
_unifi_keypass
=
"
${
DEPLOY_UNIFI_KEYPASS
:-
$DEFAULT_UNIFI_KEYPASS
}
"
# shellcheck disable=SC2181
DEFAULT_UNIFI_RELOAD
=
"service unifi restart"
if
[
"
$?
"
!=
"0"
]
;
then
_reload
=
"
${
DEPLOY_UNIFI_RELOAD
:-
$DEFAULT_UNIFI_RELOAD
}
"
_err
"Error generating pkcs12. Please re-run with --debug and report a bug."
_debug _unifi_keystore
"
$_unifi_keystore
"
if
[
!
-f
"
$_unifi_keystore
"
]
;
then
if
[
-z
"
$DEPLOY_UNIFI_KEYSTORE
"
]
;
then
_err
"unifi keystore is not found, please define DEPLOY_UNIFI_KEYSTORE"
return
1
return
1
fi
_debug
"Import into keystore:
$_unifi_keystore
"
if
keytool
-importkeystore
\
-deststorepass
"
$_unifi_keypass
"
-destkeypass
"
$_unifi_keypass
"
-destkeystore
"
$_unifi_keystore
"
\
-srckeystore
"
$_import_pkcs12
"
-srcstoretype
PKCS12
-srcstorepass
"
$_unifi_keypass
"
\
-alias
unifi
-noprompt
;
then
_debug
"Import keystore success!"
rm
"
$_import_pkcs12
"
else
else
_err
"It seems that the specified unifi keystore is not valid, please check."
_err
"Error importing into Unifi Java keystore."
_err
"Please re-run with --debug and report a bug."
rm
"
$_import_pkcs12
"
return
1
return
1
fi
fi
if
systemctl
-q
is-active unifi
;
then
_reload_cmd
=
"
${
_reload_cmd
:+
$_reload_cmd
&&
}
service unifi restart"
fi
_services_updated
=
"
${
_services_updated
}
unifi"
_info
"Install Unifi Controller certificate success!"
elif
[
"
$DEPLOY_UNIFI_KEYSTORE
"
]
;
then
_err
"The specified DEPLOY_UNIFI_KEYSTORE='
$DEPLOY_UNIFI_KEYSTORE
' is not valid, please check."
return
1
fi
fi
if
[
!
-w
"
$_unifi_keystore
"
]
;
then
_err
"The file
$_unifi_keystore
is not writable, please change the permission."
# Cloud Key environment (non-UnifiOS -- nginx serves admin pages) --
# auto-detect by file /etc/ssl/private/cloudkey.key:
_cloudkey_certdir
=
"
${
DEPLOY_UNIFI_CLOUDKEY_CERTDIR
:-
/etc/ssl/private
}
"
if
[
-f
"
${
_cloudkey_certdir
}
/cloudkey.key"
]
;
then
_info
"Installing certificate for Cloud Key Gen1 (nginx admin pages)"
_debug _cloudkey_certdir
"
$_cloudkey_certdir
"
if
[
!
-w
"
$_cloudkey_certdir
"
]
;
then
_err
"The directory
$_cloudkey_certdir
is not writable; please check permissions."
return
1
fi
# Cloud Key expects to load the keystore from /etc/ssl/private/unifi.keystore.jks.
# Normally /usr/lib/unifi/data/keystore is a symlink there (so the keystore was
# updated above), but if not, we don't know how to handle this installation:
if
!
cmp
-s
"
$_unifi_keystore
"
"
${
_cloudkey_certdir
}
/unifi.keystore.jks"
;
then
_err
"Unsupported Cloud Key configuration: keystore not found at '
${
_cloudkey_certdir
}
/unifi.keystore.jks'"
return
1
fi
cat
"
$_cfullchain
"
>
"
${
_cloudkey_certdir
}
/cloudkey.crt"
cat
"
$_ckey
"
>
"
${
_cloudkey_certdir
}
/cloudkey.key"
(
cd
"
$_cloudkey_certdir
"
&&
tar
-cf
cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks
)
if
systemctl
-q
is-active nginx
;
then
_reload_cmd
=
"
${
_reload_cmd
:+
$_reload_cmd
&&
}
service nginx restart"
fi
_info
"Install Cloud Key Gen1 certificate success!"
_services_updated
=
"
${
_services_updated
}
nginx"
elif
[
"
$DEPLOY_UNIFI_CLOUDKEY_CERTDIR
"
]
;
then
_err
"The specified DEPLOY_UNIFI_CLOUDKEY_CERTDIR='
$DEPLOY_UNIFI_CLOUDKEY_CERTDIR
' is not valid, please check."
return
1
return
1
fi
fi
_info
"Generate import pkcs12"
# UnifiOS environment -- auto-detect by /data/unifi-core/config/unifi-core.key:
_import_pkcs12
=
"
$(
_mktemp
)
"
_unifi_core_config
=
"
${
DEPLOY_UNIFI_CORE_CONFIG
:-
/data/unifi-core/config
}
"
_toPkcs
"
$_import_pkcs12
"
"
$_ckey
"
"
$_ccert
"
"
$_cca
"
"
$_unifi_keypass
"
unifi root
if
[
-f
"
${
_unifi_core_config
}
/unifi-core.key"
]
;
then
if
[
"
$?
"
!=
"0"
]
;
then
_info
"Installing certificate for UnifiOS"
_err
"Oops, error creating import pkcs12, please report bug to us."
_debug _unifi_core_config
"
$_unifi_core_config
"
if
[
!
-w
"
$_unifi_core_config
"
]
;
then
_err
"The directory
$_unifi_core_config
is not writable; please check permissions."
return
1
fi
cat
"
$_cfullchain
"
>
"
${
_unifi_core_config
}
/unifi-core.crt"
cat
"
$_ckey
"
>
"
${
_unifi_core_config
}
/unifi-core.key"
if
systemctl
-q
is-active unifi-core
;
then
_reload_cmd
=
"
${
_reload_cmd
:+
$_reload_cmd
&&
}
systemctl restart unifi-core"
fi
_info
"Install UnifiOS certificate success!"
_services_updated
=
"
${
_services_updated
}
unifi-core"
elif
[
"
$DEPLOY_UNIFI_CORE_CONFIG
"
]
;
then
_err
"The specified DEPLOY_UNIFI_CORE_CONFIG='
$DEPLOY_UNIFI_CORE_CONFIG
' is not valid, please check."
return
1
return
1
fi
fi
_info
"Modify unifi keystore:
$_unifi_keystore
"
if
[
-z
"
$_services_updated
"
]
;
then
if
keytool
-importkeystore
\
# None of the Unifi environments were auto-detected, so no deployment has occurred
-deststorepass
"
$_unifi_keypass
"
-destkeypass
"
$_unifi_keypass
"
-destkeystore
"
$_unifi_keystore
"
\
# (and none of DEPLOY_UNIFI_{KEYSTORE,CLOUDKEY_CERTDIR,CORE_CONFIG} were set).
-srckeystore
"
$_import_pkcs12
"
-srcstoretype
PKCS12
-srcstorepass
"
$_unifi_keypass
"
\
_err
"Unable to detect Unifi environment in standard location."
-alias
unifi
-noprompt
;
then
_err
"(This deploy hook must be run on the Unifi device, not a remote machine.)"
_info
"Import keystore success!"
_err
"For non-standard Unifi installations, set DEPLOY_UNIFI_KEYSTORE,"
rm
"
$_import_pkcs12
"
_err
"DEPLOY_UNIFI_CLOUDKEY_CERTDIR, and/or DEPLOY_UNIFI_CORE_CONFIG as appropriate."
else
_err
"Import unifi keystore error, please report bug to us."
rm
"
$_import_pkcs12
"
return
1
return
1
fi
fi
_info
"Run reload:
$_reload
"
_reload_cmd
=
"
${
DEPLOY_UNIFI_RELOAD
:-
$_reload_cmd
}
"
if
eval
"
$_reload
"
;
then
if
[
-z
"
$_reload_cmd
"
]
;
then
_err
"Certificates were installed for services:
${
_services_updated
}
,"
_err
"but none appear to be active. Please set DEPLOY_UNIFI_RELOAD"
_err
"to a command that will restart the necessary services."
return
1
fi
_info
"Reload services (this may take some time):
$_reload_cmd
"
if
eval
"
$_reload_cmd
"
;
then
_info
"Reload success!"
_info
"Reload success!"
if
[
"
$DEPLOY_UNIFI_KEYSTORE
"
]
;
then
_savedomainconf DEPLOY_UNIFI_KEYSTORE
"
$DEPLOY_UNIFI_KEYSTORE
"
else
_cleardomainconf DEPLOY_UNIFI_KEYSTORE
fi
if
[
"
$DEPLOY_UNIFI_KEYPASS
"
]
;
then
_savedomainconf DEPLOY_UNIFI_KEYPASS
"
$DEPLOY_UNIFI_KEYPASS
"
else
_cleardomainconf DEPLOY_UNIFI_KEYPASS
fi
if
[
"
$DEPLOY_UNIFI_RELOAD
"
]
;
then
_savedomainconf DEPLOY_UNIFI_RELOAD
"
$DEPLOY_UNIFI_RELOAD
"
else
_cleardomainconf DEPLOY_UNIFI_RELOAD
fi
return
0
else
else
_err
"Reload error"
_err
"Reload error"
return
1
return
1
fi
fi
return
0
# Successful, so save all (non-default) config:
_savedeployconf DEPLOY_UNIFI_KEYSTORE
"
$DEPLOY_UNIFI_KEYSTORE
"
_savedeployconf DEPLOY_UNIFI_KEYPASS
"
$DEPLOY_UNIFI_KEYPASS
"
_savedeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR
"
$DEPLOY_UNIFI_CLOUDKEY_CERTDIR
"
_savedeployconf DEPLOY_UNIFI_CORE_CONFIG
"
$DEPLOY_UNIFI_CORE_CONFIG
"
_savedeployconf DEPLOY_UNIFI_RELOAD
"
$DEPLOY_UNIFI_RELOAD
"
return
0
}
}
dnsapi/dns_arvan.sh
View file @
979e10f9
#!/usr/bin/env sh
#!/usr/bin/env sh
#Arvan_Token="xxxx"
#Arvan_Token="
Apikey
xxxx"
ARVAN_API_URL
=
"https://napi.arvancloud.com/cdn/4.0/domains"
ARVAN_API_URL
=
"https://napi.arvancloud.com/cdn/4.0/domains"
#Author: Vahid Fardi
#Author: Ehsan Aliakbar
#Report Bugs here: https://github.com/Neilpang/acme.sh
#Report Bugs here: https://github.com/Neilpang/acme.sh
#
#
######## Public functions #####################
######## Public functions #####################
...
@@ -38,6 +37,7 @@ dns_arvan_add() {
...
@@ -38,6 +37,7 @@ dns_arvan_add() {
_info
"Adding record"
_info
"Adding record"
if
_arvan_rest POST
"
$_domain
/dns-records"
"{
\"
type
\"
:
\"
TXT
\"
,
\"
name
\"
:
\"
$_sub_domain
\"
,
\"
value
\"
:{
\"
text
\"
:
\"
$txtvalue
\"
},
\"
ttl
\"
:120}"
;
then
if
_arvan_rest POST
"
$_domain
/dns-records"
"{
\"
type
\"
:
\"
TXT
\"
,
\"
name
\"
:
\"
$_sub_domain
\"
,
\"
value
\"
:{
\"
text
\"
:
\"
$txtvalue
\"
},
\"
ttl
\"
:120}"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"response id is
$response
"
_info
"Added, OK"
_info
"Added, OK"
return
0
return
0
elif
_contains
"
$response
"
"Record Data is Duplicated"
;
then
elif
_contains
"
$response
"
"Record Data is Duplicated"
;
then
...
@@ -49,7 +49,7 @@ dns_arvan_add() {
...
@@ -49,7 +49,7 @@ dns_arvan_add() {
fi
fi
fi
fi
_err
"Add txt record error."
_err
"Add txt record error."
return
1
return
0
}
}
#Usage: fulldomain txtvalue
#Usage: fulldomain txtvalue
...
@@ -73,33 +73,21 @@ dns_arvan_rm() {
...
@@ -73,33 +73,21 @@ dns_arvan_rm() {
_debug _domain
"
$_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_debug
"Getting txt records"
shorted_txtvalue
=
$(
printf
"%s"
"
$txtvalue
"
|
cut
-d
"-"
-d
"_"
-f1
)
_arvan_rest GET
"
${
_domain
}
/dns-records"
_arvan_rest GET
"
${
_domain
}
/dns-records?search=
$shorted_txtvalue
"
if
!
printf
"%s"
"
$response
"
|
grep
\"
current_page
\"
:1
>
/dev/null
;
then
if
!
printf
"%s"
"
$response
"
|
grep
\"
current_page
\"
:1
>
/dev/null
;
then
_err
"Error on Arvan Api"
_err
"Error on Arvan Api"
_err
"Please create a github issue with debbug log"
_err
"Please create a github issue with debbug log"
return
1
return
1
fi
fi
count
=
$(
printf
"%s
\n
"
"
$response
"
| _egrep_o
"
\"
total
\"
:[^,]*"
|
cut
-d
:
-f
2
)
_record_id
=
$(
echo
"
$response
"
| _egrep_o
".
\"
id
\"
:
\"
[^
\"
]*
\"
,
\"
type
\"
:
\"
txt
\"
,
\"
name
\"
:
\"
_acme-challenge
\"
,
\"
value
\"
:{
\"
text
\"
:
\"
$txtvalue
\"
}"
|
cut
-d
:
-f
2 |
cut
-d
,
-f
1 |
tr
-d
\"
)
_debug count
"
$count
"
if
!
_arvan_rest
"DELETE"
"
${
_domain
}
/dns-records/
${
_record_id
}
"
;
then
if
[
"
$count
"
=
"0"
]
;
then
_err
"Error on Arvan Api"
_info
"Don't need to remove."
return
1
else
record_id
=
$(
printf
"%s
\n
"
"
$response
"
| _egrep_o
"
\"
id
\"
:
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
head
-n
1
)
_debug
"record_id"
"
$record_id
"
if
[
-z
"
$record_id
"
]
;
then
_err
"Can not get record id to remove."
return
1
fi
if
!
_arvan_rest
"DELETE"
"
${
_domain
}
/dns-records/
$record_id
"
;
then
_err
"Delete record error."
return
1
fi
_debug
"
$response
"
_contains
"
$response
"
'dns record deleted'
fi
fi
_debug
"
$response
"
_contains
"
$response
"
'dns record deleted'
return
0
}
}
#################### Private functions below ##################################
#################### Private functions below ##################################
...
@@ -111,7 +99,7 @@ dns_arvan_rm() {
...
@@ -111,7 +99,7 @@ dns_arvan_rm() {
# _domain_id=sdjkglgdfewsdfg
# _domain_id=sdjkglgdfewsdfg
_get_root
()
{
_get_root
()
{
domain
=
$1
domain
=
$1
i
=
1
i
=
2
p
=
1
p
=
1
while
true
;
do
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
...
@@ -121,12 +109,11 @@ _get_root() {
...
@@ -121,12 +109,11 @@ _get_root() {
return
1
return
1
fi
fi
if
!
_arvan_rest GET
"
?search=
$h
"
;
then
if
!
_arvan_rest GET
"
$h
"
;
then
return
1
return
1
fi
fi
if
_contains
"
$response
"
"
\"
domain
\"
:
\"
$h
\"
"
;
then
if
_contains
"
$response
"
"
\"
domain
\"
:
\"
$h
\"
"
||
_contains
"
$response
"
'"total":1'
;
then
_domain_id
=
$(
echo
"
$response
"
|
cut
-d
:
-f
3 |
cut
-d
,
-f
1 |
tr
-d
\"
)
_domain_id
=
$(
echo
"
$response
"
| _egrep_o
"
\[
.
\"
id
\"
:
\"
[^
\"
]*
\"
"
| _head_n 1 |
cut
-d
:
-f
2 |
tr
-d
\"
)
if
[
"
$_domain_id
"
]
;
then
if
[
"
$_domain_id
"
]
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
_domain
=
$h
...
@@ -146,7 +133,6 @@ _arvan_rest() {
...
@@ -146,7 +133,6 @@ _arvan_rest() {
data
=
"
$3
"
data
=
"
$3
"
token_trimmed
=
$(
echo
"
$Arvan_Token
"
|
tr
-d
'"'
)
token_trimmed
=
$(
echo
"
$Arvan_Token
"
|
tr
-d
'"'
)
export
_H1
=
"Authorization:
$token_trimmed
"
export
_H1
=
"Authorization:
$token_trimmed
"
if
[
"
$mtd
"
=
"DELETE"
]
;
then
if
[
"
$mtd
"
=
"DELETE"
]
;
then
...
@@ -160,4 +146,5 @@ _arvan_rest() {
...
@@ -160,4 +146,5 @@ _arvan_rest() {
else
else
response
=
"
$(
_get
"
$ARVAN_API_URL
/
$ep$data
"
)
"
response
=
"
$(
_get
"
$ARVAN_API_URL
/
$ep$data
"
)
"
fi
fi
return
0
}
}
dnsapi/dns_duckdns.sh
View file @
979e10f9
...
@@ -12,7 +12,7 @@
...
@@ -12,7 +12,7 @@
DuckDNS_API
=
"https://www.duckdns.org/update"
DuckDNS_API
=
"https://www.duckdns.org/update"
######## Public functions #####################
######## Public functions #####################
#
#Usage: dns_duckdns_add _acme-challenge.domain.duckdns.org "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
#Usage: dns_duckdns_add _acme-challenge.domain.duckdns.org "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_duckdns_add
()
{
dns_duckdns_add
()
{
...
@@ -112,7 +112,7 @@ _duckdns_rest() {
...
@@ -112,7 +112,7 @@ _duckdns_rest() {
param
=
"
$2
"
param
=
"
$2
"
_debug param
"
$param
"
_debug param
"
$param
"
url
=
"
$DuckDNS_API
?
$param
"
url
=
"
$DuckDNS_API
?
$param
"
if
[
"
$DEBUG
"
-gt
0
]
;
then
if
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-gt
0
]
;
then
url
=
"
$url
&verbose=true"
url
=
"
$url
&verbose=true"
fi
fi
_debug url
"
$url
"
_debug url
"
$url
"
...
@@ -121,7 +121,7 @@ _duckdns_rest() {
...
@@ -121,7 +121,7 @@ _duckdns_rest() {
if
[
"
$method
"
=
"GET"
]
;
then
if
[
"
$method
"
=
"GET"
]
;
then
response
=
"
$(
_get
"
$url
"
)
"
response
=
"
$(
_get
"
$url
"
)
"
_debug2 response
"
$response
"
_debug2 response
"
$response
"
if
[
"
$DEBUG
"
-gt
0
]
&&
_contains
"
$response
"
"UPDATED"
&&
_contains
"
$response
"
"OK"
;
then
if
[
-n
"
$DEBUG
"
]
&&
[
"
$DEBUG
"
-gt
0
]
&&
_contains
"
$response
"
"UPDATED"
&&
_contains
"
$response
"
"OK"
;
then
response
=
"OK"
response
=
"OK"
fi
fi
else
else
...
...
dnsapi/dns_pdns.sh
View file @
979e10f9
...
@@ -175,13 +175,13 @@ _get_root() {
...
@@ -175,13 +175,13 @@ _get_root() {
i
=
1
i
=
1
if
_pdns_rest
"GET"
"/api/v1/servers/
$PDNS_ServerId
/zones"
;
then
if
_pdns_rest
"GET"
"/api/v1/servers/
$PDNS_ServerId
/zones"
;
then
_zones_response
=
"
$response
"
_zones_response
=
$(
echo
"
$response
"
| _normalizeJson
)
fi
fi
while
true
;
do
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
if
_contains
"
$_zones_response
"
"
\"
name
\"
:
\"
$h
.
\"
"
;
then
if
_contains
"
$_zones_response
"
"
\"
name
\"
:
\"
$h
.
\"
"
;
then
_domain
=
"
$h
."
_domain
=
"
$h
."
if
[
-z
"
$h
"
]
;
then
if
[
-z
"
$h
"
]
;
then
_domain
=
"=2E"
_domain
=
"=2E"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment