Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
cb021efa
Unverified
Commit
cb021efa
authored
Jan 31, 2023
by
Roman Lumetsberger
Committed by
GitHub
Jan 31, 2023
Browse files
Merge branch 'acmesh-official:dev' into dev
parents
91e387e8
c2344f37
Changes
13
Expand all
Show whitespace changes
Inline
Side-by-side
.github/workflows/NetBSD.yml
View file @
cb021efa
...
...
@@ -61,7 +61,6 @@ jobs:
nat
:
|
"8080": "80"
prepare
:
|
export PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/$(uname -r|cut -f '1 2' -d.)/All/"
pkg_add curl socat
usesh
:
true
copyback
:
false
...
...
.github/workflows/Ubuntu.yml
View file @
cb021efa
...
...
@@ -80,9 +80,14 @@ jobs:
-p 9000:9000 \
-e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT=true" \
-e "DOCKER_STEPCA_INIT_PASSWORD=test" \
--name stepca \
smallstep/step-ca \
&& sleep 5 && docker exec stepca step ca provisioner add acme --type ACME \
smallstep/step-ca:0.23.1
sleep
5
docker exec stepca bash -c "echo test >test" \
&& docker exec stepca step ca provisioner add acme --type ACME --admin-subject step --admin-password-file=/home/step/test \
&& docker exec stepca kill -1 1 \
&& docker exec stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
- name
:
Clone acmetest
...
...
.github/workflows/dockerhub.yml
View file @
cb021efa
...
...
@@ -28,9 +28,9 @@ jobs:
id
:
step_one
run
:
|
if [ "$DOCKER_PASSWORD" ] ; then
echo "
::set-output name=
hasToken
::
true"
echo "hasToken
=
true"
>>$GITHUB_OUTPUT
else
echo "
::set-output name=
hasToken
::
false"
echo "hasToken
=
false"
>>$GITHUB_OUTPUT
fi
-
name
:
Check the value
run
:
echo ${{ steps.step_one.outputs.hasToken }}
...
...
@@ -43,9 +43,9 @@ jobs:
-
name
:
checkout code
uses
:
actions/checkout@v3
-
name
:
Set up QEMU
uses
:
docker/setup-qemu-action@v
1
uses
:
docker/setup-qemu-action@v
2
-
name
:
Set up Docker Buildx
uses
:
docker/setup-buildx-action@v
1
uses
:
docker/setup-buildx-action@v
2
-
name
:
login to docker hub
run
:
|
echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
...
...
Dockerfile
View file @
cb021efa
FROM
alpine:3.1
6.3
FROM
alpine:3.1
7
RUN
apk
--no-cache
add
-f
\
openssl
\
...
...
@@ -12,7 +12,8 @@ RUN apk --no-cache add -f \
oath-toolkit-oathtool
\
tar
\
libidn
\
jq
jq
\
cronie
ENV
LE_CONFIG_HOME /acme.sh
...
...
@@ -25,7 +26,7 @@ COPY ./ /install_acme.sh/
RUN
cd
/install_acme.sh
&&
([
-f
/install_acme.sh/acme.sh
]
&&
/install_acme.sh/acme.sh
--install
||
curl https://get.acme.sh | sh
)
&&
rm
-rf
/install_acme.sh/
RUN
ln
-s
/root/.acme.sh/acme.sh
/usr/local/bin/acme.sh
&&
crontab
-l
|
grep
acme.sh |
sed
's#> /dev/null##'
| crontab -
RUN
ln
-s
/root/.acme.sh/acme.sh /usr/local/bin/acme.sh
&&
crontab
-l
|
grep
acme.sh |
sed
's#> /dev/null#
> /proc/1/fd/1 2>/proc/1/fd/2
#'
| crontab -
RUN for
verb
in
help
\
version
\
...
...
@@ -64,12 +65,10 @@ RUN for verb in help \
RUN
printf
"%b"
'#!'
"/usr/bin/env sh
\n
\
if [
\"\$
1
\"
=
\"
daemon
\"
]; then
\n
\
trap
\"
echo stop && killall crond && exit 0
\"
SIGTERM SIGINT
\n
\
crond && sleep infinity &
\n
\
wait
\n
\
exec crond -n -s -m off
\n
\
else
\n
\
exec --
\"\$
@
\"\n
\
fi"
>
/entry.sh
&&
chmod
+x /entry.sh
fi
\n
"
>
/entry.sh
&&
chmod
+x /entry.sh
VOLUME
/acme.sh
...
...
acme.sh
View file @
cb021efa
...
...
@@ -1637,7 +1637,7 @@ _stat() {
#keyfile
_isRSA
()
{
keyfile
=
$1
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
|
grep
"^publicExponent:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
rsa
-in
"
$keyfile
"
-noout
-text
2>&1
|
grep
"^publicExponent:"
2>&1
>
/dev/null
;
then
return
0
fi
return
1
...
...
@@ -1646,7 +1646,7 @@ _isRSA() {
#keyfile
_isEcc
()
{
keyfile
=
$1
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
>
/dev/null
2>&1
;
then
if
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
||
${
ACME_OPENSSL_BIN
:-
openssl
}
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
2>&1
>
/dev/null
;
then
return
0
fi
return
1
...
...
@@ -1744,7 +1744,7 @@ _calcjwk() {
_debug3 x64
"
$x64
"
xend
=
$(
_math
"
$xend
"
+ 1
)
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
10000
)
"
y
=
"
$(
printf
"%s"
"
$pubtext
"
|
cut
-d
:
-f
"
$xend
"
-
2048
)
"
_debug3 y
"
$y
"
y64
=
"
$(
printf
"%s"
"
$y
"
|
tr
-d
: | _h2b | _base64 | _url_replace
)
"
...
...
@@ -1852,9 +1852,14 @@ _inithttp() {
_ACME_CURL
=
"
$_ACME_CURL
--cacert
$CA_BUNDLE
"
fi
if
_contains
"
$(
curl
--help
2>&1
)
"
"--globoff"
;
then
if
_contains
"
$(
curl
--help
2>&1
)
"
"--globoff"
||
_contains
"
$(
curl
--help
curl 2>&1
)
"
"--globoff"
;
then
_ACME_CURL
=
"
$_ACME_CURL
-g "
fi
#from curl 7.76: return fail on HTTP errors but keep the body
if
_contains
"
$(
curl
--help
http 2>&1
)
"
"--fail-with-body"
;
then
_ACME_CURL
=
"
$_ACME_CURL
--fail-with-body "
fi
fi
if
[
-z
"
$_ACME_WGET
"
]
&&
_exists
"wget"
;
then
...
...
@@ -1872,12 +1877,12 @@ _inithttp() {
elif
[
"
$CA_BUNDLE
"
]
;
then
_ACME_WGET
=
"
$_ACME_WGET
--ca-certificate=
$CA_BUNDLE
"
fi
fi
#from wget 1.14: do not skip body on 404 error
if
[
"
$_ACME_WGET
"
]
&&
_contains
"
$(
$_ACME_WGET
--help
2>&1
)
"
"--content-on-error"
;
then
if
_contains
"
$(
wget
--help
2>&1
)
"
"--content-on-error"
;
then
_ACME_WGET
=
"
$_ACME_WGET
--content-on-error "
fi
fi
__HTTP_INITIALIZED
=
1
...
...
@@ -2058,7 +2063,7 @@ _get() {
fi
_debug
"_WGET"
"
$_WGET
"
if
[
"
$onlyheader
"
]
;
then
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
_wget_out
=
"
$(
$_WGET
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
-S
-O
/dev/null
"
$url
"
2>&1
)
"
if
_contains
"
$_WGET
"
" -d "
;
then
# Demultiplex wget debug output
echo
"
$_wget_out
"
>
&2
...
...
@@ -2352,6 +2357,26 @@ _readdomainconf() {
_read_conf
"
$DOMAIN_CONF
"
"
$1
"
}
#_migratedomainconf oldkey newkey base64encode
_migratedomainconf
()
{
_old_key
=
"
$1
"
_new_key
=
"
$2
"
_b64encode
=
"
$3
"
_value
=
$(
_readdomainconf
"
$_old_key
"
)
if
[
-z
"
$_value
"
]
;
then
return
1
# oldkey is not found
fi
_savedomainconf
"
$_new_key
"
"
$_value
"
"
$_b64encode
"
_cleardomainconf
"
$_old_key
"
_debug
"Domain config
$_old_key
has been migrated to
$_new_key
"
}
#_migratedeployconf oldkey newkey base64encode
_migratedeployconf
()
{
_migratedomainconf
"
$1
"
"SAVED_
$2
"
"
$3
"
||
_migratedomainconf
"SAVED_
$1
"
"SAVED_
$2
"
"
$3
"
# try only when oldkey itself is not found
}
#key value base64encode
_savedeployconf
()
{
_savedomainconf
"SAVED_
$1
"
"
$2
"
"
$3
"
...
...
@@ -2366,12 +2391,14 @@ _getdeployconf() {
if
[
"
$_rac_value
"
]
;
then
if
_startswith
"
$_rac_value
"
'"'
&&
_endswith
"
$_rac_value
"
'"'
;
then
_debug2
"trim quotation marks"
eval
"export
$_rac_key
=
$_rac_value
"
eval
$_rac_key
=
$_rac_value
export
$_rac_key
fi
return
0
# do nothing
fi
_saved
=
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
eval
"export
$_rac_key
=
\"\$
_saved
\"
"
_saved
=
"
$(
_readdomainconf
"SAVED_
$_rac_key
"
)
"
eval
$_rac_key
=
"
$_saved
"
export
$_rac_key
}
#_saveaccountconf key value base64encode
...
...
@@ -2837,7 +2864,8 @@ _initpath() {
DOMAIN_PATH
=
"
$domainhomeecc
"
else
if
[
!
-d
"
$domainhome
"
]
&&
[
-d
"
$domainhomeecc
"
]
;
then
_info
"The domain '
$domain
' seems to have a ECC cert already, please add '
$(
__red
"--ecc"
)
' parameter if you want to use that cert."
_info
"The domain '
$domain
' seems to have a ECC cert already, lets use ecc cert."
DOMAIN_PATH
=
"
$domainhomeecc
"
fi
fi
_debug DOMAIN_PATH
"
$DOMAIN_PATH
"
...
...
@@ -3995,7 +4023,7 @@ _ns_purge_cf() {
#checks if cf server is available
_ns_is_available_cf
()
{
if
_get
"https://cloudflare-dns.com"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://cloudflare-dns.com"
""
1
0
>
/dev/null
;
then
return
0
else
return
1
...
...
@@ -4003,7 +4031,7 @@ _ns_is_available_cf() {
}
_ns_is_available_google
()
{
if
_get
"https://dns.google"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://dns.google"
""
1
0
>
/dev/null
;
then
return
0
else
return
1
...
...
@@ -4019,7 +4047,7 @@ _ns_lookup_google() {
}
_ns_is_available_ali
()
{
if
_get
"https://dns.alidns.com"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://dns.alidns.com"
""
1
0
>
/dev/null
;
then
return
0
else
return
1
...
...
@@ -4035,7 +4063,7 @@ _ns_lookup_ali() {
}
_ns_is_available_dp
()
{
if
_get
"https://doh.pub"
""
1
>
/dev/null
2>&1
;
then
if
_get
"https://doh.pub"
""
1
0
>
/dev/null
;
then
return
0
else
return
1
...
...
@@ -6707,6 +6735,13 @@ _send_notify() {
return
0
fi
_nsource
=
"
$NOTIFY_SOURCE
"
if
[
-z
"
$_nsource
"
]
;
then
_nsource
=
"
$(
hostname
)
"
fi
_nsubject
=
"
$_nsubject
by
$_nsource
"
_send_err
=
0
for
_n_hook
in
$(
echo
"
$_nhooks
"
|
tr
','
" "
)
;
do
_n_hook_file
=
"
$(
_findHook
""
$_SUB_FOLDER_NOTIFY
"
$_n_hook
"
)
"
...
...
@@ -6761,11 +6796,12 @@ setnotify() {
_nhook
=
"
$1
"
_nlevel
=
"
$2
"
_nmode
=
"
$3
"
_nsource
=
"
$4
"
_initpath
if
[
-z
"
$_nhook$_nlevel$_nmode
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]"
if
[
-z
"
$_nhook$_nlevel$_nmode
$_nsource
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]
[--notify-source <hostname>]
"
_usage
"
$_NOTIFY_WIKI
"
return
1
fi
...
...
@@ -6782,6 +6818,12 @@ setnotify() {
_saveaccountconf
"NOTIFY_MODE"
"
$NOTIFY_MODE
"
fi
if
[
"
$_nsource
"
]
;
then
_info
"Set notify source to:
$_nsource
"
export
"NOTIFY_SOURCE=
$_nsource
"
_saveaccountconf
"NOTIFY_SOURCE"
"
$NOTIFY_SOURCE
"
fi
if
[
"
$_nhook
"
]
;
then
_info
"Set notify hook to:
$_nhook
"
if
[
"
$_nhook
"
=
"
$NO_VALUE
"
]
;
then
...
...
@@ -6942,6 +6984,7 @@ Parameters:
0: Bulk mode. Send all the domain's notifications in one message(mail).
1: Cert mode. Send a message for every single cert.
--notify-hook <hookname> Set the notify hook
--notify-source <server name> Set the server name in the notification message
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
See:
$_REVOKE_WIKI
...
...
@@ -7099,7 +7142,9 @@ _selectServer() {
_getCAShortName
()
{
caurl
=
"
$1
"
if
[
-z
"
$caurl
"
]
;
then
caurl
=
"
$DEFAULT_CA
"
#use letsencrypt as default value if the Le_API is empty
#this case can only come from the old upgrading.
caurl
=
"
$CA_LETSENCRYPT_V2
"
fi
if
[
"
$CA_SSLCOM_ECC
"
=
"
$caurl
"
]
;
then
caurl
=
"
$CA_SSLCOM_RSA
"
#just hack to get the short name
...
...
@@ -7216,6 +7261,7 @@ _process() {
_notify_hook
=
""
_notify_level
=
""
_notify_mode
=
""
_notify_source
=
""
_revoke_reason
=
""
_eab_kid
=
""
_eab_hmac_key
=
""
...
...
@@ -7708,6 +7754,15 @@ _process() {
_notify_mode
=
"
$_nmode
"
shift
;;
--notify-source
)
_nsource
=
"
$2
"
if
_startswith
"
$_nsource
"
"-"
;
then
_err
"'
$_nsource
' is not valid host name for '
$1
'"
return
1
fi
_notify_source
=
"
$_nsource
"
shift
;;
--revoke-reason
)
_revoke_reason
=
"
$2
"
if
_startswith
"
$_revoke_reason
"
"-"
;
then
...
...
@@ -7862,7 +7917,7 @@ _process() {
createCSR
"
$_domain
"
"
$_altdomains
"
"
$_ecc
"
;;
setnotify
)
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
setnotify
"
$_notify_hook
"
"
$_notify_level
"
"
$_notify_mode
"
"
$_notify_source
"
;;
setdefaultca
)
setdefaultca
...
...
deploy/gcore_cdn.sh
View file @
cb021efa
#!/usr/bin/env sh
# Here is the script to deploy the cert to G-Core CDN service (https://gcore
labs
.com/
ru/
) using the G-Core Labs API (https://docs.gcore
labs
.com/cdn
/
).
# Here is the script to deploy the cert to G-Core CDN service (https://gcore.com/) using the G-Core Labs API (https://
api
docs.gcore.com/cdn).
# Returns 0 when success.
#
# Written by temoffey <temofffey@gmail.com>
# Public domain, 2019
# Update by DreamOfIce <admin@dreamofice.cn> in 2023
#export DEPLOY_GCORE_CDN_USERNAME=myusername
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
...
...
@@ -56,7 +57,7 @@ gcore_cdn_deploy() {
_request
=
"{
\"
username
\"
:
\"
$Le_Deploy_gcore_cdn_username
\"
,
\"
password
\"
:
\"
$Le_Deploy_gcore_cdn_password
\"
}"
_debug _request
"
$_request
"
export
_H1
=
"Content-Type:application/json"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn
.co/auth/jwt/login"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore
.co
m
/auth/jwt/login"
)
_debug _response
"
$_response
"
_regex
=
".*
\"
access
\"
:
\"\(
[-._0-9A-Za-z]*
\)\"
.*$"
_debug _regex
"
$_regex
"
...
...
@@ -69,8 +70,8 @@ gcore_cdn_deploy() {
fi
_info
"Find CDN resource with cname
$_cdomain
"
export
_H2
=
"Authorization:
Token
$_token
"
_response
=
$(
_get
"https://api.gc
dn.co
/resources"
)
export
_H2
=
"Authorization:
Bearer
$_token
"
_response
=
$(
_get
"https://api.gc
ore.com/cdn
/resources"
)
_debug _response
"
$_response
"
_regex
=
"
\"
primary_resource
\"
:null},"
_debug _regex
"
$_regex
"
...
...
@@ -102,7 +103,7 @@ gcore_cdn_deploy() {
_date
=
$(
date
"+%d.%m.%Y %H:%M:%S"
)
_request
=
"{
\"
name
\"
:
\"
$_cdomain
(
$_date
)
\"
,
\"
sslCertificate
\"
:
\"
$_fullchain
\"
,
\"
sslPrivateKey
\"
:
\"
$_key
\"
}"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/sslData"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/sslData"
)
_debug _response
"
$_response
"
_regex
=
".*
\"
id
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
...
...
@@ -117,7 +118,7 @@ gcore_cdn_deploy() {
_info
"Update CDN resource"
_request
=
"{
\"
originGroup
\"
:
$_originGroup
,
\"
sslData
\"
:
$_sslDataAdd
}"
_debug _request
"
$_request
"
_response
=
$(
_post
"
$_request
"
"https://api.gc
dn.co
/resources/
$_resourceId
"
''
"PUT"
)
_response
=
$(
_post
"
$_request
"
"https://api.gc
ore.com/cdn
/resources/
$_resourceId
"
''
"PUT"
)
_debug _response
"
$_response
"
_regex
=
".*
\"
sslData
\"
:
\(
[0-9]*
\)
.*$"
_debug _regex
"
$_regex
"
...
...
@@ -133,7 +134,7 @@ gcore_cdn_deploy() {
_info
"Not found old SSL certificate"
else
_info
"Delete old SSL certificate"
_response
=
$(
_post
''
"https://api.gc
dn.co
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_response
=
$(
_post
''
"https://api.gc
ore.com/cdn
/sslData/
$_sslDataOld
"
''
"DELETE"
)
_debug _response
"
$_response
"
fi
...
...
deploy/ssh.sh
View file @
cb021efa
This diff is collapsed.
Click to expand it.
deploy/truenas.sh
View file @
cb021efa
...
...
@@ -184,6 +184,27 @@ truenas_deploy() {
_info
"S3 certificate is not configured or is not the same as TrueNAS web UI"
fi
_info
"Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
if
_exists jq
;
then
_info
"Query all chart release"
_release_list
=
$(
_get
"
$_api_url
/chart/release"
)
_related_name_list
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
"[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==
$_active_cert_id
) | .name ] | unique"
)
_release_length
=
$(
printf
"%s"
"
$_related_name_list
"
| jq
-r
"length"
)
_info
"Found
$_release_length
related chart release in list:
$_related_name_list
"
for
i
in
$(
seq
0
$((
_release_length
-
1
))
)
;
do
_release_name
=
$(
echo
"
$_related_name_list
"
| jq
-r
".[
$i
]"
)
_info
"Updating certificate from
$_active_cert_id
to
$_cert_id
for chart release:
$_release_name
"
#Read the chart release configuration
_chart_config
=
$(
printf
"%s"
"
$_release_list
"
| jq
-r
".[] | select(.name==
\"
$_release_name
\"
)"
)
#Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
_updated_chart_config
=
$(
printf
"%s"
"
$_chart_config
"
| jq
"(.config.ingress?.main.tls[]? | select(.scaleCert==
$_active_cert_id
) | .scaleCert ) |=
$_cert_id
| .config.ingress "
)
_update_chart_result
=
"
$(
_post
"{
\"
values
\"
: {
\"
ingress
\"
:
$_updated_chart_config
} }"
"
$_api_url
/chart/release/id/
$_release_name
"
""
"PUT"
"application/json"
)
"
_debug3 _update_chart_result
"
$_update_chart_result
"
done
else
_info
"Tool 'jq' does not exists, skip chart release checking"
fi
_info
"Deleting old certificate"
_delete_result
=
"
$(
_post
""
"
$_api_url
/certificate/id/
$_active_cert_id
"
""
"DELETE"
"application/json"
)
"
...
...
deploy/vault.sh
View file @
cb021efa
...
...
@@ -7,6 +7,9 @@
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
# VAULT_KV_V2 - set to anything if you are using v2 of the kv engine
#
# additionally, you need to ensure that VAULT_TOKEN is avialable
# to access the vault server
...
...
@@ -45,6 +48,26 @@ vault_deploy() {
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_KV_V2
_savedeployconf VAULT_KV_V2
"
$VAULT_KV_V2
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
# JSON does not allow multiline strings.
# So replacing new-lines with "\n" here
_ckey
=
$(
sed
-z
's/\n/\\n/g'
<
"
$2
"
)
...
...
@@ -52,26 +75,56 @@ vault_deploy() {
_cca
=
$(
sed
-z
's/\n/\\n/g'
<
"
$4
"
)
_cfullchain
=
$(
sed
-z
's/\n/\\n/g'
<
"
$5
"
)
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
export
_H1
=
"X-Vault-Token:
$VAULT_TOKEN
"
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
URL
=
"
$VAULT_ADDR
/v1/auth/token/renew-self"
_info
"Renew the Vault token to default TTL"
if
!
_post
""
"
$URL
"
>
/dev/null
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
URL
=
"
$VAULT_ADDR
/v1/
$VAULT_PREFIX
/
$_cdomain
"
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
$URL
in Fabio mode"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
_post
"{
\"
data
\"
: {
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
} }"
"
$URL
"
>
/dev/null
||
return
1
else
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
_post
"{
\"
cert
\"
:
\"
$_cfullchain
\"
,
\"
key
\"
:
\"
$_ckey
\"
}"
"
$URL
"
>
/dev/null
||
return
1
fi
else
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ccert
\"
}}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_ckey
\"
}}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cfullchain
\"
}}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
else
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
_info
"Writing certificate to
$URL
/cert.pem"
_post
"{
\"
value
\"
:
\"
$_ccert
\"
}"
"
$URL
/cert.pem"
>
/dev/null
||
return
1
_info
"Writing key to
$URL
/cert.key"
_post
"{
\"
value
\"
:
\"
$_ckey
\"
}"
"
$URL
/cert.key"
>
/dev/null
||
return
1
_info
"Writing CA certificate to
$URL
/ca.pem"
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/ca.pem"
>
/dev/null
||
return
1
_info
"Writing full-chain certificate to
$URL
/fullchain.pem"
_post
"{
\"
value
\"
:
\"
$_cfullchain
\"
}"
"
$URL
/fullchain.pem"
>
/dev/null
||
return
1
fi
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
_contains
"
$(
_get
"
$URL
/chain.pem"
)
"
"-----BEGIN CERTIFICATE-----"
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
$URL
/chain.pem for backward compatibility"
if
[
-n
"
$VAULT_KV_V2
"
]
;
then
_post
"{
\"
data
\"
: {
\"
value
\"
:
\"
$_cca
\"
}}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
else
_post
"{
\"
value
\"
:
\"
$_cca
\"
}"
"
$URL
/chain.pem"
>
/dev/null
||
return
1
fi
fi
fi
...
...
deploy/vault_cli.sh
View file @
cb021efa
...
...
@@ -8,6 +8,8 @@
#
# VAULT_PREFIX - this contains the prefix path in vault
# VAULT_ADDR - vault requires this to find your vault server
# VAULT_SAVE_TOKEN - set to anything if you want to save the token
# VAULT_RENEW_TOKEN - set to anything if you want to renew the token to default TTL before deploying
#
# additionally, you need to ensure that VAULT_TOKEN is avialable or
# `vault auth` has applied the appropriate authorization for the vault binary
...
...
@@ -33,15 +35,36 @@ vault_cli_deploy() {
_debug _cfullchain
"
$_cfullchain
"
# validate required env vars
_getdeployconf VAULT_PREFIX
if
[
-z
"
$VAULT_PREFIX
"
]
;
then
_err
"VAULT_PREFIX needs to be defined (contains prefix path in vault)"
return
1
fi
_savedeployconf VAULT_PREFIX
"
$VAULT_PREFIX
"
_getdeployconf VAULT_ADDR
if
[
-z
"
$VAULT_ADDR
"
]
;
then
_err
"VAULT_ADDR needs to be defined (contains vault connection address)"
return
1
fi
_savedeployconf VAULT_ADDR
"
$VAULT_ADDR
"
_getdeployconf VAULT_SAVE_TOKEN
_savedeployconf VAULT_SAVE_TOKEN
"
$VAULT_SAVE_TOKEN
"
_getdeployconf VAULT_RENEW_TOKEN
_savedeployconf VAULT_RENEW_TOKEN
"
$VAULT_RENEW_TOKEN
"
_getdeployconf VAULT_TOKEN
if
[
-z
"
$VAULT_TOKEN
"
]
;
then
_err
"VAULT_TOKEN needs to be defined"
return
1
fi
if
[
-n
"
$VAULT_SAVE_TOKEN
"
]
;
then
_savedeployconf VAULT_TOKEN
"
$VAULT_TOKEN
"
fi
_migratedeployconf FABIO VAULT_FABIO_MODE
VAULT_CMD
=
$(
command
-v
vault
)
if
[
!
$?
]
;
then
...
...
@@ -49,13 +72,33 @@ vault_cli_deploy() {
return
1
fi
if
[
-n
"
$FABIO
"
]
;
then
if
[
-n
"
$VAULT_RENEW_TOKEN
"
]
;
then
_info
"Renew the Vault token to default TTL"
if
!
$VAULT_CMD
token renew
;
then
_err
"Failed to renew the Vault token"
return
1
fi
fi
if
[
-n
"
$VAULT_FABIO_MODE
"
]
;
then
_info
"Writing certificate and key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
in Fabio mode"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
"
cert
=
@
"
$_cfullchain
"
key
=
@
"
$_ckey
"
||
return
1
else
_info
"Writing certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.pem"
value
=
@
"
$_ccert
"
||
return
1
_info
"Writing key to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/cert.key"
value
=
@
"
$_ckey
"
||
return
1
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/ca.pem"
value
=
@
"
$_cca
"
||
return
1
_info
"Writing full-chain certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/fullchain.pem"
value
=
@
"
$_cfullchain
"
||
return
1
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
if
$VAULT_CMD
kv get
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
>
/dev/null
;
then
_err
"The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
_info
"Updating CA certificate to
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem for backward compatibility"
$VAULT_CMD
kv put
"
${
VAULT_PREFIX
}
/
${
_cdomain
}
/chain.pem"
value
=
@
"
$_cca
"
||
return
1
fi
fi
}
dnsapi/dns_gcore.sh
0 → 100755
View file @
cb021efa
#!/usr/bin/env sh
#
#GCORE_Key='773$7b7adaf2a2b32bfb1b83787b4ff32a67eb178e3ada1af733e47b1411f2461f7f4fa7ed7138e2772a46124377bad7384b3bb8d87748f87b3f23db4b8bbe41b2bb'
#
GCORE_Api
=
"https://api.gcorelabs.com/dns/v2"
GCORE_Doc
=
"https://apidocs.gcore.com/dns"
######## Public functions #####################
#Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_gcore_add
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
if
[
-z
"
$GCORE_Key
"
]
;
then
GCORE_Key
=
""
_err
"You didn't specify a Gcore api key yet."
_err
"You can get yours from here
$GCORE_Doc
"
return
1
fi
#save the api key to the account conf file.
_saveaccountconf_mutable GCORE_Key
"
$GCORE_Key
"
_debug
"First detect the zone name"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
payload
=
""
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"Record doesn't exists"
payload
=
"{
\"
resource_records
\"
:[{
\"
content
\"
:[
\"
$txtvalue
\"
],
\"
enabled
\"
:true}],
\"
ttl
\"
:120}"
elif
echo
"
$response
"
|
grep
"
$txtvalue
"
>
/dev/null
;
then
_info
"Already exists, OK"
return
0
elif
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_info
"Record with mismatch txtvalue, try update it"
payload
=
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/"meta":{}}]}/"meta":{}},{"content":['
\"
"
$txtvalue
"
\"
'],"enabled":true}]}/'
)
fi
# For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
# we can not use updating anymore.
# count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
# _debug count "$count"
# if [ "$count" = "0" ]; then
_info
"Adding record"
if
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Added, OK"
return
0
elif
_contains
"
$response
"
"rrset is already exists"
;
then
_info
"Already exists, OK"
return
0
else
_err
"Add txt record error."
return
1
fi
fi
_err
"Add txt record error."
return
1
}
#fulldomain txtvalue
dns_gcore_rm
()
{
fulldomain
=
$1
txtvalue
=
$2
GCORE_Key
=
"
${
GCORE_Key
:-
$(
_readaccountconf_mutable GCORE_Key
)
}
"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
return
1
fi
_debug _zone_name
"
$_zone_name
"
_debug _sub_domain
"
$_sub_domain
"
_debug _domain
"
$_domain
"
_debug
"Getting txt records"
_gcore_rest GET
"zones/
$_zone_name
/
$fulldomain
/TXT"
if
echo
"
$response
"
|
grep
"record is not found"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
name
\"
:
\"
"
$fulldomain
"
\"
,
\"
type
\"
:
\"
TXT
\"
>
/dev/null
;
then
_err
"Error:
$response
"
return
1
fi
if
!
echo
"
$response
"
|
tr
-d
" "
|
grep
\"
"
$txtvalue
"
\"
>
/dev/null
;
then
_info
"No such txt recrod"
return
0
fi
count
=
"
$(
echo
"
$response
"
|
grep
-o
"content"
|
wc
-l
)
"
if
[
"
$count
"
=
"1"
]
;
then
if
!
_gcore_rest DELETE
"zones/
$_zone_name
/
$fulldomain
/TXT"
;
then
_err
"Delete record error.
$response
"
return
1
fi
return
0
fi
payload
=
"
$(
echo
"
$response
"
|
tr
-d
" "
|
sed
's/"updated_at":[0-9]\+,//g'
|
sed
's/{"id":[0-9]\+,"content":\["'
"
$txtvalue
"
'"\],"enabled":true,"meta":{}}//'
|
sed
's/\[,/\[/'
|
sed
's/,,/,/'
|
sed
's/,\]/\]/'
)
"
if
!
_gcore_rest PUT
"zones/
$_zone_name
/
$fulldomain
/TXT"
"
$payload
"
;
then
_err
"Delete record error.
$response
"
fi
}
#################### Private functions below ##################################
#_acme-challenge.sub.domain.com
#returns
# _sub_domain=_acme-challenge.sub or _acme-challenge
# _domain=domain.com
# _zone_name=domain.com or sub.domain.com
_get_root
()
{
domain
=
$1
i
=
1
p
=
1
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
if
[
-z
"
$h
"
]
;
then
#not valid
return
1
fi
if
!
_gcore_rest GET
"zones/
$h
"
;
then
return
1
fi
if
_contains
"
$response
"
"
\"
name
\"
:
\"
$h
\"
"
;
then
_zone_name
=
$h
if
[
"
$_zone_name
"
]
;
then
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
1-
$p
)
_domain
=
$h
return
0
fi
return
1
fi
p
=
$i
i
=
$(
_math
"
$i
"
+ 1
)
done
return
1
}
_gcore_rest
()
{
m
=
$1
ep
=
"
$2
"
data
=
"
$3
"
_debug
"
$ep
"
key_trimmed
=
$(
echo
"
$GCORE_Key
"
|
tr
-d
'"'
)
export
_H1
=
"Content-Type: application/json"
export
_H2
=
"Authorization: APIKey
$key_trimmed
"
if
[
"
$m
"
!=
"GET"
]
;
then
_debug data
"
$data
"
response
=
"
$(
_post
"
$data
"
"
$GCORE_Api
/
$ep
"
""
"
$m
"
)
"
else
response
=
"
$(
_get
"
$GCORE_Api
/
$ep
"
)
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
_err
"error
$ep
"
return
1
fi
_debug2 response
"
$response
"
return
0
}
dnsapi/dns_gd.sh
View file @
cb021efa
...
...
@@ -22,8 +22,8 @@ dns_gd_add() {
if
[
-z
"
$GD_Key
"
]
||
[
-z
"
$GD_Secret
"
]
;
then
GD_Key
=
""
GD_Secret
=
""
_err
"You d
o
n't specify godaddy api key and secret yet."
_err
"Please create you key and try again."
_err
"You d
id
n't specify godaddy api key and secret yet."
_err
"Please create you
r
key and try again."
return
1
fi
...
...
@@ -46,7 +46,7 @@ dns_gd_add() {
fi
if
_contains
"
$response
"
"
$txtvalue
"
;
then
_info
"Th
e
record
is
exist
ing
, skip"
_info
"Th
is
record
already
exist
s
, skip
ping
"
return
0
fi
...
...
dnsapi/dns_openstack.sh
View file @
cb021efa
...
...
@@ -57,16 +57,16 @@ _dns_openstack_create_recordset() {
if
[
-z
"
$_recordset_id
"
]
;
then
_info
"Creating a new recordset"
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
if
!
_recordset_id
=
$(
openstack recordset create
-c
id
-f
value
--type
TXT
--record
=
"
$txtvalue
"
"
$_zone_id
"
"
$fulldomain
."
)
;
then
_err
"No recordset ID found after create"
return
1
fi
else
_info
"Updating existing recordset"
# Build new list of --record
<rec> args for update
_record_args
=
"--record
$txtvalue
"
# Build new list of --record
=
<rec> args for update
_record_args
=
"--record
=
$txtvalue
"
for
_rec
in
$_records
;
do
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
# shellcheck disable=SC2086
if
!
_recordset_id
=
$(
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
)
;
then
...
...
@@ -107,13 +107,13 @@ _dns_openstack_delete_recordset() {
fi
else
_info
"Found existing records, updating recordset"
# Build new list of --record
<rec> args for update
# Build new list of --record
=
<rec> args for update
_record_args
=
""
for
_rec
in
$_records
;
do
if
[
"
$_rec
"
=
"
$txtvalue
"
]
;
then
continue
fi
_record_args
=
"
$_record_args
--record
$_rec
"
_record_args
=
"
$_record_args
--record
=
$_rec
"
done
# shellcheck disable=SC2086
if
!
openstack recordset
set
-c
id
-f
value
$_record_args
"
$_zone_id
"
"
$fulldomain
."
>
/dev/null
;
then
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment