1. 26 May, 2021 2 commits
    • Brian Hartvigsen's avatar
      shellcheck cleanup · dcb51683
      Brian Hartvigsen authored
      shellcheck sees '\\' as trying to escape the trailing quote (see
      koalaman/shellcheck#1548 ).
      dcb51683
    • Brian Hartvigsen's avatar
      Make certificate descriptions sed safe · 74a4a788
      Brian Hartvigsen authored
      This escapes special characters used in POSIX sed to prevent mismatches.
      e.g. `SYNO_Certficiate=*.example.com` would not match a description of
      "*.example.com" and would look to match any number of double quotes (the
      last character in the sed regex prior to certificate description),
      followed by any single character, followed by "example", followed by any
      character, followed by "com".
      
      After this change, it will properly match `*.example.com` and not
      `""zexamplefcom`.
      
      Additionally we now store the certificate description as base64 encoded
      to prevent issues with single quotes.
      
      Tested on DSM 7.0-41222 (VDSM) and DSM 6.2.4-25556 (DS1515+).
      74a4a788
  2. 19 May, 2021 1 commit
  3. 02 May, 2021 1 commit
    • Brian Hartvigsen's avatar
      FIX: Synology sets "default" on wrong certificate · 1a4a180e
      Brian Hartvigsen authored
      For some DSM installs, it appears that setting the "default" flag to the
      string "false" actually sets it to true.  This causes Synology to set
      the last updated certificate to be the default certificate.  Using an
      empty string appears to still be accepted as a false-y value for DSMs
      where this isn't happening and corrects the behavior in the cases that
      it was.
      
      Credit to @Run-King for identifying the fix and @buxm for reporting.
      1a4a180e
  4. 30 Mar, 2021 2 commits
  5. 29 Mar, 2021 1 commit
    • Christophe Le Guern's avatar
      Use 'vault kv put' instead of 'vault write' · cc90f834
      Christophe Le Guern authored
      When using vault_cli with a kv2 path, it isn't working. I have the following error:
      ```
      WARNING! The following warnings were returned from Vault:                                                                                                                                                                                     
                                                                                                                                                                                                                                                    
        * Invalid path for a versioned K/V secrets engine. See the API docs for the                                                                                                                                                                 
        appropriate API endpoints to use. If using the Vault CLI, use 'vault kv put'                                                                                                                                                                
        for this operation.                                                                                                                                                                                                                         
      ```
      The new way to write data  is to use `vault kv put`, it is compatible with kv1 and kv2.
      Ref: https://www.vaultproject.io/docs/commands#reading-and-writing-data
      ```
      The original version of K/V used the common read and write operations. A more advanced K/V Version 2 engine was released in Vault 0.10 and introduced the kv get and kv put commands.
      ```
      cc90f834
  6. 26 Mar, 2021 1 commit
  7. 21 Mar, 2021 2 commits
    • Mike Edmunds's avatar
      Fix: Unifi deploy hook support Unifi Cloud Key (#3327) · 06fb3d94
      Mike Edmunds authored
      * fix: unifi deploy hook also update Cloud Key nginx certs
      
      When running on a Unifi Cloud Key device, also deploy to
      /etc/ssl/private/cloudkey.{crt,key} and reload nginx. This
      makes the new cert available for the Cloud Key management
      app running via nginx on port 443 (as well as the port 8443
      Unifi Controller app the deploy hook already supported).
      
      Fixes #3326
      
      * Improve settings documentation comments
      
      * Improve Cloud Key pre-flight error messaging
      
      * Fix typo
      
      * Add support for UnifiOS (Cloud Key Gen2)
      
      Since UnifiOS does not use the Java keystore (like a Unifi
      Controller or Cloud Key Gen1 deploy), this also reworks
      the settings validation and error messaging somewhat.
      
      * PR review fixes
      
      * Detect unsupported Cloud Key java keystore location
      
      * Don't try to restart inactive services
      
      (and remove extra spaces from reload command)
      
      * Clean up error messages and internal variables
      
      * Change to _getdeployconf/_savedeployconf
      
      * Switch from cp to cat to preserve file permissions
      06fb3d94
    • Alexander Kulumbeg's avatar
      Revert "Syncing with the original repo (#2)" · 8de3698b
      Alexander Kulumbeg authored
      This reverts commit c384ed96.
      8de3698b
  8. 20 Mar, 2021 1 commit
    • Alexander Kulumbeg's avatar
      Syncing with the original repo (#2) · c384ed96
      Alexander Kulumbeg authored
      * change arvan api script
      
      * change Author name
      
      * change name actor
      
      * Updated --preferred-chain to issue ISRG properly
      
      To support different openssl crl2pkcs7 help cli format
      
      * dnsapi/pdns: also normalize json response in detecting root zone
      
      * Chain (#3408)
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3384
      match the issuer to the root CA cert subject
      
      * fix format
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3384
      
      * remove the alt files. https://github.com/acmesh-official/acme.sh/issues/3384
      
      * upgrade freebsd and solaris
      
      * duckdns - fix "integer expression expected" errors (#3397)
      
      * fix "integer expression expected" errors
      
      * duckdns fix
      
      * Update dns_duckdns.sh
      
      * Update dns_duckdns.sh
      
      * Implement smtp notify hook
      
      Support notifications via direct SMTP server connection.
      Uses Python (2.7.x or 3.4+) to communicate with SMTP server.
      
      * Make shfmt happy
      
      (I'm open to better ways of formatting the heredoc
      that embeds the Python script.)
      
      * Only save config if send is successful
      
      * Add instructions for reporting bugs
      
      * Prep for curl or Python; clean up SMTP_* variable usage
      
      * Implement curl version of smtp notify-hook
      
      * More than one blank line is an abomination, apparently
      
      I will not try to use whitespace to group code visually
      
      * Fix: Unifi deploy hook support Unifi Cloud Key (#3327)
      
      * fix: unifi deploy hook also update Cloud Key nginx certs
      
      When running on a Unifi Cloud Key device, also deploy to
      /etc/ssl/private/cloudkey.{crt,key} and reload nginx. This
      makes the new cert available for the Cloud Key management
      app running via nginx on port 443 (as well as the port 8443
      Unifi Controller app the deploy hook already supported).
      
      Fixes #3326
      
      * Improve settings documentation comments
      
      * Improve Cloud Key pre-flight error messaging
      
      * Fix typo
      
      * Add support for UnifiOS (Cloud Key Gen2)
      
      Since UnifiOS does not use the Java keystore (like a Unifi
      Controller or Cloud Key Gen1 deploy), this also reworks
      the settings validation and error messaging somewhat.
      
      * PR review fixes
      
      * Detect unsupported Cloud Key java keystore location
      
      * Don't try to restart inactive services
      
      (and remove extra spaces from reload command)
      
      * Clean up error messages and internal variables
      
      * Change to _getdeployconf/_savedeployconf
      
      * Switch from cp to cat to preserve file permissions
      
      * feat: add huaweicloud error handling
      
      * fix: fix freebsd and solaris
      
      * support openssl 3.0
      fix https://github.com/acmesh-official/acme.sh/issues/3399
      
      * make the fix for rsa key only
      
      * Use PROJECT_NAME and VER for X-Mailer header
      
      Also add X-Mailer header to Python version
      
      * Add _clearaccountconf_mutable()
      
      * Rework read/save config to not save default values
      
      Add and use _readaccountconf_mutable_default and
      _saveaccountconf_mutable_default helpers to capture
      common default value handling.
      
      New approach also eliminates need for separate
      underscore-prefixed version of each conf var.
      
      * Implement _rfc2822_date helper
      
      * Clean email headers and warn on unsupported address format
      
      Just in case, make sure CR or NL don't end up in
      an email header.
      
      * Clarify _readaccountconf_mutable_default
      
      * Add Date email header in Python implementation
      
      * Use email.policy.default in Python 3 implementation
      
      Improves standards compatibility and utf-8 handling
      in Python 3.3-3.8. (email.policy.default becomes the
      default in Python 3.9.)
      
      * Prefer Python to curl when both available
      
      * Change default SMTP_SECURE to "tls"
      
      Secure by default. Also try to minimize configuration errors.
      (Many ESPs/ISPs require STARTTLS, and most support it.)
      
      * Update dns_dp.sh
      
      没有encode中文字符会导致提交失败
      
      * No need to include EC parameters explicitly with the private key.
      (they are embedded)
      
      * Fixes response handling and thereby allow issuing of subdomain certs
      
      * Adds comment
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3402
      
      * dnsapi/ionos: Use POST instead of PATCH for adding TXT record
      
      The API now supports a POST route for adding records. Therefore
      checking for already existing records and including them in a PATCH
      request is no longer necessary.
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3433
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3019
      
      * fix format
      
      * Update dns_servercow.sh to support wildcard certs
      
      Updated dns_servercow.sh to support txt records with multiple entries. This supports wildcard certificates that require txt records with the same name and different contents.
      
      * Update dns_servercow.sh to support wildcard certs
      
      Updated dns_servercow.sh to support txt records with multiple entries. This supports wildcard certificates that require txt records with the same name and different contents.
      
      * fix https://github.com/acmesh-official/acme.sh/issues/3312
      
      
      
      * fix format
      
      * feat: add dns_porkbun
      
      * fix: prevent rate limit
      Co-authored-by: default avatarVahid Fardi <vahid.fardi@snapp.cab>
      Co-authored-by: default avatarneil <github@neilpang.com>
      Co-authored-by: default avatarGnought <1684105+gnought@users.noreply.github.com>
      Co-authored-by: default avatarmanuel <manuel@mausz.at>
      Co-authored-by: default avatarjerrm <jerrm@users.noreply.github.com>
      Co-authored-by: default avatarmedmunds <medmunds@gmail.com>
      Co-authored-by: default avatarMike Edmunds <github@to.mikeedmunds.com>
      Co-authored-by: default avatarEaston Man <manyang.me@outlook.com>
      Co-authored-by: default avatarczeming <loser_wind@163.com>
      Co-authored-by: default avatarGeert Hendrickx <geert@hendrickx.be>
      Co-authored-by: default avatarKristian Johansson <kristian.johansson86@gmail.com>
      Co-authored-by: default avatarLukas Brocke <lukas@brocke.net>
      Co-authored-by: default avataranom-human <80478363+anom-human@users.noreply.github.com>
      Co-authored-by: default avatarneil <win10@neilpang.com>
      Co-authored-by: default avatarQuentin Dreyer <quentin.dreyer@rgsystem.com>
      c384ed96
  9. 15 Feb, 2021 1 commit
    • Mike Edmunds's avatar
      Fix: Unifi deploy hook support Unifi Cloud Key (#3327) · bf8c3370
      Mike Edmunds authored
      * fix: unifi deploy hook also update Cloud Key nginx certs
      
      When running on a Unifi Cloud Key device, also deploy to
      /etc/ssl/private/cloudkey.{crt,key} and reload nginx. This
      makes the new cert available for the Cloud Key management
      app running via nginx on port 443 (as well as the port 8443
      Unifi Controller app the deploy hook already supported).
      
      Fixes #3326
      
      * Improve settings documentation comments
      
      * Improve Cloud Key pre-flight error messaging
      
      * Fix typo
      
      * Add support for UnifiOS (Cloud Key Gen2)
      
      Since UnifiOS does not use the Java keystore (like a Unifi
      Controller or Cloud Key Gen1 deploy), this also reworks
      the settings validation and error messaging somewhat.
      
      * PR review fixes
      
      * Detect unsupported Cloud Key java keystore location
      
      * Don't try to restart inactive services
      
      (and remove extra spaces from reload command)
      
      * Clean up error messages and internal variables
      
      * Change to _getdeployconf/_savedeployconf
      
      * Switch from cp to cat to preserve file permissions
      bf8c3370
  10. 13 Jan, 2021 1 commit
  11. 10 Jan, 2021 3 commits
  12. 10 Dec, 2020 5 commits
    • neil's avatar
      15fb47cb
    • Brian Hartvigsen's avatar
      Shellcheck linting · 2635dfef
      Brian Hartvigsen authored
      Also removed unused code
      2635dfef
    • Brian Hartvigsen's avatar
      Support DSM 6 and 7 · 7d7789ae
      Brian Hartvigsen authored
      Small changes for DSM 6:
      
      All fields (except enable_syno_token as explained below) must either be in the GET params or the POST params, you can't mix GET and POST params
      enable_syno_token=yes must be in both the GET and POST params.
      If enable_syno_token=yes is only in the POST fields, then DSM6 returns a synotoken of --------. If enable_syno_token=yes is only in the GET params, then it returns no synotoken at all. It must be in both to work.
      Need to use /webapi/auth.cgi instead of /webapi/entry.cgi
      Verified with DSM 6.2.3-25426 Update 2 and DSM 7.0-40850
      7d7789ae
    • Thijn's avatar
      Fix synology_dsm deployhook for DSM 7 · cc692854
      Thijn authored
      cc692854
    • Brian Hartvigsen's avatar
      Use POST for login · 99d3a283
      Brian Hartvigsen authored
      This allows us to get the cookie and the token (as it appears to be only in the body in DSM 7.)  HTTP_HEADERS is only guarenteed to be output with POST for both wget and curl.
      99d3a283
  13. 07 Dec, 2020 3 commits
    • neil's avatar
      fix · 8440d013
      neil authored
      8440d013
    • neil's avatar
      fix · 174c87a1
      neil authored
      174c87a1
    • neil's avatar
      fix · 32b62d6d
      neil authored
      32b62d6d
  14. 01 Dec, 2020 1 commit
    • Christian Burmeister's avatar
      Update mailcow.sh · 2bc62797
      Christian Burmeister authored
      I have modified the following things:
      
          Originally, "/data/assets/ssl/" is always appended to the varialbe ${_mailcow_path}. Since I use acme.sh as docker container, I only want to include the mailcow-ssl directory in the acem.sh container and not the complete mailcow directory. So now it is checked if the file generate_config.sh is in the directory (then it is the mailcow root directory, see https://github.com/mailcow/mailcow-dockerized) and only then "/data/assets/ssl/" is appended, in all other cases the passed variable is taken over unchanged.
      
          Because of the RP mailcow/mailcow-dockerized#2443 I have extended the script with ECC certificates.
      
          I adapted the reboot commands as described in the mailcow manual (https://mailcow.github.io/mailcow-dockerized-docs/firststeps-ssl/#how-to-use-your-own-certificate).
      2bc62797
  15. 28 Nov, 2020 1 commit
  16. 09 Nov, 2020 1 commit
  17. 02 Nov, 2020 2 commits
  18. 28 Oct, 2020 1 commit
  19. 01 Oct, 2020 1 commit
  20. 28 Aug, 2020 3 commits
  21. 23 Aug, 2020 1 commit
  22. 18 Aug, 2020 1 commit
  23. 17 Aug, 2020 1 commit
  24. 26 Jul, 2020 1 commit
  25. 16 Jul, 2020 2 commits