mirror of
https://github.com/plantroon/acme.sh.git
synced 2024-11-10 00:11:45 +00:00
neil
GitHub
commit
13255a3762
85
README.md
85
README.md
@ -290,90 +290,9 @@ If your DNS provider supports API access, we can use that API to automatically i
|
|||||||
|
|
||||||
You don't have to do anything manually!
|
You don't have to do anything manually!
|
||||||
|
|
||||||
### Currently acme.sh supports:
|
### Currently acme.sh supports most of the dns providers:
|
||||||
|
|
||||||
1. CloudFlare.com API
|
https://github.com/Neilpang/acme.sh/wiki/dnsapi
|
||||||
1. DNSPod.cn API
|
|
||||||
1. CloudXNS.com API
|
|
||||||
1. GoDaddy.com API
|
|
||||||
1. PowerDNS.com API
|
|
||||||
1. OVH, kimsufi, soyoustart and runabove API
|
|
||||||
1. nsupdate API
|
|
||||||
1. LuaDNS.com API
|
|
||||||
1. DNSMadeEasy.com API
|
|
||||||
1. AWS Route 53
|
|
||||||
1. aliyun.com(阿里云) API
|
|
||||||
1. ISPConfig 3.1 API
|
|
||||||
1. Alwaysdata.com API
|
|
||||||
1. Linode.com API
|
|
||||||
1. FreeDNS (https://freedns.afraid.org/)
|
|
||||||
1. cyon.ch
|
|
||||||
1. Domain-Offensive/Resellerinterface/Domainrobot API
|
|
||||||
1. Gandi LiveDNS API
|
|
||||||
1. Knot DNS API
|
|
||||||
1. DigitalOcean API (native)
|
|
||||||
1. ClouDNS.net API
|
|
||||||
1. Infoblox NIOS API (https://www.infoblox.com/)
|
|
||||||
1. VSCALE (https://vscale.io/)
|
|
||||||
1. Dynu API (https://www.dynu.com)
|
|
||||||
1. DNSimple API
|
|
||||||
1. NS1.com API
|
|
||||||
1. DuckDNS.org API
|
|
||||||
1. Name.com API
|
|
||||||
1. Dyn Managed DNS API
|
|
||||||
1. Yandex PDD API (https://pdd.yandex.ru)
|
|
||||||
1. Hurricane Electric DNS service (https://dns.he.net)
|
|
||||||
1. UnoEuro API (https://www.unoeuro.com/)
|
|
||||||
1. INWX (https://www.inwx.de/)
|
|
||||||
1. Servercow (https://servercow.de)
|
|
||||||
1. Namesilo (https://www.namesilo.com)
|
|
||||||
1. InternetX autoDNS API (https://internetx.com)
|
|
||||||
1. Azure DNS
|
|
||||||
1. selectel.com(selectel.ru) DNS API
|
|
||||||
1. zonomi.com DNS API
|
|
||||||
1. DreamHost.com API
|
|
||||||
1. DirectAdmin API
|
|
||||||
1. KingHost (https://www.kinghost.com.br/)
|
|
||||||
1. Zilore (https://zilore.com)
|
|
||||||
1. Loopia.se API
|
|
||||||
1. acme-dns (https://github.com/joohoi/acme-dns)
|
|
||||||
1. TELE3 (https://www.tele3.cz)
|
|
||||||
1. EUSERV.EU (https://www.euserv.eu)
|
|
||||||
1. DNSPod.com API (https://www.dnspod.com)
|
|
||||||
1. Google Cloud DNS API
|
|
||||||
1. ConoHa (https://www.conoha.jp)
|
|
||||||
1. netcup DNS API (https://www.netcup.de)
|
|
||||||
1. GratisDNS.dk (https://gratisdns.dk)
|
|
||||||
1. Namecheap API (https://www.namecheap.com/)
|
|
||||||
1. MyDNS.JP API (https://www.mydns.jp/)
|
|
||||||
1. hosting.de (https://www.hosting.de)
|
|
||||||
1. Neodigit.net API (https://www.neodigit.net)
|
|
||||||
1. Exoscale.com API (https://www.exoscale.com/)
|
|
||||||
1. PointDNS API (https://pointhq.com/)
|
|
||||||
1. Active24.cz API (https://www.active24.cz/)
|
|
||||||
1. do.de API (https://www.do.de/)
|
|
||||||
1. Nexcess API (https://www.nexcess.net)
|
|
||||||
1. Thermo.io API (https://www.thermo.io)
|
|
||||||
1. Futurehosting API (https://www.futurehosting.com)
|
|
||||||
1. Rackspace Cloud DNS (https://www.rackspace.com)
|
|
||||||
1. Online.net API (https://online.net/)
|
|
||||||
1. MyDevil.net (https://www.mydevil.net/)
|
|
||||||
1. Core-Networks.de (https://core-networks.de)
|
|
||||||
1. NederHost API (https://www.nederhost.nl/)
|
|
||||||
1. Zone.ee (zone.eu) API (https://api.zone.eu/v2)
|
|
||||||
1. UltraDNS API (https://portal.ultradns.com)
|
|
||||||
|
|
||||||
And:
|
|
||||||
|
|
||||||
**lexicon DNS API: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
|
|
||||||
(DigitalOcean, DNSimple, DNSMadeEasy, DNSPark, EasyDNS, Namesilo, NS1, PointHQ, Rage4 and Vultr etc.)**
|
|
||||||
|
|
||||||
|
|
||||||
**More APIs coming soon...**
|
|
||||||
|
|
||||||
If your DNS provider is not on the supported list above, you can write your own DNS API script easily. If you do, please consider submitting a [Pull Request](https://github.com/Neilpang/acme.sh/pulls) and contribute it to the project.
|
|
||||||
|
|
||||||
For more details: [How to use DNS API](dnsapi)
|
|
||||||
|
|
||||||
# 9. Use DNS manual mode:
|
# 9. Use DNS manual mode:
|
||||||
|
|
||||||
|
|||||||
18
acme.sh
18
acme.sh
@ -3750,7 +3750,8 @@ issue() {
|
|||||||
_on_issue_err "$_post_hook"
|
_on_issue_err "$_post_hook"
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
|
Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
|
||||||
|
_debug Le_LinkOrder "$Le_LinkOrder"
|
||||||
Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
|
Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
|
||||||
_debug Le_OrderFinalize "$Le_OrderFinalize"
|
_debug Le_OrderFinalize "$Le_OrderFinalize"
|
||||||
if [ -z "$Le_OrderFinalize" ]; then
|
if [ -z "$Le_OrderFinalize" ]; then
|
||||||
@ -4249,13 +4250,10 @@ $_authorizations_map"
|
|||||||
_on_issue_err "$_post_hook"
|
_on_issue_err "$_post_hook"
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
|
|
||||||
if [ -z "$Le_LinkOrder" ]; then
|
if [ -z "$Le_LinkOrder" ]; then
|
||||||
_err "Sign error, can not get order link location header"
|
Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
|
||||||
_err "responseHeaders" "$responseHeaders"
|
|
||||||
_on_issue_err "$_post_hook"
|
|
||||||
return 1
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
_savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
|
_savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
|
||||||
|
|
||||||
_link_cert_retry=0
|
_link_cert_retry=0
|
||||||
@ -4281,6 +4279,14 @@ $_authorizations_map"
|
|||||||
_on_issue_err "$_post_hook"
|
_on_issue_err "$_post_hook"
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
|
#the order is processing, so we are going to poll order status
|
||||||
|
if [ -z "$Le_LinkOrder" ]; then
|
||||||
|
_err "Sign error, can not get order link location header"
|
||||||
|
_err "responseHeaders" "$responseHeaders"
|
||||||
|
_on_issue_err "$_post_hook"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
_info "Polling order status: $Le_LinkOrder"
|
||||||
if ! _send_signed_request "$Le_LinkOrder"; then
|
if ! _send_signed_request "$Le_LinkOrder"; then
|
||||||
_err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
|
_err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
|
||||||
_err "$response"
|
_err "$response"
|
||||||
|
|||||||
391
deploy/README.md
391
deploy/README.md
@ -1,393 +1,6 @@
|
|||||||
# Using deploy api
|
# Using deploy api
|
||||||
|
|
||||||
Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
|
deploy hook usage:
|
||||||
|
|
||||||
Here are the scripts to deploy the certs/key to the server/services.
|
https://github.com/Neilpang/acme.sh/wiki/deployhooks
|
||||||
|
|
||||||
## 1. Deploy the certs to your cpanel host
|
|
||||||
|
|
||||||
If you want to deploy using cpanel UAPI see 7.
|
|
||||||
|
|
||||||
(cpanel deploy hook is not finished yet, this is just an example.)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Then you can deploy now:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_CPANEL_USER=myusername
|
|
||||||
export DEPLOY_CPANEL_PASSWORD=PASSWORD
|
|
||||||
acme.sh --deploy -d example.com --deploy-hook cpanel
|
|
||||||
```
|
|
||||||
|
|
||||||
## 2. Deploy ssl cert on kong proxy engine based on api
|
|
||||||
|
|
||||||
Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
|
|
||||||
Currently supports Kong-v0.10.x.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook kong
|
|
||||||
```
|
|
||||||
|
|
||||||
## 3. Deploy the cert to remote server through SSH access
|
|
||||||
|
|
||||||
The ssh deploy plugin allows you to deploy certificates to a remote host
|
|
||||||
using SSH command to connect to the remote server. The ssh plugin is invoked
|
|
||||||
with the following command...
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d example.com --deploy-hook ssh
|
|
||||||
```
|
|
||||||
Prior to running this for the first time you must tell the plugin where
|
|
||||||
and how to deploy the certificates. This is done by exporting the following
|
|
||||||
environment variables. This is not required for subsequent runs as the
|
|
||||||
values are stored by acme.sh in the domain configuration files.
|
|
||||||
|
|
||||||
Required...
|
|
||||||
```
|
|
||||||
export DEPLOY_SSH_USER=username
|
|
||||||
```
|
|
||||||
Optional...
|
|
||||||
```
|
|
||||||
export DEPLOY_SSH_CMD=custom ssh command
|
|
||||||
export DEPLOY_SSH_SERVER=url or ip address of remote host
|
|
||||||
export DEPLOY_SSH_KEYFILE=filename for private key
|
|
||||||
export DEPLOY_SSH_CERTFILE=filename for certificate file
|
|
||||||
export DEPLOY_SSH_CAFILE=filename for intermediate CA file
|
|
||||||
export DEPLOY_SSH_FULLCHAIN=filename for fullchain file
|
|
||||||
export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host
|
|
||||||
export DEPLOY_SSH_BACKUP=yes or no
|
|
||||||
```
|
|
||||||
|
|
||||||
**DEPLOY_SSH_USER**
|
|
||||||
Username at the remote host that SSH will login with. Note that
|
|
||||||
SSH must be able to login to remote host without a password... SSH Keys
|
|
||||||
must have been exchanged with the remote host. Validate and test that you
|
|
||||||
can login to USER@URL from the host running acme.sh before using this script.
|
|
||||||
|
|
||||||
The USER@URL at the remote server must also have has permissions to write to
|
|
||||||
the target location of the certificate files and to execute any commands
|
|
||||||
(e.g. to stop/start services).
|
|
||||||
|
|
||||||
**DEPLOY_SSH_CMD**
|
|
||||||
You can customize the ssh command used to connect to the remote host. For example
|
|
||||||
if you need to connect to a specific port at the remote server you can set this
|
|
||||||
to, for example, "ssh -p 22" or to use `sshpass` to provide password inline
|
|
||||||
instead of exchanging ssh keys (this is not recommended, using keys is
|
|
||||||
more secure).
|
|
||||||
|
|
||||||
**DEPLOY_SSH_SERVER**
|
|
||||||
URL or IP Address of the remote server. If not provided then the domain
|
|
||||||
name provided on the acme.sh --deploy command line is used.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_KEYFILE**
|
|
||||||
Target filename for the private key issued by LetsEncrypt.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_CERTFILE**
|
|
||||||
Target filename for the certificate issued by LetsEncrypt.
|
|
||||||
If this is the same as the previous filename (for keyfile) then it is
|
|
||||||
appended to the same file.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_CAFILE**
|
|
||||||
Target filename for the CA intermediate certificate issued by LetsEncrypt.
|
|
||||||
If this is the same as a previous filename (for keyfile or certfile) then
|
|
||||||
it is appended to the same file.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_FULLCHAIN**
|
|
||||||
Target filename for the fullchain certificate issued by LetsEncrypt.
|
|
||||||
If this is the same as a previous filename (for keyfile, certfile or
|
|
||||||
cafile) then it is appended to the same file.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_REMOTE_CMD**
|
|
||||||
Command to execute on the remote server after copying any certificates. This
|
|
||||||
could be any additional command required for example to stop and restart
|
|
||||||
the service.
|
|
||||||
|
|
||||||
**DEPLOY_SSH_BACKUP**
|
|
||||||
Before writing a certificate file to the remote server the existing
|
|
||||||
certificate will be copied to a backup directory on the remote server.
|
|
||||||
These are placed in a hidden directory in the home directory of the SSH
|
|
||||||
user
|
|
||||||
```sh
|
|
||||||
~/.acme_ssh_deploy/[domain name]-backup-[timestamp]
|
|
||||||
```
|
|
||||||
Any backups older than 180 days will be deleted when new certificates
|
|
||||||
are deployed. This defaults to "yes" set to "no" to disable backup.
|
|
||||||
|
|
||||||
###Examples using SSH deploy
|
|
||||||
The following example illustrates deploying certificates to a QNAP NAS
|
|
||||||
(tested with QTS version 4.2.3)
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_SSH_USER="admin"
|
|
||||||
export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
|
|
||||||
export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
|
|
||||||
export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
|
|
||||||
export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
|
|
||||||
|
|
||||||
acme.sh --deploy -d qnap.example.com --deploy-hook ssh
|
|
||||||
```
|
|
||||||
Note how in this example both the private key and certificate point to
|
|
||||||
the same file. This will result in the certificate being appended
|
|
||||||
to the same file as the private key... a common requirement of several
|
|
||||||
services.
|
|
||||||
|
|
||||||
The next example illustrates deploying certificates to a Unifi
|
|
||||||
Controller (tested with version 5.4.11).
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_SSH_USER="root"
|
|
||||||
export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key"
|
|
||||||
export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer"
|
|
||||||
export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \
|
|
||||||
-inkey /var/lib/unifi/unifi.example.com.key \
|
|
||||||
-in /var/lib/unifi/unifi.example.com.cer \
|
|
||||||
-out /var/lib/unifi/unifi.example.com.p12 \
|
|
||||||
-name ubnt -password pass:temppass \
|
|
||||||
&& keytool -importkeystore -deststorepass aircontrolenterprise \
|
|
||||||
-destkeypass aircontrolenterprise \
|
|
||||||
-destkeystore /var/lib/unifi/keystore \
|
|
||||||
-srckeystore /var/lib/unifi/unifi.example.com.p12 \
|
|
||||||
-srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \
|
|
||||||
&& service unifi restart"
|
|
||||||
|
|
||||||
acme.sh --deploy -d unifi.example.com --deploy-hook ssh
|
|
||||||
```
|
|
||||||
In this example we execute several commands on the remote host
|
|
||||||
after the certificate files have been copied... to generate a pkcs12 file
|
|
||||||
compatible with Unifi, to import it into the Unifi keystore and then finally
|
|
||||||
to restart the service.
|
|
||||||
|
|
||||||
Note also that once the certificate is imported
|
|
||||||
into the keystore the individual certificate files are no longer
|
|
||||||
required. We could if we desired delete those files immediately. If we
|
|
||||||
do that then we should disable backup at the remote host (as there are
|
|
||||||
no files to backup -- they were erased during deployment). For example...
|
|
||||||
```sh
|
|
||||||
export DEPLOY_SSH_BACKUP=no
|
|
||||||
# modify the end of the remote command...
|
|
||||||
&& rm /var/lib/unifi/unifi.example.com.key \
|
|
||||||
/var/lib/unifi/unifi.example.com.cer \
|
|
||||||
/var/lib/unifi/unifi.example.com.p12 \
|
|
||||||
&& service unifi restart
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Deploy the cert to local vsftpd server
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
|
||||||
```
|
|
||||||
|
|
||||||
The default vsftpd conf file is `/etc/vsftpd.conf`, if your vsftpd conf is not in the default location, you can specify one:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
|
|
||||||
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
|
||||||
```
|
|
||||||
|
|
||||||
The default command to restart vsftpd server is `service vsftpd restart`, if it doesn't work, you can specify one:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart"
|
|
||||||
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
|
||||||
```
|
|
||||||
|
|
||||||
## 5. Deploy the cert to local exim4 server
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
|
||||||
```
|
|
||||||
|
|
||||||
The default exim4 conf file is `/etc/exim/exim.conf`, if your exim4 conf is not in the default location, you can specify one:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template"
|
|
||||||
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
|
||||||
```
|
|
||||||
|
|
||||||
The default command to restart exim4 server is `service exim4 restart`, if it doesn't work, you can specify one:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart"
|
|
||||||
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
|
||||||
```
|
|
||||||
|
|
||||||
## 6. Deploy the cert to OSX Keychain
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook keychain
|
|
||||||
```
|
|
||||||
|
|
||||||
## 7. Deploy to cpanel host using UAPI
|
|
||||||
|
|
||||||
This hook is using UAPI and works in cPanel & WHM version 56 or newer.
|
|
||||||
```
|
|
||||||
acme.sh --deploy -d example.com --deploy-hook cpanel_uapi
|
|
||||||
```
|
|
||||||
DEPLOY_CPANEL_USER is required only if you run the script as root and it should contain cpanel username.
|
|
||||||
```sh
|
|
||||||
export DEPLOY_CPANEL_USER=username
|
|
||||||
acme.sh --deploy -d example.com --deploy-hook cpanel_uapi
|
|
||||||
```
|
|
||||||
Please note, that the cpanel_uapi hook will deploy only the first domain when your certificate will automatically renew. Therefore you should issue a separate certificate for each domain.
|
|
||||||
|
|
||||||
## 8. Deploy the cert to your FRITZ!Box router
|
|
||||||
|
|
||||||
You must specify the credentials that have administrative privileges on the FRITZ!Box in order to deploy the certificate, plus the URL of your FRITZ!Box, through the following environment variables:
|
|
||||||
```sh
|
|
||||||
$ export DEPLOY_FRITZBOX_USERNAME=my_username
|
|
||||||
$ export DEPLOY_FRITZBOX_PASSWORD=the_password
|
|
||||||
$ export DEPLOY_FRITZBOX_URL=https://fritzbox.example.com
|
|
||||||
```
|
|
||||||
|
|
||||||
After the first deployment, these values will be stored in your $HOME/.acme.sh/account.conf. You may now deploy the certificate like this:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d fritzbox.example.com --deploy-hook fritzbox
|
|
||||||
```
|
|
||||||
|
|
||||||
## 9. Deploy the cert to strongswan
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d ftp.example.com --deploy-hook strongswan
|
|
||||||
```
|
|
||||||
|
|
||||||
## 10. Deploy the cert to HAProxy
|
|
||||||
|
|
||||||
You must specify the path where you want the concatenated key and certificate chain written.
|
|
||||||
```sh
|
|
||||||
export DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy
|
|
||||||
```
|
|
||||||
|
|
||||||
You may optionally define the command to reload HAProxy. The value shown below will be used as the default if you don't set this environment variable.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export DEPLOY_HAPROXY_RELOAD="/usr/sbin/service haproxy restart"
|
|
||||||
```
|
|
||||||
|
|
||||||
You can then deploy the certificate as follows
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d haproxy.example.com --deploy-hook haproxy
|
|
||||||
```
|
|
||||||
|
|
||||||
The path for the PEM file will be stored with the domain configuration and will be available when renewing, so that deploy will happen automatically when renewed.
|
|
||||||
|
|
||||||
## 11. Deploy your cert to Gitlab pages
|
|
||||||
|
|
||||||
You must define the API key and the informations for the project and Gitlab page you are updating the certificate for.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
# The token can be created in your user settings under "Access Tokens"
|
|
||||||
export GITLAB_TOKEN="xxxxxxxxxxx"
|
|
||||||
|
|
||||||
# The project ID is displayed on the home page of the project
|
|
||||||
export GITLAB_PROJECT_ID=12345678
|
|
||||||
|
|
||||||
# The domain must match the one defined for the Gitlab page, without "https://"
|
|
||||||
export GITLAB_DOMAIN="www.mydomain.com"
|
|
||||||
```
|
|
||||||
|
|
||||||
You can then deploy the certificate as follows
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d www.mydomain.com --deploy-hook gitlab
|
|
||||||
```
|
|
||||||
|
|
||||||
## 12. Deploy your cert to Hashicorp Vault
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export VAULT_PREFIX="acme"
|
|
||||||
```
|
|
||||||
|
|
||||||
You can then deploy the certificate as follows
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy -d www.mydomain.com --deploy-hook vault_cli
|
|
||||||
```
|
|
||||||
|
|
||||||
Your certs will be saved in Vault using this structure:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
vault write "${VAULT_PREFIX}/${domain}/cert.pem" value=@"..."
|
|
||||||
vault write "${VAULT_PREFIX}/${domain}/cert.key" value=@"..."
|
|
||||||
vault write "${VAULT_PREFIX}/${domain}/chain.pem" value=@"..."
|
|
||||||
vault write "${VAULT_PREFIX}/${domain}/fullchain.pem" value=@"..."
|
|
||||||
```
|
|
||||||
|
|
||||||
You might be using Fabio load balancer (which can get certs from
|
|
||||||
Vault). It needs a bit different structure of your certs in Vault. It
|
|
||||||
gets certs only from keys that were saved in `prefix/domain`, like this:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
vault write <PREFIX>/www.domain.com cert=@cert.pem key=@key.pem
|
|
||||||
```
|
|
||||||
|
|
||||||
If you want to save certs in Vault this way just set "FABIO" env
|
|
||||||
variable to anything (ex: "1") before running `acme.sh`:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
export FABIO="1"
|
|
||||||
```
|
|
||||||
|
|
||||||
## 13. Deploy your certificate to Qiniu.com
|
|
||||||
|
|
||||||
使用 acme.sh 部署到七牛之前，需要确保部署的域名已打开 HTTPS 功能，您可以访问[融合 CDN - 域名管理](https://portal.qiniu.com/cdn/domain) 设置。
|
|
||||||
另外还需要先导出 AK/SK 环境变量，您可以访问[密钥管理](https://portal.qiniu.com/user/key) 获得。
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ export QINIU_AK="foo"
|
|
||||||
$ export QINIU_SK="bar"
|
|
||||||
```
|
|
||||||
|
|
||||||
完成准备工作之后，您就可以通过下面的命令开始部署 SSL 证书到七牛上：
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ acme.sh --deploy -d example.com --deploy-hook qiniu
|
|
||||||
```
|
|
||||||
|
|
||||||
假如您部署的证书为泛域名证书，您还需要设置 `QINIU_CDN_DOMAIN` 变量，指定实际需要部署的域名(请注意泛域名前的点)：
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ export QINIU_CDN_DOMAIN=".cdn.example.com"
|
|
||||||
$ acme.sh --deploy -d example.com --deploy-hook qiniu
|
|
||||||
```
|
|
||||||
|
|
||||||
### English version
|
|
||||||
|
|
||||||
You should create AccessKey/SecretKey pair in https://portal.qiniu.com/user/key
|
|
||||||
before deploying your certificate, and please ensure you have enabled HTTPS for
|
|
||||||
your domain name. You can enable it in https://portal.qiniu.com/cdn/domain.
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ export QINIU_AK="foo"
|
|
||||||
$ export QINIU_SK="bar"
|
|
||||||
```
|
|
||||||
|
|
||||||
then you can deploy certificate by following command:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ acme.sh --deploy -d example.com --deploy-hook qiniu
|
|
||||||
```
|
|
||||||
|
|
||||||
(Optional), If you are using wildcard certificate,
|
|
||||||
you may need export `QINIU_CDN_DOMAIN` to specify which domain
|
|
||||||
you want to update (please note the leading dot):
|
|
||||||
|
|
||||||
```sh
|
|
||||||
$ export QINIU_CDN_DOMAIN=".cdn.example.com"
|
|
||||||
$ acme.sh --deploy -d example.com --deploy-hook qiniu
|
|
||||||
```
|
|
||||||
|
|
||||||
## 14. Deploy your cert on MyDevil.net
|
|
||||||
|
|
||||||
Once you have acme.sh installed and certificate issued (see info in [DNS API](../dnsapi/README.md#61-use-mydevilnet)), you can install it by following command:
|
|
||||||
|
|
||||||
```sh
|
|
||||||
acme.sh --deploy --deploy-hook mydevil -d example.com
|
|
||||||
```
|
|
||||||
|
|
||||||
That will remove old certificate and install new one.
|
|
||||||
|
|||||||
58
deploy/mailcow.sh
Normal file
58
deploy/mailcow.sh
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
#!/usr/bin/env sh
|
||||||
|
|
||||||
|
#Here is a script to deploy cert to mailcow.
|
||||||
|
|
||||||
|
#returns 0 means success, otherwise error.
|
||||||
|
|
||||||
|
######## Public functions #####################
|
||||||
|
|
||||||
|
#domain keyfile certfile cafile fullchain
|
||||||
|
mailcow_deploy() {
|
||||||
|
_cdomain="$1"
|
||||||
|
_ckey="$2"
|
||||||
|
_ccert="$3"
|
||||||
|
_cca="$4"
|
||||||
|
_cfullchain="$5"
|
||||||
|
|
||||||
|
_debug _cdomain "$_cdomain"
|
||||||
|
_debug _ckey "$_ckey"
|
||||||
|
_debug _ccert "$_ccert"
|
||||||
|
_debug _cca "$_cca"
|
||||||
|
_debug _cfullchain "$_cfullchain"
|
||||||
|
|
||||||
|
_mailcow_path="${DEPLOY_MAILCOW_PATH}"
|
||||||
|
|
||||||
|
if [ -z "$_mailcow_path" ]; then
|
||||||
|
_err "Mailcow path is not found, please define DEPLOY_MAILCOW_PATH."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_ssl_path="${_mailcow_path}/data/assets/ssl/"
|
||||||
|
if [ ! -d "$_ssl_path" ]; then
|
||||||
|
_err "Cannot find mailcow ssl path: $_ssl_path"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_info "Copying key and cert"
|
||||||
|
_real_key="$_ssl_path/key.pem"
|
||||||
|
if ! cat "$_ckey" >"$_real_key"; then
|
||||||
|
_err "Error: write key file to: $_real_key"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_real_fullchain="$_ssl_path/cert.pem"
|
||||||
|
if ! cat "$_cfullchain" >"$_real_fullchain"; then
|
||||||
|
_err "Error: write cert file to: $_real_fullchain"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
DEFAULT_MAILCOW_RELOAD="cd ${_mailcow_path} && docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
|
||||||
|
_reload="${DEPLOY_MAILCOW_RELOAD:-$DEFAULT_MAILCOW_RELOAD}"
|
||||||
|
|
||||||
|
_info "Run reload: $_reload"
|
||||||
|
if eval "$_reload"; then
|
||||||
|
_info "Reload success!"
|
||||||
|
fi
|
||||||
|
return 0
|
||||||
|
|
||||||
|
}
|
||||||
1375
dnsapi/README.md
1375
dnsapi/README.md
File diff suppressed because it is too large
Load Diff
204
dnsapi/dns_desec.sh
Normal file
204
dnsapi/dns_desec.sh
Normal file
@ -0,0 +1,204 @@
|
|||||||
|
#!/usr/bin/env sh
|
||||||
|
#
|
||||||
|
# deSEC.io Domain API
|
||||||
|
#
|
||||||
|
# Author: Zheng Qian
|
||||||
|
#
|
||||||
|
# deSEC API doc
|
||||||
|
# https://desec.readthedocs.io/en/latest/
|
||||||
|
|
||||||
|
REST_API="https://desec.io/api/v1/domains"
|
||||||
|
|
||||||
|
######## Public functions #####################
|
||||||
|
|
||||||
|
#Usage: dns_desec_add _acme-challenge.foobar.dedyn.io "d41d8cd98f00b204e9800998ecf8427e"
|
||||||
|
dns_desec_add() {
|
||||||
|
fulldomain=$1
|
||||||
|
txtvalue=$2
|
||||||
|
_info "Using desec.io api"
|
||||||
|
_debug fulldomain "$fulldomain"
|
||||||
|
_debug txtvalue "$txtvalue"
|
||||||
|
|
||||||
|
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||||
|
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||||
|
|
||||||
|
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||||
|
DEDYN_TOKEN=""
|
||||||
|
DEDYN_NAME=""
|
||||||
|
_err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||||
|
_err "Please create you key and try again."
|
||||||
|
_err "e.g."
|
||||||
|
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||||
|
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
#save the api token and name to the account conf file.
|
||||||
|
_saveaccountconf_mutable DEDYN_TOKEN "$DEDYN_TOKEN"
|
||||||
|
_saveaccountconf_mutable DEDYN_NAME "$DEDYN_NAME"
|
||||||
|
|
||||||
|
_debug "First detect the root zone"
|
||||||
|
if ! _get_root "$fulldomain" "$REST_API/"; then
|
||||||
|
_err "invalid domain"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
_debug _sub_domain "$_sub_domain"
|
||||||
|
_debug _domain "$_domain"
|
||||||
|
|
||||||
|
# Get existing TXT record
|
||||||
|
_debug "Getting txt records"
|
||||||
|
txtvalues="\"\\\"$txtvalue\\\"\""
|
||||||
|
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||||
|
|
||||||
|
if [ "$_code" = "200" ]; then
|
||||||
|
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||||
|
_debug "existing TXT found"
|
||||||
|
_debug oldtxtvalues "$oldtxtvalues"
|
||||||
|
if [ -n "$oldtxtvalues" ]; then
|
||||||
|
for oldtxtvalue in $oldtxtvalues; do
|
||||||
|
txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
_debug txtvalues "$txtvalues"
|
||||||
|
_info "Adding record"
|
||||||
|
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
|
||||||
|
|
||||||
|
if _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"; then
|
||||||
|
if _contains "$response" "$txtvalue"; then
|
||||||
|
_info "Added, OK"
|
||||||
|
return 0
|
||||||
|
else
|
||||||
|
_err "Add txt record error."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
_err "Add txt record error."
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
#Usage: fulldomain txtvalue
|
||||||
|
#Remove the txt record after validation.
|
||||||
|
dns_desec_rm() {
|
||||||
|
fulldomain=$1
|
||||||
|
txtvalue=$2
|
||||||
|
_info "Using desec.io api"
|
||||||
|
_debug fulldomain "$fulldomain"
|
||||||
|
_debug txtvalue "$txtvalue"
|
||||||
|
|
||||||
|
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||||
|
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||||
|
|
||||||
|
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||||
|
DEDYN_TOKEN=""
|
||||||
|
DEDYN_NAME=""
|
||||||
|
_err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||||
|
_err "Please create you key and try again."
|
||||||
|
_err "e.g."
|
||||||
|
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||||
|
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_debug "First detect the root zone"
|
||||||
|
if ! _get_root "$fulldomain" "$REST_API/"; then
|
||||||
|
_err "invalid domain"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_debug _sub_domain "$_sub_domain"
|
||||||
|
_debug _domain "$_domain"
|
||||||
|
|
||||||
|
# Get existing TXT record
|
||||||
|
_debug "Getting txt records"
|
||||||
|
txtvalues=""
|
||||||
|
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||||
|
|
||||||
|
if [ "$_code" = "200" ]; then
|
||||||
|
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||||
|
_debug "existing TXT found"
|
||||||
|
_debug oldtxtvalues "$oldtxtvalues"
|
||||||
|
if [ -n "$oldtxtvalues" ]; then
|
||||||
|
for oldtxtvalue in $oldtxtvalues; do
|
||||||
|
if [ "$txtvalue" != "$oldtxtvalue" ]; then
|
||||||
|
txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
txtvalues="$(echo "$txtvalues" | cut -c3-)"
|
||||||
|
_debug txtvalues "$txtvalues"
|
||||||
|
|
||||||
|
_info "Deleting record"
|
||||||
|
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
|
||||||
|
_desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"
|
||||||
|
if [ "$_code" = "200" ]; then
|
||||||
|
_info "Deleted, OK"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
_err "Delete txt record error."
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
#################### Private functions below ##################################
|
||||||
|
|
||||||
|
_desec_rest() {
|
||||||
|
m="$1"
|
||||||
|
ep="$2"
|
||||||
|
data="$3"
|
||||||
|
|
||||||
|
export _H1="Authorization: Token $DEDYN_TOKEN"
|
||||||
|
export _H2="Accept: application/json"
|
||||||
|
export _H3="Content-Type: application/json"
|
||||||
|
|
||||||
|
if [ "$m" != "GET" ]; then
|
||||||
|
_secure_debug2 data "$data"
|
||||||
|
response="$(_post "$data" "$ep" "" "$m")"
|
||||||
|
else
|
||||||
|
response="$(_get "$ep")"
|
||||||
|
fi
|
||||||
|
_ret="$?"
|
||||||
|
_code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
|
||||||
|
_debug "http response code $_code"
|
||||||
|
_secure_debug2 response "$response"
|
||||||
|
if [ "$_ret" != "0" ]; then
|
||||||
|
_err "error $ep"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
response="$(printf "%s" "$response" | _normalizeJson)"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
#_acme-challenge.www.domain.com
|
||||||
|
#returns
|
||||||
|
# _sub_domain=_acme-challenge.www
|
||||||
|
# _domain=domain.com
|
||||||
|
_get_root() {
|
||||||
|
domain="$1"
|
||||||
|
ep="$2"
|
||||||
|
i=2
|
||||||
|
p=1
|
||||||
|
while true; do
|
||||||
|
h=$(printf "%s" "$domain" | cut -d . -f $i-100)
|
||||||
|
_debug h "$h"
|
||||||
|
if [ -z "$h" ]; then
|
||||||
|
#not valid
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! _desec_rest GET "$ep"; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
|
||||||
|
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
|
||||||
|
_domain=$h
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
p=$i
|
||||||
|
i=$(_math "$i" + 1)
|
||||||
|
done
|
||||||
|
return 1
|
||||||
|
}
|
||||||
@ -137,7 +137,7 @@ _mypost() {
|
|||||||
|
|
||||||
_get_domain() {
|
_get_domain() {
|
||||||
_myget 'action=dns_primarydns'
|
_myget 'action=dns_primarydns'
|
||||||
_domains=$(echo "$_result" | _egrep_o ' domain="[[:alnum:].-_]+' | sed 's/^.*"//')
|
_domains=$(echo "$_result" | _egrep_o ' domain="[[:alnum:]._-]+' | sed 's/^.*"//')
|
||||||
if [ -z "$_domains" ]; then
|
if [ -z "$_domains" ]; then
|
||||||
_err "Primary domain list not found!"
|
_err "Primary domain list not found!"
|
||||||
return 1
|
return 1
|
||||||
|
|||||||
244
dnsapi/dns_openprovider.sh
Executable file
244
dnsapi/dns_openprovider.sh
Executable file
@ -0,0 +1,244 @@
|
|||||||
|
#!/usr/bin/env sh
|
||||||
|
|
||||||
|
# This is the OpenProvider API wrapper for acme.sh
|
||||||
|
#
|
||||||
|
# Author: Sylvia van Os
|
||||||
|
# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2104
|
||||||
|
#
|
||||||
|
# export OPENPROVIDER_USER="username"
|
||||||
|
# export OPENPROVIDER_PASSWORDHASH="hashed_password"
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# acme.sh --issue --dns dns_openprovider -d example.com
|
||||||
|
|
||||||
|
OPENPROVIDER_API="https://api.openprovider.eu/"
|
||||||
|
#OPENPROVIDER_API="https://api.cte.openprovider.eu/" # Test API
|
||||||
|
|
||||||
|
######## Public functions #####################
|
||||||
|
|
||||||
|
#Usage: dns_openprovider_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
|
||||||
|
dns_openprovider_add() {
|
||||||
|
fulldomain="$1"
|
||||||
|
txtvalue="$2"
|
||||||
|
|
||||||
|
OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
|
||||||
|
OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
|
||||||
|
|
||||||
|
if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
|
||||||
|
_err "You didn't specify the openprovider user and/or password hash."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# save the username and password to the account conf file.
|
||||||
|
_saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
|
||||||
|
_saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
|
||||||
|
|
||||||
|
_debug "First detect the root zone"
|
||||||
|
if ! _get_root "$fulldomain"; then
|
||||||
|
_err "invalid domain"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_debug _domain_name "$_domain_name"
|
||||||
|
_debug _domain_extension "$_domain_extension"
|
||||||
|
|
||||||
|
_debug "Getting current records"
|
||||||
|
existing_items=""
|
||||||
|
results_retrieved=0
|
||||||
|
while true; do
|
||||||
|
_openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
|
||||||
|
|
||||||
|
items="$response"
|
||||||
|
while true; do
|
||||||
|
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
|
||||||
|
_debug existing_items "$existing_items"
|
||||||
|
_debug results_retrieved "$results_retrieved"
|
||||||
|
_debug item "$item"
|
||||||
|
|
||||||
|
if [ -z "$item" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
items="$(echo "$items" | sed "s|${item}||")"
|
||||||
|
|
||||||
|
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||||
|
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||||
|
if [ -z "$new_item" ]; then
|
||||||
|
# Base record
|
||||||
|
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
|
||||||
|
_debug "not an allowed record type, skipping" "$new_item"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
existing_items="$existing_items$new_item"
|
||||||
|
done
|
||||||
|
|
||||||
|
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||||
|
|
||||||
|
_debug total "$total"
|
||||||
|
if [ "$results_retrieved" -eq "$total" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
_debug "Creating acme record"
|
||||||
|
acme_record="$(echo "$fulldomain" | sed -e "s/.$_domain_name.$_domain_extension$//")"
|
||||||
|
_openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s<item><name>%s</name><type>TXT</type><value>%s</value><ttl>86400</ttl></item></array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items" "$acme_record" "$txtvalue")"
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
#Usage: fulldomain txtvalue
|
||||||
|
#Remove the txt record after validation.
|
||||||
|
dns_openprovider_rm() {
|
||||||
|
fulldomain="$1"
|
||||||
|
txtvalue="$2"
|
||||||
|
|
||||||
|
OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
|
||||||
|
OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
|
||||||
|
|
||||||
|
if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
|
||||||
|
_err "You didn't specify the openprovider user and/or password hash."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# save the username and password to the account conf file.
|
||||||
|
_saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
|
||||||
|
_saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
|
||||||
|
|
||||||
|
_debug "First detect the root zone"
|
||||||
|
if ! _get_root "$fulldomain"; then
|
||||||
|
_err "invalid domain"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_debug _domain_name "$_domain_name"
|
||||||
|
_debug _domain_extension "$_domain_extension"
|
||||||
|
|
||||||
|
_debug "Getting current records"
|
||||||
|
existing_items=""
|
||||||
|
results_retrieved=0
|
||||||
|
while true; do
|
||||||
|
_openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
|
||||||
|
|
||||||
|
# Remove acme records from items
|
||||||
|
items="$response"
|
||||||
|
while true; do
|
||||||
|
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
|
||||||
|
_debug existing_items "$existing_items"
|
||||||
|
_debug results_retrieved "$results_retrieved"
|
||||||
|
_debug item "$item"
|
||||||
|
|
||||||
|
if [ -z "$item" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
items="$(echo "$items" | sed "s|${item}||")"
|
||||||
|
|
||||||
|
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||||
|
if ! echo "$item" | grep -v "$fulldomain"; then
|
||||||
|
_debug "acme record, skipping" "$item"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||||
|
|
||||||
|
if [ -z "$new_item" ]; then
|
||||||
|
# Base record
|
||||||
|
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
|
||||||
|
_debug "not an allowed record type, skipping" "$new_item"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
existing_items="$existing_items$new_item"
|
||||||
|
done
|
||||||
|
|
||||||
|
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||||
|
|
||||||
|
_debug total "$total"
|
||||||
|
|
||||||
|
if [ "$results_retrieved" -eq "$total" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
_debug "Removing acme record"
|
||||||
|
_openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s</array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items")"
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
#################### Private functions below ##################################
|
||||||
|
#_acme-challenge.www.domain.com
|
||||||
|
#returns
|
||||||
|
# _domain_name=domain
|
||||||
|
# _domain_extension=com
|
||||||
|
_get_root() {
|
||||||
|
domain=$1
|
||||||
|
i=2
|
||||||
|
|
||||||
|
results_retrieved=0
|
||||||
|
while true; do
|
||||||
|
h=$(echo "$domain" | cut -d . -f $i-100)
|
||||||
|
_debug h "$h"
|
||||||
|
if [ -z "$h" ]; then
|
||||||
|
#not valid
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
_openprovider_request "$(printf '<searchDomainRequest><domainNamePattern>%s</domainNamePattern><offset>%s</offset></searchDomainRequest>' "$(echo "$h" | cut -d . -f 1)" "$results_retrieved")"
|
||||||
|
|
||||||
|
items="$response"
|
||||||
|
while true; do
|
||||||
|
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<domain>.*<\/domain>\).*/\1/p')"
|
||||||
|
_debug existing_items "$existing_items"
|
||||||
|
_debug results_retrieved "$results_retrieved"
|
||||||
|
_debug item "$item"
|
||||||
|
|
||||||
|
if [ -z "$item" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
items="$(echo "$items" | sed "s|${item}||")"
|
||||||
|
|
||||||
|
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||||
|
|
||||||
|
_domain_name="$(echo "$item" | sed -n 's/.*<domain>.*<name>\(.*\)<\/name>.*<\/domain>.*/\1/p')"
|
||||||
|
_domain_extension="$(echo "$item" | sed -n 's/.*<domain>.*<extension>\(.*\)<\/extension>.*<\/domain>.*/\1/p')"
|
||||||
|
_debug _domain_name "$_domain_name"
|
||||||
|
_debug _domain_extension "$_domain_extension"
|
||||||
|
if [ "$_domain_name.$_domain_extension" = "$h" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||||
|
|
||||||
|
_debug total "$total"
|
||||||
|
|
||||||
|
if [ "$results_retrieved" -eq "$total" ]; then
|
||||||
|
results_retrieved=0
|
||||||
|
i="$(_math "$i" + 1)"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
_openprovider_request() {
|
||||||
|
request_xml=$1
|
||||||
|
|
||||||
|
xml_prefix='<?xml version="1.0" encoding="UTF-8"?>'
|
||||||
|
xml_content=$(printf '<openXML><credentials><username>%s</username><hash>%s</hash></credentials>%s</openXML>' "$OPENPROVIDER_USER" "$OPENPROVIDER_PASSWORDHASH" "$request_xml")
|
||||||
|
response="$(_post "$(echo "$xml_prefix$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
|
||||||
|
_debug response "$response"
|
||||||
|
if ! _contains "$response" "<openXML><reply><code>0</code>.*</reply></openXML>"; then
|
||||||
|
_err "API request failed."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user