acme: Add package.
This adds a package wrapping the acme.sh script from https://github.com/Neilpang/acme.sh in Uci config and hooks to interact correctly with uhttpd. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
This commit is contained in:
Toke Høiland-Jørgensen
parent
10c7c26203
commit
a1d617bd8b
5 changed files with 261 additions and 0 deletions
58
net/acme/Makefile
Normal file
58
net/acme/Makefile
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
#
|
||||
# Copyright (C) 2016 Toke Høiland-Jørgensen
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v3 or
|
||||
# later.
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=acme
|
||||
PKG_SOURCE_VERSION:=1e6b68f5d187fa3d64c889d04a77ee1c79726282
|
||||
PKG_VERSION:=1.0
|
||||
PKG_RELEASE:=1
|
||||
PKG_LICENSE:=GPLv3
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE).tar.xz
|
||||
PKG_SOURCE_URL:=git://github.com/Neilpang/acme.sh.git
|
||||
PKG_SOURCE_PROTO:=git
|
||||
PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE)
|
||||
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE)
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
define Package/acme
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
DEPENDS:=+curl +ca-certificates +uhttpd-mod-tls +openssl-util
|
||||
TITLE:=ACME (Letsencrypt) client
|
||||
PKGARCH:=all
|
||||
MAINTAINER:=Toke Høiland-Jørgensen <toke@toke.dk>
|
||||
endef
|
||||
|
||||
define Package/acme/description
|
||||
A client for issuing Letsencrypt certificates.
|
||||
endef
|
||||
|
||||
define Package/acme/conffiles
|
||||
/etc/config/acme
|
||||
/etc/acme
|
||||
endef
|
||||
|
||||
define Build/Configure
|
||||
endef
|
||||
|
||||
define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/acme/install
|
||||
$(INSTALL_DIR) $(1)/etc/config
|
||||
$(INSTALL_CONF) ./files/acme.config $(1)/etc/config/acme
|
||||
$(INSTALL_DIR) $(1)/etc/init.d
|
||||
$(INSTALL_BIN) ./files/acme.init $(1)/etc/init.d/acme
|
||||
$(INSTALL_DIR) $(1)/usr/lib/acme
|
||||
$(INSTALL_BIN) ./files/run.sh $(1)/usr/lib/acme/run-acme
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/acme.sh $(1)/usr/lib/acme/acme.sh
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,acme))
|
||||
11
net/acme/files/acme.config
Normal file
11
net/acme/files/acme.config
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
config acme 'main'
|
||||
option state_dir '/etc/acme'
|
||||
option account_email 'email@example.org'
|
||||
option debug 0
|
||||
|
||||
config cert 'example'
|
||||
option enabled 0
|
||||
option use_staging 0
|
||||
option keylength 2048
|
||||
option update_uhttpd 1
|
||||
list domains example.org
|
||||
34
net/acme/files/acme.init
Normal file
34
net/acme/files/acme.init
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
#!/bin/sh /etc/rc.common
|
||||
|
||||
USE_PROCD=1
|
||||
|
||||
START=50
|
||||
SCRIPT=/usr/lib/acme/run-acme
|
||||
|
||||
start_service()
|
||||
{
|
||||
procd_open_instance
|
||||
procd_set_param command $SCRIPT
|
||||
procd_set_param file /etc/config/acme
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
rc_procd start_service "$@"
|
||||
return 0
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
return 0
|
||||
}
|
||||
|
||||
boot() {
|
||||
$SCRIPT check_cron
|
||||
}
|
||||
|
||||
service_triggers()
|
||||
{
|
||||
procd_add_reload_trigger acme
|
||||
}
|
||||
144
net/acme/files/run.sh
Normal file
144
net/acme/files/run.sh
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
#!/bin/sh
|
||||
# Wrapper for acme.sh to work on openwrt.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it under
|
||||
# the terms of the GNU General Public License as published by the Free Software
|
||||
# Foundation; either version 3 of the License, or (at your option) any later
|
||||
# version.
|
||||
#
|
||||
# Author: Toke Høiland-Jørgensen <toke@toke.dk>
|
||||
|
||||
CHECK_CRON=$1
|
||||
ACME=/usr/lib/acme/acme.sh
|
||||
export SSL_CERT_DIR=/etc/ssl/certs
|
||||
|
||||
UHTTPD_REDIRECT_HTTPS=
|
||||
UHTTPD_LISTEN_HTTP=
|
||||
STATE_DIR='/etc/acme'
|
||||
ACCOUNT_EMAIL=
|
||||
DEBUG=0
|
||||
|
||||
. /lib/functions.sh
|
||||
|
||||
check_cron()
|
||||
{
|
||||
[ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
|
||||
echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
|
||||
/etc/init.d/cron start
|
||||
}
|
||||
|
||||
pre_checks()
|
||||
{
|
||||
echo "Running pre checks."
|
||||
check_cron
|
||||
|
||||
UHTTPD_REDIRECT_HTTPS=$(uci get uhttpd.main.redirect_https)
|
||||
UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
|
||||
|
||||
uci set uhttpd.main.redirect_https=1
|
||||
uci set uhttpd.main.listen_http='0.0.0.0:80'
|
||||
uci commit uhttpd
|
||||
/etc/init.d/uhttpd reload || return 1
|
||||
|
||||
iptables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
post_checks()
|
||||
{
|
||||
echo "Running post checks (cleanup)."
|
||||
iptables -D input_rule -p tcp --dport 80 -j ACCEPT
|
||||
|
||||
uci set uhttpd.main.redirect_https="$UHTTPD_REDIRECT_HTTPS"
|
||||
uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
|
||||
uci commit uhttpd
|
||||
/etc/init.d/uhttpd reload
|
||||
}
|
||||
|
||||
err_out()
|
||||
{
|
||||
post_checks
|
||||
exit 1
|
||||
}
|
||||
|
||||
int_out()
|
||||
{
|
||||
post_checks
|
||||
trap - SIGINT
|
||||
kill -SIGINT $$
|
||||
}
|
||||
|
||||
issue_cert()
|
||||
{
|
||||
local section="$1"
|
||||
local acme_args=
|
||||
local enabled
|
||||
local use_staging
|
||||
local update_uhttpd
|
||||
local keylength
|
||||
local domains
|
||||
local main_domain
|
||||
|
||||
config_get_bool enabled "$section" enabled 0
|
||||
config_get_bool use_staging "$section" use_staging
|
||||
config_get_bool update_uhttpd "$section" update_uhttpd
|
||||
config_get domains "$section" domains
|
||||
config_get keylength "$section" keylength
|
||||
|
||||
[ "$enabled" -eq "1" ] || return
|
||||
|
||||
[ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
|
||||
|
||||
set -- $domains
|
||||
main_domain=$1
|
||||
|
||||
if [ -e "$STATE_DIR/$main_domain" ]; then
|
||||
$ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1
|
||||
return 0
|
||||
fi
|
||||
|
||||
|
||||
acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
|
||||
acme_args="$acme_args --webroot $(uci get uhttpd.main.home)"
|
||||
acme_args="$acme_args --keylength $keylength"
|
||||
[ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
|
||||
[ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
|
||||
|
||||
if ! $ACME --home "$STATE_DIR" --issue $acme_args; then
|
||||
echo "Issuing cert for $main_domain failed. It may be necessary to remove $STATE_DIR/$main_domain to recover." >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [ "$update_uhttpd" -eq "1" ]; then
|
||||
uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
|
||||
uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
|
||||
# commit and reload is in post_checks
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
load_vars()
|
||||
{
|
||||
local section="$1"
|
||||
|
||||
STATE_DIR=$(config_get "$section" state_dir)
|
||||
ACCOUNT_EMAIL=$(config_get "$section" account_email)
|
||||
DEBUG=$(config_get "$section" debug)
|
||||
}
|
||||
|
||||
if [ -n "$CHECK_CRON" ]; then
|
||||
check_cron
|
||||
exit 0
|
||||
fi
|
||||
|
||||
config_load acme
|
||||
config_foreach load_vars acme
|
||||
|
||||
pre_checks || exit 1
|
||||
trap err_out SIGHUP SIGTERM
|
||||
trap int_out SIGINT
|
||||
|
||||
config_foreach issue_cert cert
|
||||
post_checks
|
||||
|
||||
exit 0
|
||||
14
net/acme/patches/0001-remove-timestamp.patch
Normal file
14
net/acme/patches/0001-remove-timestamp.patch
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
--- a/acme.sh 2016-08-05 17:00:58.000000000 +0200
|
||||
+++ b/acme.sh 2016-08-05 17:13:58.582459764 +0200
|
||||
@@ -48,9 +48,9 @@
|
||||
|
||||
_info() {
|
||||
if [ -z "$2" ] ; then
|
||||
- echo "[$(date)] $1"
|
||||
+ echo "$1"
|
||||
else
|
||||
- echo "[$(date)] $1='$2'"
|
||||
+ echo "$1='$2'"
|
||||
fi
|
||||
}
|
||||
|
||||
Loading…
Reference in a new issue