Merge pull request #13036 from TDT-AG/pr/20200806-acme
acme: fix alignment space vs tabs
This commit is contained in:
Toke Høiland-Jørgensen
GitHub
commit
cbca68b4f2
4 changed files with 266 additions and 266 deletions
net/acme
|
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
PKG_NAME:=acme
|
PKG_NAME:=acme
|
||||||
PKG_VERSION:=2.8.6
|
PKG_VERSION:=2.8.6
|
||||||
PKG_RELEASE:=3
|
PKG_RELEASE:=4
|
||||||
|
|
||||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||||
PKG_SOURCE_URL:=https://github.com/acmesh-official/acme.sh/archive/$(PKG_VERSION).tar.gz
|
PKG_SOURCE_URL:=https://github.com/acmesh-official/acme.sh/archive/$(PKG_VERSION).tar.gz
|
||||||
|
|
|
||||||
|
|
@ -1,33 +1,33 @@
|
||||||
config acme
|
config acme
|
||||||
option state_dir '/etc/acme'
|
option state_dir '/etc/acme'
|
||||||
option account_email 'email@example.org'
|
option account_email 'email@example.org'
|
||||||
option debug 0
|
option debug 0
|
||||||
|
|
||||||
config cert 'example_wildcard'
|
config cert 'example_wildcard'
|
||||||
option enabled 0
|
option enabled 0
|
||||||
option use_staging 1
|
option use_staging 1
|
||||||
option keylength 2048
|
option keylength 2048
|
||||||
option update_uhttpd 1
|
option update_uhttpd 1
|
||||||
option update_nginx 1
|
option update_nginx 1
|
||||||
list domains example.org
|
list domains example.org
|
||||||
list domains sub.example.org
|
list domains sub.example.org
|
||||||
list domains *.sub.example.org
|
list domains *.sub.example.org
|
||||||
# option user_setup "path-to-custom-setup.script"
|
# option user_setup "path-to-custom-setup.script"
|
||||||
# option user_cleanup "path-to-custom-cleanup.script"
|
# option user_cleanup "path-to-custom-cleanup.script"
|
||||||
option dns "dns_freedns"
|
option dns "dns_freedns"
|
||||||
list credentials 'FREEDNS_User="ssladmin@example.org"'
|
list credentials 'FREEDNS_User="ssladmin@example.org"'
|
||||||
list credentials 'FREEDNS_Password="1234"'
|
list credentials 'FREEDNS_Password="1234"'
|
||||||
option calias "example.com"
|
option calias "example.com"
|
||||||
option dalias "dalias.example.com"
|
option dalias "dalias.example.com"
|
||||||
|
|
||||||
config cert 'example'
|
config cert 'example'
|
||||||
option enabled 0
|
option enabled 0
|
||||||
option use_staging 1
|
option use_staging 1
|
||||||
option keylength 2048
|
option keylength 2048
|
||||||
option update_uhttpd 1
|
option update_uhttpd 1
|
||||||
option update_nginx 1
|
option update_nginx 1
|
||||||
list domains example.org
|
list domains example.org
|
||||||
list domains sub.example.org
|
list domains sub.example.org
|
||||||
option webroot ""
|
option webroot ""
|
||||||
# option user_setup "path-to-custom-setup.script"
|
# option user_setup "path-to-custom-setup.script"
|
||||||
# option user_cleanup "path-to-custom-cleanup.script"
|
# option user_cleanup "path-to-custom-cleanup.script"
|
||||||
|
|
|
||||||
|
|
@ -7,29 +7,29 @@ SCRIPT=/usr/lib/acme/run-acme
|
||||||
|
|
||||||
start_service()
|
start_service()
|
||||||
{
|
{
|
||||||
procd_open_instance
|
procd_open_instance
|
||||||
procd_set_param command $SCRIPT
|
procd_set_param command $SCRIPT
|
||||||
procd_set_param file /etc/config/acme
|
procd_set_param file /etc/config/acme
|
||||||
procd_set_param stdout 1
|
procd_set_param stdout 1
|
||||||
procd_set_param stderr 1
|
procd_set_param stderr 1
|
||||||
procd_close_instance
|
procd_close_instance
|
||||||
}
|
}
|
||||||
|
|
||||||
reload_service() {
|
reload_service() {
|
||||||
rc_procd start_service "$@"
|
rc_procd start_service "$@"
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
stop_service() {
|
stop_service() {
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
boot() {
|
boot() {
|
||||||
touch "/var/run/acme_boot"
|
touch "/var/run/acme_boot"
|
||||||
start
|
start
|
||||||
}
|
}
|
||||||
|
|
||||||
service_triggers()
|
service_triggers()
|
||||||
{
|
{
|
||||||
procd_add_reload_trigger acme
|
procd_add_reload_trigger acme
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -26,307 +26,307 @@ USER_CLEANUP=
|
||||||
|
|
||||||
check_cron()
|
check_cron()
|
||||||
{
|
{
|
||||||
[ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
|
[ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
|
||||||
echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
|
echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
|
||||||
/etc/init.d/cron start
|
/etc/init.d/cron start
|
||||||
}
|
}
|
||||||
|
|
||||||
log()
|
log()
|
||||||
{
|
{
|
||||||
logger -t acme -s -p daemon.info -- "$@"
|
logger -t acme -s -p daemon.info -- "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
err()
|
err()
|
||||||
{
|
{
|
||||||
logger -t acme -s -p daemon.err -- "$@"
|
logger -t acme -s -p daemon.err -- "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
debug()
|
debug()
|
||||||
{
|
{
|
||||||
[ "$DEBUG" -eq "1" ] && logger -t acme -s -p daemon.debug -- "$@"
|
[ "$DEBUG" -eq "1" ] && logger -t acme -s -p daemon.debug -- "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
get_listeners() {
|
get_listeners() {
|
||||||
local proto rq sq listen remote state program
|
local proto rq sq listen remote state program
|
||||||
netstat -nptl 2>/dev/null | while read proto rq sq listen remote state program; do
|
netstat -nptl 2>/dev/null | while read proto rq sq listen remote state program; do
|
||||||
case "$proto#$listen#$program" in
|
case "$proto#$listen#$program" in
|
||||||
tcp#*:80#[0-9]*/*) echo -n "${program%% *} " ;;
|
tcp#*:80#[0-9]*/*) echo -n "${program%% *} " ;;
|
||||||
esac
|
esac
|
||||||
done
|
done
|
||||||
}
|
}
|
||||||
|
|
||||||
run_acme()
|
run_acme()
|
||||||
{
|
{
|
||||||
debug "Running acme.sh as '$ACME $@'"
|
debug "Running acme.sh as '$ACME $@'"
|
||||||
$ACME "$@"
|
$ACME "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
pre_checks()
|
pre_checks()
|
||||||
{
|
{
|
||||||
main_domain="$1"
|
main_domain="$1"
|
||||||
|
|
||||||
log "Running pre checks for $main_domain."
|
log "Running pre checks for $main_domain."
|
||||||
|
|
||||||
listeners="$(get_listeners)"
|
listeners="$(get_listeners)"
|
||||||
|
|
||||||
debug "port80 listens: $listeners"
|
debug "port80 listens: $listeners"
|
||||||
|
|
||||||
for listener in $(get_listeners); do
|
for listener in $(get_listeners); do
|
||||||
pid="${listener%/*}"
|
pid="${listener%/*}"
|
||||||
cmd="${listener#*/}"
|
cmd="${listener#*/}"
|
||||||
|
|
||||||
case "$cmd" in
|
case "$cmd" in
|
||||||
uhttpd)
|
uhttpd)
|
||||||
debug "Found uhttpd listening on port 80; trying to disable."
|
debug "Found uhttpd listening on port 80; trying to disable."
|
||||||
|
|
||||||
UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
|
UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
|
||||||
|
|
||||||
if [ -z "$UHTTPD_LISTEN_HTTP" ]; then
|
if [ -z "$UHTTPD_LISTEN_HTTP" ]; then
|
||||||
err "$main_domain: Unable to find uhttpd listen config."
|
err "$main_domain: Unable to find uhttpd listen config."
|
||||||
err "Manually disable uhttpd or set webroot to continue."
|
err "Manually disable uhttpd or set webroot to continue."
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
uci set uhttpd.main.listen_http=''
|
uci set uhttpd.main.listen_http=''
|
||||||
uci commit uhttpd || return 1
|
uci commit uhttpd || return 1
|
||||||
if ! /etc/init.d/uhttpd reload ; then
|
if ! /etc/init.d/uhttpd reload ; then
|
||||||
uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
|
uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
|
||||||
uci commit uhttpd
|
uci commit uhttpd
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
;;
|
;;
|
||||||
nginx*)
|
nginx*)
|
||||||
debug "Found nginx listening on port 80; trying to disable."
|
debug "Found nginx listening on port 80; trying to disable."
|
||||||
NGINX_WEBSERVER=1
|
NGINX_WEBSERVER=1
|
||||||
local tries=0
|
local tries=0
|
||||||
while grep -sq "$cmd" "/proc/$pid/cmdline" && kill -0 "$pid"; do
|
while grep -sq "$cmd" "/proc/$pid/cmdline" && kill -0 "$pid"; do
|
||||||
/etc/init.d/nginx stop
|
/etc/init.d/nginx stop
|
||||||
if [ $tries -gt 10 ]; then
|
if [ $tries -gt 10 ]; then
|
||||||
debug "Can't stop nginx. Terminating script."
|
debug "Can't stop nginx. Terminating script."
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
debug "Waiting for nginx to stop..."
|
debug "Waiting for nginx to stop..."
|
||||||
tries=$((tries + 1))
|
tries=$((tries + 1))
|
||||||
sleep 1
|
sleep 1
|
||||||
done
|
done
|
||||||
;;
|
;;
|
||||||
"")
|
"")
|
||||||
debug "Nothing listening on port 80."
|
debug "Nothing listening on port 80."
|
||||||
;;
|
;;
|
||||||
*)
|
*)
|
||||||
err "$main_domain: Cannot run in standalone mode; another daemon is listening on port 80."
|
err "$main_domain: Cannot run in standalone mode; another daemon is listening on port 80."
|
||||||
err "Disable other daemon or set webroot to continue."
|
err "Disable other daemon or set webroot to continue."
|
||||||
return 1
|
return 1
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
done
|
done
|
||||||
|
|
||||||
iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
|
iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
|
||||||
ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
|
ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1
|
||||||
debug "v4 input_rule: $(iptables -nvL input_rule)"
|
debug "v4 input_rule: $(iptables -nvL input_rule)"
|
||||||
debug "v6 input_rule: $(ip6tables -nvL input_rule)"
|
debug "v6 input_rule: $(ip6tables -nvL input_rule)"
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
post_checks()
|
post_checks()
|
||||||
{
|
{
|
||||||
log "Running post checks (cleanup)."
|
log "Running post checks (cleanup)."
|
||||||
# The comment ensures we only touch our own rules. If no rules exist, that
|
# The comment ensures we only touch our own rules. If no rules exist, that
|
||||||
# is fine, so hide any errors
|
# is fine, so hide any errors
|
||||||
iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
|
iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
|
||||||
ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
|
ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2>/dev/null
|
||||||
|
|
||||||
if [ -e /etc/init.d/uhttpd ] && ( [ -n "$UHTTPD_LISTEN_HTTP" ] || [ "$UPDATE_UHTTPD" -eq 1 ] ); then
|
if [ -e /etc/init.d/uhttpd ] && ( [ -n "$UHTTPD_LISTEN_HTTP" ] || [ "$UPDATE_UHTTPD" -eq 1 ] ); then
|
||||||
if [ -n "$UHTTPD_LISTEN_HTTP" ]; then
|
if [ -n "$UHTTPD_LISTEN_HTTP" ]; then
|
||||||
uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
|
uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
|
||||||
UHTTPD_LISTEN_HTTP=
|
UHTTPD_LISTEN_HTTP=
|
||||||
fi
|
fi
|
||||||
uci commit uhttpd
|
uci commit uhttpd
|
||||||
/etc/init.d/uhttpd reload
|
/etc/init.d/uhttpd reload
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -e /etc/init.d/nginx ] && ( [ "$NGINX_WEBSERVER" -eq 1 ] || [ "$UPDATE_NGINX" -eq 1 ] ); then
|
if [ -e /etc/init.d/nginx ] && ( [ "$NGINX_WEBSERVER" -eq 1 ] || [ "$UPDATE_NGINX" -eq 1 ] ); then
|
||||||
NGINX_WEBSERVER=0
|
NGINX_WEBSERVER=0
|
||||||
/etc/init.d/nginx restart
|
/etc/init.d/nginx restart
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -n "$USER_CLEANUP" ] && [ -f "$USER_CLEANUP" ]; then
|
if [ -n "$USER_CLEANUP" ] && [ -f "$USER_CLEANUP" ]; then
|
||||||
log "Running user-provided cleanup script from $USER_CLEANUP."
|
log "Running user-provided cleanup script from $USER_CLEANUP."
|
||||||
"$USER_CLEANUP" || return 1
|
"$USER_CLEANUP" || return 1
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
err_out()
|
err_out()
|
||||||
{
|
{
|
||||||
post_checks
|
post_checks
|
||||||
exit 1
|
exit 1
|
||||||
}
|
}
|
||||||
|
|
||||||
int_out()
|
int_out()
|
||||||
{
|
{
|
||||||
post_checks
|
post_checks
|
||||||
trap - INT
|
trap - INT
|
||||||
kill -INT $$
|
kill -INT $$
|
||||||
}
|
}
|
||||||
|
|
||||||
is_staging()
|
is_staging()
|
||||||
{
|
{
|
||||||
local main_domain
|
local main_domain
|
||||||
local domain_dir
|
local domain_dir
|
||||||
main_domain="$1"
|
main_domain="$1"
|
||||||
domain_dir="$2"
|
domain_dir="$2"
|
||||||
|
|
||||||
grep -q "acme-staging" "${domain_dir}/${main_domain}.conf"
|
grep -q "acme-staging" "${domain_dir}/${main_domain}.conf"
|
||||||
return $?
|
return $?
|
||||||
}
|
}
|
||||||
|
|
||||||
issue_cert()
|
issue_cert()
|
||||||
{
|
{
|
||||||
local section="$1"
|
local section="$1"
|
||||||
local acme_args=
|
local acme_args=
|
||||||
local enabled
|
local enabled
|
||||||
local use_staging
|
local use_staging
|
||||||
local update_uhttpd
|
local update_uhttpd
|
||||||
local update_nginx
|
local update_nginx
|
||||||
local keylength
|
local keylength
|
||||||
local keylength_ecc=0
|
local keylength_ecc=0
|
||||||
local domains
|
local domains
|
||||||
local main_domain
|
local main_domain
|
||||||
local moved_staging=0
|
local moved_staging=0
|
||||||
local failed_dir
|
local failed_dir
|
||||||
local webroot
|
local webroot
|
||||||
local dns
|
local dns
|
||||||
local user_setup
|
local user_setup
|
||||||
local user_cleanup
|
local user_cleanup
|
||||||
local ret
|
local ret
|
||||||
local domain_dir
|
local domain_dir
|
||||||
|
|
||||||
config_get_bool enabled "$section" enabled 0
|
config_get_bool enabled "$section" enabled 0
|
||||||
config_get_bool use_staging "$section" use_staging
|
config_get_bool use_staging "$section" use_staging
|
||||||
config_get_bool update_uhttpd "$section" update_uhttpd
|
config_get_bool update_uhttpd "$section" update_uhttpd
|
||||||
config_get_bool update_nginx "$section" update_nginx
|
config_get_bool update_nginx "$section" update_nginx
|
||||||
config_get calias "$section" calias
|
config_get calias "$section" calias
|
||||||
config_get dalias "$section" dalias
|
config_get dalias "$section" dalias
|
||||||
config_get domains "$section" domains
|
config_get domains "$section" domains
|
||||||
config_get keylength "$section" keylength
|
config_get keylength "$section" keylength
|
||||||
config_get webroot "$section" webroot
|
config_get webroot "$section" webroot
|
||||||
config_get dns "$section" dns
|
config_get dns "$section" dns
|
||||||
config_get user_setup "$section" user_setup
|
config_get user_setup "$section" user_setup
|
||||||
config_get user_cleanup "$section" user_cleanup
|
config_get user_cleanup "$section" user_cleanup
|
||||||
|
|
||||||
UPDATE_NGINX=$update_nginx
|
UPDATE_NGINX=$update_nginx
|
||||||
UPDATE_UHTTPD=$update_uhttpd
|
UPDATE_UHTTPD=$update_uhttpd
|
||||||
USER_CLEANUP=$user_cleanup
|
USER_CLEANUP=$user_cleanup
|
||||||
|
|
||||||
[ "$enabled" -eq "1" ] || return
|
[ "$enabled" -eq "1" ] || return
|
||||||
|
|
||||||
[ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
|
[ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
|
||||||
|
|
||||||
set -- $domains
|
set -- $domains
|
||||||
main_domain=$1
|
main_domain=$1
|
||||||
|
|
||||||
if [ -n "$user_setup" ] && [ -f "$user_setup" ]; then
|
if [ -n "$user_setup" ] && [ -f "$user_setup" ]; then
|
||||||
log "Running user-provided setup script from $user_setup."
|
log "Running user-provided setup script from $user_setup."
|
||||||
"$user_setup" "$main_domain" || return 1
|
"$user_setup" "$main_domain" || return 1
|
||||||
else
|
else
|
||||||
[ -n "$webroot" ] || [ -n "$dns" ] || pre_checks "$main_domain" || return 1
|
[ -n "$webroot" ] || [ -n "$dns" ] || pre_checks "$main_domain" || return 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if echo $keylength | grep -q "^ec-"; then
|
if echo $keylength | grep -q "^ec-"; then
|
||||||
domain_dir="$STATE_DIR/${main_domain}_ecc"
|
domain_dir="$STATE_DIR/${main_domain}_ecc"
|
||||||
keylength_ecc=1
|
keylength_ecc=1
|
||||||
else
|
else
|
||||||
domain_dir="$STATE_DIR/${main_domain}"
|
domain_dir="$STATE_DIR/${main_domain}"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
log "Running ACME for $main_domain"
|
log "Running ACME for $main_domain"
|
||||||
|
|
||||||
handle_credentials() {
|
handle_credentials() {
|
||||||
local credential="$1"
|
local credential="$1"
|
||||||
eval export $credential
|
eval export $credential
|
||||||
}
|
}
|
||||||
config_list_foreach "$section" credentials handle_credentials
|
config_list_foreach "$section" credentials handle_credentials
|
||||||
|
|
||||||
if [ -e "$domain_dir" ]; then
|
if [ -e "$domain_dir" ]; then
|
||||||
if [ "$use_staging" -eq "0" ] && is_staging "$main_domain" "$domain_dir"; then
|
if [ "$use_staging" -eq "0" ] && is_staging "$main_domain" "$domain_dir"; then
|
||||||
log "Found previous cert issued using staging server. Moving it out of the way."
|
log "Found previous cert issued using staging server. Moving it out of the way."
|
||||||
mv "$domain_dir" "${domain_dir}.staging"
|
mv "$domain_dir" "${domain_dir}.staging"
|
||||||
moved_staging=1
|
moved_staging=1
|
||||||
else
|
else
|
||||||
log "Found previous cert config. Issuing renew."
|
log "Found previous cert config. Issuing renew."
|
||||||
[ "$keylength_ecc" -eq "1" ] && acme_args="$acme_args --ecc"
|
[ "$keylength_ecc" -eq "1" ] && acme_args="$acme_args --ecc"
|
||||||
run_acme --home "$STATE_DIR" --renew -d "$main_domain" $acme_args && ret=0 || ret=1
|
run_acme --home "$STATE_DIR" --renew -d "$main_domain" $acme_args && ret=0 || ret=1
|
||||||
post_checks
|
post_checks
|
||||||
return $ret
|
return $ret
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
||||||
acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
|
acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
|
||||||
acme_args="$acme_args --keylength $keylength"
|
acme_args="$acme_args --keylength $keylength"
|
||||||
[ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
|
[ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
|
||||||
[ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
|
[ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
|
||||||
|
|
||||||
if [ -n "$dns" ]; then
|
if [ -n "$dns" ]; then
|
||||||
log "Using dns mode"
|
log "Using dns mode"
|
||||||
acme_args="$acme_args --dns $dns"
|
acme_args="$acme_args --dns $dns"
|
||||||
if [ -n "$dalias" ]; then
|
if [ -n "$dalias" ]; then
|
||||||
log "Using domain alias for dns mode"
|
log "Using domain alias for dns mode"
|
||||||
acme_args="$acme_args --domain-alias $dalias"
|
acme_args="$acme_args --domain-alias $dalias"
|
||||||
if [ -n "$calias" ]; then
|
if [ -n "$calias" ]; then
|
||||||
err "Both domain and challenge aliases are defined. Ignoring the challenge alias."
|
err "Both domain and challenge aliases are defined. Ignoring the challenge alias."
|
||||||
fi
|
fi
|
||||||
elif [ -n "$calias" ]; then
|
elif [ -n "$calias" ]; then
|
||||||
log "Using challenge alias for dns mode"
|
log "Using challenge alias for dns mode"
|
||||||
acme_args="$acme_args --challenge-alias $calias"
|
acme_args="$acme_args --challenge-alias $calias"
|
||||||
fi
|
fi
|
||||||
elif [ -z "$webroot" ]; then
|
elif [ -z "$webroot" ]; then
|
||||||
log "Using standalone mode"
|
log "Using standalone mode"
|
||||||
acme_args="$acme_args --standalone --listen-v6"
|
acme_args="$acme_args --standalone --listen-v6"
|
||||||
else
|
else
|
||||||
if [ ! -d "$webroot" ]; then
|
if [ ! -d "$webroot" ]; then
|
||||||
err "$main_domain: Webroot dir '$webroot' does not exist!"
|
err "$main_domain: Webroot dir '$webroot' does not exist!"
|
||||||
post_checks
|
post_checks
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
log "Using webroot dir: $webroot"
|
log "Using webroot dir: $webroot"
|
||||||
acme_args="$acme_args --webroot $webroot"
|
acme_args="$acme_args --webroot $webroot"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if ! run_acme --home "$STATE_DIR" --issue $acme_args; then
|
if ! run_acme --home "$STATE_DIR" --issue $acme_args; then
|
||||||
failed_dir="${domain_dir}.failed-$(date +%s)"
|
failed_dir="${domain_dir}.failed-$(date +%s)"
|
||||||
err "Issuing cert for $main_domain failed. Moving state to $failed_dir"
|
err "Issuing cert for $main_domain failed. Moving state to $failed_dir"
|
||||||
[ -d "$domain_dir" ] && mv "$domain_dir" "$failed_dir"
|
[ -d "$domain_dir" ] && mv "$domain_dir" "$failed_dir"
|
||||||
if [ "$moved_staging" -eq "1" ]; then
|
if [ "$moved_staging" -eq "1" ]; then
|
||||||
err "Restoring staging certificate"
|
err "Restoring staging certificate"
|
||||||
mv "${domain_dir}.staging" "${domain_dir}"
|
mv "${domain_dir}.staging" "${domain_dir}"
|
||||||
fi
|
fi
|
||||||
post_checks
|
post_checks
|
||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -e /etc/init.d/uhttpd ] && [ "$update_uhttpd" -eq "1" ]; then
|
if [ -e /etc/init.d/uhttpd ] && [ "$update_uhttpd" -eq "1" ]; then
|
||||||
uci set uhttpd.main.key="${domain_dir}/${main_domain}.key"
|
uci set uhttpd.main.key="${domain_dir}/${main_domain}.key"
|
||||||
uci set uhttpd.main.cert="${domain_dir}/fullchain.cer"
|
uci set uhttpd.main.cert="${domain_dir}/fullchain.cer"
|
||||||
# commit and reload is in post_checks
|
# commit and reload is in post_checks
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -e /etc/init.d/nginx ] && [ "$update_nginx" -eq "1" ]; then
|
if [ -e /etc/init.d/nginx ] && [ "$update_nginx" -eq "1" ]; then
|
||||||
sed -i "s#ssl_certificate\ .*#ssl_certificate ${domain_dir}/fullchain.cer;#g" /etc/nginx/nginx.conf
|
sed -i "s#ssl_certificate\ .*#ssl_certificate ${domain_dir}/fullchain.cer;#g" /etc/nginx/nginx.conf
|
||||||
sed -i "s#ssl_certificate_key\ .*#ssl_certificate_key ${domain_dir}/${main_domain}.key;#g" /etc/nginx/nginx.conf
|
sed -i "s#ssl_certificate_key\ .*#ssl_certificate_key ${domain_dir}/${main_domain}.key;#g" /etc/nginx/nginx.conf
|
||||||
# commit and reload is in post_checks
|
# commit and reload is in post_checks
|
||||||
fi
|
fi
|
||||||
|
|
||||||
post_checks
|
post_checks
|
||||||
}
|
}
|
||||||
|
|
||||||
load_vars()
|
load_vars()
|
||||||
{
|
{
|
||||||
local section="$1"
|
local section="$1"
|
||||||
|
|
||||||
STATE_DIR=$(config_get "$section" state_dir)
|
STATE_DIR=$(config_get "$section" state_dir)
|
||||||
ACCOUNT_EMAIL=$(config_get "$section" account_email)
|
ACCOUNT_EMAIL=$(config_get "$section" account_email)
|
||||||
DEBUG=$(config_get "$section" debug)
|
DEBUG=$(config_get "$section" debug)
|
||||||
}
|
}
|
||||||
|
|
||||||
check_cron
|
check_cron
|
||||||
|
|
@ -337,8 +337,8 @@ config_load acme
|
||||||
config_foreach load_vars acme
|
config_foreach load_vars acme
|
||||||
|
|
||||||
if [ -z "$STATE_DIR" ] || [ -z "$ACCOUNT_EMAIL" ]; then
|
if [ -z "$STATE_DIR" ] || [ -z "$ACCOUNT_EMAIL" ]; then
|
||||||
err "state_dir and account_email must be set"
|
err "state_dir and account_email must be set"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
[ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
|
[ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue