Skip to content

Commit 676d766

Browse files
NeilpangNeilpang
authored
Merge pull request #6328 from acmesh-official/dev
sync
2 parents 1d87d9b + 1d18432 commit 676d766

File tree

3 files changed

+248
-15
lines changed

3 files changed

+248
-15
lines changed

‎Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM alpine:3.17
1+
FROM alpine:3.21
22

33
RUN apk --no-cache add -f \
44
openssl \

‎deploy/vault.sh

Lines changed: 84 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -80,52 +80,122 @@ vault_deploy() {
8080
if [ -n "$VAULT_RENEW_TOKEN" ]; then
8181
URL="$VAULT_ADDR/v1/auth/token/renew-self"
8282
_info "Renew the Vault token to default TTL"
83-
if ! _post "" "$URL" >/dev/null; then
83+
_response=$(_post "" "$URL")
84+
if [ "$?" != "0" ]; then
8485
_err "Failed to renew the Vault token"
8586
return 1
8687
fi
88+
if echo "$_response" | grep -q '"errors":\['; then
89+
_err "Failed to renew the Vault token: $_response"
90+
return 1
91+
fi
8792
fi
8893

8994
URL="$VAULT_ADDR/v1/$VAULT_PREFIX/$_cdomain"
9095

9196
if [ -n "$VAULT_FABIO_MODE" ]; then
9297
_info "Writing certificate and key to $URL in Fabio mode"
9398
if [ -n "$VAULT_KV_V2" ]; then
94-
_post "{ \"data\": {\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"} }" "$URL" >/dev/null || return 1
99+
_response=$(_post "{ \"data\": {\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"} }" "$URL")
100+
if [ "$?" != "0" ]; then return 1; fi
101+
if echo "$_response" | grep -q '"errors":\['; then
102+
_err "Vault error: $_response"
103+
return 1
104+
fi
95105
else
96-
_post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL" >/dev/null || return 1
106+
_response=$(_post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL")
107+
if [ "$?" != "0" ]; then return 1; fi
108+
if echo "$_response" | grep -q '"errors":\['; then
109+
_err "Vault error: $_response"
110+
return 1
111+
fi
97112
fi
98113
else
99114
if [ -n "$VAULT_KV_V2" ]; then
100115
_info "Writing certificate to $URL/cert.pem"
101-
_post "{\"data\": {\"value\": \"$_ccert\"}}" "$URL/cert.pem" >/dev/null || return 1
116+
_response=$(_post "{\"data\": {\"value\": \"$_ccert\"}}" "$URL/cert.pem")
117+
if [ "$?" != "0" ]; then return 1; fi
118+
if echo "$_response" | grep -q '"errors":\['; then
119+
_err "Vault error writing cert.pem: $_response"
120+
return 1
121+
fi
122+
102123
_info "Writing key to $URL/cert.key"
103-
_post "{\"data\": {\"value\": \"$_ckey\"}}" "$URL/cert.key" >/dev/null || return 1
124+
_response=$(_post "{\"data\": {\"value\": \"$_ckey\"}}" "$URL/cert.key")
125+
if [ "$?" != "0" ]; then return 1; fi
126+
if echo "$_response" | grep -q '"errors":\['; then
127+
_err "Vault error writing cert.key: $_response"
128+
return 1
129+
fi
130+
104131
_info "Writing CA certificate to $URL/ca.pem"
105-
_post "{\"data\": {\"value\": \"$_cca\"}}" "$URL/ca.pem" >/dev/null || return 1
132+
_response=$(_post "{\"data\": {\"value\": \"$_cca\"}}" "$URL/ca.pem")
133+
if [ "$?" != "0" ]; then return 1; fi
134+
if echo "$_response" | grep -q '"errors":\['; then
135+
_err "Vault error writing ca.pem: $_response"
136+
return 1
137+
fi
138+
106139
_info "Writing full-chain certificate to $URL/fullchain.pem"
107-
_post "{\"data\": {\"value\": \"$_cfullchain\"}}" "$URL/fullchain.pem" >/dev/null || return 1
140+
_response=$(_post "{\"data\": {\"value\": \"$_cfullchain\"}}" "$URL/fullchain.pem")
141+
if [ "$?" != "0" ]; then return 1; fi
142+
if echo "$_response" | grep -q '"errors":\['; then
143+
_err "Vault error writing fullchain.pem: $_response"
144+
return 1
145+
fi
108146
else
109147
_info "Writing certificate to $URL/cert.pem"
110-
_post "{\"value\": \"$_ccert\"}" "$URL/cert.pem" >/dev/null || return 1
148+
_response=$(_post "{\"value\": \"$_ccert\"}" "$URL/cert.pem")
149+
if [ "$?" != "0" ]; then return 1; fi
150+
if echo "$_response" | grep -q '"errors":\['; then
151+
_err "Vault error writing cert.pem: $_response"
152+
return 1
153+
fi
154+
111155
_info "Writing key to $URL/cert.key"
112-
_post "{\"value\": \"$_ckey\"}" "$URL/cert.key" >/dev/null || return 1
156+
_response=$(_post "{\"value\": \"$_ckey\"}" "$URL/cert.key")
157+
if [ "$?" != "0" ]; then return 1; fi
158+
if echo "$_response" | grep -q '"errors":\['; then
159+
_err "Vault error writing cert.key: $_response"
160+
return 1
161+
fi
162+
113163
_info "Writing CA certificate to $URL/ca.pem"
114-
_post "{\"value\": \"$_cca\"}" "$URL/ca.pem" >/dev/null || return 1
164+
_response=$(_post "{\"value\": \"$_cca\"}" "$URL/ca.pem")
165+
if [ "$?" != "0" ]; then return 1; fi
166+
if echo "$_response" | grep -q '"errors":\['; then
167+
_err "Vault error writing ca.pem: $_response"
168+
return 1
169+
fi
170+
115171
_info "Writing full-chain certificate to $URL/fullchain.pem"
116-
_post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem" >/dev/null || return 1
172+
_response=$(_post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem")
173+
if [ "$?" != "0" ]; then return 1; fi
174+
if echo "$_response" | grep -q '"errors":\['; then
175+
_err "Vault error writing fullchain.pem: $_response"
176+
return 1
177+
fi
117178
fi
118179

119180
# To make it compatible with the wrong ca path `chain.pem` which was used in former versions
120181
if _contains "$(_get "$URL/chain.pem")" "-----BEGIN CERTIFICATE-----"; then
121182
_err "The CA certificate has moved from chain.pem to ca.pem, if you don't depend on chain.pem anymore, you can delete it to avoid this warning"
122183
_info "Updating CA certificate to $URL/chain.pem for backward compatibility"
123184
if [ -n "$VAULT_KV_V2" ]; then
124-
_post "{\"data\": {\"value\": \"$_cca\"}}" "$URL/chain.pem" >/dev/null || return 1
185+
_response=$(_post "{\"data\": {\"value\": \"$_cca\"}}" "$URL/chain.pem")
186+
if [ "$?" != "0" ]; then return 1; fi
187+
if echo "$_response" | grep -q '"errors":\['; then
188+
_err "Vault error writing chain.pem: $_response"
189+
return 1
190+
fi
125191
else
126-
_post "{\"value\": \"$_cca\"}" "$URL/chain.pem" >/dev/null || return 1
192+
_response=$(_post "{\"value\": \"$_cca\"}" "$URL/chain.pem")
193+
if [ "$?" != "0" ]; then return 1; fi
194+
if echo "$_response" | grep -q '"errors":\['; then
195+
_err "Vault error writing chain.pem: $_response"
196+
return 1
197+
fi
127198
fi
128199
fi
129200
fi
130-
131201
}

‎dnsapi/dns_edgecenter.sh

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
#!/usr/bin/env sh
2+
# shellcheck disable=SC2034
3+
4+
# EdgeCenter DNS API integration for acme.sh
5+
# Author: Konstantin Ruchev <[email protected]>
6+
dns_edgecenter_info='edgecenter DNS API
7+
Site: https://edgecenter.ru
8+
Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_edgecenter
9+
Options:
10+
EDGECENTER_API_KEY auth APIKey'
11+
12+
EDGECENTER_API="https://api.edgecenter.ru"
13+
DOMAIN_TYPE=
14+
DOMAIN_MASTER=
15+
16+
######## Public functions #####################
17+
18+
#Usage: dns_edgecenter_add _acme-challenge.www.domain.com "TXT_RECORD_VALUE"
19+
dns_edgecenter_add() {
20+
fulldomain="$1"
21+
txtvalue="$2"
22+
23+
_info "Using EdgeCenter DNS API"
24+
25+
if ! _dns_edgecenter_init_check; then
26+
return 1
27+
fi
28+
29+
_debug "Detecting root zone for $fulldomain"
30+
if ! _get_root "$fulldomain"; then
31+
return 1
32+
fi
33+
34+
subdomain="${fulldomain%."$_zone"}"
35+
subdomain=${subdomain%.}
36+
37+
_debug "Zone: $_zone"
38+
_debug "Subdomain: $subdomain"
39+
_debug "TXT value: $txtvalue"
40+
41+
payload='{"resource_records": [ { "content": ["'"$txtvalue"'"] } ], "ttl": 60 }'
42+
_dns_edgecenter_http_api_call "post" "dns/v2/zones/$_zone/$subdomain.$_zone/txt" "$payload"
43+
44+
if _contains "$response" '"error":"rrset is already exists"'; then
45+
_debug "RRSet exists, merging values"
46+
_dns_edgecenter_http_api_call "get" "dns/v2/zones/$_zone/$subdomain.$_zone/txt"
47+
current="$response"
48+
newlist=""
49+
for v in $(echo "$current" | sed -n 's/.*"content":\["\([^"]*\)"\].*/\1/p'); do
50+
newlist="$newlist {\"content\":[\"$v\"]},"
51+
done
52+
newlist="$newlist{\"content\":[\"$txtvalue\"]}"
53+
putdata="{\"resource_records\":[${newlist}]}
54+
"
55+
_dns_edgecenter_http_api_call "put" "dns/v2/zones/$_zone/$subdomain.$_zone/txt" "$putdata"
56+
_info "Updated existing RRSet with new TXT value."
57+
return 0
58+
fi
59+
60+
if _contains "$response" '"exception":'; then
61+
_err "Record cannot be added."
62+
return 1
63+
fi
64+
65+
_info "TXT record added successfully."
66+
return 0
67+
}
68+
69+
#Usage: dns_edgecenter_rm _acme-challenge.www.domain.com "TXT_RECORD_VALUE"
70+
dns_edgecenter_rm() {
71+
fulldomain="$1"
72+
txtvalue="$2"
73+
74+
_info "Removing TXT record for $fulldomain"
75+
76+
if ! _dns_edgecenter_init_check; then
77+
return 1
78+
fi
79+
80+
if ! _get_root "$fulldomain"; then
81+
return 1
82+
fi
83+
84+
subdomain="${fulldomain%."$_zone"}"
85+
subdomain=${subdomain%.}
86+
87+
_dns_edgecenter_http_api_call "delete" "dns/v2/zones/$_zone/$subdomain.$_zone/txt"
88+
89+
if [ -z "$response" ]; then
90+
_info "TXT record deleted successfully."
91+
else
92+
_info "TXT record may not have been deleted: $response"
93+
fi
94+
return 0
95+
}
96+
97+
#################### Private functions below ##################################
98+
99+
_dns_edgecenter_init_check() {
100+
EDGECENTER_API_KEY="${EDGECENTER_API_KEY:-$(_readaccountconf_mutable EDGECENTER_API_KEY)}"
101+
if [ -z "$EDGECENTER_API_KEY" ]; then
102+
_err "EDGECENTER_API_KEY was not exported."
103+
return 1
104+
fi
105+
106+
_saveaccountconf_mutable EDGECENTER_API_KEY "$EDGECENTER_API_KEY"
107+
export _H1="Authorization: APIKey $EDGECENTER_API_KEY"
108+
109+
_dns_edgecenter_http_api_call "get" "dns/v2/clients/me/features"
110+
if ! _contains "$response" '"id":'; then
111+
_err "Invalid API key."
112+
return 1
113+
fi
114+
return 0
115+
}
116+
117+
_get_root() {
118+
domain="$1"
119+
i=1
120+
while true; do
121+
h=$(printf "%s" "$domain" | cut -d . -f "$i"-)
122+
if [ -z "$h" ]; then
123+
return 1
124+
fi
125+
_dns_edgecenter_http_api_call "get" "dns/v2/zones/$h"
126+
if ! _contains "$response" 'zone is not found'; then
127+
_zone="$h"
128+
return 0
129+
fi
130+
i=$((i + 1))
131+
done
132+
return 1
133+
}
134+
135+
_dns_edgecenter_http_api_call() {
136+
mtd="$1"
137+
endpoint="$2"
138+
data="$3"
139+
140+
export _H1="Authorization: APIKey $EDGECENTER_API_KEY"
141+
142+
case "$mtd" in
143+
get)
144+
response="$(_get "$EDGECENTER_API/$endpoint")"
145+
;;
146+
post)
147+
response="$(_post "$data" "$EDGECENTER_API/$endpoint")"
148+
;;
149+
delete)
150+
response="$(_post "" "$EDGECENTER_API/$endpoint" "" "DELETE")"
151+
;;
152+
put)
153+
response="$(_post "$data" "$EDGECENTER_API/$endpoint" "" "PUT")"
154+
;;
155+
*)
156+
_err "Unknown HTTP method $mtd"
157+
return 1
158+
;;
159+
esac
160+
161+
_debug "HTTP $mtd response: $response"
162+
return 0
163+
}

0 commit comments

Comments
 (0)