Skip to content

Commit eb5eaa7

Browse files
lodzendzatoah
lodzen
authored and
dzatoah
committed
Added dns challenge authentication for ipv64, Updated script to work behind NAT
1 parent 1fe84b3 commit eb5eaa7

File tree

4 files changed

+206
-39
lines changed

4 files changed

+206
-39
lines changed

‎settings.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ UNATTENDED_INSTALL=false
2828
#SSL_CHAIN_PATH_ECDSA=""
2929
#DHPARAM_PATH=""
3030

31+
# If you are running the script behind a NAT you need to specify it with true
32+
# make sure that the webserver are reachable from the internet via
33+
# port (80 only if http cert auth method is used), 443 & 5349 (TCP & UDP)
34+
BEHIND_NAT=""
35+
3136
# Collabora (Gets asked anyway, except unattended install.)
3237
SHOULD_INSTALL_COLLABORA=true
3338

@@ -40,6 +45,11 @@ SHOULD_INSTALL_CERTBOT=true
4045
SHOULD_INSTALL_UNATTENDEDUPGRADES=true
4146
SHOULD_INSTALL_MSMTP=true
4247

48+
#Select between http and ipv64 DNS Challenage
49+
CERTBOT_AUTH_METHOD=""
50+
#Becomes mandatory if Certbot Auth method ipv64 is specified
51+
IPV64_API_KEY=""
52+
4353
# Logfile get created if UNATTENDED_INSTALL is true.
4454
# Leave empty, if you wish that the user will be asked about this.
4555
LOGFILE_PATH="./setup-nextcloud-hpb-$(date +%Y-%m-%dT%H:%M:%SZ).log"

‎setup-nextcloud-hpb.sh‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ set -eo pipefail
77
# See settings.sh
88
DRY_RUN=false
99
UNATTENDED_INSTALL=false
10+
BEHIND_NAT="" # Ask user
1011
NEXTCLOUD_SERVER_FQDNS="" # Ask user
12+
CERTBOT_AUTH_METHOD="" # Ask user
1113
SERVER_FQDN="" # Ask user
1214
SSL_CERT_PATH_RSA="" # Will be auto filled, if not overriden by settings file.
1315
SSL_CERT_KEY_PATH_RSA="" # Will be auto filled, if not overriden by settings file.
@@ -65,6 +67,85 @@ function show_dialogs() {
6567
fi
6668
log "Using '$DRY_RUN' for DRY_RUN".
6769

70+
if [ "$BEHIND_NAT" = "" ]; then
71+
if [ "$UNATTENDED_INSTALL" = true ]; then
72+
log "Can't continue since this is a non-interactive installation and I'm missing BEHIND_NAT!"
73+
exit 1
74+
fi
75+
76+
if whiptail --title "Are you behind a NAT?" --yesno "Are you running the server $(
77+
)behind a NAT? Make sure that the ports (80 only if http cert auth method is used), 443 and 5349 (TCP & UDP) $(
78+
)are opened in the Firewall." 10 65 --defaultno; then
79+
BEHIND_NAT=true
80+
else
81+
BEHIND_NAT=false
82+
fi
83+
fi
84+
log "BEHIND_NAT '$BEHIND_NAT' selected.".
85+
86+
if [ "$CERTBOT_AUTH_METHOD" = "" ]; then
87+
CHOICES=$(whiptail --title "Select Certbot Authentication Method" \
88+
--menu "Use the space bar key to select/deselect the AUTH Method $(
89+
)you want to use." 15 90 2 \
90+
"1" "Use HTTP Challenge" \
91+
"2" "Use IPv64.net DNS Challenge" \
92+
3>&1 1>&2 2>&3 || true)
93+
94+
if [ -z "$CHOICES" ]; then
95+
log "No AUTH Method was selected (user hit Cancel or unselected all options) Exiting…"
96+
exit 0
97+
else
98+
for CHOICE in $CHOICES; do
99+
case "$CHOICE" in
100+
"1")
101+
CERTBOT_AUTH_METHOD="http"
102+
;;
103+
"2")
104+
CERTBOT_AUTH_METHOD="ipv64"
105+
;;
106+
*)
107+
log "Unsupported service $CHOICE!" >&2
108+
exit 1
109+
;;
110+
esac
111+
done
112+
fi
113+
fi
114+
log "Using '$CERTBOT_AUTH_METHOD' for CERTBOT_AUTH_METHOD".
115+
116+
IPV64_API_KEY_FILE="./credentials.ini"
117+
if [ "$CERTBOT_AUTH_METHOD" = "ipv64" ]; then
118+
if [ "$IPV64_API_KEY" = "" ]; then
119+
if [ "$UNATTENDED_INSTALL" = true ]; then
120+
log "Can't continue since this is a non-interactive installation and I'm" \
121+
"missing IPV64_API_KEY!"
122+
exit 1
123+
fi
124+
125+
IPV64_API_KEY_Old="123456789abcdefg123456789abcdefg"
126+
if [ -e "$IPV64_API_KEY_FILE" ]; then
127+
# Rebuilding dhparam file.
128+
IPV64_API_KEY_Old=$(sed -r "s#dns_ipv64_bearer_token = ?##gi" credentials.ini)
129+
fi
130+
IPV64_API_KEY=$(
131+
whiptail --title "IPV64.de API Key" \
132+
--inputbox "Please enter your IPV64.de API Key here. $(
133+
)" 12 65 \
134+
"$IPV64_API_KEY_Old" 3>&1 1>&2 2>&3
135+
)
136+
fi
137+
138+
if [ -e "$IPV64_API_KEY_FILE" ]; then
139+
# Rebuilding dhparam file.
140+
log "Removing old Credential file at '$IPV64_API_KEY_FILE'."
141+
rm -fv "$IPV64_API_KEY_FILE/credentials.ini" 2>&1 | tee -a "$LOGFILE_PATH"
142+
fi
143+
144+
touch credentials.ini
145+
echo "dns_ipv64_bearer_token = $IPV64_API_KEY" > "credentials.ini"
146+
log "Created credentials.ini at $IPV64_API_KEY_FILE"
147+
fi
148+
68149
if [ "$NEXTCLOUD_SERVER_FQDNS" = "" ]; then
69150
if [ "$UNATTENDED_INSTALL" = true ]; then
70151
log "Can't continue since this is a non-interactive installation and I'm" \

‎src/setup-certbot.sh‎

Lines changed: 103 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,30 @@ function run_certbot_command() {
3232
error_title_ratelimited="LetsEncrypt rate limit reached!"
3333

3434
# RSA certificate
35-
certbot_args=(certonly --nginx $arg_staging $arg_interactive $arg_dry_run
36-
--key-path "$SSL_CERT_KEY_PATH_RSA" --domains "$SERVER_FQDN"
37-
--fullchain-path "$SSL_CERT_PATH_RSA" --email "$EMAIL_USER_ADDRESS"
38-
--rsa-key-size 4096 --cert-name "$SERVER_FQDN"-rsa
39-
--chain-path "$SSL_CHAIN_PATH_RSA")
35+
case "$CERTBOT_AUTH_METHOD" in
36+
"http")
37+
certbot_args=(certonly --nginx $arg_staging $arg_interactive $arg_dry_run
38+
--key-path "$SSL_CERT_KEY_PATH_RSA" --domains "$SERVER_FQDN"
39+
--fullchain-path "$SSL_CERT_PATH_RSA" --email "$EMAIL_USER_ADDRESS"
40+
--rsa-key-size 4096 --cert-name "$SERVER_FQDN"-rsa
41+
--chain-path "$SSL_CHAIN_PATH_RSA")
42+
;;
43+
"ipv64")
44+
certbot_args=(certonly $arg_staging $arg_interactive $arg_dry_run
45+
--key-path "$SSL_CERT_KEY_PATH_RSA" --domains "$SERVER_FQDN"
46+
--fullchain-path "$SSL_CERT_PATH_RSA" --email "$EMAIL_USER_ADDRESS"
47+
--rsa-key-size 4096 --cert-name "$SERVER_FQDN"-rsa
48+
--chain-path "$SSL_CHAIN_PATH_RSA"
49+
--authenticator dns-ipv64
50+
--dns-ipv64-credentials "credentials.ini"
51+
--dns-ipv64-propagation-seconds 30)
52+
;;
53+
*)
54+
log "Unsupported AUTH Method $CERTBOT_AUTH_METHOD!" >&2
55+
exit 1
56+
;;
57+
esac
58+
4059

4160
log "Executing Certbot using arguments: '${certbot_args[@]}'…"
4261

@@ -62,11 +81,29 @@ function run_certbot_command() {
6281
fi
6382

6483
# ECDSA certificate
65-
certbot_args=(certonly --nginx $arg_staging $arg_interactive $arg_dry_run
66-
--key-path "$SSL_CERT_KEY_PATH_ECDSA" --domains "$SERVER_FQDN"
67-
--fullchain-path "$SSL_CERT_PATH_ECDSA" --email "$EMAIL_USER_ADDRESS"
68-
--key-type ecdsa --cert-name "$SERVER_FQDN"-ecdsa
69-
--chain-path "$SSL_CHAIN_PATH_ECDSA")
84+
case "$CERTBOT_AUTH_METHOD" in
85+
"http")
86+
certbot_args=(certonly --nginx $arg_staging $arg_interactive $arg_dry_run
87+
--key-path "$SSL_CERT_KEY_PATH_ECDSA" --domains "$SERVER_FQDN"
88+
--fullchain-path "$SSL_CERT_PATH_ECDSA" --email "$EMAIL_USER_ADDRESS"
89+
--key-type ecdsa --cert-name "$SERVER_FQDN"-ecdsa
90+
--chain-path "$SSL_CHAIN_PATH_ECDSA")
91+
;;
92+
"ipv64")
93+
certbot_args=(certonly $arg_staging $arg_interactive $arg_dry_run
94+
--key-path "$SSL_CERT_KEY_PATH_ECDSA" --domains "$SERVER_FQDN"
95+
--fullchain-path "$SSL_CERT_PATH_ECDSA" --email "$EMAIL_USER_ADDRESS"
96+
--key-type ecdsa --cert-name "$SERVER_FQDN"-ecdsa
97+
--chain-path "$SSL_CHAIN_PATH_ECDSA"
98+
--authenticator dns-ipv64
99+
--dns-ipv64-credentials "credentials.ini"
100+
--dns-ipv64-propagation-seconds 30)
101+
;;
102+
*)
103+
log "Unsupported AUTH Method $CERTBOT_AUTH_METHOD!" >&2
104+
exit 1
105+
;;
106+
esac
70107

71108
log "Executing Certbot using arguments: '${certbot_args[@]}'…"
72109

@@ -92,30 +129,30 @@ function run_certbot_command() {
92129
fi
93130

94131
# Force renewal of certificates
95-
certbot_args=(renew --force-renewal $arg_staging $arg_interactive $arg_dry_run)
132+
# certbot_args=(renew --force-renewal $arg_staging $arg_interactive $arg_dry_run)
96133

97-
log "Executing Certbot using arguments: '${certbot_args[@]}'…"
134+
# log "Executing Certbot using arguments: '${certbot_args[@]}'…"
98135

99-
if certbot "${certbot_args[@]}" |& tee -a $LOGFILE_PATH; then
100-
return 0
101-
else
102-
# Checking if Certbot reported rate limit error
103-
# Let the user decide if they want staging certificates (for testing
104-
# purposes for example).
105-
error_ratelimited="$(tail $LOGFILE_PATH | grep 'too many certificates (5) already issued for this exact set of domains in the last 168 hours')"
106-
if [ -n "$error_ratelimited" ]; then
107-
if [ "$UNATTENDED_INSTALL" != true ]; then
108-
if whiptail --title "$error_title_ratelimited" --defaultno \
109-
--yesno "$error_message_ratelimited $error_message_ratelimited_extra" 16 65 3>&1 1>&2 2>&3; then
110-
# Recursively call this function
111-
run_certbot_command "true"
112-
return 0
113-
fi
114-
else
115-
log "$error_message_ratelimited"
116-
fi
117-
fi
118-
fi
136+
# if certbot "${certbot_args[@]}" |& tee -a $LOGFILE_PATH; then
137+
# return 0
138+
# else
139+
# # Checking if Certbot reported rate limit error
140+
# # Let the user decide if they want staging certificates (for testing
141+
# # purposes for example).
142+
# error_ratelimited="$(tail $LOGFILE_PATH | grep 'too many certificates (5) already issued for this exact set of domains in the last 168 hours')"
143+
# if [ -n "$error_ratelimited" ]; then
144+
# if [ "$UNATTENDED_INSTALL" != true ]; then
145+
# if whiptail --title "$error_title_ratelimited" --defaultno \
146+
# --yesno "$error_message_ratelimited $error_message_ratelimited_extra" 16 65 3>&1 1>&2 2>&3; then
147+
# # Recursively call this function
148+
# run_certbot_command "true"
149+
# return 0
150+
# fi
151+
# else
152+
# log "$error_message_ratelimited"
153+
# fi
154+
# fi
155+
# fi
119156
}
120157

121158
function install_certbot() {
@@ -130,7 +167,27 @@ function install_certbot() {
130167

131168
function certbot_step1() {
132169
log "\nStep 1: Installing Certbot packages"
133-
packages_to_install=(python3-certbot-nginx certbot ssl-cert)
170+
if [ "$CERTBOT_AUTH_METHOD" = "" ]; then
171+
if [ "$UNATTENDED_INSTALL" = true ]; then
172+
log "Can't continue since this is a non-interactive installation and I'm" \
173+
"missing CERTBOT_AUTH_METHOD!"
174+
exit 1
175+
fi
176+
fi
177+
178+
case "$CERTBOT_AUTH_METHOD" in
179+
"http")
180+
packages_to_install=(python3-certbot-nginx certbot ssl-cert)
181+
;;
182+
"ipv64")
183+
packages_to_install=(git python3-setuptools python3-certbot-nginx certbot ssl-cert)
184+
;;
185+
*)
186+
log "Unsupported Certbot AUTH method: $CERTBOT_AUTH_METHOD!" >&2
187+
exit 1
188+
;;
189+
esac
190+
134191
if ! is_dry_run; then
135192
if [ "$UNATTENDED_INSTALL" == true ]; then
136193
log "Trying unattended install for Certbot."
@@ -139,6 +196,19 @@ function certbot_step1() {
139196
else
140197
apt-get install -y "${packages_to_install[@]}" 2>&1 | tee -a $LOGFILE_PATH
141198
fi
199+
if [ "$CERTBOT_AUTH_METHOD" = "ipv64" ]; then
200+
CERTBOT_PLUGIN_DIR="./certbot-dns-ipv64"
201+
if [ -e "$CERTBOT_PLUGIN_DIR" ]; then
202+
log "Deleted contents of '$CERTBOT_PLUGIN_DIR'."
203+
rm -vrf "$CERTBOT_PLUGIN_DIR" 2>&1 | tee -a $LOGFILE_PATH || true
204+
fi
205+
git clone https://github.com/lodzen/certbot-dns-ipv64.git 2>&1 | tee -a $LOGFILE_PATH
206+
cd certbot-dns-ipv64
207+
git checkout fix-dns-zone 2>&1 | tee -a $LOGFILE_PATH
208+
python3 ./setup.py build 2>&1 | tee -a $LOGFILE_PATH
209+
python3 ./setup.py install 2>&1 | tee -a $LOGFILE_PATH
210+
cd ../
211+
fi
142212
else
143213
log "Would have installed '${packages_to_install[@]}' via APT now."
144214
fi

‎src/setup-signaling.sh‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -550,13 +550,19 @@ function signaling_step4() {
550550
log "Replacing '<DHPARAM_PATH>' with '$DHPARAM_PATH'…"
551551
sed -i "s|<DHPARAM_PATH>|$DHPARAM_PATH|g" "$TMP_DIR_PATH"/signaling/*
552552

553-
EXTERN_IPv4=$(wget -4 ident.me -O - -o /dev/null || true)
554-
log "Replacing '<SIGNALING_COTURN_EXTERN_IPV4>' with '$EXTERN_IPv4'…"
555-
sed -i "s|<SIGNALING_COTURN_EXTERN_IPV4>|$EXTERN_IPv4|g" "$TMP_DIR_PATH"/signaling/*
553+
if [ "$BEHIND_NAT" = true ]; then
554+
log "Running behind NAT, commenting out external IP's for TURN"
555+
sed -i "/<SIGNALING_COTURN_EXTERN_IPV4>/,/<SIGNALING_COTURN_EXTERN_IPV6>/s/^/#/" "$TMP_DIR_PATH"/signaling/*
556+
sed -i "s|listening-ip=127.0.0.1|listening-ip=0.0.0.0|g" "$TMP_DIR_PATH"/signaling/*
557+
else
558+
EXTERN_IPv4=$(wget -4 ident.me -O - -o /dev/null || true)
559+
log "Replacing '<SIGNALING_COTURN_EXTERN_IPV4>' with '$EXTERN_IPv4'…"
560+
sed -i "s|<SIGNALING_COTURN_EXTERN_IPV4>|$EXTERN_IPv4|g" "$TMP_DIR_PATH"/signaling/*
556561

557-
EXTERN_IPv6=$(wget -6 ident.me -O - -o /dev/null || true)
558-
log "Replacing '<SIGNALING_COTURN_EXTERN_IPV6>' with '$EXTERN_IPv6'…"
559-
sed -i "s|<SIGNALING_COTURN_EXTERN_IPV6>|$EXTERN_IPv6|g" "$TMP_DIR_PATH"/signaling/*
562+
EXTERN_IPv6=$(wget -6 ident.me -O - -o /dev/null || true)
563+
log "Replacing '<SIGNALING_COTURN_EXTERN_IPV6>' with '$EXTERN_IPv6'…"
564+
sed -i "s|<SIGNALING_COTURN_EXTERN_IPV6>|$EXTERN_IPv6|g" "$TMP_DIR_PATH"/signaling/*
565+
fi
560566
}
561567

562568
function signaling_step5() {

0 commit comments

Comments
 (0)