From 778ee02803098904be7dc5ec608665ad56060215 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Mon, 7 Nov 2022 23:43:37 +0100
Subject: [PATCH 001/174] update documentation for --cert-home

Although the main use-case may be the --install command, this command
also proves to be useful for the --signcsr and --issue commands.
---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index d6d8e48c..9d6dfecc 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6897,7 +6897,7 @@ Parameters:
 
   --accountconf <file>              Specifies a customized account config file.
   --home <directory>                Specifies the home dir for $PROJECT_NAME.
-  --cert-home <directory>           Specifies the home dir to save all the certs, only valid for '--install' command.
+  --cert-home <directory>           Specifies the home dir to save all the certs.
   --config-home <directory>         Specifies the home dir to save all the configurations.
   --useragent <string>              Specifies the user agent string. it will be saved for future use too.
   -m, --email <email>               Specifies the account email, only valid for the '--install' and '--update-account' command.

From ed72b090af3fce68195b7ab3d605d70831fca45d Mon Sep 17 00:00:00 2001
From: Keith Chiem <chiem@home.chiem.net>
Date: Wed, 18 Oct 2023 20:32:39 -0700
Subject: [PATCH 002/174] deploy hook for Ruckus ZoneDirector / Unleashed

---
 deploy/ruckus.sh | 110 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100755 deploy/ruckus.sh

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
new file mode 100755
index 00000000..d16f40e4
--- /dev/null
+++ b/deploy/ruckus.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+
+# Here is a script to deploy cert to Ruckus Zone Director/Unleashed.
+#
+# Adapted from:
+# https://ms264556.net/pages/PfSenseLetsEncryptToRuckus
+#
+# ```sh
+# acme.sh --deploy -d ruckus.example.com --deploy-hook ruckus
+# ```
+#
+# Then you need to set the environment variables for the
+# deploy script to work.
+#
+# ```sh
+# export RUCKUS_HOST=ruckus.example.com
+# export RUCKUS_USER=myruckususername
+# export RUCKUS_PASS=myruckuspassword
+#
+# acme.sh --deploy -d ruckus.example.com --deploy-hook ruckus
+# ```
+#
+# returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+ruckus_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+  _err_code=0
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  _getdeployconf RUCKUS_HOST
+  _getdeployconf RUCKUS_USER
+  _getdeployconf RUCKUS_PASS
+
+  if [ -z "$RUCKUS_HOST" ]; then
+    _debug "Using _cdomain as RUCKUS_HOST, please set if not correct."
+    RUCKUS_HOST="$_cdomain"
+  fi
+
+  if [ -z "$RUCKUS_USER" ]; then
+    _err "Need to set the env variable RUCKUS_USER"
+    return 1
+  fi
+
+  if [ -z "$RUCKUS_PASS" ]; then
+    _err "Need to set the env variable RUCKUS_PASS"
+    return 1
+  fi
+
+  _savedeployconf RUCKUS_HOST "$RUCKUS_HOST"
+  _savedeployconf RUCKUS_USER "$RUCKUS_USER"
+  _savedeployconf RUCKUS_PASS "$RUCKUS_PASS"
+
+  _debug RUCKUS_HOST "$RUCKUS_HOST"
+  _debug RUCKUS_USER "$RUCKUS_USER"
+  _debug RUCKUS_PASS "$RUCKUS_PASS"
+
+  COOKIE_JAR=$(mktemp)
+  cleanup() {
+    rm $COOKIE_JAR
+  }
+  trap cleanup EXIT
+
+  LOGIN_URL=$(curl https://$RUCKUS_HOST -ksSLo /dev/null -w '%{url_effective}')
+  _debug LOGIN_URL "$LOGIN_URL"
+
+  XSS=$(curl -ksSic $COOKIE_JAR $LOGIN_URL -d username=$RUCKUS_USER -d password="$RUCKUS_PASS" -d ok='Log In' | awk '/^HTTP_X_CSRF_TOKEN:/ { print $2 }' | tr -d '\040\011\012\015')
+  _debug XSS "$XSS"
+
+  if [ -n "$XSS" ]; then
+    _info "Authentication successful"
+  else
+    _err "Authentication failed"
+    return 1
+  fi
+
+  BASE_URL=$(dirname $LOGIN_URL)
+  CONF_ARGS="-ksSo /dev/null -b $COOKIE_JAR -c $COOKIE_JAR"
+  UPLOAD="$CONF_ARGS $BASE_URL/_upload.jsp?request_type=xhr"
+  CMD="$CONF_ARGS $BASE_URL/_cmdstat.jsp"
+
+  REPLACE_CERT_AJAX='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
+  CERT_REBOOT_AJAX='<ajax-request action="docmd" comp="worker" updater="rid.0.5" xcmd="cert-reboot" checkAbility="6"><xcmd cmd="cert-reboot" action="undefined"/></ajax-request>'
+
+  _info "Uploading certificate"
+  curl $UPLOAD -H "X-CSRF-Token: $XSS" -F "u=@$_ccert" -F action=uploadcert -F callback=uploader_uploadcert || return 1
+
+  _info "Uploading private key"
+  curl $UPLOAD -H "X-CSRF-Token: $XSS" -F "u=@$_ckey" -F action=uploadprivatekey -F callback=uploader_uploadprivatekey || return 1
+
+  _info "Replacing certificate"
+  curl $CMD -H "X-CSRF-Token: $XSS" --data-raw "$REPLACE_CERT_AJAX" || return 1
+
+  _info "Rebooting"
+  curl $CMD -H "X-CSRF-Token: $XSS" --data-raw "$CERT_REBOOT_AJAX" || return 1
+
+  return 0
+}
+

From 517baa3235cb5f94ffa866884cd65fa1147c3d10 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Mon, 29 Apr 2024 22:54:31 +1000
Subject: [PATCH 003/174] test DNS for v2 (actual)

---
 dnsapi/dns_selectel.sh | 479 +++++++++++++++++++++++++++++++++++------
 1 file changed, 418 insertions(+), 61 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 1b09882d..f5b6b1b9 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -1,10 +1,29 @@
 #!/usr/bin/env sh
 
+# переменные, которые должны быть определены перед запуском
+#   export SL_Ver="v1"                    - версия API: 'v2' (actual) или 'v1' (legacy).
+#                                           По-умолчанию: v2
+# Если SL_Ver="v1"
+#   export SL_Key="API_KEY"               - Токен Selectel (API key)
+#                                           Посмотреть или создать можно в панели управления в правом верхнем углу откройте меню Профиль и настройки -> Ключи API.
+#                                           https://my.selectel.ru/profile/apikeys
+# Если SL_Ver="v2"
+#   export SL_Expire=60                   - время жизни token в минутах (0-1440).
+#                                           По-умолчанию: 1400 минут
+#   export SL_Login_ID=<account_id>       - номер аккаунта в панели управления;
+#   export SL_Project_Name=<project_name> - имя проекта.
+#   export SL_Login_name=<username>       - имя сервисного пользователя. Посмотреть имя можно в панели управления:
+#                                           в правом верхнем углу откройте меню → Профиль и настройки → раздел Управление пользователями → вкладка Сервисные пользователи
+#   export SL_Pswd='pswd'                 - пароль сервисного пользователя, можно посмотреть при создании пользователя или изменить на новый.
+# Все эти переменные будут сохранены ~/.acme.sh/account.conf  и будут использоваться повторно при необходимости.
 #
-#SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-#
+# Авторизация описана в:
+#   https://developers.selectel.ru/docs/control-panel/authorization/
+#   https://developers.selectel.com/docs/control-panel/authorization/
 
-SL_Api="https://api.selectel.ru/domains/v1"
+SL_Api="https://api.selectel.ru/domains"
+auth_uri="https://cloud.api.selcloud.ru/identity/v3/auth/tokens"
+_sl_sep='#'
 
 ########  Public functions #####################
 
@@ -13,17 +32,16 @@ dns_selectel_add() {
   fulldomain=$1
   txtvalue=$2
 
-  SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
-
-  if [ -z "$SL_Key" ]; then
-    SL_Key=""
-    _err "You don't specify selectel.ru api key yet."
-    _err "Please create you key and try again."
+  #if ! _sl_init_vars; then
+  if ! _sl_init_vars; then
     return 1
   fi
-
-  #save the api key to the account conf file.
-  _saveaccountconf_mutable SL_Key "$SL_Key"
+  _debug2 SL_Ver "$SL_Ver"
+  _secure_debug3 SL_Key "$SL_Key"
+  _debug2 SL_Expire "$SL_Expire"
+  _debug2 SL_Login_Name "$SL_Login_Name"
+  _debug2 SL_Login_ID "$SL_Login_ID"
+  _debug2 SL_Project_Name "$SL_Project_Name"
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -35,11 +53,68 @@ dns_selectel_add() {
   _debug _domain "$_domain"
 
   _info "Adding record"
-  if _sl_rest POST "/$_domain_id/records/" "{\"type\": \"TXT\", \"ttl\": 60, \"name\": \"$fulldomain\", \"content\": \"$txtvalue\"}"; then
-    if _contains "$response" "$txtvalue" || _contains "$response" "record_already_exists"; then
+  if [ "$SL_Ver" = "v2" ]; then
+    _ext_srv1="/zones/"
+    _ext_srv2="/rrset/"
+    _text_tmp=$(echo "$txtvalue" | sed -En "s/[\"]*([^\"]*)/\1/p")
+    _debug txtvalue "$txtvalue"
+    _text_tmp='\"'$_text_tmp'\"'
+    _debug _text_tmp "$_text_tmp"
+    _data="{\"type\": \"TXT\", \"ttl\": 60, \"name\": \"${fulldomain}.\", \"records\": [{\"content\":\"$_text_tmp\"}]}"
+  elif [ "$SL_Ver" = "v1" ]; then
+    _ext_srv1="/"
+    _ext_srv2="/records/"
+    _data="{\"type\":\"TXT\",\"ttl\":60,\"name\":\"$fulldomain\",\"content\":\"$txtvalue\"}"
+  else
+    #not valid
+    _err "Error. Unsupported version API $SL_Ver"
+    return 1
+  fi
+  _ext_uri="${_ext_srv1}$_domain_id${_ext_srv2}"
+  _debug3 _ext_uri "$_ext_uri"
+  _debug3 _data "$_data"
+
+  if _sl_rest POST "$_ext_uri" "$_data"; then
+    if _contains "$response" "$txtvalue"; then
       _info "Added, OK"
       return 0
     fi
+    if _contains "$response" "already_exists"; then
+      # запись TXT с $fulldomain уже существует
+      if [ "$SL_Ver" = "v2" ]; then
+        # надо добавить к существующей записи еще один content
+        #
+        # считать записи rrset
+        _debug "Getting txt records"
+        _sl_rest GET "${_ext_uri}"
+        # Если в данной записи, есть текстовое значение $txtvalue,
+        # то все хорошо, добавлять ничего не надо и результат успешный
+        if _contains "$response" "$txtvalue"; then
+          _info "Added, OK"
+          _info "Txt record ${fulldomain} со значением ${txtvalue} already exists"
+          return 0
+        fi
+        # группа \1 - полная запись rrset; группа \2 - значение records:[{"content":"\"v1\""},{"content":"\"v2\""}",...], а именно {"content":"\"v1\""},{"content":"\"v2\""}",...
+        _record_seg="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\1/p")"
+        _record_array="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\2/p")"
+        # record id
+        _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
+        _tmp_str="${_record_array},{\"content\":\"${_text_tmp}\"}"
+        _data="{\"ttl\": 60, \"records\": [${_tmp_str}]}"
+        _debug3 _record_seg "$_record_seg"
+        _debug3 _record_array "$_record_array"
+        _debug3 _record_array "$_record_id"
+        _debug3 _data "$_data"
+        # вызов REST API PATCH
+        if _sl_rest PATCH "${_ext_uri}${_record_id}" "$_data"; then
+          _info "Added, OK"
+          return 0
+        fi
+      elif [ "$SL_Ver" = "v1" ]; then
+        _info "Added, OK"
+        return 0
+      fi
+    fi
   fi
   _err "Add txt record error."
   return 1
@@ -49,16 +124,17 @@ dns_selectel_add() {
 dns_selectel_rm() {
   fulldomain=$1
   txtvalue=$2
-
-  SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
-
-  if [ -z "$SL_Key" ]; then
-    SL_Key=""
-    _err "You don't specify slectel api key yet."
-    _err "Please create you key and try again."
+  #SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
+  if ! _sl_init_vars "nosave"; then
     return 1
   fi
-
+  _debug2 SL_Ver "$SL_Ver"
+  _secure_debug3 SL_Key "$SL_Key"
+  _debug2 SL_Expire "$SL_Expire"
+  _debug2 SL_Login_Name "$SL_Login_Name"
+  _debug2 SL_Login_ID "$SL_Login_ID"
+  _debug2 SL_Project_Name "$SL_Project_Name"
+  #
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
@@ -67,32 +143,90 @@ dns_selectel_rm() {
   _debug _domain_id "$_domain_id"
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
-
+  #
+  if [ "$SL_Ver" = "v2" ]; then
+    _ext_srv1="/zones/"
+    _ext_srv2="/rrset/"
+  elif [ "$SL_Ver" = "v1" ]; then
+    _ext_srv1="/"
+    _ext_srv2="/records/"
+  else
+    #not valid
+    _err "Error. Unsupported version API $SL_Ver"
+    return 1
+  fi
+  #
   _debug "Getting txt records"
-  _sl_rest GET "/${_domain_id}/records/"
-
+  _ext_uri="${_ext_srv1}$_domain_id${_ext_srv2}"
+  _debug3 _ext_uri "$_ext_uri"
+  _sl_rest GET "${_ext_uri}"
+  #
   if ! _contains "$response" "$txtvalue"; then
     _err "Txt record not found"
     return 1
   fi
-
-  _record_seg="$(echo "$response" | _egrep_o "[^{]*\"content\" *: *\"$txtvalue\"[^}]*}")"
-  _debug2 "_record_seg" "$_record_seg"
+  #
+  if [ "$SL_Ver" = "v2" ]; then
+    _record_seg="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\1/gp")"
+    _record_arr="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\3/p")"
+    #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2)"
+  elif [ "$SL_Ver" = "v1" ]; then
+    _record_seg="$(echo "$response" | _egrep_o "[^{]*\"content\" *: *\"$txtvalue\"[^}]*}")"
+    # record id
+    #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2)"
+  else
+    #not valid
+    _err "Error. Unsupported version API $SL_Ver"
+    return 1
+  fi
+  _debug3 "_record_seg" "$_record_seg"
   if [ -z "$_record_seg" ]; then
     _err "can not find _record_seg"
     return 1
   fi
-
-  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2)"
-  _debug2 "_record_id" "$_record_id"
+  # record id
+  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
   if [ -z "$_record_id" ]; then
     _err "can not find _record_id"
     return 1
   fi
-
-  if ! _sl_rest DELETE "/$_domain_id/records/$_record_id"; then
-    _err "Delete record error."
-    return 1
+  _debug3 "_record_id" "$_record_id"
+  # delete all record type TXT with text $txtvalue
+  if [ "$SL_Ver" = "v2" ]; then
+    # actual
+    #del_txt='it47Qq60vJuzQJXb9WEaapciTwtt1gb_14gm1ubwzrA';
+    _new_arr="$(echo "$_record_seg" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\3/gp" | sed -En "s/(\},\{)/}\n{/gp" | sed "/${txtvalue}/d" | sed ":a;N;s/\n/,/;ta")"
+    # uri record for DEL or PATCH
+    _del_uri="${_ext_uri}${_record_id}"
+    if [ -z "$_new_arr" ]; then
+      # удалить запись
+      if ! _sl_rest DELETE "${_del_uri}"; then
+        _err "Delete record error: ${_del_uri}."
+      else
+        info "Delete record success: ${_del_uri}."
+      fi
+    else
+      # обновить запись, удалив content
+      _data="{\"ttl\": 60, \"records\": [${_new_arr}]}"
+      _debug3 _data "$_data"
+      # вызов REST API PATCH
+      if _sl_rest PATCH "${_del_uri}" "$_data"; then
+        _info "Patched, OK: ${_del_uri}"
+      else
+        _err "Patched record error: ${_del_uri}."
+      fi
+    fi
+  else
+    # legacy
+    for _one_id in $_record_id; do
+      _del_uri="${_ext_uri}${_one_id}"
+      _debug2 _ext_uri "$_del_uri"
+      if ! _sl_rest DELETE "${_del_uri}"; then
+        _err "Delete record error: ${_del_uri}."
+      else
+        info "Delete record success: ${_del_uri}."
+      fi
+    done
   fi
   return 0
 }
@@ -105,51 +239,114 @@ dns_selectel_rm() {
 # _domain_id=sdjkglgdfewsdfg
 _get_root() {
   domain=$1
+  #
+  if [ "$SL_Ver" = 'v1' ]; then
+    # version API 1
+    if ! _sl_rest GET "/"; then
+      return 1
+    fi
+    i=2
+    p=1
+    while true; do
+      #h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+      h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+      _debug h "$h"
+      if [ -z "$h" ]; then
+        #not valid
+        return 1
+      fi
 
-  if ! _sl_rest GET "/"; then
+      if _contains "$response" "\"name\" *: *\"$h\","; then
+        #_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
+        _domain=$h
+        _debug "Getting domain id for $h"
+        if ! _sl_rest GET "/$h"; then
+          _err "Error read records of all domains $SL_Ver"
+          return 1
+        fi
+        _domain_id="$(echo "$response" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\":" | cut -d : -f 2)"
+        return 0
+      fi
+      p=$i
+      i=$(_math "$i" + 1)
+    done
+    _err "Error read records of all domains $SL_Ver"
     return 1
-  fi
-
-  i=2
-  p=1
-  while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
-    _debug h "$h"
-    if [ -z "$h" ]; then
+  elif [ "$SL_Ver" = "v2" ]; then
+    # version API 2
+    _ext_uri='/zones/'
+    domain="${domain}."
+    _debug "domain:: " "$domain"
+    # read records of all domains
+    if ! _sl_rest GET "$_ext_uri"; then
       #not valid
+      _err "Error read records of all domains $SL_Ver"
       return 1
     fi
-
-    if _contains "$response" "\"name\" *: *\"$h\","; then
-      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
-      _domain=$h
-      _debug "Getting domain id for $h"
-      if ! _sl_rest GET "/$h"; then
+    i=2
+    p=1
+    while true; do
+      h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+      _debug h "$h"
+      if [ -z "$h" ]; then
+        #not valid
+        _err "The domain was not found among the registered ones"
         return 1
       fi
-      _domain_id="$(echo "$response" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\":" | cut -d : -f 2)"
-      return 0
-    fi
-    p=$i
-    i=$(_math "$i" + 1)
-  done
-  return 1
+
+      _domain_record=$(echo "$response" | sed -En "s/.*(\{[^}]*id[^}]*\"name\" *: *\"$h\"[^}]*}).*/\1/p")
+      _debug "_domain_record:: " "$_domain_record"
+      if [ -n "$_domain_record" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
+        _domain=$h
+        _debug "Getting domain id for $h"
+        #_domain_id="$(echo "$_domain_record" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\":" | cut -d : -f 2 | sed -En "s/\"([^\"]*)\"/\1\p")"
+        _domain_id=$(echo "$_domain_record" | sed -En "s/\{[^}]*\"id\" *: *\"([^\"]*)\"[^}]*\}/\1/p")
+        return 0
+      fi
+      p=$i
+      i=$(_math "$i" + 1)
+    done
+    #not valid
+    _err "Error read records of all domains $SL_Ver"
+    return 1
+  else
+    #not valid
+    _err "Error. Unsupported version API $SL_Ver"
+    return 1
+  fi
 }
 
+#################################################################
+# use: method add_url body
 _sl_rest() {
   m=$1
   ep="$2"
   data="$3"
-  _debug "$ep"
 
-  export _H1="X-Token: $SL_Key"
+  _token=$(_get_auth_token)
+  #_debug "$_token"
+  if [ -z "$_token" ]; then
+    _err "BAD key or token $ep"
+    return 1
+  fi
+  if [ "$SL_Ver" = v2 ]; then
+    _h1_name="X-Auth-Token"
+  else
+    _h1_name='X-Token'
+  fi
+  export _H1="${_h1_name}: ${_token}"
   export _H2="Content-Type: application/json"
+  _debug3 "Full URI: " "$SL_Api/${SL_Ver}${ep}"
+  _debug3 "_H1:" "$_H1"
+  _debug3 "_H2:" "$_H2"
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"
-    response="$(_post "$data" "$SL_Api/$ep" "" "$m")"
+    response="$(_post "$data" "$SL_Api/${SL_Ver}${ep}" "" "$m")"
   else
-    response="$(_get "$SL_Api/$ep")"
+    response="$(_get "$SL_Api/${SL_Ver}${ep}")"
   fi
 
   if [ "$?" != "0" ]; then
@@ -159,3 +356,163 @@ _sl_rest() {
   _debug2 response "$response"
   return 0
 }
+
+#################################################################3
+# use:
+_get_auth_token() {
+  if [ "$SL_Ver" = 'v1' ]; then
+    # token for v1
+    _debug "Token v1"
+    _token_keystone=$SL_Key
+  elif [ "$SL_Ver" = 'v2' ]; then
+    # token for v2. Get a token for calling the API
+    _debug "Keystone Token v2"
+    token_v2=$(_readaccountconf_mutable SL_Token_V2)
+    if [ -n "$token_v2" ]; then
+      # The structure with the token was considered. Let's check its validity
+      # field 1 - SL_Login_Name
+      # field 2 - token keystone
+      # field 3 - SL_Login_ID
+      # field 4 - SL_Project_Name
+      # field 5 - Receipt time
+      # separator - ';'
+      _login_name=$(_getfield "$token_v2" 1 "$_sl_sep")
+      _token_keystone=$(_getfield "$token_v2" 2 "$_sl_sep")
+      _project_name=$(_getfield "$token_v2" 4 "$_sl_sep")
+      _receipt_time=$(_getfield "$token_v2" 5 "$_sl_sep")
+      _login_id=$(_getfield "$token_v2" 3 "$_sl_sep")
+      _debug3 _login_name "$_login_name"
+      _debug3 _login_id "$_login_id"
+      _debug3 _project_name "$_project_name"
+      _debug3 _receipt_time "$(date -d @"$_receipt_time" -u)"
+      # check the validity of the token for the user and the project and its lifetime
+      #_dt_diff_minute=$(( ( $(EPOCHSECONDS)-$_receipt_time )/60 ))
+      _dt_diff_minute=$((($(date +%s) - _receipt_time) / 60))
+      _debug3 _dt_diff_minute "$_dt_diff_minute"
+      [ "$_dt_diff_minute" -gt "$SL_Expire" ] && unset _token_keystone
+      if [ "$_project_name" != "$SL_Project_Name" ] || [ "$_login_name" != "$SL_Login_Name" ] || [ "$_login_id" != "$SL_Login_ID" ]; then
+        unset _token_keystone
+      fi
+      _debug "Get exists token"
+    fi
+    if [ -z "$_token_keystone" ]; then
+      # the previous token is incorrect or was not received, get a new one
+      _debug "Update (get new) token"
+      _data_auth="{\"auth\":{\"identity\":{\"methods\":[\"password\"],\"password\":{\"user\":{\"name\":\"${SL_Login_Name}\",\"domain\":{\"name\":\"${SL_Login_ID}\"},\"password\":\"${SL_Pswd}\"}}},\"scope\":{\"project\":{\"name\":\"${SL_Project_Name}\",\"domain\":{\"name\":\"${SL_Login_ID}\"}}}}}"
+      #_secure_debug2 "_data_auth" "$_data_auth"
+      export _H1="Content-Type: application/json"
+      # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+      _result=$(_post "$_data_auth" "$auth_uri")
+      _token_keystone=$(grep 'x-subject-token' "$HTTP_HEADER" | sed -nE "s/[[:space:]]*x-subject-token:[[:space:]]*([[:print:]]*)(\r*)/\1/p")
+      #echo $_token_keystone > /root/123456.qwe
+      #_dt_curr=$EPOCHSECONDS
+      _dt_curr=$(date +%s)
+      SL_Token_V2="${SL_Login_Name}${_sl_sep}${_token_keystone}${_sl_sep}${SL_Login_ID}${_sl_sep}${SL_Project_Name}${_sl_sep}${_dt_curr}"
+      _saveaccountconf_mutable SL_Token_V2 "$SL_Token_V2"
+    fi
+  else
+    # token set empty for unsupported version API
+    _token_keystone=""
+  fi
+  printf -- "%s" "$_token_keystone"
+}
+
+#################################################################
+# use: [non_save]
+_sl_init_vars() {
+  _non_save="${1}"
+  _debug2 _non_save "$_non_save"
+
+  _debug "First init variables"
+  # version API
+  SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
+  if [ -z "$SL_Ver" ]; then
+    SL_Ver="v2"
+  fi
+  if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
+    _err "You don't specify selectel.ru API version."
+    _err "Please define specify API version."
+  fi
+  _debug2 SL_Ver "$SL_Ver"
+
+  if [ "$SL_Ver" = "v1" ]; then
+    # token
+    SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
+
+    if [ -z "$SL_Key" ]; then
+      SL_Key=""
+      _err "You don't specify selectel.ru api key yet."
+      _err "Please create you key and try again."
+      return 1
+    fi
+    #save the api key to the account conf file.
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Key "$SL_Key"
+    fi
+  elif [ "$SL_Ver" = "v2" ]; then
+    # time expire token
+    SL_Expire="${SL_Expire:-$(_readaccountconf_mutable SL_Expire)}"
+    if [ -z "$SL_Expire" ]; then
+      SL_Expire=1400 # 23h 20 min
+    fi
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Expire "$SL_Expire"
+    fi
+    # login service user
+    SL_Login_Name="${SL_Login_Name:-$(_readaccountconf_mutable SL_Login_Name)}"
+    if [ -z "$SL_Login_Name" ]; then
+      SL_Login_Name=''
+      _err "You did not specify the selectel.ru API service user name."
+      _err "Please provide a service user name and try again."
+      return 1
+    fi
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Login_Name "$SL_Login_Name"
+    fi
+    # user ID
+    SL_Login_ID="${SL_Login_ID:-$(_readaccountconf_mutable SL_Login_ID)}"
+    if [ -z "$SL_Login_ID" ]; then
+      SL_Login_ID=''
+      _err "You did not specify the selectel.ru API user ID."
+      _err "Please provide a user ID and try again."
+      return 1
+    fi
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Login_ID "$SL_Login_ID"
+    fi
+    # project name
+    SL_Project_Name="${SL_Project_Name:-$(_readaccountconf_mutable SL_Project_Name)}"
+    if [ -z "$SL_Project_Name" ]; then
+      SL_Project_Name=''
+      _err "You did not specify the project name."
+      _err "Please provide a project name and try again."
+      return 1
+    fi
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Project_Name "$SL_Project_Name"
+    fi
+    # service user password
+    SL_Pswd="${SL_Pswd:-$(_readaccountconf_mutable SL_Pswd)}"
+    #_secure_debug3 SL_Pswd "$SL_Pswd"
+    if [ -z "$SL_Pswd" ]; then
+      SL_Pswd=''
+      _err "You did not specify the service user password."
+      _err "Please provide a service user password and try again."
+      return 1
+    fi
+    if [ -z "$_non_save" ]; then
+      _saveaccountconf_mutable SL_Pswd "$SL_Pswd" "12345678"
+    fi
+  else
+    SL_Ver=""
+    _err "You also specified the wrong version of the selectel.ru API."
+    _err "Please provide the correct API version and try again."
+    return 1
+  fi
+
+  if [ -z "$_non_save" ]; then
+    _saveaccountconf_mutable SL_Ver "$SL_Ver"
+  fi
+
+  return 0
+}

From 577920de863d7ee142cc86f925eca1d1526bf441 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 08:36:36 +1000
Subject: [PATCH 004/174] test DNS for v2 (actual) 001

---
 dnsapi/dns_selectel.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index f5b6b1b9..99f031dd 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -513,6 +513,5 @@ _sl_init_vars() {
   if [ -z "$_non_save" ]; then
     _saveaccountconf_mutable SL_Ver "$SL_Ver"
   fi
-
   return 0
 }

From 73fe47ba798d269f3082aa4ec5ca06c1f4f6fb1f Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 09:57:49 +1000
Subject: [PATCH 005/174] test DNS for v1 (legacy) 001

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 99f031dd..73210164 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -427,7 +427,7 @@ _sl_init_vars() {
   # version API
   SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
   if [ -z "$SL_Ver" ]; then
-    SL_Ver="v2"
+    SL_Ver="v1"
   fi
   if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
     _err "You don't specify selectel.ru API version."

From b8949ba3dd82f1846eef195e75700c148a91f214 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 10:01:50 +1000
Subject: [PATCH 006/174] test DNS for v1 (legacy) 002

---
 dnsapi/dns_selectel.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 73210164..04c9a388 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -513,5 +513,6 @@ _sl_init_vars() {
   if [ -z "$_non_save" ]; then
     _saveaccountconf_mutable SL_Ver "$SL_Ver"
   fi
+
   return 0
 }

From ada7e12b5a85297c42f6169e65612ac0cd2eb709 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 11:03:53 +1000
Subject: [PATCH 007/174] test DNS for v1 (legacy) 003

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 04c9a388..f5b6b1b9 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -427,7 +427,7 @@ _sl_init_vars() {
   # version API
   SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
   if [ -z "$SL_Ver" ]; then
-    SL_Ver="v1"
+    SL_Ver="v2"
   fi
   if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
     _err "You don't specify selectel.ru API version."

From 2e3c1ef4ac7f0d971f2afe4e18a9b07c5e0427ca Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 13:49:53 +1000
Subject: [PATCH 008/174] test DNS for v1 (legacy) 003

---
 dnsapi/dns_selectel.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index f5b6b1b9..99f031dd 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -513,6 +513,5 @@ _sl_init_vars() {
   if [ -z "$_non_save" ]; then
     _saveaccountconf_mutable SL_Ver "$SL_Ver"
   fi
-
   return 0
 }

From 8bb29f53d131f4761752a979d03270d650a260f1 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Tue, 30 Apr 2024 16:15:45 +1000
Subject: [PATCH 009/174] test DNS for v1 (legacy) 003

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 99f031dd..73210164 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -427,7 +427,7 @@ _sl_init_vars() {
   # version API
   SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
   if [ -z "$SL_Ver" ]; then
-    SL_Ver="v2"
+    SL_Ver="v1"
   fi
   if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
     _err "You don't specify selectel.ru API version."

From 7a1305c1bb3448ba6573101a0cd9854455b2084d Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Sat, 4 May 2024 19:12:42 +1000
Subject: [PATCH 010/174] fix del record for v1, delete one entry at a time

---
 dnsapi/dns_selectel.sh | 58 +++++++++---------------------------------
 1 file changed, 12 insertions(+), 46 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 73210164..4806773d 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -2,7 +2,7 @@
 
 # переменные, которые должны быть определены перед запуском
 #   export SL_Ver="v1"                    - версия API: 'v2' (actual) или 'v1' (legacy).
-#                                           По-умолчанию: v2
+#                                           По-умолчанию: v1
 # Если SL_Ver="v1"
 #   export SL_Key="API_KEY"               - Токен Selectel (API key)
 #                                           Посмотреть или создать можно в панели управления в правом верхнем углу откройте меню Профиль и настройки -> Ключи API.
@@ -32,7 +32,6 @@ dns_selectel_add() {
   fulldomain=$1
   txtvalue=$2
 
-  #if ! _sl_init_vars; then
   if ! _sl_init_vars; then
     return 1
   fi
@@ -66,7 +65,6 @@ dns_selectel_add() {
     _ext_srv2="/records/"
     _data="{\"type\":\"TXT\",\"ttl\":60,\"name\":\"$fulldomain\",\"content\":\"$txtvalue\"}"
   else
-    #not valid
     _err "Error. Unsupported version API $SL_Ver"
     return 1
   fi
@@ -83,29 +81,27 @@ dns_selectel_add() {
       # запись TXT с $fulldomain уже существует
       if [ "$SL_Ver" = "v2" ]; then
         # надо добавить к существующей записи еще один content
-        #
         # считать записи rrset
         _debug "Getting txt records"
         _sl_rest GET "${_ext_uri}"
-        # Если в данной записи, есть текстовое значение $txtvalue,
-        # то все хорошо, добавлять ничего не надо и результат успешный
+        # Уже есть значение $txtvalue, добавлять не надо
         if _contains "$response" "$txtvalue"; then
           _info "Added, OK"
           _info "Txt record ${fulldomain} со значением ${txtvalue} already exists"
           return 0
         fi
-        # группа \1 - полная запись rrset; группа \2 - значение records:[{"content":"\"v1\""},{"content":"\"v2\""}",...], а именно {"content":"\"v1\""},{"content":"\"v2\""}",...
+        # группа \1 - полная запись rrset; группа \2 - значение атрибута records, а именно {"content":"\"value1\""},{"content":"\"value2\""}",...
         _record_seg="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\1/p")"
         _record_array="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\2/p")"
         # record id
         _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
+        # готовим _data
         _tmp_str="${_record_array},{\"content\":\"${_text_tmp}\"}"
         _data="{\"ttl\": 60, \"records\": [${_tmp_str}]}"
         _debug3 _record_seg "$_record_seg"
         _debug3 _record_array "$_record_array"
         _debug3 _record_array "$_record_id"
-        _debug3 _data "$_data"
-        # вызов REST API PATCH
+        _debug2 "New data for record" "$_data"
         if _sl_rest PATCH "${_ext_uri}${_record_id}" "$_data"; then
           _info "Added, OK"
           return 0
@@ -124,7 +120,7 @@ dns_selectel_add() {
 dns_selectel_rm() {
   fulldomain=$1
   txtvalue=$2
-  #SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
+
   if ! _sl_init_vars "nosave"; then
     return 1
   fi
@@ -151,7 +147,6 @@ dns_selectel_rm() {
     _ext_srv1="/"
     _ext_srv2="/records/"
   else
-    #not valid
     _err "Error. Unsupported version API $SL_Ver"
     return 1
   fi
@@ -169,13 +164,9 @@ dns_selectel_rm() {
   if [ "$SL_Ver" = "v2" ]; then
     _record_seg="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\1/gp")"
     _record_arr="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\3/p")"
-    #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2)"
   elif [ "$SL_Ver" = "v1" ]; then
     _record_seg="$(echo "$response" | _egrep_o "[^{]*\"content\" *: *\"$txtvalue\"[^}]*}")"
-    # record id
-    #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2)"
   else
-    #not valid
     _err "Error. Unsupported version API $SL_Ver"
     return 1
   fi
@@ -185,7 +176,7 @@ dns_selectel_rm() {
     return 1
   fi
   # record id
-  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
+  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')"
   if [ -z "$_record_id" ]; then
     _err "can not find _record_id"
     return 1
@@ -194,7 +185,6 @@ dns_selectel_rm() {
   # delete all record type TXT with text $txtvalue
   if [ "$SL_Ver" = "v2" ]; then
     # actual
-    #del_txt='it47Qq60vJuzQJXb9WEaapciTwtt1gb_14gm1ubwzrA';
     _new_arr="$(echo "$_record_seg" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\3/gp" | sed -En "s/(\},\{)/}\n{/gp" | sed "/${txtvalue}/d" | sed ":a;N;s/\n/,/;ta")"
     # uri record for DEL or PATCH
     _del_uri="${_ext_uri}${_record_id}"
@@ -232,14 +222,10 @@ dns_selectel_rm() {
 }
 
 ####################  Private functions below ##################################
-#_acme-challenge.www.domain.com
-#returns
-# _sub_domain=_acme-challenge.www
-# _domain=domain.com
-# _domain_id=sdjkglgdfewsdfg
+
 _get_root() {
   domain=$1
-  #
+
   if [ "$SL_Ver" = 'v1' ]; then
     # version API 1
     if ! _sl_rest GET "/"; then
@@ -248,16 +234,12 @@ _get_root() {
     i=2
     p=1
     while true; do
-      #h=$(printf "%s" "$domain" | cut -d . -f $i-100)
       h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
       _debug h "$h"
       if [ -z "$h" ]; then
-        #not valid
         return 1
       fi
-
       if _contains "$response" "\"name\" *: *\"$h\","; then
-        #_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
         _domain=$h
         _debug "Getting domain id for $h"
@@ -280,7 +262,6 @@ _get_root() {
     _debug "domain:: " "$domain"
     # read records of all domains
     if ! _sl_rest GET "$_ext_uri"; then
-      #not valid
       _err "Error read records of all domains $SL_Ver"
       return 1
     fi
@@ -290,29 +271,24 @@ _get_root() {
       h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
       _debug h "$h"
       if [ -z "$h" ]; then
-        #not valid
         _err "The domain was not found among the registered ones"
         return 1
       fi
-
       _domain_record=$(echo "$response" | sed -En "s/.*(\{[^}]*id[^}]*\"name\" *: *\"$h\"[^}]*}).*/\1/p")
       _debug "_domain_record:: " "$_domain_record"
       if [ -n "$_domain_record" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
         _domain=$h
         _debug "Getting domain id for $h"
-        #_domain_id="$(echo "$_domain_record" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\":" | cut -d : -f 2 | sed -En "s/\"([^\"]*)\"/\1\p")"
         _domain_id=$(echo "$_domain_record" | sed -En "s/\{[^}]*\"id\" *: *\"([^\"]*)\"[^}]*\}/\1/p")
         return 0
       fi
       p=$i
       i=$(_math "$i" + 1)
     done
-    #not valid
     _err "Error read records of all domains $SL_Ver"
     return 1
   else
-    #not valid
     _err "Error. Unsupported version API $SL_Ver"
     return 1
   fi
@@ -341,14 +317,12 @@ _sl_rest() {
   _debug3 "Full URI: " "$SL_Api/${SL_Ver}${ep}"
   _debug3 "_H1:" "$_H1"
   _debug3 "_H2:" "$_H2"
-
   if [ "$m" != "GET" ]; then
     _debug data "$data"
     response="$(_post "$data" "$SL_Api/${SL_Ver}${ep}" "" "$m")"
   else
     response="$(_get "$SL_Api/${SL_Ver}${ep}")"
   fi
-
   if [ "$?" != "0" ]; then
     _err "error $ep"
     return 1
@@ -357,8 +331,6 @@ _sl_rest() {
   return 0
 }
 
-#################################################################3
-# use:
 _get_auth_token() {
   if [ "$SL_Ver" = 'v1' ]; then
     # token for v1
@@ -375,7 +347,7 @@ _get_auth_token() {
       # field 3 - SL_Login_ID
       # field 4 - SL_Project_Name
       # field 5 - Receipt time
-      # separator - ';'
+      # separator - '$_sl_sep'
       _login_name=$(_getfield "$token_v2" 1 "$_sl_sep")
       _token_keystone=$(_getfield "$token_v2" 2 "$_sl_sep")
       _project_name=$(_getfield "$token_v2" 4 "$_sl_sep")
@@ -386,7 +358,6 @@ _get_auth_token() {
       _debug3 _project_name "$_project_name"
       _debug3 _receipt_time "$(date -d @"$_receipt_time" -u)"
       # check the validity of the token for the user and the project and its lifetime
-      #_dt_diff_minute=$(( ( $(EPOCHSECONDS)-$_receipt_time )/60 ))
       _dt_diff_minute=$((($(date +%s) - _receipt_time) / 60))
       _debug3 _dt_diff_minute "$_dt_diff_minute"
       [ "$_dt_diff_minute" -gt "$SL_Expire" ] && unset _token_keystone
@@ -399,13 +370,9 @@ _get_auth_token() {
       # the previous token is incorrect or was not received, get a new one
       _debug "Update (get new) token"
       _data_auth="{\"auth\":{\"identity\":{\"methods\":[\"password\"],\"password\":{\"user\":{\"name\":\"${SL_Login_Name}\",\"domain\":{\"name\":\"${SL_Login_ID}\"},\"password\":\"${SL_Pswd}\"}}},\"scope\":{\"project\":{\"name\":\"${SL_Project_Name}\",\"domain\":{\"name\":\"${SL_Login_ID}\"}}}}}"
-      #_secure_debug2 "_data_auth" "$_data_auth"
       export _H1="Content-Type: application/json"
-      # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
       _result=$(_post "$_data_auth" "$auth_uri")
       _token_keystone=$(grep 'x-subject-token' "$HTTP_HEADER" | sed -nE "s/[[:space:]]*x-subject-token:[[:space:]]*([[:print:]]*)(\r*)/\1/p")
-      #echo $_token_keystone > /root/123456.qwe
-      #_dt_curr=$EPOCHSECONDS
       _dt_curr=$(date +%s)
       SL_Token_V2="${SL_Login_Name}${_sl_sep}${_token_keystone}${_sl_sep}${SL_Login_ID}${_sl_sep}${SL_Project_Name}${_sl_sep}${_dt_curr}"
       _saveaccountconf_mutable SL_Token_V2 "$SL_Token_V2"
@@ -427,14 +394,13 @@ _sl_init_vars() {
   # version API
   SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
   if [ -z "$SL_Ver" ]; then
-    SL_Ver="v1"
+    SL_Ver="v2"
   fi
   if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
     _err "You don't specify selectel.ru API version."
     _err "Please define specify API version."
   fi
   _debug2 SL_Ver "$SL_Ver"
-
   if [ "$SL_Ver" = "v1" ]; then
     # token
     SL_Key="${SL_Key:-$(_readaccountconf_mutable SL_Key)}"
@@ -509,9 +475,9 @@ _sl_init_vars() {
     _err "Please provide the correct API version and try again."
     return 1
   fi
-
   if [ -z "$_non_save" ]; then
     _saveaccountconf_mutable SL_Ver "$SL_Ver"
   fi
+
   return 0
 }

From 177d9b7cb0fce9baabbc5fa90aa86f8765e33c3b Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Sat, 4 May 2024 20:38:42 +1000
Subject: [PATCH 011/174] set default SL_Ver to v1

---
 dnsapi/dns_selectel.sh | 47 +++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 4806773d..65729804 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -4,7 +4,7 @@
 #   export SL_Ver="v1"                    - версия API: 'v2' (actual) или 'v1' (legacy).
 #                                           По-умолчанию: v1
 # Если SL_Ver="v1"
-#   export SL_Key="API_KEY"               - Токен Selectel (API key)
+#   export SL_Key="API_Key"               - Токен Selectel (API key)
 #                                           Посмотреть или создать можно в панели управления в правом верхнем углу откройте меню Профиль и настройки -> Ключи API.
 #                                           https://my.selectel.ru/profile/apikeys
 # Если SL_Ver="v2"
@@ -35,12 +35,11 @@ dns_selectel_add() {
   if ! _sl_init_vars; then
     return 1
   fi
-  _debug2 SL_Ver "$SL_Ver"
-  _secure_debug3 SL_Key "$SL_Key"
-  _debug2 SL_Expire "$SL_Expire"
-  _debug2 SL_Login_Name "$SL_Login_Name"
-  _debug2 SL_Login_ID "$SL_Login_ID"
-  _debug2 SL_Project_Name "$SL_Project_Name"
+  _debug3 SL_Ver "$SL_Ver"
+  _debug3 SL_Expire "$SL_Expire"
+  _debug3 SL_Login_Name "$SL_Login_Name"
+  _debug3 SL_Login_ID "$SL_Login_ID"
+  _debug3 SL_Project_Name "$SL_Project_Name"
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -56,9 +55,7 @@ dns_selectel_add() {
     _ext_srv1="/zones/"
     _ext_srv2="/rrset/"
     _text_tmp=$(echo "$txtvalue" | sed -En "s/[\"]*([^\"]*)/\1/p")
-    _debug txtvalue "$txtvalue"
     _text_tmp='\"'$_text_tmp'\"'
-    _debug _text_tmp "$_text_tmp"
     _data="{\"type\": \"TXT\", \"ttl\": 60, \"name\": \"${fulldomain}.\", \"records\": [{\"content\":\"$_text_tmp\"}]}"
   elif [ "$SL_Ver" = "v1" ]; then
     _ext_srv1="/"
@@ -69,8 +66,8 @@ dns_selectel_add() {
     return 1
   fi
   _ext_uri="${_ext_srv1}$_domain_id${_ext_srv2}"
-  _debug3 _ext_uri "$_ext_uri"
-  _debug3 _data "$_data"
+  _debug _ext_uri "$_ext_uri"
+  _debug _data "$_data"
 
   if _sl_rest POST "$_ext_uri" "$_data"; then
     if _contains "$response" "$txtvalue"; then
@@ -101,7 +98,7 @@ dns_selectel_add() {
         _debug3 _record_seg "$_record_seg"
         _debug3 _record_array "$_record_array"
         _debug3 _record_array "$_record_id"
-        _debug2 "New data for record" "$_data"
+        _debug "New data for record" "$_data"
         if _sl_rest PATCH "${_ext_uri}${_record_id}" "$_data"; then
           _info "Added, OK"
           return 0
@@ -124,12 +121,11 @@ dns_selectel_rm() {
   if ! _sl_init_vars "nosave"; then
     return 1
   fi
-  _debug2 SL_Ver "$SL_Ver"
-  _secure_debug3 SL_Key "$SL_Key"
-  _debug2 SL_Expire "$SL_Expire"
-  _debug2 SL_Login_Name "$SL_Login_Name"
-  _debug2 SL_Login_ID "$SL_Login_ID"
-  _debug2 SL_Project_Name "$SL_Project_Name"
+  _debug3 SL_Ver "$SL_Ver"
+  _debug3 SL_Expire "$SL_Expire"
+  _debug3 SL_Login_Name "$SL_Login_Name"
+  _debug3 SL_Login_ID "$SL_Login_ID"
+  _debug3 SL_Project_Name "$SL_Project_Name"
   #
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -153,7 +149,7 @@ dns_selectel_rm() {
   #
   _debug "Getting txt records"
   _ext_uri="${_ext_srv1}$_domain_id${_ext_srv2}"
-  _debug3 _ext_uri "$_ext_uri"
+  _debug _ext_uri "$_ext_uri"
   _sl_rest GET "${_ext_uri}"
   #
   if ! _contains "$response" "$txtvalue"; then
@@ -176,7 +172,11 @@ dns_selectel_rm() {
     return 1
   fi
   # record id
-  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')"
+  # следующие строки меняют алгоритм удаления записей со значением $txtvalue
+  # если использовать 1-ю строку, то за раз удаляются все такие записи 
+  # если использовать 2-ю строку, то удаляется только первая запись из них
+  #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")" # удалять все записи со значением $txtvalue
+  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')" # удалять только первую запись со значением $txtvalue
   if [ -z "$_record_id" ]; then
     _err "can not find _record_id"
     return 1
@@ -188,6 +188,7 @@ dns_selectel_rm() {
     _new_arr="$(echo "$_record_seg" | sed -En "s/.*(\{\"id\"[^}]*records[^[]*(\[(\{[^]]*${txtvalue}[^]]*)\])[^}]*}).*/\3/gp" | sed -En "s/(\},\{)/}\n{/gp" | sed "/${txtvalue}/d" | sed ":a;N;s/\n/,/;ta")"
     # uri record for DEL or PATCH
     _del_uri="${_ext_uri}${_record_id}"
+    _debug _del_uri "$_del_uri"
     if [ -z "$_new_arr" ]; then
       # удалить запись
       if ! _sl_rest DELETE "${_del_uri}"; then
@@ -210,7 +211,7 @@ dns_selectel_rm() {
     # legacy
     for _one_id in $_record_id; do
       _del_uri="${_ext_uri}${_one_id}"
-      _debug2 _ext_uri "$_del_uri"
+      _debug _del_uri "$_del_uri"
       if ! _sl_rest DELETE "${_del_uri}"; then
         _err "Delete record error: ${_del_uri}."
       else
@@ -302,7 +303,6 @@ _sl_rest() {
   data="$3"
 
   _token=$(_get_auth_token)
-  #_debug "$_token"
   if [ -z "$_token" ]; then
     _err "BAD key or token $ep"
     return 1
@@ -394,7 +394,7 @@ _sl_init_vars() {
   # version API
   SL_Ver="${SL_Ver:-$(_readaccountconf_mutable SL_Ver)}"
   if [ -z "$SL_Ver" ]; then
-    SL_Ver="v2"
+    SL_Ver="v1"
   fi
   if ! [ "$SL_Ver" = "v1" ] && ! [ "$SL_Ver" = "v2" ]; then
     _err "You don't specify selectel.ru API version."
@@ -459,7 +459,6 @@ _sl_init_vars() {
     fi
     # service user password
     SL_Pswd="${SL_Pswd:-$(_readaccountconf_mutable SL_Pswd)}"
-    #_secure_debug3 SL_Pswd "$SL_Pswd"
     if [ -z "$SL_Pswd" ]; then
       SL_Pswd=''
       _err "You did not specify the service user password."

From d989617825ccc0b9a60b4f9f657148243d14b15b Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Sat, 4 May 2024 20:42:38 +1000
Subject: [PATCH 012/174] set default SL_Ver to v1

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 65729804..9868cb12 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -173,7 +173,7 @@ dns_selectel_rm() {
   fi
   # record id
   # следующие строки меняют алгоритм удаления записей со значением $txtvalue
-  # если использовать 1-ю строку, то за раз удаляются все такие записи 
+  # если использовать 1-ю строку, то за раз удаляются все такие записи
   # если использовать 2-ю строку, то удаляется только первая запись из них
   #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")" # удалять все записи со значением $txtvalue
   _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')" # удалять только первую запись со значением $txtvalue

From a375e924b491e8245ee763305f59627eac996f80 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mai.ru>
Date: Sun, 5 May 2024 07:42:22 +1000
Subject: [PATCH 013/174] translation of comments into English

---
 dnsapi/dns_selectel.sh | 62 +++++++++++++++++++++---------------------
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 9868cb12..d4ca13b2 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -1,23 +1,23 @@
 #!/usr/bin/env sh
 
-# переменные, которые должны быть определены перед запуском
-#   export SL_Ver="v1"                    - версия API: 'v2' (actual) или 'v1' (legacy).
-#                                           По-умолчанию: v1
-# Если SL_Ver="v1"
-#   export SL_Key="API_Key"               - Токен Selectel (API key)
-#                                           Посмотреть или создать можно в панели управления в правом верхнем углу откройте меню Профиль и настройки -> Ключи API.
+# Variables that must be defined before running
+#   export SL_Ver="v1"                    - version API: 'v2' (actual) or 'v1' (legacy).
+#                                           Default: v1
+# If SL_Ver="v1"
+#   export SL_Key="API_Key"               - Token Selectel (API key)
+#                                           You can view or create in the control panel in the upper right corner, open the menu: "Profile and setting -> Keys API".
 #                                           https://my.selectel.ru/profile/apikeys
-# Если SL_Ver="v2"
-#   export SL_Expire=60                   - время жизни token в минутах (0-1440).
-#                                           По-умолчанию: 1400 минут
-#   export SL_Login_ID=<account_id>       - номер аккаунта в панели управления;
-#   export SL_Project_Name=<project_name> - имя проекта.
-#   export SL_Login_name=<username>       - имя сервисного пользователя. Посмотреть имя можно в панели управления:
-#                                           в правом верхнем углу откройте меню → Профиль и настройки → раздел Управление пользователями → вкладка Сервисные пользователи
-#   export SL_Pswd='pswd'                 - пароль сервисного пользователя, можно посмотреть при создании пользователя или изменить на новый.
-# Все эти переменные будут сохранены ~/.acme.sh/account.conf  и будут использоваться повторно при необходимости.
+# If SL_Ver="v2"
+#   export SL_Expire=60                   - token lifetime in minutes (0-1440).
+#                                           Default: 1400 minutes
+#   export SL_Login_ID=<account_id>       - account number in the control panel;
+#   export SL_Project_Name=<project_name> - name project.
+#   export SL_Login_name=<username>       - service user name. You can view the name in the control panel:
+#                                           in the upper right corner open menu: "Profile and setting → User management → Service users
+#   export SL_Pswd='pswd'                 - service user password, can be viewed when creating a user or changed to a new one.
+# All these variables will be saved in ~/.acme.sh/account.conf and will be reused as needed.
 #
-# Авторизация описана в:
+# Authorization is described in:
 #   https://developers.selectel.ru/docs/control-panel/authorization/
 #   https://developers.selectel.com/docs/control-panel/authorization/
 
@@ -75,24 +75,24 @@ dns_selectel_add() {
       return 0
     fi
     if _contains "$response" "already_exists"; then
-      # запись TXT с $fulldomain уже существует
+      # record TXT with $fulldomain already exists
       if [ "$SL_Ver" = "v2" ]; then
-        # надо добавить к существующей записи еще один content
-        # считать записи rrset
+        # It is necessary to add one more content to the comments
+        # read all records rrset
         _debug "Getting txt records"
         _sl_rest GET "${_ext_uri}"
-        # Уже есть значение $txtvalue, добавлять не надо
+        # There is already a $txtvalue value, no need to add it
         if _contains "$response" "$txtvalue"; then
           _info "Added, OK"
-          _info "Txt record ${fulldomain} со значением ${txtvalue} already exists"
+          _info "Txt record ${fulldomain} with value ${txtvalue} already exists"
           return 0
         fi
-        # группа \1 - полная запись rrset; группа \2 - значение атрибута records, а именно {"content":"\"value1\""},{"content":"\"value2\""}",...
+        # group \1 - full record rrset; group \2 - records attribute value, exactly {"content":"\"value1\""},{"content":"\"value2\""}",...
         _record_seg="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\1/p")"
         _record_array="$(echo "$response" | sed -En "s/.*(\{\"id\"[^}]*${fulldomain}[^}]*records[^}]*\[(\{[^]]*\})\][^}]*}).*/\2/p")"
         # record id
         _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
-        # готовим _data
+        # preparing _data
         _tmp_str="${_record_array},{\"content\":\"${_text_tmp}\"}"
         _data="{\"ttl\": 60, \"records\": [${_tmp_str}]}"
         _debug3 _record_seg "$_record_seg"
@@ -172,11 +172,11 @@ dns_selectel_rm() {
     return 1
   fi
   # record id
-  # следующие строки меняют алгоритм удаления записей со значением $txtvalue
-  # если использовать 1-ю строку, то за раз удаляются все такие записи
-  # если использовать 2-ю строку, то удаляется только первая запись из них
-  #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")" # удалять все записи со значением $txtvalue
-  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')" # удалять только первую запись со значением $txtvalue
+  # the following lines change the algorithm for deleting records with the value $txtvalue
+  # if you use the 1st line, then all such records are deleted at once
+  # if you use the 2nd line, then only the first entry from them is deleted
+  #_record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"")"
+  _record_id="$(echo "$_record_seg" | tr "," "\n" | tr "}" "\n" | tr -d " " | grep "\"id\"" | cut -d : -f 2 | tr -d "\"" | sed '1!d')"
   if [ -z "$_record_id" ]; then
     _err "can not find _record_id"
     return 1
@@ -190,17 +190,17 @@ dns_selectel_rm() {
     _del_uri="${_ext_uri}${_record_id}"
     _debug _del_uri "$_del_uri"
     if [ -z "$_new_arr" ]; then
-      # удалить запись
+      # remove record
       if ! _sl_rest DELETE "${_del_uri}"; then
         _err "Delete record error: ${_del_uri}."
       else
         info "Delete record success: ${_del_uri}."
       fi
     else
-      # обновить запись, удалив content
+      # update a record by removing one element in content
       _data="{\"ttl\": 60, \"records\": [${_new_arr}]}"
       _debug3 _data "$_data"
-      # вызов REST API PATCH
+      # REST API PATCH call
       if _sl_rest PATCH "${_del_uri}" "$_data"; then
         _info "Patched, OK: ${_del_uri}"
       else

From 1c9423ef31cc80fee79e25b823b2c12047f01083 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Tue, 11 Jun 2024 12:50:45 -0300
Subject: [PATCH 014/174] fix pagination bug querying Linode API v4

fixes issue #4956

previous code only worked for the first 10 domains on the account (as Linode
API returned a paginated response, with only 10 records).

This change makes an exact search query for each subdomain, completely removing any
need for walking through paginated responses. What makes it work for large
accounts with any number of domains.
---
 dnsapi/dns_linode_v4.sh | 36 ++++++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 9504afbf..d0545938 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -126,34 +126,41 @@ _Linode_API() {
 # _domain=domain.com
 # _domain_id=12345
 _get_root() {
-  domain=$1
+  local full_host_str="$1"
+
   i=2
   p=1
+  while true; do
+    # loop through the received string (e.g.  _acme-challenge.sub3.sub2.sub1.domain.tld),
+    # starting from the lowest subdomain, and check if it's a hosted domain
+    h=$(printf "%s" "$full_host_str" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
 
-  if _rest GET; then
-    response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
-    while true; do
-      h=$(printf "%s" "$domain" | cut -d . -f $i-100)
-      _debug h "$h"
-      if [ -z "$h" ]; then
-        #not valid
-        return 1
-      fi
-
+   _debug "Querying Linode APIv4 for subdomain: $h"
+    if _H4="X-Filter: {\"domain\":\"$h\"}" _rest GET; then
+      _debug "Got response from API: $response"
+      response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
       hostedzone="$(echo "$response" | _egrep_o "\{.*\"domain\": *\"$h\".*}")"
       if [ "$hostedzone" ]; then
         _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
+        _debug "Found domain hosted on Linode DNS. Zone: $h, id: $_domain_id"
         if [ "$_domain_id" ]; then
-          _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+          _sub_domain=$(printf "%s" "$full_host_str" | cut -d . -f 1-$p)
           _domain=$h
           return 0
         fi
         return 1
       fi
+
       p=$i
       i=$(_math "$i" + 1)
-    done
-  fi
+    fi
+  done
+
   return 1
 }
 
@@ -169,6 +176,7 @@ _rest() {
   export _H1="Accept: application/json"
   export _H2="Content-Type: application/json"
   export _H3="Authorization: Bearer $LINODE_V4_API_KEY"
+  export _H4 # used to query for the root domain on _get_root()
 
   if [ "$mtd" != "GET" ]; then
     # both POST and DELETE.

From 05ec3922f1d9b72ca6d65709f21fca2b6d1ded84 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Tue, 11 Jun 2024 17:17:37 -0300
Subject: [PATCH 015/174] minor wording fix

minor fix for text coherence
---
 dnsapi/dns_linode_v4.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index d0545938..390ec0d8 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -140,7 +140,7 @@ _get_root() {
       return 1
     fi
 
-   _debug "Querying Linode APIv4 for subdomain: $h"
+   _debug "Querying Linode APIv4 for hosted zone: $h"
     if _H4="X-Filter: {\"domain\":\"$h\"}" _rest GET; then
       _debug "Got response from API: $response"
       response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"

From 2f8fb360aa789b4198aba092ac61d0fcbb4e5df0 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Wed, 12 Jun 2024 15:03:02 -0300
Subject: [PATCH 016/174] fix CI reported problems for shellcheck and shfmt

fix minor problems reported by shellcheck and shfmt
---
 dnsapi/dns_linode_v4.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 390ec0d8..12682dbf 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -126,7 +126,7 @@ _Linode_API() {
 # _domain=domain.com
 # _domain_id=12345
 _get_root() {
-  local full_host_str="$1"
+  full_host_str="$1"
 
   i=2
   p=1
@@ -140,7 +140,7 @@ _get_root() {
       return 1
     fi
 
-   _debug "Querying Linode APIv4 for hosted zone: $h"
+    _debug "Querying Linode APIv4 for hosted zone: $h"
     if _H4="X-Filter: {\"domain\":\"$h\"}" _rest GET; then
       _debug "Got response from API: $response"
       response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"

From 51151293d7556dde713c197d0fdc83b97cbbe642 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=BB=D0=B0=D0=B4=D0=B8=D0=BC=D0=B8=D1=80=20=D0=90?=
 =?UTF-8?q?=D0=BB=D0=B5=D0=BA=D1=81=D0=B5=D0=B5=D0=B2?=
 <73811032+vlad-kms@users.noreply.github.com>
Date: Sat, 6 Jul 2024 21:01:25 +1000
Subject: [PATCH 017/174] Remove `date -d` on macOS

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index c8aa2db7..511ab7f5 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -356,7 +356,7 @@ _get_auth_token() {
       _debug3 _login_name "$_login_name"
       _debug3 _login_id "$_login_id"
       _debug3 _project_name "$_project_name"
-      _debug3 _receipt_time "$(date -d @"$_receipt_time" -u)"
+      # _debug3 _receipt_time "$(date -d @"$_receipt_time" -u)"
       # check the validity of the token for the user and the project and its lifetime
       _dt_diff_minute=$((($(date +%s) - _receipt_time) / 60))
       _debug3 _dt_diff_minute "$_dt_diff_minute"

From 5214a7c3ec32cdffc3ff3497c163bf235bd7eaed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <25136274+markkuleinio@users.noreply.github.com>
Date: Sun, 4 Aug 2024 18:19:21 +0300
Subject: [PATCH 018/174] Add dnsapi script for HE DDNS

---
 dnsapi/dns_he_ddns.sh | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 dnsapi/dns_he_ddns.sh

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
new file mode 100644
index 00000000..7338ab18
--- /dev/null
+++ b/dnsapi/dns_he_ddns.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env sh
+dns_he_ddns_info='Hurricane Electric HE.net DDNS
+Site: dns.he.net
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_he_ddns
+Options:
+ HE_DDNS_KEY The DDNS key for updating the TXT record
+Author: Markku Leiniö
+'
+
+HE_DDNS_URL="https://dyn.dns.he.net/nic/update"
+
+########  Public functions #####################
+
+#Usage: dns_he_ddns_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_he_ddns_add() {
+  fulldomain=$1
+  txtvalue=$2
+  HE_DDNS_KEY="${HE_DDNS_KEY:-$(_readaccountconf_mutable HE_DDNS_KEY)}"
+  if [ -z "$HE_DDNS_KEY" ]; then
+    HE_DDNS_KEY=""
+    _err "You didn't specify a DDNS key for accessing the TXT record in HE API."
+    return 1
+  fi
+  #Save the DDNS key to the account conf file.
+  _saveaccountconf_mutable HE_DDNS_KEY "$HE_DDNS_KEY"
+
+  _info "Using Hurricane Electric DDNS API"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  response="$(_post "hostname=$fulldomain&password=$HE_DDNS_KEY&txt=$txtvalue" "$HE_DDNS_URL")"
+  _info "Response: $response"
+  _contains "$response" "good" && return 0 || return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_he_ddns_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+}

From c96fcf319a8667115baaad335f8820b1fba93735 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <25136274+markkuleinio@users.noreply.github.com>
Date: Sun, 4 Aug 2024 18:25:20 +0300
Subject: [PATCH 019/174] Remove dns_he_ddns_rm(), not used

---
 dnsapi/dns_he_ddns.sh | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
index 7338ab18..44e6783e 100644
--- a/dnsapi/dns_he_ddns.sh
+++ b/dnsapi/dns_he_ddns.sh
@@ -33,11 +33,5 @@ dns_he_ddns_add() {
   _contains "$response" "good" && return 0 || return 1
 }
 
-#Usage: fulldomain txtvalue
-#Remove the txt record after validation.
-dns_he_ddns_rm() {
-  fulldomain=$1
-  txtvalue=$2
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
-}
+# dns_he_ddns_rm() is not implemented because the API call always updates the
+# contents of the existing record (that the API key gives access to).

From abc76299c0c74faa265933f532c8d1ec59a27b77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <25136274+markkuleinio@users.noreply.github.com>
Date: Sun, 4 Aug 2024 18:58:59 +0300
Subject: [PATCH 020/174] Fix documentation link

---
 dnsapi/dns_he_ddns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
index 44e6783e..95ec290b 100644
--- a/dnsapi/dns_he_ddns.sh
+++ b/dnsapi/dns_he_ddns.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 dns_he_ddns_info='Hurricane Electric HE.net DDNS
 Site: dns.he.net
-Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_he_ddns
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_he_ddns
 Options:
  HE_DDNS_KEY The DDNS key for updating the TXT record
 Author: Markku Leiniö

From 833632eee3d8aa9b562297cf6a8c13fee9d81b09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <25136274+markkuleinio@users.noreply.github.com>
Date: Sun, 4 Aug 2024 19:15:11 +0300
Subject: [PATCH 021/174] Add shellcheck disable=SC2034 for the info variable

---
 dnsapi/dns_he_ddns.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
index 95ec290b..0893f938 100644
--- a/dnsapi/dns_he_ddns.sh
+++ b/dnsapi/dns_he_ddns.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env sh
+# shellcheck disable=SC2034
 dns_he_ddns_info='Hurricane Electric HE.net DDNS
 Site: dns.he.net
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_he_ddns

From fcffe8beb9da574818ee6f53772fcd3bbe737d72 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 15:40:45 +0200
Subject: [PATCH 022/174] feat: add bearer token support

---
 dnsapi/dns_azure.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 00ccd798..c482ed03 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -9,6 +9,7 @@ Options:
  AZUREDNS_APPID App ID. App ID of the service principal
  AZUREDNS_CLIENTSECRET Client Secret. Secret from creating the service principal
  AZUREDNS_MANAGEDIDENTITY Use Managed Identity. Use Managed Identity assigned to a resource instead of a service principal. "true"/"false"
+ AZUREDNS_BEARERTOKEN Optional Bearer Token. Used instead of service principal credentials or managed identity
 '
 
 ########  Public functions #####################
@@ -83,7 +84,11 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
   fi
 
-  accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
+  else
+    accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
     _err "invalid domain"

From 92a47aaac54309fd8a3ebc82044724acccc55751 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 15:41:55 +0200
Subject: [PATCH 023/174] logic

---
 dnsapi/dns_azure.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index c482ed03..9db028a1 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -84,10 +84,10 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
   fi
 
-  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
-    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
-  else
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  else
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
   fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then

From 1eaa2cc6198632bd03bd329fb2b6390190ccd100 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 15:53:33 +0200
Subject: [PATCH 024/174] debug

---
 dnsapi/dns_azure.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 9db028a1..b0db0f76 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -126,6 +126,7 @@ dns_azure_add() {
   # Add the txtvalue TXT Record
   body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
   _azure_rest PUT "$acmeRecordURI" "$body" "$accesstoken"
+  _debug "$acmeRecordURI $body $accesstoken"
   if [ "$_code" = "200" ] || [ "$_code" = '201' ]; then
     _info "validation value added"
     return 0

From c7fb15573300d9428c73ed3248d877b389bf40d9 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 15:56:12 +0200
Subject: [PATCH 025/174] debug

---
 dnsapi/dns_azure.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index b0db0f76..c1e48d23 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -101,6 +101,7 @@ dns_azure_add() {
   acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
   _debug "$acmeRecordURI"
   # Get existing TXT record
+  _debug "$acmeRecordURI $accesstoken"
   _azure_rest GET "$acmeRecordURI" "" "$accesstoken"
   values="{\"value\":[\"$txtvalue\"]}"
   timestamp="$(_time)"
@@ -126,7 +127,6 @@ dns_azure_add() {
   # Add the txtvalue TXT Record
   body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
   _azure_rest PUT "$acmeRecordURI" "$body" "$accesstoken"
-  _debug "$acmeRecordURI $body $accesstoken"
   if [ "$_code" = "200" ] || [ "$_code" = '201' ]; then
     _info "validation value added"
     return 0

From dd634382d7c4a038e5c60d20625c89a3eacbfdef Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 15:57:48 +0200
Subject: [PATCH 026/174] debug

---
 dnsapi/dns_azure.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index c1e48d23..6edb19cc 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -101,7 +101,6 @@ dns_azure_add() {
   acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
   _debug "$acmeRecordURI"
   # Get existing TXT record
-  _debug "$acmeRecordURI $accesstoken"
   _azure_rest GET "$acmeRecordURI" "" "$accesstoken"
   values="{\"value\":[\"$txtvalue\"]}"
   timestamp="$(_time)"
@@ -361,6 +360,7 @@ _get_root() {
   ## (ZoneListResult with  continuation token for the next page of results)
   ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
   ##
+  _debug "$accesstoken $subscriptionId"
   _azure_rest GET "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?\$top=500&api-version=2017-09-01" "" "$accesstoken"
   # Find matching domain name in Json response
   while true; do

From 0b2edd28dfad12d7061ea00277d87e27e4c5192a Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 16:02:36 +0200
Subject: [PATCH 027/174] bearer check

---
 dnsapi/dns_azure.sh | 54 +++++++++++++++++++++++----------------------
 1 file changed, 28 insertions(+), 26 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 6edb19cc..95cadd07 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -45,36 +45,39 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_APPID ""
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET ""
   else
-    _info "You didn't ask to use Azure managed identity, checking service principal credentials"
+    _info "You didn't ask to use Azure managed identity, checking service principal credentials or provided bearer token"
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
+      _info "Using provided bearer token"
+    else
+      if [ -z "$AZUREDNS_TENANTID" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure Tenant ID "
+        return 1
+      fi
 
-    if [ -z "$AZUREDNS_TENANTID" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure Tenant ID "
-      return 1
-    fi
-
-    if [ -z "$AZUREDNS_APPID" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure App ID"
-      return 1
-    fi
+      if [ -z "$AZUREDNS_APPID" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure App ID"
+        return 1
+      fi
 
-    if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure Client Secret"
-      return 1
+      if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure Client Secret"
+        return 1
+      fi
     fi
 
     #save account details to account conf file, don't opt in for azure manages identity check.
@@ -360,7 +363,6 @@ _get_root() {
   ## (ZoneListResult with  continuation token for the next page of results)
   ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
   ##
-  _debug "$accesstoken $subscriptionId"
   _azure_rest GET "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?\$top=500&api-version=2017-09-01" "" "$accesstoken"
   # Find matching domain name in Json response
   while true; do

From b27767e8f4ecc3ded21ed25ab9f84e4547b82cb7 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Mon, 2 Sep 2024 16:04:34 +0200
Subject: [PATCH 028/174] logic

---
 dnsapi/dns_azure.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 95cadd07..f67dac29 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -50,8 +50,6 @@ dns_azure_add() {
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
-      _info "Using provided bearer token"
-    else
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -78,6 +76,8 @@ dns_azure_add() {
         _err "You didn't specify the Azure Client Secret"
         return 1
       fi
+    else
+      _info "Using provided bearer token"
     fi
 
     #save account details to account conf file, don't opt in for azure manages identity check.

From f0d486d1ff6d96554c0545c8276155b8d0d4368f Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Tue, 3 Sep 2024 20:59:17 +0200
Subject: [PATCH 029/174] add bearer token to removal

---
 dnsapi/dns_azure.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index f67dac29..875520cb 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -194,8 +194,12 @@ dns_azure_rm() {
     fi
   fi
 
-  accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
-
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
+    accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  else
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
+  fi
+  
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
     _err "invalid domain"
     return 1

From 8860915fb9fafde9c23456f5d7be6d3877ffd26e Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Tue, 3 Sep 2024 21:36:54 +0200
Subject: [PATCH 030/174] remove dns

---
 dnsapi/dns_azure.sh | 55 ++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 26 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 875520cb..31bc42ca 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -161,36 +161,39 @@ dns_azure_rm() {
   if [ "$AZUREDNS_MANAGEDIDENTITY" = true ]; then
     _info "Using Azure managed identity"
   else
-    _info "You didn't ask to use Azure managed identity, checking service principal credentials"
+    _info "You didn't ask to use Azure managed identity, checking service principal credentials or provided bearer token"
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+      if [ -z "$AZUREDNS_TENANTID" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure Tenant ID "
+        return 1
+      fi
 
-    if [ -z "$AZUREDNS_TENANTID" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure Tenant ID "
-      return 1
-    fi
-
-    if [ -z "$AZUREDNS_APPID" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure App ID"
-      return 1
-    fi
+      if [ -z "$AZUREDNS_APPID" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure App ID"
+        return 1
+      fi
 
-    if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
-      AZUREDNS_SUBSCRIPTIONID=""
-      AZUREDNS_TENANTID=""
-      AZUREDNS_APPID=""
-      AZUREDNS_CLIENTSECRET=""
-      _err "You didn't specify the Azure Client Secret"
-      return 1
+      if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
+        AZUREDNS_SUBSCRIPTIONID=""
+        AZUREDNS_TENANTID=""
+        AZUREDNS_APPID=""
+        AZUREDNS_CLIENTSECRET=""
+        _err "You didn't specify the Azure Client Secret"
+        return 1
+      fi
+    else
+      _info "Using provided bearer token"
     fi
   fi
 
@@ -199,7 +202,7 @@ dns_azure_rm() {
   else
     accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
   fi
-  
+
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
     _err "invalid domain"
     return 1

From 1029dd3504b28ae686a0e5a32d7ebbb97eaeb7c2 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Fri, 20 Sep 2024 15:44:50 +0200
Subject: [PATCH 031/174] fix format

---
 dnsapi/dns_azure.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 31bc42ca..c39fc846 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,7 +49,7 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
+    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -87,7 +87,7 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
   fi
 
-  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
     accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
@@ -197,7 +197,7 @@ dns_azure_rm() {
     fi
   fi
 
-  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then    
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
     accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")

From 28afe6f29f1bd6700fbfa7c87a705fd212c635da Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 10:30:54 +0200
Subject: [PATCH 032/174] comment

---
 dnsapi/dns_azure.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index c39fc846..d2372cca 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -87,6 +87,7 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
   fi
 
+  # Use provided bearer token if available and prefix it with Bearer if not already done
   if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else

From ba7764aeaf59c4bed00e8ac7867e329dbc3e82ef Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 10:59:29 +0200
Subject: [PATCH 033/174] saveaccountconf

---
 dnsapi/dns_azure.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index d2372cca..703203a1 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -85,6 +85,7 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
     _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
+    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$AZUREDNS_BEARERTOKEN"
   fi
 
   # Use provided bearer token if available and prefix it with Bearer if not already done

From 8887a0a6d39bd08e7ae7d5c0f6adeddf78568c17 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:09:25 +0200
Subject: [PATCH 034/174] new name

---
 dnsapi/dns_azure.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 703203a1..7f838a6c 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,7 +49,7 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+    if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -85,14 +85,14 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
     _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
-    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$AZUREDNS_BEARERTOKEN"
+    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN2 "$AZUREDNS_BEARERTOKEN2"
   fi
 
   # Use provided bearer token if available and prefix it with Bearer if not already done
-  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+  if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
-    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN2" | sed "s/Bearer //g")
   fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
@@ -167,7 +167,7 @@ dns_azure_rm() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+    if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -199,10 +199,10 @@ dns_azure_rm() {
     fi
   fi
 
-  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+  if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
-    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN2" | sed "s/Bearer //g")
   fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then

From fc87fc7cab30a888fab1fd4aff4423bd34192744 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:18:03 +0200
Subject: [PATCH 035/174] debug

---
 dnsapi/dns_azure.sh | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 7f838a6c..d3248436 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,7 +49,8 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
+    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+      _debug "Contents of bearertoken: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -85,14 +86,13 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
     _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
-    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN2 "$AZUREDNS_BEARERTOKEN2"
+    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$AZUREDNS_BEARERTOKEN"
   fi
 
-  # Use provided bearer token if available and prefix it with Bearer if not already done
-  if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
-    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN2" | sed "s/Bearer //g")
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
   fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
@@ -167,7 +167,8 @@ dns_azure_rm() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
+    if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
+      _debug "Contents of bearertoken second time: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -199,10 +200,10 @@ dns_azure_rm() {
     fi
   fi
 
-  if [ -z "$AZUREDNS_BEARERTOKEN2" ]; then
+  if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
     accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
   else
-    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN2" | sed "s/Bearer //g")
+    accesstoken=$(echo "$AZUREDNS_BEARERTOKEN" | sed "s/Bearer //g")
   fi
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then

From 5fc41a3ea2c57e896c8de9d456cbda24007b7a2e Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:24:24 +0200
Subject: [PATCH 036/174] read account conf

---
 dnsapi/dns_azure.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index d3248436..caeeb76a 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,6 +49,7 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       _debug "Contents of bearertoken: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then
@@ -167,6 +168,7 @@ dns_azure_rm() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       _debug "Contents of bearertoken second time: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then

From 1305b0d8dd8fd0b0d680bf7451ec4a274537776b Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:29:34 +0200
Subject: [PATCH 037/174] revert

---
 dnsapi/dns_azure.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index caeeb76a..56b755cf 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -51,7 +51,6 @@ dns_azure_add() {
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
     AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
-      _debug "Contents of bearertoken: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -170,7 +169,6 @@ dns_azure_rm() {
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
     AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
-      _debug "Contents of bearertoken second time: $AZUREDNS_BEARERTOKEN"
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
         AZUREDNS_TENANTID=""
@@ -404,4 +402,4 @@ _get_root() {
     i=$(_math "$i" + 1)
   done
   return 1
-}
+}
\ No newline at end of file

From ffd3b3e6b540bd65feda1ab8c149dc1dab868b17 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:36:37 +0200
Subject: [PATCH 038/174] revert

---
 dnsapi/dns_azure.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 56b755cf..95087616 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,7 +49,6 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
@@ -86,7 +85,6 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
     _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
-    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$AZUREDNS_BEARERTOKEN"
   fi
 
   if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
@@ -167,7 +165,6 @@ dns_azure_rm() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""

From 0dff1dce8fa925ddaa79585ed258027a074af94d Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:50:57 +0200
Subject: [PATCH 039/174] accoutn conf

---
 dnsapi/dns_azure.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 95087616..351af80e 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -49,6 +49,7 @@ dns_azure_add() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
@@ -85,6 +86,7 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
     _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
+    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$AZUREDNS_BEARERTOKEN"
   fi
 
   if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
@@ -165,6 +167,7 @@ dns_azure_rm() {
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
     AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
     AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+    AZUREDNS_BEARERTOKEN="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
     if [ -z "$AZUREDNS_BEARERTOKEN" ]; then
       if [ -z "$AZUREDNS_TENANTID" ]; then
         AZUREDNS_SUBSCRIPTIONID=""
@@ -308,7 +311,7 @@ _azure_getaccess_token() {
   clientID=$3
   clientSecret=$4
 
-  accesstoken="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
+  accesstoken="${AZUREDNS_ACCESSTOKEN:-$(_readaccountconf_mutable AZUREDNS_ACCESSTOKEN)}"
   expires_on="${AZUREDNS_TOKENVALIDTO:-$(_readaccountconf_mutable AZUREDNS_TOKENVALIDTO)}"
 
   # can we reuse the bearer token?
@@ -352,7 +355,7 @@ _azure_getaccess_token() {
     _err "error $response"
     return 1
   fi
-  _saveaccountconf_mutable AZUREDNS_BEARERTOKEN "$accesstoken"
+  _saveaccountconf_mutable AZUREDNS_ACCESSTOKEN "$accesstoken"
   _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO "$expires_on"
   printf "%s" "$accesstoken"
   return 0

From 40df6e87db78e5f3ff83ce4b16e1155f97aaded5 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 11:54:42 +0200
Subject: [PATCH 040/174] newline

---
 dnsapi/dns_azure.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 351af80e..ee2dc9d4 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -402,4 +402,4 @@ _get_root() {
     i=$(_math "$i" + 1)
   done
   return 1
-}
\ No newline at end of file
+}

From a30c81dadcf9d7237c4528d9686c569b0b040e25 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 12:00:11 +0200
Subject: [PATCH 041/174] bearetoken

---
 dnsapi/dns_azure.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index ee2dc9d4..8ca1b359 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -30,6 +30,7 @@ dns_azure_add() {
     AZUREDNS_TENANTID=""
     AZUREDNS_APPID=""
     AZUREDNS_CLIENTSECRET=""
+    AZUREDNS_BEARERTOKEN=""
     _err "You didn't specify the Azure Subscription ID"
     return 1
   fi
@@ -44,6 +45,7 @@ dns_azure_add() {
     _saveaccountconf_mutable AZUREDNS_TENANTID ""
     _saveaccountconf_mutable AZUREDNS_APPID ""
     _saveaccountconf_mutable AZUREDNS_CLIENTSECRET ""
+    _saveaccountconf_mutable AZUREDNS_BEARERTOKEN ""
   else
     _info "You didn't ask to use Azure managed identity, checking service principal credentials or provided bearer token"
     AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
@@ -56,6 +58,7 @@ dns_azure_add() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure Tenant ID "
         return 1
       fi
@@ -65,6 +68,7 @@ dns_azure_add() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure App ID"
         return 1
       fi
@@ -74,6 +78,7 @@ dns_azure_add() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure Client Secret"
         return 1
       fi
@@ -155,6 +160,7 @@ dns_azure_rm() {
     AZUREDNS_TENANTID=""
     AZUREDNS_APPID=""
     AZUREDNS_CLIENTSECRET=""
+    AZUREDNS_BEARERTOKEN=""
     _err "You didn't specify the Azure Subscription ID "
     return 1
   fi
@@ -174,6 +180,7 @@ dns_azure_rm() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure Tenant ID "
         return 1
       fi
@@ -183,6 +190,7 @@ dns_azure_rm() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure App ID"
         return 1
       fi
@@ -192,6 +200,7 @@ dns_azure_rm() {
         AZUREDNS_TENANTID=""
         AZUREDNS_APPID=""
         AZUREDNS_CLIENTSECRET=""
+        AZUREDNS_BEARERTOKEN=""
         _err "You didn't specify the Azure Client Secret"
         return 1
       fi

From b0418cb39404c68a37c00666c0c542922017f4c6 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 12:23:07 +0200
Subject: [PATCH 042/174] trigger

---
 dnsapi/dns_azure.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 8ca1b359..14546899 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -412,3 +412,4 @@ _get_root() {
   done
   return 1
 }
+

From 0c10bd7dd7bba1775e03074e83256c8249697b85 Mon Sep 17 00:00:00 2001
From: stbeldarborge <eldar.borge@storebrand.no>
Date: Thu, 10 Oct 2024 12:35:05 +0200
Subject: [PATCH 043/174] shfmt

---
 dnsapi/dns_azure.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 14546899..8ca1b359 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -412,4 +412,3 @@ _get_root() {
   done
   return 1
 }
-

From 1aabb7d6dec01bd49d5d507e5c99826988c3cf8f Mon Sep 17 00:00:00 2001
From: sahsanu <sahsanu@users.noreply.github.com>
Date: Mon, 14 Oct 2024 15:59:54 +0200
Subject: [PATCH 044/174] Fix dns_pdns.sh to use saved account conf

---
 dnsapi/dns_pdns.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_pdns.sh b/dnsapi/dns_pdns.sh
index 6cce54da..12e0e83d 100755
--- a/dnsapi/dns_pdns.sh
+++ b/dnsapi/dns_pdns.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/bash
 # shellcheck disable=SC2034
 dns_pdns_info='PowerDNS Server API
 Site: PowerDNS.com
@@ -10,6 +10,7 @@ Options:
  PDNS_Ttl=60 Domain TTL. Default: "60".
 '
 
+
 DEFAULT_PDNS_TTL=60
 
 ########  Public functions #####################
@@ -20,6 +21,11 @@ dns_pdns_add() {
   fulldomain=$1
   txtvalue=$2
 
+  PDNS_Url="${PDNS_Url:-$(_readaccountconf_mutable PDNS_Url)}"
+  PDNS_ServerId="${PDNS_ServerId:-$(_readaccountconf_mutable PDNS_ServerId)}"
+  PDNS_Token="${PDNS_Token:-$(_readaccountconf_mutable PDNS_Token)}"
+  PDNS_Ttl="${PDNS_Ttl:-$(_readaccountconf_mutable PDNS_Ttl)}"
+
   if [ -z "$PDNS_Url" ]; then
     PDNS_Url=""
     _err "You don't specify PowerDNS address."
@@ -73,6 +79,11 @@ dns_pdns_rm() {
   fulldomain=$1
   txtvalue=$2
 
+  PDNS_Url="${PDNS_Url:-$(_readaccountconf_mutable PDNS_Url)}"
+  PDNS_ServerId="${PDNS_ServerId:-$(_readaccountconf_mutable PDNS_ServerId)}"
+  PDNS_Token="${PDNS_Token:-$(_readaccountconf_mutable PDNS_Token)}"
+  PDNS_Ttl="${PDNS_Ttl:-$(_readaccountconf_mutable PDNS_Ttl)}"
+
   if [ -z "$PDNS_Ttl" ]; then
     PDNS_Ttl="$DEFAULT_PDNS_TTL"
   fi

From 1782eeb785372a618cd64fd6a31e1b22510678bf Mon Sep 17 00:00:00 2001
From: sahsanu <sahsanu@users.noreply.github.com>
Date: Mon, 14 Oct 2024 16:18:44 +0200
Subject: [PATCH 045/174] Fix dns_pdns.sh to use saved account conf

---
 dnsapi/dns_pdns.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_pdns.sh b/dnsapi/dns_pdns.sh
index 12e0e83d..3130a02b 100755
--- a/dnsapi/dns_pdns.sh
+++ b/dnsapi/dns_pdns.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/bash
+#!/usr/bin/env sh
 # shellcheck disable=SC2034
 dns_pdns_info='PowerDNS Server API
 Site: PowerDNS.com
@@ -10,7 +10,6 @@ Options:
  PDNS_Ttl=60 Domain TTL. Default: "60".
 '
 
-
 DEFAULT_PDNS_TTL=60
 
 ########  Public functions #####################

From 6a9304dd1caf145ec01e11d8b40472d2734335d6 Mon Sep 17 00:00:00 2001
From: sahsanu <sahsanu@users.noreply.github.com>
Date: Wed, 16 Oct 2024 09:03:18 +0200
Subject: [PATCH 046/174] Change _saveaccountconf to _saveaccountconf_mutable

---
 dnsapi/dns_pdns.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_pdns.sh b/dnsapi/dns_pdns.sh
index 3130a02b..2478e19f 100755
--- a/dnsapi/dns_pdns.sh
+++ b/dnsapi/dns_pdns.sh
@@ -51,12 +51,12 @@ dns_pdns_add() {
   fi
 
   #save the api addr and key to the account conf file.
-  _saveaccountconf PDNS_Url "$PDNS_Url"
-  _saveaccountconf PDNS_ServerId "$PDNS_ServerId"
-  _saveaccountconf PDNS_Token "$PDNS_Token"
+  _saveaccountconf_mutable PDNS_Url "$PDNS_Url"
+  _saveaccountconf_mutable PDNS_ServerId "$PDNS_ServerId"
+  _saveaccountconf_mutable PDNS_Token "$PDNS_Token"
 
   if [ "$PDNS_Ttl" != "$DEFAULT_PDNS_TTL" ]; then
-    _saveaccountconf PDNS_Ttl "$PDNS_Ttl"
+    _saveaccountconf_mutable PDNS_Ttl "$PDNS_Ttl"
   fi
 
   _debug "Detect root zone"

From 30ed4af38d7ee9a3fb01ee719658e7efc65d579c Mon Sep 17 00:00:00 2001
From: Roland Giesler <roland@greentree.systems>
Date: Wed, 16 Oct 2024 11:49:29 +0200
Subject: [PATCH 047/174] Revert TXT add update

The change was needed for Power-Mailinabox and broke Mail-in-a-box, so a new API for Power-Mailinabox has been added
---
 dnsapi/dns_miab.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index c2aa9789..0824a4e7 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -16,8 +16,7 @@ Author: Darven Dissek, William Gertz
 #Usage: dns_miab_add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_miab_add() {
   fulldomain=$1
-  # Added "value=" and "&ttl=300" to accomodate the new TXT record format used by the MIAB/PMIAB API
-  txtvalue="value=$2&ttl=300"
+  txtvalue=$2
   _info "Using miab challenge add"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"

From 838a20ea9510860533973aa26d6741c26dcdf0f7 Mon Sep 17 00:00:00 2001
From: Ryo ONODERA <ryo@tetera.org>
Date: Thu, 24 Oct 2024 22:47:30 +0900
Subject: [PATCH 048/174] Fix POSIX shell portability

POSIX standard says test command has '=" as for checking identical.
'==' is bash dialect.
Replace '==' with '='.

See:
https://pubs.opengroup.org/onlinepubs/009604399/utilities/test.html
---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index e39a146b..03d4c552 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1442,7 +1442,7 @@ _toPkcs() {
   else
     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
   fi
-  if [ "$?" == "0" ]; then
+  if [ "$?" = "0" ]; then
     _savedomainconf "Le_PFXPassword" "$pfxPassword"
   fi
 

From 10833dcf395d50d177b78988aa19359c919a063e Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Mon, 28 Oct 2024 11:50:28 -0300
Subject: [PATCH 049/174] trigger github action

---
 dnsapi/dns_linode_v4.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 12682dbf..6af076cc 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env sh
 
+
 #Original Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>
 #v4 Update Author: Aaron W. Swenson <aaron@grandmasfridge.org>
 

From 03906cc055e533f444bd6731c8bab37de2dc701c Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Mon, 28 Oct 2024 12:07:33 -0300
Subject: [PATCH 050/174] trigger github action

---
 dnsapi/dns_linode_v4.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 6af076cc..12682dbf 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -1,6 +1,5 @@
 #!/usr/bin/env sh
 
-
 #Original Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>
 #v4 Update Author: Aaron W. Swenson <aaron@grandmasfridge.org>
 

From a4e7806d2103c03cfd3a1287fd5f5fee73311e32 Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sun, 3 Nov 2024 13:09:44 +0100
Subject: [PATCH 051/174] fix
 https://github.com/acmesh-official/acme.sh/issues/5208

---
 acme.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 03d4c552..2eea666a 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2193,7 +2193,6 @@ _send_signed_request() {
         _debug2 _headers "$_headers"
         _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
       fi
-      _debug2 _CACHED_NONCE "$_CACHED_NONCE"
       if [ "$?" != "0" ]; then
         _err "Cannot connect to $nonceurl to get nonce."
         return 1

From a3032ab9456c83ff91150c3f42fc1a65f08cf7d0 Mon Sep 17 00:00:00 2001
From: vmmello <vmmello@vmmello.eti.br>
Date: Tue, 5 Nov 2024 11:10:55 -0300
Subject: [PATCH 052/174] dns_linode_v4.sh: remove uneeeded extra space (shfmt
 error)

---
 dnsapi/dns_linode_v4.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index e79ec309..1c7c0db9 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -145,7 +145,6 @@ _get_root() {
       return 1
     fi
 
-
     _debug "Querying Linode APIv4 for hosted zone: $h"
     if _H4="X-Filter: {\"domain\":\"$h\"}" _rest GET; then
       _debug "Got response from API: $response"

From 43ed998ed682a2c49f48d338374158c38792e672 Mon Sep 17 00:00:00 2001
From: vmmello <vmmello@vmmello.eti.br>
Date: Tue, 5 Nov 2024 11:26:37 -0300
Subject: [PATCH 053/174] dns_linode_v4.sh: trigger action execution (dummy
 change)

---
 dnsapi/dns_linode_v4.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 1c7c0db9..e2f06420 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -4,7 +4,7 @@ dns_linode_v4_info='Linode.com
 Site: Linode.com
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_linode_v4
 Options:
- LINODE_V4_API_KEY API Key
+  LINODE_V4_API_KEY API Key
 Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>, Aaron W. Swenson <aaron@grandmasfridge.org>
 '
 

From 2663f500cff18b0a954f4774336ab62257c147b9 Mon Sep 17 00:00:00 2001
From: vmmello <vmmello@vmmello.eti.br>
Date: Tue, 5 Nov 2024 11:43:04 -0300
Subject: [PATCH 054/174] dns_linode_v4.sh: trigger action

---
 dnsapi/dns_linode_v4.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index e2f06420..c9511f8b 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -4,7 +4,7 @@ dns_linode_v4_info='Linode.com
 Site: Linode.com
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_linode_v4
 Options:
-  LINODE_V4_API_KEY API Key
+   LINODE_V4_API_KEY API Key
 Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>, Aaron W. Swenson <aaron@grandmasfridge.org>
 '
 

From 1ff326c89c120c0775e3522cd9ac938544a656ae Mon Sep 17 00:00:00 2001
From: vmmello <vmmello@vmmello.eti.br>
Date: Tue, 5 Nov 2024 14:57:28 -0300
Subject: [PATCH 055/174] dns_linode_v4.sh: trigger action

---
 dnsapi/dns_linode_v4.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index c9511f8b..e2f06420 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -4,7 +4,7 @@ dns_linode_v4_info='Linode.com
 Site: Linode.com
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_linode_v4
 Options:
-   LINODE_V4_API_KEY API Key
+  LINODE_V4_API_KEY API Key
 Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>, Aaron W. Swenson <aaron@grandmasfridge.org>
 '
 

From 724f3aa301da65a0a8ce472b78d88e8e99ca30d0 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Wed, 6 Nov 2024 16:18:21 -0300
Subject: [PATCH 056/174] rename variable, undo accidental revert from dev

---
 dnsapi/dns_linode_v4.sh | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index e2f06420..a4cec0b3 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -4,7 +4,7 @@ dns_linode_v4_info='Linode.com
 Site: Linode.com
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_linode_v4
 Options:
-  LINODE_V4_API_KEY API Key
+ LINODE_V4_API_KEY API Key
 Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net>, Aaron W. Swenson <aaron@grandmasfridge.org>
 '
 
@@ -138,24 +138,25 @@ _get_root() {
   while true; do
     # loop through the received string (e.g.  _acme-challenge.sub3.sub2.sub1.domain.tld),
     # starting from the lowest subdomain, and check if it's a hosted domain
-    h=$(printf "%s" "$full_host_str" | cut -d . -f $i-100)
-    _debug h "$h"
-    if [ -z "$h" ]; then
+    tst_hosted_domain=$(printf "%s" "$full_host_str" | cut -d . -f "$i"-100)
+    _debug tst_hosted_domain "$tst_hosted_domain"
+    if [ -z "$tst_hosted_domain" ]; then
       #not valid
+      _err "Couldn't get domain from string '$full_host_str'."
       return 1
     fi
 
-    _debug "Querying Linode APIv4 for hosted zone: $h"
-    if _H4="X-Filter: {\"domain\":\"$h\"}" _rest GET; then
+    _debug "Querying Linode APIv4 for hosted zone: $tst_hosted_domain"
+    if _H4="X-Filter: {\"domain\":\"$tst_hosted_domain\"}" _rest GET; then
       _debug "Got response from API: $response"
       response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
-      hostedzone="$(echo "$response" | _egrep_o "\{.*\"domain\": *\"$h\".*}")"
+      hostedzone="$(echo "$response" | _egrep_o "\{.*\"domain\": *\"$tst_hosted_domain\".*}")"
       if [ "$hostedzone" ]; then
         _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
-        _debug "Found domain hosted on Linode DNS. Zone: $h, id: $_domain_id"
+        _debug "Found domain hosted on Linode DNS. Zone: $tst_hosted_domain, id: $_domain_id"
         if [ "$_domain_id" ]; then
-          _sub_domain=$(printf "%s" "$full_host_str" | cut -d . -f 1-$p)
-          _domain=$h
+          _sub_domain=$(printf "%s" "$full_host_str" | cut -d . -f 1-"$p")
+          _domain=$tst_hosted_domain
           return 0
         fi
         return 1

From 7b63ebfcaa8e59d6099953de14b0c20e0be722e2 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Thu, 7 Nov 2024 12:33:56 -0300
Subject: [PATCH 057/174] fix random failures due to unnecessary headers on
 requests

was unintendedly replaying the save _H4 header on all requests, what was
causing random failures on responses from the API.
---
 dnsapi/dns_linode_v4.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index a4cec0b3..fc59c342 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -192,6 +192,10 @@ _rest() {
     response="$(_get "$LINODE_V4_API_URL$ep$data")"
   fi
 
+  # unset _H4, for it not to be used on every request unnecessarily, because it
+  # causes random failures inside Linode API when using unnecessary _H4 parameters (e.g. X-Filter)
+  unset _H4
+
   if [ "$?" != "0" ]; then
     _err "error $ep"
     return 1

From 4f96a2a6679a7093ef36b8746431d32dcd5e2253 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Thu, 7 Nov 2024 17:36:25 -0300
Subject: [PATCH 058/174] remove unnecessary variable 'export' on variable _H4

---
 dnsapi/dns_linode_v4.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index fc59c342..20c32ad1 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -182,7 +182,6 @@ _rest() {
   export _H1="Accept: application/json"
   export _H2="Content-Type: application/json"
   export _H3="Authorization: Bearer $LINODE_V4_API_KEY"
-  export _H4 # used to query for the root domain on _get_root()
 
   if [ "$mtd" != "GET" ]; then
     # both POST and DELETE.
@@ -192,10 +191,6 @@ _rest() {
     response="$(_get "$LINODE_V4_API_URL$ep$data")"
   fi
 
-  # unset _H4, for it not to be used on every request unnecessarily, because it
-  # causes random failures inside Linode API when using unnecessary _H4 parameters (e.g. X-Filter)
-  unset _H4
-
   if [ "$?" != "0" ]; then
     _err "error $ep"
     return 1

From d3cf3f7a5c672a78f7b82b024f176a5deb25c1b2 Mon Sep 17 00:00:00 2001
From: Vinicius Mello <vmmello@vmmello.eti.br>
Date: Fri, 8 Nov 2024 00:59:21 -0300
Subject: [PATCH 059/174] fix pagination bug for domains with a big zone file

the same pagination bug that happens for accounts with a large number of
domains also happens for DNS zones with a large number of records. The
previous code assumes that all records are returned in a single page.

Changed the code to do an exact match search so that it returns only the few
required records and never paginates replies.
---
 dnsapi/dns_linode_v4.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index 20c32ad1..3c6997a0 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -76,7 +76,7 @@ dns_linode_v4_rm() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  if _rest GET "/$_domain_id/records" && [ -n "$response" ]; then
+  if _H4="X-Filter: { \"type\": \"TXT\", \"name\": \"$_sub_domain\" }" _rest GET "/$_domain_id/records" && [ -n "$response" ]; then
     response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
 
     resource="$(echo "$response" | _egrep_o "\{.*\"name\": *\"$_sub_domain\".*}")"

From 1a43c81840fc9ca8a386fa3677ea530a3f5f80a3 Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 9 Nov 2024 17:24:22 +0200
Subject: [PATCH 060/174] dnsapi omg.lol: fix info

Description "Based on the omg.lol API" is useless for users so removed.
The link to api moved to comment bellow.
Domains: omg.lol is unnecessary because the DNS provider name is anyway omg.lol.
Site: changed to point to the https://omg.lol site.
Issues: put a link to the support issue.

Remove the useless "Please Read this guide first" comment.
Fix typos.

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_omglol.sh | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_omglol.sh b/dnsapi/dns_omglol.sh
index b6c06aee..5c137c3f 100644
--- a/dnsapi/dns_omglol.sh
+++ b/dnsapi/dns_omglol.sh
@@ -1,23 +1,19 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
-dns_myapi_info='omg.lol
- Based on the omg.lol API, defined at https://api.omg.lol/
-Domains: omg.lol
-Site: github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_duckdns
+dns_omglol_info='omg.lol
+Site: omg.lol
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_omglol
 Options:
- OMG_ApiKey API Key from omg.lol.  This is accesible from the bottom of the account page at https://home.omg.lol/account
+ OMG_ApiKey API Key from omg.lol. This is accessible from the bottom of the account page at https://home.omg.lol/account
  OMG_Address This is your omg.lol address, without the preceding @ - you can see your list on your dashboard at https://home.omg.lol/dashboard
-Issues: github.com/acmesh-official/acme.sh
+Issues: github.com/acmesh-official/acme.sh/issues/5299
 Author: @Kholin <kholin+acme.omglolapi@omg.lol>
 '
 
-#returns 0 means success, otherwise error.
+# See API Docs https://api.omg.lol/
 
 ########  Public functions #####################
 
-# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-
 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_omglol_add() {
   fulldomain=$1
@@ -244,8 +240,8 @@ omg_delete() {
   omg_validate_delete "$output"
 }
 
-# Validate the response on request to delete.  Confirm stastus is success and
-# Message indicates deletion was successful
+# Validate the response on request to delete.
+# Confirm status is success and message indicates deletion was successful.
 # Input: Response - HTTP response received from delete request
 omg_validate_delete() {
   response=$1

From 4f17bc0d864180467a74917a11f88292bea3a60f Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 9 Nov 2024 18:05:28 +0200
Subject: [PATCH 061/174] dnsapi timeweb: Use structured info

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_timeweb.sh | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_timeweb.sh b/dnsapi/dns_timeweb.sh
index 9860872c..544564ea 100644
--- a/dnsapi/dns_timeweb.sh
+++ b/dnsapi/dns_timeweb.sh
@@ -1,16 +1,13 @@
 #!/usr/bin/env sh
-
-# acme.sh DNS API for Timeweb Cloud provider (https://timeweb.cloud).
-#
-# Author: https://github.com/nikolaypronchev.
-#
-# Prerequisites:
-# Timeweb Cloud API JWT token. Obtain one from the Timeweb Cloud control panel
-# ("API and Terraform" section: https://timeweb.cloud/my/api-keys). The JWT token
-# must be provided to this script in one of two ways:
-# 1.  As the "TW_Token" variable, for example: "export TW_Token=eyJhbG...zUxMiIs";
-# 2.  As a "TW_Token" config entry in acme.sh account config file
-#     (usually located at ~/.acme.sh/account.conf by default).
+# shellcheck disable=SC2034
+dns_timeweb_info='Timeweb.Cloud
+Site: Timeweb.Cloud
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_timeweb
+Options:
+ TW_Token API JWT token. Get it from the control panel at https://timeweb.cloud/my/api-keys
+Issues: github.com/acmesh-official/acme.sh/issues/5140
+Author: Nikolay Pronchev <https://github.com/nikolaypronchev>
+'
 
 TW_Api="https://api.timeweb.cloud/api/v1"
 

From fe8ad3548bd64a0c17887b2f45f37dc085c978ef Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 9 Nov 2024 18:22:01 +0200
Subject: [PATCH 062/174] dnsapi alviy: Use structured info

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_alviy.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_alviy.sh b/dnsapi/dns_alviy.sh
index 2217b0df..8aa7da34 100644
--- a/dnsapi/dns_alviy.sh
+++ b/dnsapi/dns_alviy.sh
@@ -1,11 +1,12 @@
 #!/usr/bin/env sh
-# Alviy domain api
-#
-# Get API key and secret from https://cloud.alviy.com/token
-#
-# Alviy_token="some-secret-key"
-#
-# Ex.: acme.sh --issue --staging --dns dns_alviy -d "*.s.example.com" -d "s.example.com"
+# shellcheck disable=SC2034
+dns_alviy_info='Alviy.com
+Site: Alviy.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_alviy
+Options:
+ Alviy_token API token. Get it from the https://cloud.alviy.com/token
+Issues: github.com/acmesh-official/acme.sh/issues/5115
+'
 
 Alviy_Api="https://cloud.alviy.com/api/v1"
 

From 8bf9482bc094baa6d1bf52d4cf5aa6dad9852755 Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 9 Nov 2024 18:31:52 +0200
Subject: [PATCH 063/174] dnsapi ionos_cloud: Use structured info

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_ionos_cloud.sh | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_ionos_cloud.sh b/dnsapi/dns_ionos_cloud.sh
index fa229e03..f255092f 100644
--- a/dnsapi/dns_ionos_cloud.sh
+++ b/dnsapi/dns_ionos_cloud.sh
@@ -1,12 +1,14 @@
 #!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_ionos_cloud_info='IONOS Cloud DNS
+Site: ionos.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_ionos_cloud
+Options:
+ IONOS_TOKEN API Token.
+Issues: github.com/acmesh-official/acme.sh/issues/5243
+'
 
 # Supports IONOS Cloud DNS API v1.15.4
-#
-# Usage:
-#   Export IONOS_TOKEN before calling acme.sh:
-#   $ export IONOS_TOKEN="..."
-#
-#   $ acme.sh --issue --dns dns_ionos_cloud ...
 
 IONOS_CLOUD_API="https://dns.de-fra.ionos.com"
 IONOS_CLOUD_ROUTE_ZONES="/zones"

From 2c67934191a9a382b1c8f6397551042dcc0f033c Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sat, 9 Nov 2024 23:29:52 +0100
Subject: [PATCH 064/174] fix(truenas): builtin service deprecation

---
 deploy/truenas.sh | 140 +++++++++++++++++++++++++---------------------
 1 file changed, 76 insertions(+), 64 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index c79e6dac..7f6a8ec8 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -9,7 +9,7 @@
 #
 # Following environment variables must be set:
 #
-# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
+# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI>"
 #
 # The following environmental variables may be set if you don't like their
 # default values:
@@ -64,6 +64,11 @@ truenas_deploy() {
   _response=$(_get "$_api_url/system/state")
   _info "TrueNAS system state: $_response."
 
+  _info "Getting TrueNAS version"
+  _response=$(_get "$_api_url/system/version")
+  _info "TrueNAS system version: $_response"
+  _truenas_version=$(echo "$_response"  | cut -d '-' -f 3)
+
   if [ -z "$_response" ]; then
     _err "Unable to authenticate to $_api_url."
     _err 'Check your connection settings are correct, e.g.'
@@ -115,27 +120,78 @@ truenas_deploy() {
 
   _debug3 _activate_result "$_activate_result"
 
-  _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
-  _webdav_list=$(_get "$_api_url/webdav")
-  _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
-
-  if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
-    _info "Updating the WebDAV certificate"
-    _debug _webdav_cert_id "$_webdav_cert_id"
-    _webdav_data="{\"certssl\": \"${_cert_id}\"}"
-    _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
-    _webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | grep '"certssl":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
-    if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
-      _info "WebDAV certificate updated successfully"
-    else
-      _err "Unable to set WebDAV certificate"
-      _debug3 _activate_webdav_cert "$_activate_webdav_cert"
+  _truenas_version_23_10="23.10.0.0"
+  _truenas_version_24_10="24.10.0.0"
+
+  if [ "$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_23_10" ]; then
+    _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
+    _webdav_list=$(_get "$_api_url/webdav")
+    _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
+
+    if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
+      _info "Updating the WebDAV certificate"
+      _debug _webdav_cert_id "$_webdav_cert_id"
+      _webdav_data="{\"certssl\": \"${_cert_id}\"}"
+      _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
+      _webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | grep '"certssl":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
+      if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
+        _info "WebDAV certificate updated successfully"
+      else
+        _err "Unable to set WebDAV certificate"
+        _debug3 _activate_webdav_cert "$_activate_webdav_cert"
+        _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
+        return 1
+      fi
       _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
-      return 1
+    else
+      _info "WebDAV certificate is not configured or is not the same as TrueNAS web UI"
+    fi
+
+    _info "Checking if S3 certificate is the same as the TrueNAS web UI"
+    _s3_list=$(_get "$_api_url/s3")
+    _s3_cert_id=$(echo "$_s3_list" | grep '"certificate":' | tr -d -- '"certifa:_ ,')
+
+    if [ "$_s3_cert_id" = "$_active_cert_id" ]; then
+      _info "Updating the S3 certificate"
+      _debug _s3_cert_id "$_s3_cert_id"
+      _s3_data="{\"certificate\": \"${_cert_id}\"}"
+      _activate_s3_cert="$(_post "$_s3_data" "$_api_url/s3" "" "PUT" "application/json")"
+      _s3_new_cert_id=$(echo "$_activate_s3_cert" | _json_decode | grep '"certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
+      if [ "$_s3_new_cert_id" -eq "$_cert_id" ]; then
+        _info "S3 certificate updated successfully"
+      else
+        _err "Unable to set S3 certificate"
+        _debug3 _activate_s3_cert "$_activate_s3_cert"
+        _debug3 _s3_new_cert_id "$_s3_new_cert_id"
+        return 1
+      fi
+      _debug3 _activate_s3_cert "$_activate_s3_cert"
+    else
+      _info "S3 certificate is not configured or is not the same as TrueNAS web UI"
+    fi
+  fi
+
+  if [ "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]; then
+    _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
+    if _exists jq; then
+      _info "Query all chart release"
+      _release_list=$(_get "$_api_url/chart/release")
+      _related_name_list=$(printf "%s" "$_release_list" | jq -r "[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==$_active_cert_id) | .name ] | unique")
+      _release_length=$(printf "%s" "$_related_name_list" | jq -r "length")
+      _info "Found $_release_length related chart release in list: $_related_name_list"
+      for i in $(seq 0 $((_release_length - 1))); do
+        _release_name=$(echo "$_related_name_list" | jq -r ".[$i]")
+        _info "Updating certificate from $_active_cert_id to $_cert_id for chart release: $_release_name"
+        #Read the chart release configuration
+        _chart_config=$(printf "%s" "$_release_list" | jq -r ".[] | select(.name==\"$_release_name\")")
+        #Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
+        _updated_chart_config=$(printf "%s" "$_chart_config" | jq "(.config.ingress?.main.tls[]? | select(.scaleCert==$_active_cert_id) | .scaleCert  ) |= $_cert_id | .config.ingress ")
+        _update_chart_result="$(_post "{\"values\" : { \"ingress\" : $_updated_chart_config } }" "$_api_url/chart/release/id/$_release_name" "" "PUT" "application/json")"
+        _debug3 _update_chart_result "$_update_chart_result"
+      done
+    else
+      _info "Tool 'jq' does not exists, skip chart release checking"
     fi
-    _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
-  else
-    _info "WebDAV certificate is not configured or is not the same as TrueNAS web UI"
   fi
 
   _info "Checking if FTP certificate is the same as the TrueNAS web UI"
@@ -161,50 +217,6 @@ truenas_deploy() {
     _info "FTP certificate is not configured or is not the same as TrueNAS web UI"
   fi
 
-  _info "Checking if S3 certificate is the same as the TrueNAS web UI"
-  _s3_list=$(_get "$_api_url/s3")
-  _s3_cert_id=$(echo "$_s3_list" | grep '"certificate":' | tr -d -- '"certifa:_ ,')
-
-  if [ "$_s3_cert_id" = "$_active_cert_id" ]; then
-    _info "Updating the S3 certificate"
-    _debug _s3_cert_id "$_s3_cert_id"
-    _s3_data="{\"certificate\": \"${_cert_id}\"}"
-    _activate_s3_cert="$(_post "$_s3_data" "$_api_url/s3" "" "PUT" "application/json")"
-    _s3_new_cert_id=$(echo "$_activate_s3_cert" | _json_decode | grep '"certificate":' | sed -n 's/.*: \([0-9]\{1,\}\),\{0,1\}$/\1/p')
-    if [ "$_s3_new_cert_id" -eq "$_cert_id" ]; then
-      _info "S3 certificate updated successfully"
-    else
-      _err "Unable to set S3 certificate"
-      _debug3 _activate_s3_cert "$_activate_s3_cert"
-      _debug3 _s3_new_cert_id "$_s3_new_cert_id"
-      return 1
-    fi
-    _debug3 _activate_s3_cert "$_activate_s3_cert"
-  else
-    _info "S3 certificate is not configured or is not the same as TrueNAS web UI"
-  fi
-
-  _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
-  if _exists jq; then
-    _info "Query all chart release"
-    _release_list=$(_get "$_api_url/chart/release")
-    _related_name_list=$(printf "%s" "$_release_list" | jq -r "[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==$_active_cert_id) | .name ] | unique")
-    _release_length=$(printf "%s" "$_related_name_list" | jq -r "length")
-    _info "Found $_release_length related chart release in list: $_related_name_list"
-    for i in $(seq 0 $((_release_length - 1))); do
-      _release_name=$(echo "$_related_name_list" | jq -r ".[$i]")
-      _info "Updating certificate from $_active_cert_id to $_cert_id for chart release: $_release_name"
-      #Read the chart release configuration
-      _chart_config=$(printf "%s" "$_release_list" | jq -r ".[] | select(.name==\"$_release_name\")")
-      #Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
-      _updated_chart_config=$(printf "%s" "$_chart_config" | jq "(.config.ingress?.main.tls[]? | select(.scaleCert==$_active_cert_id) | .scaleCert  ) |= $_cert_id | .config.ingress ")
-      _update_chart_result="$(_post "{\"values\" : { \"ingress\" : $_updated_chart_config } }" "$_api_url/chart/release/id/$_release_name" "" "PUT" "application/json")"
-      _debug3 _update_chart_result "$_update_chart_result"
-    done
-  else
-    _info "Tool 'jq' does not exists, skip chart release checking"
-  fi
-
   _info "Deleting old certificate"
   _delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"
 

From fa420d70ccb4da8a0cbf3e531d3ee3191eafa86a Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 00:13:53 +0100
Subject: [PATCH 065/174] fix: verify truenas os version

---
 deploy/truenas.sh | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 7f6a8ec8..c98b51ab 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -66,8 +66,17 @@ truenas_deploy() {
 
   _info "Getting TrueNAS version"
   _response=$(_get "$_api_url/system/version")
-  _info "TrueNAS system version: $_response"
-  _truenas_version=$(echo "$_response"  | cut -d '-' -f 3)
+
+  if [[ "$_response" == *"SCALE"* ]]; then
+    _truenas_os=$(echo "$_response"  | cut -d '-' -f 2)
+    _truenas_version=$(echo "$_response"  | cut -d '-' -f 3 | tr -d '"')
+  else
+    _truenas_os="unknown"
+    _truenas_version="unknown"
+  fi
+  
+  _info "Detected TrueNAS system os: $_truenas_os"
+  _info "Detected TrueNAS system version: $_truenas_version"
 
   if [ -z "$_response" ]; then
     _err "Unable to authenticate to $_api_url."
@@ -123,7 +132,7 @@ truenas_deploy() {
   _truenas_version_23_10="23.10.0.0"
   _truenas_version_24_10="24.10.0.0"
 
-  if [ "$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_23_10" ]; then
+  if [[ "$_truenas_os" != "SCALE" || "$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_23_10" ]]; then
     _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
     _webdav_list=$(_get "$_api_url/webdav")
     _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
@@ -171,7 +180,7 @@ truenas_deploy() {
     fi
   fi
 
-  if [ "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]; then
+  if [[ "$_truenas_os" != "SCALE" || "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]]; then
     _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
     if _exists jq; then
       _info "Query all chart release"

From 34c8b882c63edbf40251f1705c7edc34c371c560 Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 00:34:26 +0100
Subject: [PATCH 066/174] fix: helm chart seems available only on truenas scale

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index c98b51ab..5cc108b3 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -180,7 +180,7 @@ truenas_deploy() {
     fi
   fi
 
-  if [[ "$_truenas_os" != "SCALE" || "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]]; then
+  if [[ "$_truenas_os" == "SCALE" || "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]]; then
     _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
     if _exists jq; then
       _info "Query all chart release"

From 64a1e889824f40fcef29503c6d8f0b44f9cdbf0c Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 02:41:38 +0100
Subject: [PATCH 067/174] feat: add support for docker apps

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 64 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 45 insertions(+), 19 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 5cc108b3..75cece6d 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -180,26 +180,52 @@ truenas_deploy() {
     fi
   fi
 
-  if [[ "$_truenas_os" == "SCALE" || "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]]; then
-    _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
-    if _exists jq; then
-      _info "Query all chart release"
-      _release_list=$(_get "$_api_url/chart/release")
-      _related_name_list=$(printf "%s" "$_release_list" | jq -r "[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==$_active_cert_id) | .name ] | unique")
-      _release_length=$(printf "%s" "$_related_name_list" | jq -r "length")
-      _info "Found $_release_length related chart release in list: $_related_name_list"
-      for i in $(seq 0 $((_release_length - 1))); do
-        _release_name=$(echo "$_related_name_list" | jq -r ".[$i]")
-        _info "Updating certificate from $_active_cert_id to $_cert_id for chart release: $_release_name"
-        #Read the chart release configuration
-        _chart_config=$(printf "%s" "$_release_list" | jq -r ".[] | select(.name==\"$_release_name\")")
-        #Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
-        _updated_chart_config=$(printf "%s" "$_chart_config" | jq "(.config.ingress?.main.tls[]? | select(.scaleCert==$_active_cert_id) | .scaleCert  ) |= $_cert_id | .config.ingress ")
-        _update_chart_result="$(_post "{\"values\" : { \"ingress\" : $_updated_chart_config } }" "$_api_url/chart/release/id/$_release_name" "" "PUT" "application/json")"
-        _debug3 _update_chart_result "$_update_chart_result"
-      done
+  if [ "$_truenas_os" == "SCALE" ]; then
+    if [ "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]; then
+      _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
+      if _exists jq; then
+        _info "Query all chart release"
+        _release_list=$(_get "$_api_url/chart/release")
+        _related_name_list=$(printf "%s" "$_release_list" | jq -r "[.[] | {name,certId: .config.ingress?.main.tls[]?.scaleCert} | select(.certId==$_active_cert_id) | .name ] | unique")
+        _release_length=$(printf "%s" "$_related_name_list" | jq -r "length")
+        _info "Found $_release_length related chart release in list: $_related_name_list"
+        for i in $(seq 0 $((_release_length - 1))); do
+          _release_name=$(echo "$_related_name_list" | jq -r ".[$i]")
+          _info "Updating certificate from $_active_cert_id to $_cert_id for chart release: $_release_name"
+          #Read the chart release configuration
+          _chart_config=$(printf "%s" "$_release_list" | jq -r ".[] | select(.name==\"$_release_name\")")
+          #Replace the old certificate id with the new one in path .config.ingress.main.tls[].scaleCert. Then update .config.ingress
+          _updated_chart_config=$(printf "%s" "$_chart_config" | jq "(.config.ingress?.main.tls[]? | select(.scaleCert==$_active_cert_id) | .scaleCert  ) |= $_cert_id | .config.ingress ")
+          _update_chart_result="$(_post "{\"values\" : { \"ingress\" : $_updated_chart_config } }" "$_api_url/chart/release/id/$_release_name" "" "PUT" "application/json")"
+          _debug3 _update_chart_result "$_update_chart_result"
+        done
+      else
+        _info "Tool 'jq' does not exists, skip chart release checking"
+      fi
     else
-      _info "Tool 'jq' does not exists, skip chart release checking"
+      _info "Checking if any app is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
+      if _exists jq; then
+        _info "Query all apps"
+        _app_list=$(_get "$_api_url/app")
+        _app_id_list=$(printf "%s" "$_app_list" | jq -r '.[].name')
+        _app_length=$(echo "$_app_id_list" | wc -l)
+        _info "Found $_app_length apps"
+        _info "Checking for each app if an update is needed"
+        for i in $(seq 1 $_app_length); do
+          _app_id=$(echo "$_app_id_list" | sed -n "${i}p")
+          _app_config="$(_post "\"$_app_id\"" "$_api_url/app/config" "" "POST" "application/json")"
+          # Check if the app use the same certificate TrueNAS web UI
+          _app_active_cert_config=$(echo "$_app_config" | _json_decode | jq -r ".ix_certificates[\"$_active_cert_id\"]")
+          if [[ "$_app_active_cert_config" != "null" ]]; then
+            _info "Updating certificate from $_active_cert_id to $_cert_id for app: $_app_id"
+            #Replace the old certificate id with the new one in path
+            _update_app_result="$(_post "{\"values\" : { \"network\": { \"certificate_id\": $_cert_id } } }" "$_api_url/app/id/$_app_id" "" "PUT" "application/json")"
+            _debug3 _update_app_result "$_update_app_result"
+          fi
+        done
+      else
+        _info "Tool 'jq' does not exists, skip chart release checking"
+      fi
     fi
   fi
 

From 21b966c8e6a4fd08079aff7fa52d677e78b6381b Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 02:56:40 +0100
Subject: [PATCH 068/174] fix: don't check for subversion that can lead to
 error

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 75cece6d..944ba240 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -69,7 +69,7 @@ truenas_deploy() {
 
   if [[ "$_response" == *"SCALE"* ]]; then
     _truenas_os=$(echo "$_response"  | cut -d '-' -f 2)
-    _truenas_version=$(echo "$_response"  | cut -d '-' -f 3 | tr -d '"')
+    _truenas_version=$(echo "$_response"  | cut -d '-' -f 3 | tr -d '"' | cut -d '.'  -f 1,2)
   else
     _truenas_os="unknown"
     _truenas_version="unknown"
@@ -129,8 +129,8 @@ truenas_deploy() {
 
   _debug3 _activate_result "$_activate_result"
 
-  _truenas_version_23_10="23.10.0.0"
-  _truenas_version_24_10="24.10.0.0"
+  _truenas_version_23_10="23.10"
+  _truenas_version_24_10="24.10"
 
   if [[ "$_truenas_os" != "SCALE" || "$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_23_10" ]]; then
     _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"

From b6a77e0231923ab13a31c00c73e2727ec2adb070 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Sun, 10 Nov 2024 22:12:38 +1300
Subject: [PATCH 069/174] Ruckus - use _get() and _post()

---
 deploy/ruckus.sh | 134 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 99 insertions(+), 35 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index d16f40e4..cbd5e353 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -1,9 +1,8 @@
-#!/usr/bin/env bash
+#!/usr/bin/env sh
 
-# Here is a script to deploy cert to Ruckus Zone Director/Unleashed.
-#
-# Adapted from:
-# https://ms264556.net/pages/PfSenseLetsEncryptToRuckus
+# Here is a script to deploy cert to Ruckus ZoneDirector / Unleashed.
+# 
+# Public domain, 2024, Tony Rielly <https://github.com/ms264556>
 #
 # ```sh
 # acme.sh --deploy -d ruckus.example.com --deploy-hook ruckus
@@ -13,11 +12,11 @@
 # deploy script to work.
 #
 # ```sh
-# export RUCKUS_HOST=ruckus.example.com
+# export RUCKUS_HOST=myruckus.example.com
 # export RUCKUS_USER=myruckususername
 # export RUCKUS_PASS=myruckuspassword
 #
-# acme.sh --deploy -d ruckus.example.com --deploy-hook ruckus
+# acme.sh --deploy -d myruckus.example.com --deploy-hook ruckus
 # ```
 #
 # returns 0 means success, otherwise error.
@@ -66,45 +65,110 @@ ruckus_deploy() {
   _debug RUCKUS_USER "$RUCKUS_USER"
   _debug RUCKUS_PASS "$RUCKUS_PASS"
 
-  COOKIE_JAR=$(mktemp)
-  cleanup() {
-    rm $COOKIE_JAR
-  }
-  trap cleanup EXIT
-
-  LOGIN_URL=$(curl https://$RUCKUS_HOST -ksSLo /dev/null -w '%{url_effective}')
-  _debug LOGIN_URL "$LOGIN_URL"
-
-  XSS=$(curl -ksSic $COOKIE_JAR $LOGIN_URL -d username=$RUCKUS_USER -d password="$RUCKUS_PASS" -d ok='Log In' | awk '/^HTTP_X_CSRF_TOKEN:/ { print $2 }' | tr -d '\040\011\012\015')
-  _debug XSS "$XSS"
+  export HTTPS_INSECURE=1
+  export ACME_HTTP_NO_REDIRECTS=1
+
+  _info Discovering the login URL
+  _get "https://$RUCKUS_HOST" >/dev/null
+  _login_url="$(_response_header 'Location')"
+  if [ -n "$_login_url" ]; then
+    _login_path=$(echo "$_login_url" | sed 's|https\?://[^/]\+||')
+    if [ -z "$_login_path" ]; then
+      # redirect was to a different host
+      _get "$_login_url" >/dev/null
+      _login_url="$(_response_header 'Location')"
+    fi
+  fi
 
-  if [ -n "$XSS" ]; then
-    _info "Authentication successful"
-  else
-    _err "Authentication failed"
+  if [ -z "${_login_url}" ]; then
+    _err "Connection failed: couldn't find login page."
     return 1
   fi
+  
+  _base_url=$(dirname "$_login_url")
+  _login_page=$(basename "$_login_url")
 
-  BASE_URL=$(dirname $LOGIN_URL)
-  CONF_ARGS="-ksSo /dev/null -b $COOKIE_JAR -c $COOKIE_JAR"
-  UPLOAD="$CONF_ARGS $BASE_URL/_upload.jsp?request_type=xhr"
-  CMD="$CONF_ARGS $BASE_URL/_cmdstat.jsp"
+   if [ "$_login_page" = "index.html" ]; then
+    _err "Connection temporarily unavailable: Unleashed Rebuilding."
+    return 1
+  fi
 
-  REPLACE_CERT_AJAX='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
-  CERT_REBOOT_AJAX='<ajax-request action="docmd" comp="worker" updater="rid.0.5" xcmd="cert-reboot" checkAbility="6"><xcmd cmd="cert-reboot" action="undefined"/></ajax-request>'
+   if [ "$_login_page" = "wizard.jsp" ]; then
+    _err "Connection failed: Setup Wizard not complete."
+    return 1
+  fi
+ 
+  _info Login
+  _username_encoded="$(printf "%s" "$RUCKUS_USER" | _url_encode)"
+  _password_encoded="$(printf "%s" "$RUCKUS_PASS" | _url_encode)"
+  _login_query="$(printf "%s" "username=${_username_encoded}&password=${_password_encoded}&ok=Log+In")"
+  _post "$_login_query" "$_login_url" >/dev/null
+
+  _login_code="$(_response_code)"
+  if [ "$_login_code" = "200" ]; then
+    _err "Login failed: incorrect credentials."
+    return 1
+  fi
+  
+  _info Collect Session Cookie
+  _H1="Cookie: $(_response_cookie)"
+  export _H1
+  _info Collect CSRF Token
+  _H2="X-CSRF-Token: $(_response_header 'HTTP_X_CSRF_TOKEN')"
+  export _H2
 
   _info "Uploading certificate"
-  curl $UPLOAD -H "X-CSRF-Token: $XSS" -F "u=@$_ccert" -F action=uploadcert -F callback=uploader_uploadcert || return 1
-
+  _post_upload "uploadcert" "$_cfullchain"
+  
   _info "Uploading private key"
-  curl $UPLOAD -H "X-CSRF-Token: $XSS" -F "u=@$_ckey" -F action=uploadprivatekey -F callback=uploader_uploadprivatekey || return 1
+  _post_upload "uploadprivatekey" "$_ckey"
 
   _info "Replacing certificate"
-  curl $CMD -H "X-CSRF-Token: $XSS" --data-raw "$REPLACE_CERT_AJAX" || return 1
+  _replace_cert_ajax='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
+  _post "$_replace_cert_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
+  
+  info "Rebooting"
+  _cert_reboot_ajax='<ajax-request action="docmd" comp="worker" updater="rid.0.5" xcmd="cert-reboot" checkAbility="6"><xcmd cmd="cert-reboot" action="undefined"/></ajax-request>'
+  _post "$_cert_reboot_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
+  
+  return 0
+}
+
+_response_code() {
+  < "$HTTP_HEADER" _egrep_o "^HTTP[^ ]* .*$" | cut -d " " -f 2-100 | tr -d "\f\n" | _egrep_o "^[0-9]*"
+}
 
-  _info "Rebooting"
-  curl $CMD -H "X-CSRF-Token: $XSS" --data-raw "$CERT_REBOOT_AJAX" || return 1
+_response_header() {
+    < "$HTTP_HEADER" grep -i "^$1:" | cut -d ':' -f 2- | tr -d "\r\n\t "
+}
 
-  return 0
+_response_cookie() {
+  _response_header 'Set-Cookie' | awk -F';' '{for(i=1;i<=NF;i++) if (tolower($i) !~ /(path|domain|expires|max-age|secure|httponly|samesite)/) printf "%s; ", $i}' | sed 's/; $//'
 }
 
+_post_upload() {
+  _post_action="$1"
+  _post_file="$2"
+  _post_url="$3"
+
+  _post_boundary="----FormBoundary$(date "+%s%N")"
+  
+  _post_data="$({
+    printf -- "--%s\r\n" "$_post_boundary"
+    printf -- "Content-Disposition: form-data; name=\"u\"; filename=\"%s\"\r\n" "$_post_action"
+    printf -- "Content-Type: application/octet-stream\r\n\r\n"
+    printf -- "%s\r\n" "$(cat "$_post_file")"
+
+    printf -- "--%s\r\n" "$_post_boundary"
+    printf -- "Content-Disposition: form-data; name=\"action\"\r\n\r\n"
+    printf -- "%s\r\n" "$_post_action"
+
+    printf -- "--%s\r\n" "$_post_boundary"
+    printf -- "Content-Disposition: form-data; name=\"callback\"\r\n\r\n"
+    printf -- "%s\r\n" "uploader_$_post_action"
+
+    printf -- "--%s--\r\n\r\n" "$_post_boundary"
+  })"
+
+  _post "$_post_data" "$_base_url/_upload.jsp?request_type=xhr" "" "" "multipart/form-data; boundary=$_post_boundary" >/dev/null
+}

From 717802611afb4d3e36c2aa2796b013355a0643f7 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Sun, 10 Nov 2024 22:43:57 +1300
Subject: [PATCH 070/174] remove dead code

---
 deploy/ruckus.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index cbd5e353..def8197d 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -149,8 +149,7 @@ _response_cookie() {
 _post_upload() {
   _post_action="$1"
   _post_file="$2"
-  _post_url="$3"
-
+  
   _post_boundary="----FormBoundary$(date "+%s%N")"
   
   _post_data="$({

From e8a453c567be8c5f77f8cdee69fadf1901425761 Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 13:21:09 +0100
Subject: [PATCH 071/174] fix: lint

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 944ba240..d53a5514 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -67,14 +67,14 @@ truenas_deploy() {
   _info "Getting TrueNAS version"
   _response=$(_get "$_api_url/system/version")
 
-  if [[ "$_response" == *"SCALE"* ]]; then
-    _truenas_os=$(echo "$_response"  | cut -d '-' -f 2)
-    _truenas_version=$(echo "$_response"  | cut -d '-' -f 3 | tr -d '"' | cut -d '.'  -f 1,2)
+  if [[ "$_response" = *"SCALE"* ]]; then
+    _truenas_os=$(echo "$_response" | cut -d '-' -f 2)
+    _truenas_version=$(echo "$_response" | cut -d '-' -f 3 | tr -d '"' | cut -d '.' -f 1,2)
   else
     _truenas_os="unknown"
     _truenas_version="unknown"
   fi
-  
+
   _info "Detected TrueNAS system os: $_truenas_os"
   _info "Detected TrueNAS system version: $_truenas_version"
 
@@ -132,7 +132,8 @@ truenas_deploy() {
   _truenas_version_23_10="23.10"
   _truenas_version_24_10="24.10"
 
-  if [[ "$_truenas_os" != "SCALE" || "$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_23_10" ]]; then
+  _check_version=$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)
+  if [ "$_truenas_os" != "SCALE" ] || [ "$_check_version" != "$_truenas_version_23_10" ]; then
     _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
     _webdav_list=$(_get "$_api_url/webdav")
     _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
@@ -180,8 +181,9 @@ truenas_deploy() {
     fi
   fi
 
-  if [ "$_truenas_os" == "SCALE" ]; then
-    if [ "$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)" != "$_truenas_version_24_10" ]; then
+  if [ "$_truenas_os" = "SCALE" ]; then
+    _check_version=$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)
+    if [ "$_check_version" != "$_truenas_version_24_10" ]; then
       _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
       if _exists jq; then
         _info "Query all chart release"
@@ -211,12 +213,12 @@ truenas_deploy() {
         _app_length=$(echo "$_app_id_list" | wc -l)
         _info "Found $_app_length apps"
         _info "Checking for each app if an update is needed"
-        for i in $(seq 1 $_app_length); do
+        for i in $(seq 1 "$_app_length"); do
           _app_id=$(echo "$_app_id_list" | sed -n "${i}p")
           _app_config="$(_post "\"$_app_id\"" "$_api_url/app/config" "" "POST" "application/json")"
           # Check if the app use the same certificate TrueNAS web UI
           _app_active_cert_config=$(echo "$_app_config" | _json_decode | jq -r ".ix_certificates[\"$_active_cert_id\"]")
-          if [[ "$_app_active_cert_config" != "null" ]]; then
+          if [ "$_app_active_cert_config" != "null" ]; then
             _info "Updating certificate from $_active_cert_id to $_cert_id for app: $_app_id"
             #Replace the old certificate id with the new one in path
             _update_app_result="$(_post "{\"values\" : { \"network\": { \"certificate_id\": $_cert_id } } }" "$_api_url/app/id/$_app_id" "" "PUT" "application/json")"

From 08807b498ed7b382b503741de0c04aa38fea3176 Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Sun, 10 Nov 2024 13:30:18 +0100
Subject: [PATCH 072/174] fix: bad copy/paste

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index d53a5514..4b0f17f4 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -226,7 +226,7 @@ truenas_deploy() {
           fi
         done
       else
-        _info "Tool 'jq' does not exists, skip chart release checking"
+        _info "Tool 'jq' does not exists, skip app checking"
       fi
     fi
   fi

From 1bfd4672e1ca68670a362cfe78a8df78d2f3b52c Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Tue, 12 Nov 2024 22:10:34 +0100
Subject: [PATCH 073/174] fix: remove double square brackets

---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 4b0f17f4..a425cff2 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -67,7 +67,7 @@ truenas_deploy() {
   _info "Getting TrueNAS version"
   _response=$(_get "$_api_url/system/version")
 
-  if [[ "$_response" = *"SCALE"* ]]; then
+  if echo "$_response" | grep -q "SCALE"; then
     _truenas_os=$(echo "$_response" | cut -d '-' -f 2)
     _truenas_version=$(echo "$_response" | cut -d '-' -f 3 | tr -d '"' | cut -d '.' -f 1,2)
   else

From 2229bcc98b9a00b938f612951b8ba1d3199f128e Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Tue, 12 Nov 2024 22:15:44 +0100
Subject: [PATCH 074/174] fix: echo flag

---
 deploy/truenas.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index a425cff2..407395a3 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -132,7 +132,7 @@ truenas_deploy() {
   _truenas_version_23_10="23.10"
   _truenas_version_24_10="24.10"
 
-  _check_version=$(echo -e "$_truenas_version_23_10\n$_truenas_version" | sort -V | head -n 1)
+  _check_version=$(printf "%s\n%s" "$_truenas_version_23_10" "$_truenas_version" | sort -V | head -n 1)
   if [ "$_truenas_os" != "SCALE" ] || [ "$_check_version" != "$_truenas_version_23_10" ]; then
     _info "Checking if WebDAV certificate is the same as the TrueNAS web UI"
     _webdav_list=$(_get "$_api_url/webdav")
@@ -182,7 +182,7 @@ truenas_deploy() {
   fi
 
   if [ "$_truenas_os" = "SCALE" ]; then
-    _check_version=$(echo -e "$_truenas_version_24_10\n$_truenas_version" | sort -V | head -n 1)
+    _check_version=$(printf "%s\n%s" "$_truenas_version_24_10" "$_truenas_version" | sort -V | head -n 1)
     if [ "$_check_version" != "$_truenas_version_24_10" ]; then
       _info "Checking if any chart release Apps is using the same certificate as TrueNAS web UI. Tool 'jq' is required"
       if _exists jq; then

From 0cc74b7cfe910d6961cd225e70dfaba884a418b4 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Wed, 13 Nov 2024 12:50:51 +1300
Subject: [PATCH 075/174] fix insecure password debug and _info typo

---
 deploy/ruckus.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index def8197d..d83675bb 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -63,7 +63,7 @@ ruckus_deploy() {
 
   _debug RUCKUS_HOST "$RUCKUS_HOST"
   _debug RUCKUS_USER "$RUCKUS_USER"
-  _debug RUCKUS_PASS "$RUCKUS_PASS"
+  _secure_debug RUCKUS_PASS "$RUCKUS_PASS"
 
   export HTTPS_INSECURE=1
   export ACME_HTTP_NO_REDIRECTS=1
@@ -127,7 +127,7 @@ ruckus_deploy() {
   _replace_cert_ajax='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
   _post "$_replace_cert_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
   
-  info "Rebooting"
+  _info "Rebooting"
   _cert_reboot_ajax='<ajax-request action="docmd" comp="worker" updater="rid.0.5" xcmd="cert-reboot" checkAbility="6"><xcmd cmd="cert-reboot" action="undefined"/></ajax-request>'
   _post "$_cert_reboot_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
   

From 9c25365b1222ad944f585d043f888f6dbd7f0b0d Mon Sep 17 00:00:00 2001
From: Sergey Parfenov <chuvakk91@gmail.com>
Date: Tue, 12 Nov 2024 01:20:39 +0300
Subject: [PATCH 076/174] Add swanctl support

---
 deploy/strongswan.sh | 111 ++++++++++++++++++++++++++++++-------------
 1 file changed, 77 insertions(+), 34 deletions(-)

diff --git a/deploy/strongswan.sh b/deploy/strongswan.sh
index 3d5f1b34..14567d17 100644
--- a/deploy/strongswan.sh
+++ b/deploy/strongswan.sh
@@ -10,46 +10,89 @@
 
 #domain keyfile certfile cafile fullchain
 strongswan_deploy() {
-  _cdomain="$1"
-  _ckey="$2"
-  _ccert="$3"
-  _cca="$4"
-  _cfullchain="$5"
-
+  _cdomain="${1}"
+  _ckey="${2}"
+  _ccert="${3}"
+  _cca="${4}"
+  _cfullchain="${5}"
   _info "Using strongswan"
-
-  if [ -x /usr/sbin/ipsec ]; then
-    _ipsec=/usr/sbin/ipsec
-  elif [ -x /usr/sbin/strongswan ]; then
-    _ipsec=/usr/sbin/strongswan
-  elif [ -x /usr/local/sbin/ipsec ]; then
-    _ipsec=/usr/local/sbin/ipsec
-  else
+  if _exists ipsec; then
+    _ipsec=ipsec
+  elif _exists strongswan; then
+    _ipsec=strongswan
+  fi
+  if _exists swanctl; then
+    _swanctl=swanctl
+  fi
+  # For legacy stroke mode
+  if [ -n "${_ipsec}" ]; then
+    _info "${_ipsec} command detected"
+    _confdir=$(${_ipsec} --confdir)
+    if [ -z "${_confdir}" ]; then
+      _err "no strongswan --confdir is detected"
+      return 1
+    fi
+    _info _confdir "${_confdir}"
+    __deploy_cert "$@" "stroke" "${_confdir}"
+    ${_ipsec} reload
+  fi
+  # For modern vici mode
+  if [ -n "${_swanctl}" ]; then
+    _info "${_swanctl} command detected"
+    for _dir in /usr/local/etc/swanctl /etc/swanctl /etc/strongswan/swanctl; do
+      if [ -d ${_dir} ]; then
+        _confdir=${_dir}
+        _info _confdir "${_confdir}"
+        break
+      fi
+    done
+    if [ -z "${_confdir}" ]; then
+      _err "no swanctl config dir is found"
+      return 1
+    fi
+    __deploy_cert "$@" "vici" "${_confdir}"
+    ${_swanctl} --load-creds
+  fi
+  if [ -z "${_swanctl}" ] && [ -z "${_ipsec}" ]; then
     _err "no strongswan or ipsec command is detected"
+    _err "no swanctl is detected"
     return 1
   fi
+}
 
-  _info _ipsec "$_ipsec"
+####################  Private functions below ##################################
 
-  _confdir=$($_ipsec --confdir)
-  if [ $? -ne 0 ] || [ -z "$_confdir" ]; then
-    _err "no strongswan --confdir is detected"
+__deploy_cert() {
+  _cdomain="${1}"
+  _ckey="${2}"
+  _ccert="${3}"
+  _cca="${4}"
+  _cfullchain="${5}"
+  _swan_mode="${6}"
+  _confdir="${7}"
+  _debug _cdomain "${_cdomain}"
+  _debug _ckey "${_ckey}"
+  _debug _ccert "${_ccert}"
+  _debug _cca "${_cca}"
+  _debug _cfullchain "${_cfullchain}"
+  _debug _swan_mode "${_swan_mode}"
+  _debug _confdir "${_confdir}"
+  if [ "${_swan_mode}" = "vici" ]; then
+    _dir_private="private"
+    _dir_cert="x509"
+    _dir_ca="x509ca"
+  elif [ "${_swan_mode}" = "stroke" ]; then
+    _dir_private="ipsec.d/private"
+    _dir_cert="ipsec.d/certs"
+    _dir_ca="ipsec.d/cacerts"
+  else
+    _err "unknown StrongSwan mode ${_swan_mode}"
     return 1
   fi
-
-  _info _confdir "$_confdir"
-
-  _debug _cdomain "$_cdomain"
-  _debug _ckey "$_ckey"
-  _debug _ccert "$_ccert"
-  _debug _cca "$_cca"
-  _debug _cfullchain "$_cfullchain"
-
-  cat "$_ckey" >"${_confdir}/ipsec.d/private/$(basename "$_ckey")"
-  cat "$_ccert" >"${_confdir}/ipsec.d/certs/$(basename "$_ccert")"
-  cat "$_cca" >"${_confdir}/ipsec.d/cacerts/$(basename "$_cca")"
-  cat "$_cfullchain" >"${_confdir}/ipsec.d/cacerts/$(basename "$_cfullchain")"
-
-  $_ipsec reload
-
+  cat "${_ckey}" >"${_confdir}/${_dir_private}/$(basename "${_ckey}")"
+  cat "${_ccert}" >"${_confdir}/${_dir_cert}/$(basename "${_ccert}")"
+  cat "${_cca}" >"${_confdir}/${_dir_ca}/$(basename "${_cca}")"
+  if [ "${_swan_mode}" = "stroke" ]; then
+    cat "${_cfullchain}" >"${_confdir}/${_dir_ca}/$(basename "${_cfullchain}")"
+  fi
 }

From e98e7a232ffa70d37bc4af6260e754a5a5060b98 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Wed, 13 Nov 2024 17:27:36 +1300
Subject: [PATCH 077/174] Fix info logging

---
 deploy/ruckus.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index d83675bb..3b147c25 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -68,7 +68,7 @@ ruckus_deploy() {
   export HTTPS_INSECURE=1
   export ACME_HTTP_NO_REDIRECTS=1
 
-  _info Discovering the login URL
+  _info "Discovering the login URL"
   _get "https://$RUCKUS_HOST" >/dev/null
   _login_url="$(_response_header 'Location')"
   if [ -n "$_login_url" ]; then
@@ -98,7 +98,7 @@ ruckus_deploy() {
     return 1
   fi
  
-  _info Login
+  _info "Login"
   _username_encoded="$(printf "%s" "$RUCKUS_USER" | _url_encode)"
   _password_encoded="$(printf "%s" "$RUCKUS_PASS" | _url_encode)"
   _login_query="$(printf "%s" "username=${_username_encoded}&password=${_password_encoded}&ok=Log+In")"
@@ -110,10 +110,10 @@ ruckus_deploy() {
     return 1
   fi
   
-  _info Collect Session Cookie
+  _info "Collect Session Cookie"
   _H1="Cookie: $(_response_cookie)"
   export _H1
-  _info Collect CSRF Token
+  _info "Collect CSRF Token"
   _H2="X-CSRF-Token: $(_response_header 'HTTP_X_CSRF_TOKEN')"
   export _H2
 

From 38c41b72d6acc0edfe6d7a1fa072fe16a1505ff5 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Thu, 14 Nov 2024 07:16:38 +1300
Subject: [PATCH 078/174] fix acme.sh PR shfmt failure

---
 deploy/ruckus.sh | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index 3b147c25..b4249472 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
 # Here is a script to deploy cert to Ruckus ZoneDirector / Unleashed.
-# 
+#
 # Public domain, 2024, Tony Rielly <https://github.com/ms264556>
 #
 # ```sh
@@ -84,20 +84,20 @@ ruckus_deploy() {
     _err "Connection failed: couldn't find login page."
     return 1
   fi
-  
+
   _base_url=$(dirname "$_login_url")
   _login_page=$(basename "$_login_url")
 
-   if [ "$_login_page" = "index.html" ]; then
+  if [ "$_login_page" = "index.html" ]; then
     _err "Connection temporarily unavailable: Unleashed Rebuilding."
     return 1
   fi
 
-   if [ "$_login_page" = "wizard.jsp" ]; then
+  if [ "$_login_page" = "wizard.jsp" ]; then
     _err "Connection failed: Setup Wizard not complete."
     return 1
   fi
- 
+
   _info "Login"
   _username_encoded="$(printf "%s" "$RUCKUS_USER" | _url_encode)"
   _password_encoded="$(printf "%s" "$RUCKUS_PASS" | _url_encode)"
@@ -109,7 +109,7 @@ ruckus_deploy() {
     _err "Login failed: incorrect credentials."
     return 1
   fi
-  
+
   _info "Collect Session Cookie"
   _H1="Cookie: $(_response_cookie)"
   export _H1
@@ -119,27 +119,27 @@ ruckus_deploy() {
 
   _info "Uploading certificate"
   _post_upload "uploadcert" "$_cfullchain"
-  
+
   _info "Uploading private key"
   _post_upload "uploadprivatekey" "$_ckey"
 
   _info "Replacing certificate"
   _replace_cert_ajax='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
   _post "$_replace_cert_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
-  
+
   _info "Rebooting"
   _cert_reboot_ajax='<ajax-request action="docmd" comp="worker" updater="rid.0.5" xcmd="cert-reboot" checkAbility="6"><xcmd cmd="cert-reboot" action="undefined"/></ajax-request>'
   _post "$_cert_reboot_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
-  
+
   return 0
 }
 
 _response_code() {
-  < "$HTTP_HEADER" _egrep_o "^HTTP[^ ]* .*$" | cut -d " " -f 2-100 | tr -d "\f\n" | _egrep_o "^[0-9]*"
+  _egrep_o <"$HTTP_HEADER" "^HTTP[^ ]* .*$" | cut -d " " -f 2-100 | tr -d "\f\n" | _egrep_o "^[0-9]*"
 }
 
 _response_header() {
-    < "$HTTP_HEADER" grep -i "^$1:" | cut -d ':' -f 2- | tr -d "\r\n\t "
+  grep <"$HTTP_HEADER" -i "^$1:" | cut -d ':' -f 2- | tr -d "\r\n\t "
 }
 
 _response_cookie() {
@@ -149,9 +149,9 @@ _response_cookie() {
 _post_upload() {
   _post_action="$1"
   _post_file="$2"
-  
+
   _post_boundary="----FormBoundary$(date "+%s%N")"
-  
+
   _post_data="$({
     printf -- "--%s\r\n" "$_post_boundary"
     printf -- "Content-Disposition: form-data; name=\"u\"; filename=\"%s\"\r\n" "$_post_action"

From 2bb5fbdee549f6f1baacd2e7cc3cd8f1a4c4fc48 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Thu, 14 Nov 2024 07:21:19 +1300
Subject: [PATCH 079/174] Remove HTTPS_INSECURE

---
 deploy/ruckus.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index b4249472..1bfa6bd6 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -65,7 +65,6 @@ ruckus_deploy() {
   _debug RUCKUS_USER "$RUCKUS_USER"
   _secure_debug RUCKUS_PASS "$RUCKUS_PASS"
 
-  export HTTPS_INSECURE=1
   export ACME_HTTP_NO_REDIRECTS=1
 
   _info "Discovering the login URL"

From 0c2d7b9c06a648e31a5bd7c93436088ab8a0ca83 Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Thu, 14 Nov 2024 20:03:22 +0100
Subject: [PATCH 080/174] fix for latest omnios-r151052

---
 acme.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 2eea666a..a55ee41c 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1811,7 +1811,11 @@ _date2time() {
     return
   fi
   #Omnios
-  if da="$(echo "$1" | tr -d "Z" | tr "T" ' ')" perl -MTime::Piece -e 'print Time::Piece->strptime($ENV{da}, "%Y-%m-%d %H:%M:%S")->epoch, "\n";' 2>/dev/null; then
+  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%d %H:%M:%S\").timestamp()))" 2>/dev/null; then
+    return
+  fi
+  #Omnios
+  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%dT%H:%M:%SZ\").timestamp()))" 2>/dev/null; then
     return
   fi
   _err "Cannot parse _date2time $1"

From 709f1e76d3ea77f3415e8bdca5d13ae4532c0e7e Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Thu, 14 Nov 2024 20:17:03 +0100
Subject: [PATCH 081/174] fix for omnios-r151052

---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index a55ee41c..2791325d 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1811,11 +1811,11 @@ _date2time() {
     return
   fi
   #Omnios
-  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%d %H:%M:%S\").timestamp()))" 2>/dev/null; then
+  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%d %H:%M:%S\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
     return
   fi
   #Omnios
-  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%dT%H:%M:%SZ\").timestamp()))" 2>/dev/null; then
+  if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%dT%H:%M:%SZ\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
     return
   fi
   _err "Cannot parse _date2time $1"

From 4e0686f73cf89d29d19cd24d46386b770d194bbb Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Thu, 14 Nov 2024 20:35:15 +0100
Subject: [PATCH 082/174] fix for omnios-r151052

---
 acme.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/acme.sh b/acme.sh
index 2791325d..9842e3f1 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1628,6 +1628,11 @@ _time2str() {
     return
   fi
 
+  #Omnios
+  if date -u -r "$1" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null; then
+    return
+  fi
+
   #Solaris
   if printf "%(%Y-%m-%dT%H:%M:%SZ)T\n" $1 2>/dev/null; then
     return

From 4232923641479da186a21009cd1aae9617801da4 Mon Sep 17 00:00:00 2001
From: ms264556 <29752086+ms264556@users.noreply.github.com>
Date: Fri, 15 Nov 2024 12:39:41 +1300
Subject: [PATCH 083/174] Remove awk usage and refuse redirect to new host

---
 deploy/ruckus.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/ruckus.sh b/deploy/ruckus.sh
index 1bfa6bd6..f62e2fc0 100755
--- a/deploy/ruckus.sh
+++ b/deploy/ruckus.sh
@@ -74,8 +74,8 @@ ruckus_deploy() {
     _login_path=$(echo "$_login_url" | sed 's|https\?://[^/]\+||')
     if [ -z "$_login_path" ]; then
       # redirect was to a different host
-      _get "$_login_url" >/dev/null
-      _login_url="$(_response_header 'Location')"
+      _err "Connection failed: redirected to a different host. Configure Unleashed with a Preferred Master or Management Interface."
+      return 1
     fi
   fi
 
@@ -142,7 +142,7 @@ _response_header() {
 }
 
 _response_cookie() {
-  _response_header 'Set-Cookie' | awk -F';' '{for(i=1;i<=NF;i++) if (tolower($i) !~ /(path|domain|expires|max-age|secure|httponly|samesite)/) printf "%s; ", $i}' | sed 's/; $//'
+  _response_header 'Set-Cookie' | sed 's/;.*//'
 }
 
 _post_upload() {

From 413a91646c03b0cd4ab6dace1bdabe78d702a710 Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Sat, 16 Nov 2024 19:15:39 +0100
Subject: [PATCH 084/174] Create truenas_ws.sh

---
 deploy/truenas_ws.sh | 317 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 317 insertions(+)
 create mode 100644 deploy/truenas_ws.sh

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
new file mode 100644
index 00000000..b5ba51ab
--- /dev/null
+++ b/deploy/truenas_ws.sh
@@ -0,0 +1,317 @@
+#!/usr/bin/env bash
+
+# TrueNAS deploy script for SCALE/CORE using websocket
+# It is recommend to use a wildcard certificate
+#
+# Websocket Documentation: https://www.truenas.com/docs/api/scale_websocket_api.html
+#
+# Tested with TrueNAS Scale - Electric Eel 24.10
+# Changes certificate in the following services:
+#  - Web UI
+#  - FTP
+#  - iX Apps
+#
+# The following environment variables must be set:
+# ------------------------------------------------
+#
+# # API KEY
+# # Use the folowing URL to create a new API token: <TRUENAS_HOSTNAME OR IP>/ui/apikeys
+# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
+#
+
+### Private functions
+
+# Call websocket method
+# Usage:
+#   _ws_response=$(_ws_call "math.dummycalc" "'{"x": 4, "y": 5}'")
+#   _info "$_ws_response"
+#
+# Output:
+#   {"z": 9}
+#
+# Arguments:
+#   $@ - midclt arguments for call
+#
+# Returns:
+#   JSON/JOBID
+_ws_call() {
+  _debug "_ws_call arg1" "$1"
+  _debug "_ws_call arg2" "$2"
+  _debug "_ws_call arg3" "$3"
+  if [ $# -eq 3 ]
+  then
+    _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2" "$3")
+  fi
+  if [ $# -eq 2 ]
+  then
+    _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2")
+  fi
+  if [ $# -eq 1 ]
+  then
+    _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1")
+  fi
+  _debug "_ws_response" "$_ws_response"
+  printf "%s" $_ws_response
+  return 0
+}
+
+# Check argument is a number
+# Usage:
+#
+# Output:
+#   n/a
+#
+# Arguments:
+#   $1 - Anything
+#
+# Returns:
+#   0: true
+#   1: false
+_ws_check_jobid() {
+  case "$1" in
+    [0-9]*)
+      return 0
+      ;;
+  esac
+  return 1
+}
+
+
+# Wait for job to finish and return result as JSON
+# Usage:
+#   _ws_result=$(_ws_get_job_result "$_ws_jobid")
+#   _new_certid=$(printf "%s" "$_ws_result" | jq -r '."id"')
+#
+# Output:
+#   JSON result of the job
+#
+# Arguments:
+#   $1 - JobID
+#
+# Returns:
+#   n/a
+_ws_get_job_result() {
+  while true
+  do
+    sleep 2
+    _ws_response=$(_ws_call "core.get_jobs" "[[\"id\", \"=\", $1]]")
+    if [ "$(printf "%s" "$_ws_response" | jq -r '.[]."state"')" != "RUNNING" ]
+    then
+      _ws_result="$(printf "%s" "$_ws_response" | jq '.[]."result"')"
+      _debug "_ws_result" "$_ws_result"
+      printf "%s" $_ws_result
+      _ws_error="$(printf "%s" "$_ws_response" | jq '.[]."error"')"
+      if [ "$_ws_error" != "null" ]
+      then
+        _err "Job $1 failed:"
+        _err "$_ws_error"
+        return 7
+      fi
+      break
+    fi
+  done
+  return 0
+}
+
+
+
+
+########################
+### Public functions ###
+########################
+
+# truenas_ws_deploy
+#
+# Deploy new certificate to TrueNAS services
+#
+# Arguments
+#  1: Domain
+#  2: Key-File
+#  3: Certificate-File
+#  4: CA-File
+#  5: FullChain-File
+# Returns:
+#  0: Success
+#  1: Missing API Key
+#  2: TrueNAS not ready
+#  3: Not a JobID
+#  4: FTP cert error
+#  5: WebUI cert error
+#  6: Job error
+#  7: WS call error
+# 10: No CORE or SCALE detected
+#
+truenas_ws_deploy() {
+  _domain="$1"
+  _file_key="$2"
+  _file_cert="$3"
+  _file_ca="$4"
+  _file_fullchain="$5"
+  _debug _domain "$_domain"
+  _debug _file_key "$_file_key"
+  _debug _file_cert "$_file_cert"
+  _debug _file_ca "$_file_ca"
+  _debug _file_fullchain "$_file_fullchain"
+
+########## Environment check
+
+  _info "Checking environment variables..."
+  _getdeployconf DEPLOY_TRUENAS_APIKEY
+  # Check API Key
+  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]
+  then
+    _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
+    exit 1
+  fi
+  _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _info "Environment variables: OK"
+
+########## Health check
+
+  _info "Checking TrueNAS health..."
+  _ws_response=$(_ws_call "system.ready" | tr '[:lower:]' '[:upper:]')
+  _ws_ret=$?
+  if [ $_ws_ret -gt 0 ]
+  then
+    _err "Error calling system.ready:"
+    _err "$_ws_response"
+    exit $_ws_re
+  fi
+
+  if [ "$_ws_response" != "TRUE" ]
+  then
+    _err "TrueNAS is not ready."
+    _err "Please check environment variables DEPLOY_TRUENAS_APIKEY, DEPLOY_TRUENAS_HOSTNAME and DEPLOY_TRUENAS_PROTOCOL."
+    _err "Verify API key."
+    exit 2
+  fi
+  _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _info "TrueNAS health: OK"
+
+########## System info
+
+  _info "Gather system info..."
+  _ws_response=$(_ws_call "system.info")
+  _truenas_system=$(printf "%s" "$_ws_response" | jq -r '."version"' | cut -d '-' -f 2 | tr '[:lower:]' '[:upper:]')
+  _truenas_version=$(printf "%s" "$_ws_response" | jq -r '."version"' | cut -d '-' -f 3)
+  _info "TrueNAS system: $_truenas_system"
+  _info "TrueNAS version: $_truenas_version"
+  if [ "$_truenas_system" != "SCALE" ] && ["$_truenas_system" != "CORE" ]
+  then
+    _err "Cannot gather TrueNAS system. Nor CORE oder SCALE detected."
+    exit 10
+  fi
+
+########## Gather current certificate
+
+  _info "Gather current WebUI certificate..."
+  _ws_response="$(_ws_call "system.general.config")"
+  _ui_certificate_id=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
+  _ui_certificate_name=$(printf "%s"  "$_ws_response" | jq -r '."ui_certificate"."name"')
+  _info "Current WebUI certificate ID: $_ui_certificate_id"
+  _info "Current WebUI certificate name: $_ui_certificate_name"
+  _info "WebUI redirect to https: $_ui_http_redirect"
+
+########## Upload new certificate
+
+  _info "Upload new certificate..."
+  _certname="acme_$(_utc_date | tr -d '\-\:' | tr ' ' '_')"
+  _debug _certname "$_certname"
+  _ws_jobid=$(_ws_call "certificate.create" "{\"name\": \"${_certname}\", \"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"certificate\": \"$(_json_encode <"$_file_fullchain")\", \"privatekey\": \"$(_json_encode <"$_file_key")\", \"passphrase\": \"\"}")
+  _debug "_ws_jobid" "$_ws_jobid"
+  if ! _ws_check_jobid "$_ws_jobid"
+  then
+    _err "No JobID returned from websocket method."
+    exit 3
+  fi
+  _ws_result=$(_ws_get_job_result "$_ws_jobid")
+  if [ $? -gt 0 ]
+  then
+    exit $?
+  fi
+  _debug "_ws_result" "$_ws_result"
+  _new_certid=$(printf "%s" "$_ws_result" | jq -r '."id"')
+  _info "New certificate ID: $_new_certid"
+
+########## FTP
+
+  _info "Replace FTP certificate..."
+  _ws_response=$(_ws_call "ftp.update" "{\"ssltls_certificate\": $_new_certid}")
+  _ftp_certid=$(printf "%s" "$_ws_response" | jq -r '."ssltls_certificate"')
+  if [ "$_ftp_certid" != "$_new_certid" ]
+  then
+    _err "Cannot set FTP certificate."
+    _debug "_ws_response" "$_ws_response"
+    exit 4
+  fi
+
+########## ix Apps (SCALE only)
+
+  if [ "$_truenas_system" = "SCALE" ]
+  then
+    _info "Replace app certificates..."
+    _ws_response=$(_ws_call "app.query")
+    for _app_name in $(printf "%s" $_ws_response | jq -r '.[]."name"')
+    do
+      _info "Checking app $_app_name..."
+      _ws_response=$(_ws_call "app.config" "$_app_name")
+      if [ "$(printf "%s" $_ws_response | jq -r '."network" | has("certificate_id")')" = "true" ]
+      then
+        _info "App has certificate option, setup new certificate..."
+        _info "App will be redeployed after updating the certificate."
+        _ws_jobid=$(_ws_call "app.update" "$_app_name" "{\"values\": {\"network\": {\"certificate_id\": $_new_certid}}}")
+        _debug "_ws_jobid" "$_ws_jobid"
+        if ! _ws_check_jobid "$_ws_jobid"
+        then
+          _err "No JobID returned from websocket method."
+          exit 3
+        fi
+        _ws_result=$(_ws_get_job_result "$_ws_jobid")
+         if [ $? -gt 0 ]
+         then
+           exit $?
+         fi
+        _debug "_ws_result" "$_ws_result"
+        _info "App certificate replaced."
+      else
+        _info "App has no certificate option, skipping..."
+      fi
+    done
+  fi
+
+########## WebUI
+
+  _info "Replace WebUI certificate..."
+  _ws_response=$(_ws_call "system.general.update" "{\"ui_certificate\": $_new_certid}")
+  _changed_certid=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
+  if [ "$_changed_certid" != "$_new_certid" ]
+  then
+    _err "WebUI certificate change error.."
+    exit 5
+  else
+    _info "WebUI certificate replaced."
+  fi
+  _info "Restarting WebUI..."
+  _ws_response=$(_ws_call "system.general.ui_restart")
+  _info "Waiting for UI restart..."
+  sleep 6
+
+########## Certificates
+
+  _info "Deleting old certificate..."
+  _ws_jobid=$(_ws_call "certificate.delete" "$_ui_certificate_id")
+  if ! _ws_check_jobid "$_ws_jobid"
+  then
+    _err "No JobID returned from websocket method."
+    exit 3
+  fi
+  _ws_result=$(_ws_get_job_result $_ws_jobid)
+  if [ $? -gt 0 ]
+  then
+    exit $?
+  fi
+
+
+  _info "Have a nice day...bye!"
+
+}

From 3b8608761b53fb6fce3991012e4cbf82109ab653 Mon Sep 17 00:00:00 2001
From: "Kirill A. Korinsky" <kirill@korins.ky>
Date: Sun, 17 Nov 2024 20:58:06 +0100
Subject: [PATCH 085/174] Fix syntax for OpenBSD sh

---
 dnsapi/dns_netcup.sh | 6 +++---
 notify/aws_ses.sh    | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_netcup.sh b/dnsapi/dns_netcup.sh
index 687b99bc..8609adf6 100644
--- a/dnsapi/dns_netcup.sh
+++ b/dnsapi/dns_netcup.sh
@@ -19,7 +19,7 @@ client=""
 
 dns_netcup_add() {
   _debug NC_Apikey "$NC_Apikey"
-  login
+  _login
   if [ "$NC_Apikey" = "" ] || [ "$NC_Apipw" = "" ] || [ "$NC_CID" = "" ]; then
     _err "No Credentials given"
     return 1
@@ -61,7 +61,7 @@ dns_netcup_add() {
 }
 
 dns_netcup_rm() {
-  login
+  _login
   fulldomain=$1
   txtvalue=$2
 
@@ -125,7 +125,7 @@ dns_netcup_rm() {
   logout
 }
 
-login() {
+_login() {
   tmp=$(_post "{\"action\": \"login\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apipassword\": \"$NC_Apipw\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
   sid=$(echo "$tmp" | tr '{}' '\n' | grep apisessionid | cut -d '"' -f 4)
   _debug "$tmp"
diff --git a/notify/aws_ses.sh b/notify/aws_ses.sh
index 30db45ad..07e0c48c 100644
--- a/notify/aws_ses.sh
+++ b/notify/aws_ses.sh
@@ -89,7 +89,7 @@ _use_metadata() {
       _normalizeJson |
       tr '{,}' '\n' |
       while read -r _line; do
-        _key="$(echo "${_line%%:*}" | tr -d '"')"
+        _key="$(echo "${_line%%:*}" | tr -d \")"
         _value="${_line#*:}"
         _debug3 "_key" "$_key"
         _secure_debug3 "_value" "$_value"

From 276e089419592eabe1f188fdb53d161ab835cf70 Mon Sep 17 00:00:00 2001
From: mikhailkhr <CreatorDT1@gmail.com>
Date: Wed, 20 Nov 2024 12:38:06 +0300
Subject: [PATCH 086/174] fix: new version of fornex dns based on api version
 2.3.1

---
 dnsapi/dns_fornex.sh | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_fornex.sh b/dnsapi/dns_fornex.sh
index cede0cd0..a352547b 100644
--- a/dnsapi/dns_fornex.sh
+++ b/dnsapi/dns_fornex.sh
@@ -9,7 +9,7 @@ Issues: github.com/acmesh-official/acme.sh/issues/3998
 Author: Timur Umarov <inbox@tumarov.com>
 '
 
-FORNEX_API_URL="https://fornex.com/api/dns/v0.1"
+FORNEX_API_URL="https://fornex.com/api"
 
 ########  Public functions #####################
 
@@ -30,12 +30,10 @@ dns_fornex_add() {
   fi
 
   _info "Adding record"
-  if _rest POST "$_domain/entry_set/add/" "host=$fulldomain&type=TXT&value=$txtvalue&apikey=$FORNEX_API_KEY"; then
+  if _rest POST "dns/domain/$_domain/entry_set/" "{\"host\" : \"${fulldomain}\" , \"type\" : \"TXT\" , \"value\" : \"${txtvalue}\" , \"ttl\" : null}"; then
     _debug _response "$response"
-    if _contains "$response" '"ok": true' || _contains "$response" 'Такая запись уже существует.'; then
-      _info "Added, OK"
-      return 0
-    fi
+    _info "Added, OK"
+    return 0
   fi
   _err "Add txt record error."
   return 1
@@ -58,21 +56,21 @@ dns_fornex_rm() {
   fi
 
   _debug "Getting txt records"
-  _rest GET "$_domain/entry_set.json?apikey=$FORNEX_API_KEY"
+  _rest GET "dns/domain/$_domain/entry_set?type=TXT&q=$fulldomain"
 
   if ! _contains "$response" "$txtvalue"; then
     _err "Txt record not found"
     return 1
   fi
 
-  _record_id="$(echo "$response" | _egrep_o "{[^{]*\"value\"*:*\"$txtvalue\"[^}]*}" | sed -n -e 's#.*"id": \([0-9]*\).*#\1#p')"
+  _record_id="$(echo "$response" | _egrep_o "\{[^\{]*\"value\"*:*\"$txtvalue\"[^\}]*\}" | sed -n -e 's#.*"id":\([0-9]*\).*#\1#p')"
   _debug "_record_id" "$_record_id"
   if [ -z "$_record_id" ]; then
-    _err "can not find _record_id"
+    _err "can not find _record_id
     return 1
   fi
 
-  if ! _rest POST "$_domain/entry_set/$_record_id/delete/" "apikey=$FORNEX_API_KEY"; then
+  if ! _rest DELETE "dns/domain/$_domain/entry_set/$_record_id/"; then
     _err "Delete record error."
     return 1
   fi
@@ -90,18 +88,18 @@ _get_root() {
 
   i=1
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
     _debug h "$h"
     if [ -z "$h" ]; then
       #not valid
       return 1
     fi
 
-    if ! _rest GET "domain_list.json?q=$h&apikey=$FORNEX_API_KEY"; then
+    if ! _rest GET "dns/domain/"; then
       return 1
     fi
 
-    if _contains "$response" "\"$h\"" >/dev/null; then
+    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
       _domain=$h
       return 0
     else
@@ -134,7 +132,9 @@ _rest() {
   data="$3"
   _debug "$ep"
 
-  export _H1="Accept: application/json"
+  export _H1="Authorization: Api-Key $FORNEX_API_KEY"
+  export _H2="Content-Type: application/json"
+  export _H3="Accept: application/json"
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"

From 54ac0048c4bdb9c57c26e8204d1996c61fd54456 Mon Sep 17 00:00:00 2001
From: mikhailkhr <CreatorDT1@gmail.com>
Date: Wed, 20 Nov 2024 12:43:58 +0300
Subject: [PATCH 087/174] fix: missing quotes

---
 dnsapi/dns_fornex.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_fornex.sh b/dnsapi/dns_fornex.sh
index a352547b..d1a10af8 100644
--- a/dnsapi/dns_fornex.sh
+++ b/dnsapi/dns_fornex.sh
@@ -66,7 +66,7 @@ dns_fornex_rm() {
   _record_id="$(echo "$response" | _egrep_o "\{[^\{]*\"value\"*:*\"$txtvalue\"[^\}]*\}" | sed -n -e 's#.*"id":\([0-9]*\).*#\1#p')"
   _debug "_record_id" "$_record_id"
   if [ -z "$_record_id" ]; then
-    _err "can not find _record_id
+    _err "can not find _record_id"
     return 1
   fi
 

From d7855e8fe58d7fcbd01cbd195e23f315bb5086e4 Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Sun, 24 Nov 2024 14:59:51 +0100
Subject: [PATCH 088/174] Update truenas_ws.sh (shfmt and shellcheck)

---
 deploy/truenas_ws.sh | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index b5ba51ab..4b3a5c72 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -51,7 +51,7 @@ _ws_call() {
     _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1")
   fi
   _debug "_ws_response" "$_ws_response"
-  printf "%s" $_ws_response
+  printf "%s" "$_ws_response"
   return 0
 }
 
@@ -99,7 +99,7 @@ _ws_get_job_result() {
     then
       _ws_result="$(printf "%s" "$_ws_response" | jq '.[]."result"')"
       _debug "_ws_result" "$_ws_result"
-      printf "%s" $_ws_result
+      printf "%s" "$_ws_result"
       _ws_error="$(printf "%s" "$_ws_response" | jq '.[]."error"')"
       if [ "$_ws_error" != "null" ]
       then
@@ -175,7 +175,7 @@ truenas_ws_deploy() {
   then
     _err "Error calling system.ready:"
     _err "$_ws_response"
-    exit $_ws_re
+    exit $_ws_ret
   fi
 
   if [ "$_ws_response" != "TRUE" ]
@@ -196,7 +196,7 @@ truenas_ws_deploy() {
   _truenas_version=$(printf "%s" "$_ws_response" | jq -r '."version"' | cut -d '-' -f 3)
   _info "TrueNAS system: $_truenas_system"
   _info "TrueNAS version: $_truenas_version"
-  if [ "$_truenas_system" != "SCALE" ] && ["$_truenas_system" != "CORE" ]
+  if [ "$_truenas_system" != "SCALE" ] && [ "$_truenas_system" != "CORE" ]
   then
     _err "Cannot gather TrueNAS system. Nor CORE oder SCALE detected."
     exit 10
@@ -210,7 +210,6 @@ truenas_ws_deploy() {
   _ui_certificate_name=$(printf "%s"  "$_ws_response" | jq -r '."ui_certificate"."name"')
   _info "Current WebUI certificate ID: $_ui_certificate_id"
   _info "Current WebUI certificate name: $_ui_certificate_name"
-  _info "WebUI redirect to https: $_ui_http_redirect"
 
 ########## Upload new certificate
 
@@ -225,9 +224,10 @@ truenas_ws_deploy() {
     exit 3
   fi
   _ws_result=$(_ws_get_job_result "$_ws_jobid")
-  if [ $? -gt 0 ]
+  _ws_ret=$?
+  if [ $_ws_ret -gt 0 ]
   then
-    exit $?
+    exit $_ws_ret
   fi
   _debug "_ws_result" "$_ws_result"
   _new_certid=$(printf "%s" "$_ws_result" | jq -r '."id"')
@@ -251,11 +251,11 @@ truenas_ws_deploy() {
   then
     _info "Replace app certificates..."
     _ws_response=$(_ws_call "app.query")
-    for _app_name in $(printf "%s" $_ws_response | jq -r '.[]."name"')
+    for _app_name in $(printf "%s" "$_ws_response" | jq -r '.[]."name"')
     do
       _info "Checking app $_app_name..."
       _ws_response=$(_ws_call "app.config" "$_app_name")
-      if [ "$(printf "%s" $_ws_response | jq -r '."network" | has("certificate_id")')" = "true" ]
+      if [ "$(printf "%s" "$_ws_response" | jq -r '."network" | has("certificate_id")')" = "true" ]
       then
         _info "App has certificate option, setup new certificate..."
         _info "App will be redeployed after updating the certificate."
@@ -267,9 +267,10 @@ truenas_ws_deploy() {
           exit 3
         fi
         _ws_result=$(_ws_get_job_result "$_ws_jobid")
-         if [ $? -gt 0 ]
+        _ws_ret=$?
+         if [ $_ws_ret -gt 0 ]
          then
-           exit $?
+           exit $_ws_ret
          fi
         _debug "_ws_result" "$_ws_result"
         _info "App certificate replaced."
@@ -305,10 +306,11 @@ truenas_ws_deploy() {
     _err "No JobID returned from websocket method."
     exit 3
   fi
-  _ws_result=$(_ws_get_job_result $_ws_jobid)
-  if [ $? -gt 0 ]
+  _ws_result=$(_ws_get_job_result "$_ws_jobid")
+  _ws_ret=$?
+  if [ $_ws_ret -gt 0 ]
   then
-    exit $?
+    exit $_ws_ret
   fi
 
 

From f2a311bb8194cff518978545da619c439b2f1621 Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Mon, 25 Nov 2024 14:44:52 +0100
Subject: [PATCH 089/174] Update truenas_ws.sh (added return instead exit)

---
 deploy/truenas_ws.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index 4b3a5c72..952cfc42 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -161,7 +161,7 @@ truenas_ws_deploy() {
   if [ -z "$DEPLOY_TRUENAS_APIKEY" ]
   then
     _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
-    exit 1
+    return 1
   fi
   _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
   _info "Environment variables: OK"
@@ -175,7 +175,7 @@ truenas_ws_deploy() {
   then
     _err "Error calling system.ready:"
     _err "$_ws_response"
-    exit $_ws_ret
+    return $_ws_ret
   fi
 
   if [ "$_ws_response" != "TRUE" ]
@@ -183,7 +183,7 @@ truenas_ws_deploy() {
     _err "TrueNAS is not ready."
     _err "Please check environment variables DEPLOY_TRUENAS_APIKEY, DEPLOY_TRUENAS_HOSTNAME and DEPLOY_TRUENAS_PROTOCOL."
     _err "Verify API key."
-    exit 2
+    return 2
   fi
   _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
   _info "TrueNAS health: OK"
@@ -199,7 +199,7 @@ truenas_ws_deploy() {
   if [ "$_truenas_system" != "SCALE" ] && [ "$_truenas_system" != "CORE" ]
   then
     _err "Cannot gather TrueNAS system. Nor CORE oder SCALE detected."
-    exit 10
+    return 10
   fi
 
 ########## Gather current certificate
@@ -221,13 +221,13 @@ truenas_ws_deploy() {
   if ! _ws_check_jobid "$_ws_jobid"
   then
     _err "No JobID returned from websocket method."
-    exit 3
+    return 3
   fi
   _ws_result=$(_ws_get_job_result "$_ws_jobid")
   _ws_ret=$?
   if [ $_ws_ret -gt 0 ]
   then
-    exit $_ws_ret
+    return $_ws_ret
   fi
   _debug "_ws_result" "$_ws_result"
   _new_certid=$(printf "%s" "$_ws_result" | jq -r '."id"')
@@ -242,7 +242,7 @@ truenas_ws_deploy() {
   then
     _err "Cannot set FTP certificate."
     _debug "_ws_response" "$_ws_response"
-    exit 4
+    return 4
   fi
 
 ########## ix Apps (SCALE only)
@@ -264,13 +264,13 @@ truenas_ws_deploy() {
         if ! _ws_check_jobid "$_ws_jobid"
         then
           _err "No JobID returned from websocket method."
-          exit 3
+          return 3
         fi
         _ws_result=$(_ws_get_job_result "$_ws_jobid")
         _ws_ret=$?
          if [ $_ws_ret -gt 0 ]
          then
-           exit $_ws_ret
+           return $_ws_ret
          fi
         _debug "_ws_result" "$_ws_result"
         _info "App certificate replaced."
@@ -288,7 +288,7 @@ truenas_ws_deploy() {
   if [ "$_changed_certid" != "$_new_certid" ]
   then
     _err "WebUI certificate change error.."
-    exit 5
+    return 5
   else
     _info "WebUI certificate replaced."
   fi
@@ -304,13 +304,13 @@ truenas_ws_deploy() {
   if ! _ws_check_jobid "$_ws_jobid"
   then
     _err "No JobID returned from websocket method."
-    exit 3
+    return 3
   fi
   _ws_result=$(_ws_get_job_result "$_ws_jobid")
   _ws_ret=$?
   if [ $_ws_ret -gt 0 ]
   then
-    exit $_ws_ret
+    return $_ws_ret
   fi
 
 

From cd924099e43a1eb4ac1895b8004557945499a450 Mon Sep 17 00:00:00 2001
From: Henning Reich <github@qupfer.de>
Date: Mon, 25 Nov 2024 17:46:59 +0000
Subject: [PATCH 090/174] add template

---
 dnsapi/dns_technitum.sh | 44 +++++++++++++++++++++++++++++++++++++++++
 test.technitum.sh       |  3 +++
 2 files changed, 47 insertions(+)
 create mode 100755 dnsapi/dns_technitum.sh
 create mode 100755 test.technitum.sh

diff --git a/dnsapi/dns_technitum.sh b/dnsapi/dns_technitum.sh
new file mode 100755
index 00000000..c9f5eb9f
--- /dev/null
+++ b/dnsapi/dns_technitum.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_myapi_info='Custom API Example
+ A sample custom DNS API script.
+Domains: example.com
+Site: github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_duckdns
+Options:
+ MYAPI_Token API Token. Get API Token from https://example.com/api/. Optional.
+Issues: github.com/acmesh-official/acme.sh
+Author: Neil Pang <neilgit@neilpang.com>
+'
+
+#This file name is "dns_myapi.sh"
+#So, here must be a method   dns_myapi_add()
+#Which will be called by acme.sh to add the txt record to your api system.
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
+
+#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_myapi_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using myapi"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  _err "Not implemented!"
+  return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_myapi_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using myapi"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+}
+
+####################  Private functions below ##################################
diff --git a/test.technitum.sh b/test.technitum.sh
new file mode 100755
index 00000000..438d2f4d
--- /dev/null
+++ b/test.technitum.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+./acme.sh --issue --staging --debug 2 -d test.07q.de --dns  dns_technitum

From c3557bbe3f07052ac29b5ca95ff2405a557af817 Mon Sep 17 00:00:00 2001
From: qupfer <github@qupfer.de>
Date: Mon, 25 Nov 2024 20:26:23 +0100
Subject: [PATCH 091/174] 1

---
 dnsapi/dns_technitum.sh | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_technitum.sh b/dnsapi/dns_technitum.sh
index c9f5eb9f..8eb2e4b8 100755
--- a/dnsapi/dns_technitum.sh
+++ b/dnsapi/dns_technitum.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
-dns_myapi_info='Custom API Example
- A sample custom DNS API script.
+dns_technitum_info='Technitum DNS Server
+
 Domains: example.com
 Site: github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_duckdns
@@ -21,10 +21,10 @@ Author: Neil Pang <neilgit@neilpang.com>
 # Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
 
 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
-dns_myapi_add() {
+dns_technitum_add() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using myapi"
+  _info "Using technitum"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
   _err "Not implemented!"
@@ -33,12 +33,17 @@ dns_myapi_add() {
 
 #Usage: fulldomain txtvalue
 #Remove the txt record after validation.
-dns_myapi_rm() {
+dns_technitum_rm() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using myapi"
+  _info "Using technitum"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
+  _err "Not implemented!"
+  return 1
 }
 
 ####################  Private functions below ##################################
+
+
+dns_technitum_add "_acme-challenge.test.07q.de" "abcd"
\ No newline at end of file

From 91103751736161e43e1806bc485e591661f4591a Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Mon, 25 Nov 2024 20:50:40 +0100
Subject: [PATCH 092/174] Update truenas_ws.sh (fixed shfmt)

---
 deploy/truenas_ws.sh | 98 ++++++++++++++++----------------------------
 1 file changed, 36 insertions(+), 62 deletions(-)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index 952cfc42..3ee983a3 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -38,16 +38,13 @@ _ws_call() {
   _debug "_ws_call arg1" "$1"
   _debug "_ws_call arg2" "$2"
   _debug "_ws_call arg3" "$3"
-  if [ $# -eq 3 ]
-  then
+  if [ $# -eq 3 ]; then
     _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2" "$3")
   fi
-  if [ $# -eq 2 ]
-  then
+  if [ $# -eq 2 ]; then
     _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2")
   fi
-  if [ $# -eq 1 ]
-  then
+  if [ $# -eq 1 ]; then
     _ws_response=$(midclt -K "$DEPLOY_TRUENAS_APIKEY" call "$1")
   fi
   _debug "_ws_response" "$_ws_response"
@@ -69,14 +66,13 @@ _ws_call() {
 #   1: false
 _ws_check_jobid() {
   case "$1" in
-    [0-9]*)
-      return 0
-      ;;
+  [0-9]*)
+    return 0
+    ;;
   esac
   return 1
 }
 
-
 # Wait for job to finish and return result as JSON
 # Usage:
 #   _ws_result=$(_ws_get_job_result "$_ws_jobid")
@@ -91,18 +87,15 @@ _ws_check_jobid() {
 # Returns:
 #   n/a
 _ws_get_job_result() {
-  while true
-  do
+  while true; do
     sleep 2
     _ws_response=$(_ws_call "core.get_jobs" "[[\"id\", \"=\", $1]]")
-    if [ "$(printf "%s" "$_ws_response" | jq -r '.[]."state"')" != "RUNNING" ]
-    then
+    if [ "$(printf "%s" "$_ws_response" | jq -r '.[]."state"')" != "RUNNING" ]; then
       _ws_result="$(printf "%s" "$_ws_response" | jq '.[]."result"')"
       _debug "_ws_result" "$_ws_result"
       printf "%s" "$_ws_result"
       _ws_error="$(printf "%s" "$_ws_response" | jq '.[]."error"')"
-      if [ "$_ws_error" != "null" ]
-      then
+      if [ "$_ws_error" != "null" ]; then
         _err "Job $1 failed:"
         _err "$_ws_error"
         return 7
@@ -113,9 +106,6 @@ _ws_get_job_result() {
   return 0
 }
 
-
-
-
 ########################
 ### Public functions ###
 ########################
@@ -153,33 +143,30 @@ truenas_ws_deploy() {
   _debug _file_ca "$_file_ca"
   _debug _file_fullchain "$_file_fullchain"
 
-########## Environment check
+  ########## Environment check
 
   _info "Checking environment variables..."
   _getdeployconf DEPLOY_TRUENAS_APIKEY
   # Check API Key
-  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]
-  then
+  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
     _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
     return 1
   fi
   _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
   _info "Environment variables: OK"
 
-########## Health check
+  ########## Health check
 
   _info "Checking TrueNAS health..."
   _ws_response=$(_ws_call "system.ready" | tr '[:lower:]' '[:upper:]')
   _ws_ret=$?
-  if [ $_ws_ret -gt 0 ]
-  then
+  if [ $_ws_ret -gt 0 ]; then
     _err "Error calling system.ready:"
     _err "$_ws_response"
     return $_ws_ret
   fi
 
-  if [ "$_ws_response" != "TRUE" ]
-  then
+  if [ "$_ws_response" != "TRUE" ]; then
     _err "TrueNAS is not ready."
     _err "Please check environment variables DEPLOY_TRUENAS_APIKEY, DEPLOY_TRUENAS_HOSTNAME and DEPLOY_TRUENAS_PROTOCOL."
     _err "Verify API key."
@@ -188,7 +175,7 @@ truenas_ws_deploy() {
   _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
   _info "TrueNAS health: OK"
 
-########## System info
+  ########## System info
 
   _info "Gather system info..."
   _ws_response=$(_ws_call "system.info")
@@ -196,82 +183,73 @@ truenas_ws_deploy() {
   _truenas_version=$(printf "%s" "$_ws_response" | jq -r '."version"' | cut -d '-' -f 3)
   _info "TrueNAS system: $_truenas_system"
   _info "TrueNAS version: $_truenas_version"
-  if [ "$_truenas_system" != "SCALE" ] && [ "$_truenas_system" != "CORE" ]
-  then
+  if [ "$_truenas_system" != "SCALE" ] && [ "$_truenas_system" != "CORE" ]; then
     _err "Cannot gather TrueNAS system. Nor CORE oder SCALE detected."
     return 10
   fi
 
-########## Gather current certificate
+  ########## Gather current certificate
 
   _info "Gather current WebUI certificate..."
   _ws_response="$(_ws_call "system.general.config")"
   _ui_certificate_id=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
-  _ui_certificate_name=$(printf "%s"  "$_ws_response" | jq -r '."ui_certificate"."name"')
+  _ui_certificate_name=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."name"')
   _info "Current WebUI certificate ID: $_ui_certificate_id"
   _info "Current WebUI certificate name: $_ui_certificate_name"
 
-########## Upload new certificate
+  ########## Upload new certificate
 
   _info "Upload new certificate..."
   _certname="acme_$(_utc_date | tr -d '\-\:' | tr ' ' '_')"
   _debug _certname "$_certname"
   _ws_jobid=$(_ws_call "certificate.create" "{\"name\": \"${_certname}\", \"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"certificate\": \"$(_json_encode <"$_file_fullchain")\", \"privatekey\": \"$(_json_encode <"$_file_key")\", \"passphrase\": \"\"}")
   _debug "_ws_jobid" "$_ws_jobid"
-  if ! _ws_check_jobid "$_ws_jobid"
-  then
+  if ! _ws_check_jobid "$_ws_jobid"; then
     _err "No JobID returned from websocket method."
     return 3
   fi
   _ws_result=$(_ws_get_job_result "$_ws_jobid")
   _ws_ret=$?
-  if [ $_ws_ret -gt 0 ]
-  then
+  if [ $_ws_ret -gt 0 ]; then
     return $_ws_ret
   fi
   _debug "_ws_result" "$_ws_result"
   _new_certid=$(printf "%s" "$_ws_result" | jq -r '."id"')
   _info "New certificate ID: $_new_certid"
 
-########## FTP
+  ########## FTP
 
   _info "Replace FTP certificate..."
   _ws_response=$(_ws_call "ftp.update" "{\"ssltls_certificate\": $_new_certid}")
   _ftp_certid=$(printf "%s" "$_ws_response" | jq -r '."ssltls_certificate"')
-  if [ "$_ftp_certid" != "$_new_certid" ]
-  then
+  if [ "$_ftp_certid" != "$_new_certid" ]; then
     _err "Cannot set FTP certificate."
     _debug "_ws_response" "$_ws_response"
     return 4
   fi
 
-########## ix Apps (SCALE only)
+  ########## ix Apps (SCALE only)
 
-  if [ "$_truenas_system" = "SCALE" ]
-  then
+  if [ "$_truenas_system" = "SCALE" ]; then
     _info "Replace app certificates..."
     _ws_response=$(_ws_call "app.query")
-    for _app_name in $(printf "%s" "$_ws_response" | jq -r '.[]."name"')
-    do
+    for _app_name in $(printf "%s" "$_ws_response" | jq -r '.[]."name"'); do
       _info "Checking app $_app_name..."
       _ws_response=$(_ws_call "app.config" "$_app_name")
-      if [ "$(printf "%s" "$_ws_response" | jq -r '."network" | has("certificate_id")')" = "true" ]
-      then
+      if [ "$(printf "%s" "$_ws_response" | jq -r '."network" | has("certificate_id")')" = "true" ]; then
         _info "App has certificate option, setup new certificate..."
         _info "App will be redeployed after updating the certificate."
         _ws_jobid=$(_ws_call "app.update" "$_app_name" "{\"values\": {\"network\": {\"certificate_id\": $_new_certid}}}")
         _debug "_ws_jobid" "$_ws_jobid"
-        if ! _ws_check_jobid "$_ws_jobid"
-        then
+        if ! _ws_check_jobid "$_ws_jobid"; then
           _err "No JobID returned from websocket method."
           return 3
         fi
         _ws_result=$(_ws_get_job_result "$_ws_jobid")
         _ws_ret=$?
-         if [ $_ws_ret -gt 0 ]
-         then
-           return $_ws_ret
-         fi
+        if [ $_ws_ret -gt 0 ]; then
+          return $_ws_ret
+        fi
         _debug "_ws_result" "$_ws_result"
         _info "App certificate replaced."
       else
@@ -280,13 +258,12 @@ truenas_ws_deploy() {
     done
   fi
 
-########## WebUI
+  ########## WebUI
 
   _info "Replace WebUI certificate..."
   _ws_response=$(_ws_call "system.general.update" "{\"ui_certificate\": $_new_certid}")
   _changed_certid=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
-  if [ "$_changed_certid" != "$_new_certid" ]
-  then
+  if [ "$_changed_certid" != "$_new_certid" ]; then
     _err "WebUI certificate change error.."
     return 5
   else
@@ -297,23 +274,20 @@ truenas_ws_deploy() {
   _info "Waiting for UI restart..."
   sleep 6
 
-########## Certificates
+  ########## Certificates
 
   _info "Deleting old certificate..."
   _ws_jobid=$(_ws_call "certificate.delete" "$_ui_certificate_id")
-  if ! _ws_check_jobid "$_ws_jobid"
-  then
+  if ! _ws_check_jobid "$_ws_jobid"; then
     _err "No JobID returned from websocket method."
     return 3
   fi
   _ws_result=$(_ws_get_job_result "$_ws_jobid")
   _ws_ret=$?
-  if [ $_ws_ret -gt 0 ]
-  then
+  if [ $_ws_ret -gt 0 ]; then
     return $_ws_ret
   fi
 
-
   _info "Have a nice day...bye!"
 
 }

From 44240339d9856568d418d41f89556495cb651be2 Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Mon, 25 Nov 2024 21:13:43 +0100
Subject: [PATCH 093/174] Update truenas_ws.sh (Interpreter changed from bash
 to sh)

---
 deploy/truenas_ws.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index 3ee983a3..7292987b 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/usr/bin/env sh
 
 # TrueNAS deploy script for SCALE/CORE using websocket
 # It is recommend to use a wildcard certificate

From ebaf4c9c01bd590003bc91dec4ca05e88c091cb7 Mon Sep 17 00:00:00 2001
From: Attackwave <51136146+Attackwave@users.noreply.github.com>
Date: Mon, 25 Nov 2024 21:23:59 +0100
Subject: [PATCH 094/174] Update truenas_ws.sh (Output new certificate name)

---
 deploy/truenas_ws.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index 7292987b..940cde2e 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -201,6 +201,7 @@ truenas_ws_deploy() {
 
   _info "Upload new certificate..."
   _certname="acme_$(_utc_date | tr -d '\-\:' | tr ' ' '_')"
+  _info "New WebUI certificate name: $_certname"
   _debug _certname "$_certname"
   _ws_jobid=$(_ws_call "certificate.create" "{\"name\": \"${_certname}\", \"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"certificate\": \"$(_json_encode <"$_file_fullchain")\", \"privatekey\": \"$(_json_encode <"$_file_key")\", \"passphrase\": \"\"}")
   _debug "_ws_jobid" "$_ws_jobid"

From 9cd1d1a9dcbabcc2a316f1d655e2f5f2db8682cb Mon Sep 17 00:00:00 2001
From: Lorenz Stechauner <lorenz.stechauner@necronda.net>
Date: Tue, 26 Nov 2024 09:20:18 +0100
Subject: [PATCH 095/174] dns_world4you: Adapt to change in world4you.com
 DeleteDnsRecordForm

---
 dnsapi/dns_world4you.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_world4you.sh b/dnsapi/dns_world4you.sh
index be6ef5c8..2e8efe82 100644
--- a/dnsapi/dns_world4you.sh
+++ b/dnsapi/dns_world4you.sh
@@ -115,7 +115,7 @@ dns_world4you_rm() {
 
   _resethttp
   export ACME_HTTP_NO_REDIRECTS=1
-  body="DeleteDnsRecordForm[recordId]=$recordid&DeleteDnsRecordForm[uniqueFormIdDP]=$formiddp&DeleteDnsRecordForm[_token]=$form_token"
+  body="DeleteDnsRecordForm[id]=$recordid&DeleteDnsRecordForm[uniqueFormIdDP]=$formiddp&DeleteDnsRecordForm[_token]=$form_token"
   _info "Removing record..."
   ret=$(_post "$body" "$WORLD4YOU_API/$paketnr/dns/record/delete" '' POST 'application/x-www-form-urlencoded')
   _resethttp
@@ -203,6 +203,7 @@ _get_paketnr() {
   form="$2"
 
   domains=$(echo "$form" | grep '<ul class="nav header-paket-list">' | sed 's/<li/\n<li/g' | sed 's/<[^>]*>/ /g' | sed 's/^.*>\([^>]*\)$/\1/')
+  _debug domains "$domains"
   domain=''
   for domain in $domains; do
     if _contains "$fqdn" "$domain\$"; then

From cb12c8dfd5694fa07643cf2fd64ffa812c2efb03 Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Tue, 26 Nov 2024 11:21:17 +0100
Subject: [PATCH 096/174] working example

---
 dnsapi/dns_technitium.sh | 69 ++++++++++++++++++++++++++++++++++++++++
 dnsapi/dns_technitum.sh  | 49 ----------------------------
 test.technitum.sh        |  3 --
 3 files changed, 69 insertions(+), 52 deletions(-)
 create mode 100755 dnsapi/dns_technitium.sh
 delete mode 100755 dnsapi/dns_technitum.sh
 delete mode 100755 test.technitum.sh

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
new file mode 100755
index 00000000..463ce433
--- /dev/null
+++ b/dnsapi/dns_technitium.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_Technitium_info='Technitium DNS Server
+
+Site: https://technitium.com/dns/
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_technitium
+Options:
+ Technitium_Server Server Address
+ Technitium_Token API Token
+Issues: github.com/acmesh-official/acme.sh
+Author: Neil Pang <neilgit@neilpang.com>
+'
+
+#This file name is "dns_myapi.sh"
+#So, here must be a method   dns_myapi_add()
+#Which will be called by acme.sh to add the txt record to your api system.
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
+
+#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_technitium_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _Technitium_account
+  _info "Using Technitium"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  response="$(_get "$Technitium_Server/api/zones/records/add?token=$Technitium_Token&domain=$fulldomain&type=TXT&text=${txtvalue}")"
+  if _contains "$response" '"status":"ok"'; then
+    return 0
+  fi
+  _err "Could not add txt record."
+  return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_technitium_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using Technitium"
+  response="$(_get "$Technitium_Server/api/zones/records/delete?token=$Technitium_Token&domain=$fulldomain&type=TXT&text=${txtvalue}")"
+  if _contains "$response" '"status":"ok"'; then
+    return 0
+  fi
+  _err "Could not remove txt record"
+  return 1
+}
+
+####################  Private functions below ##################################
+
+_Technitium_account() {
+  Technitium_Server="${Technitium_Server:-$(_readaccountconf_mutable Technitium_Server)}"
+  Technitium_Token="${Technitium_Token:-$(_readaccountconf_mutable Technitium_Token)}"
+  if [ -z "$Technitium_Server" ] || [ -z "$Technitium_Token" ]; then
+    Technitium_Server=""
+    Technitium_Token=""
+    _err "You don't specify Technitium Server and Token yet."
+    _err "Please create your Token and add server address and try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable Technitium_Server "$Technitium_Server"
+  _saveaccountconf_mutable Technitium_Token "$Technitium_Token"
+}
diff --git a/dnsapi/dns_technitum.sh b/dnsapi/dns_technitum.sh
deleted file mode 100755
index 8eb2e4b8..00000000
--- a/dnsapi/dns_technitum.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env sh
-# shellcheck disable=SC2034
-dns_technitum_info='Technitum DNS Server
-
-Domains: example.com
-Site: github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_duckdns
-Options:
- MYAPI_Token API Token. Get API Token from https://example.com/api/. Optional.
-Issues: github.com/acmesh-official/acme.sh
-Author: Neil Pang <neilgit@neilpang.com>
-'
-
-#This file name is "dns_myapi.sh"
-#So, here must be a method   dns_myapi_add()
-#Which will be called by acme.sh to add the txt record to your api system.
-#returns 0 means success, otherwise error.
-
-########  Public functions #####################
-
-# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-
-#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
-dns_technitum_add() {
-  fulldomain=$1
-  txtvalue=$2
-  _info "Using technitum"
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
-  _err "Not implemented!"
-  return 1
-}
-
-#Usage: fulldomain txtvalue
-#Remove the txt record after validation.
-dns_technitum_rm() {
-  fulldomain=$1
-  txtvalue=$2
-  _info "Using technitum"
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
-  _err "Not implemented!"
-  return 1
-}
-
-####################  Private functions below ##################################
-
-
-dns_technitum_add "_acme-challenge.test.07q.de" "abcd"
\ No newline at end of file
diff --git a/test.technitum.sh b/test.technitum.sh
deleted file mode 100755
index 438d2f4d..00000000
--- a/test.technitum.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-./acme.sh --issue --staging --debug 2 -d test.07q.de --dns  dns_technitum

From 36f060dcf69b4e49a262575565c20eb93a644588 Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Tue, 26 Nov 2024 11:42:05 +0100
Subject: [PATCH 097/174] add author

---
 dnsapi/dns_technitium.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index 463ce433..744d4b60 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -8,7 +8,7 @@ Options:
  Technitium_Server Server Address
  Technitium_Token API Token
 Issues: github.com/acmesh-official/acme.sh
-Author: Neil Pang <neilgit@neilpang.com>
+Author: Henning Reich <acmesh@qupfer.de>
 '
 
 #This file name is "dns_myapi.sh"

From aacc26179e2482aef6f599c231d5363e5741bd25 Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Tue, 26 Nov 2024 12:17:11 +0100
Subject: [PATCH 098/174] remove comments

---
 dnsapi/dns_technitium.sh | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index 744d4b60..360bff0c 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -11,16 +11,6 @@ Issues: github.com/acmesh-official/acme.sh
 Author: Henning Reich <acmesh@qupfer.de>
 '
 
-#This file name is "dns_myapi.sh"
-#So, here must be a method   dns_myapi_add()
-#Which will be called by acme.sh to add the txt record to your api system.
-#returns 0 means success, otherwise error.
-
-########  Public functions #####################
-
-# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-
-#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_technitium_add() {
   fulldomain=$1
   txtvalue=$2
@@ -36,8 +26,6 @@ dns_technitium_add() {
   return 1
 }
 
-#Usage: fulldomain txtvalue
-#Remove the txt record after validation.
 dns_technitium_rm() {
   fulldomain=$1
   txtvalue=$2

From 19e73f88895f64427650f57de1caa39f93aa7fd6 Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Tue, 26 Nov 2024 12:29:07 +0100
Subject: [PATCH 099/174] add account to rm function

---
 dnsapi/dns_technitium.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index 360bff0c..9a068b7e 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -29,6 +29,7 @@ dns_technitium_add() {
 dns_technitium_rm() {
   fulldomain=$1
   txtvalue=$2
+  _Technitium_account
   _info "Using Technitium"
   response="$(_get "$Technitium_Server/api/zones/records/delete?token=$Technitium_Token&domain=$fulldomain&type=TXT&text=${txtvalue}")"
   if _contains "$response" '"status":"ok"'; then

From a94ac63e74d541662df242abf3f41bff3085397d Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Wed, 27 Nov 2024 09:20:57 +0100
Subject: [PATCH 100/174] add issue link

---
 dnsapi/dns_technitium.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index 9a068b7e..ec1c6d7f 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -7,7 +7,7 @@ Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_technitium
 Options:
  Technitium_Server Server Address
  Technitium_Token API Token
-Issues: github.com/acmesh-official/acme.sh
+Issues:https://github.com/acmesh-official/acme.sh/issues/6116
 Author: Henning Reich <acmesh@qupfer.de>
 '
 

From 6d302889fa36892c6e316bdac9ec744379691834 Mon Sep 17 00:00:00 2001
From: Henning Reich <henning@leipzig.07q.de>
Date: Wed, 27 Nov 2024 10:11:50 +0100
Subject: [PATCH 101/174] small cleanup

---
 dnsapi/dns_technitium.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index ec1c6d7f..a50db97c 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -12,12 +12,10 @@ Author: Henning Reich <acmesh@qupfer.de>
 '
 
 dns_technitium_add() {
+  _info "add txt Record using Technitium"
+  _Technitium_account
   fulldomain=$1
   txtvalue=$2
-  _Technitium_account
-  _info "Using Technitium"
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
   response="$(_get "$Technitium_Server/api/zones/records/add?token=$Technitium_Token&domain=$fulldomain&type=TXT&text=${txtvalue}")"
   if _contains "$response" '"status":"ok"'; then
     return 0
@@ -27,10 +25,10 @@ dns_technitium_add() {
 }
 
 dns_technitium_rm() {
+  _info "remove txt record using Technitium"
+  _Technitium_account
   fulldomain=$1
   txtvalue=$2
-  _Technitium_account
-  _info "Using Technitium"
   response="$(_get "$Technitium_Server/api/zones/records/delete?token=$Technitium_Token&domain=$fulldomain&type=TXT&text=${txtvalue}")"
   if _contains "$response" '"status":"ok"'; then
     return 0

From f3b2ab5e604f49cf437e293f921812cdb46adc07 Mon Sep 17 00:00:00 2001
From: 3VAbdAVE <dcollodel@outlook.com>
Date: Sat, 30 Nov 2024 10:32:24 -0500
Subject: [PATCH 102/174] Fix gen1 cloudkey's symlinked keystore

---
 deploy/unifi.sh | 73 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 49 insertions(+), 24 deletions(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 4d8c058e..706b24e8 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -30,7 +30,9 @@
 # Keystore password (built into Unifi Controller, not a user-set password):
 #DEPLOY_UNIFI_KEYPASS="aircontrolenterprise"
 # Command to restart Unifi Controller:
-#DEPLOY_UNIFI_RELOAD="service unifi restart"
+# DEPLOY_UNIFI_RELOAD="systemctl restart unifi"
+# System Properties file location for controller
+#DEPLOY_UNIFI_SYSTEM_PROPERTIES="/usr/lib/unifi/data/system.properties"
 #
 # Settings for Unifi Cloud Key Gen1 (nginx admin pages):
 # Directory where cloudkey.crt and cloudkey.key live:
@@ -43,7 +45,7 @@
 # Directory where unifi-core.crt and unifi-core.key live:
 #DEPLOY_UNIFI_CORE_CONFIG="/data/unifi-core/config/"
 # Command to restart unifi-core:
-#DEPLOY_UNIFI_RELOAD="systemctl restart unifi-core"
+# DEPLOY_UNIFI_OS_RELOAD="systemctl restart unifi-core"
 #
 # At least one of DEPLOY_UNIFI_KEYSTORE, DEPLOY_UNIFI_CLOUDKEY_CERTDIR,
 # or DEPLOY_UNIFI_CORE_CONFIG must exist to receive the deployed certs.
@@ -69,12 +71,16 @@ unifi_deploy() {
   _getdeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR
   _getdeployconf DEPLOY_UNIFI_CORE_CONFIG
   _getdeployconf DEPLOY_UNIFI_RELOAD
+  _getdeployconf DEPLOY_UNIFI_SYSTEM_PROPERTIES
+  _getdeployconf DEPLOY_UNIFI_OS_RELOAD
 
   _debug2 DEPLOY_UNIFI_KEYSTORE "$DEPLOY_UNIFI_KEYSTORE"
   _debug2 DEPLOY_UNIFI_KEYPASS "$DEPLOY_UNIFI_KEYPASS"
   _debug2 DEPLOY_UNIFI_CLOUDKEY_CERTDIR "$DEPLOY_UNIFI_CLOUDKEY_CERTDIR"
   _debug2 DEPLOY_UNIFI_CORE_CONFIG "$DEPLOY_UNIFI_CORE_CONFIG"
   _debug2 DEPLOY_UNIFI_RELOAD "$DEPLOY_UNIFI_RELOAD"
+  _debug2 DEPLOY_UNIFI_OS_RELOAD "$DEPLOY_UNIFI_OS_RELOAD"
+  _debug2 DEPLOY_UNIFI_SYSTEM_PROPERTIES "$DEPLOY_UNIFI_SYSTEM_PROPERTIES"
 
   # Space-separated list of environments detected and installed:
   _services_updated=""
@@ -136,32 +142,38 @@ unifi_deploy() {
     fi
 
     # Update unifi service for certificate cipher compatibility
+    _unifi_system_properties="${DEPLOY_UNIFI_SYSTEM_PROPERTIES:-/usr/lib/unifi/data/system.properties}"
     if ${ACME_OPENSSL_BIN:-openssl} pkcs12 \
       -in "$_import_pkcs12" \
       -password pass:aircontrolenterprise \
       -nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
       -noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
-      cp -f /usr/lib/unifi/data/system.properties /usr/lib/unifi/data/system.properties_original
+      cp -f "${_unifi_system_properties}" "${_unifi_system_properties}_original"
       _info "Updating system configuration for cipher compatibility."
-      _info "Saved original system config to /usr/lib/unifi/data/system.properties_original"
-      sed -i '/unifi\.https\.ciphers/d' /usr/lib/unifi/data/system.properties
-      echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>/usr/lib/unifi/data/system.properties
-      sed -i '/unifi\.https\.sslEnabledProtocols/d' /usr/lib/unifi/data/system.properties
-      echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>/usr/lib/unifi/data/system.properties
+      _info "Saved original system config to ${_unifi_system_properties}_original"
+      sed -i '/unifi\.https\.ciphers/d' "${_unifi_system_properties}"
+      echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>"${_unifi_system_properties}"
+      sed -i '/unifi\.https\.sslEnabledProtocols/d' "${_unifi_system_properties}"
+      echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>"${_unifi_system_properties}"
       _info "System configuration updated."
+    else
+      _info "New certificate does not require ecdsa ciphers, not updating system properties."
     fi
 
     rm "$_import_pkcs12"
 
     # Restarting unifi-core will bring up unifi, doing it out of order results in
     # a certificate error, and breaks wifiman.
-    # Restart if we aren't doing unifi-core, otherwise stop for later restart.
-    if systemctl -q is-active unifi; then
-      if [ ! -f "${DEPLOY_UNIFI_CORE_CONFIG:-/data/unifi-core/config}/unifi-core.key" ]; then
-        _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl restart unifi"
-      else
-        _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl stop unifi"
-      fi
+    # Restart if we aren't doing Unifi OS (e.g. unifi-core service), otherwise stop for later restart.
+    _unifi_reload="${DEPLOY_UNIFI_RELOAD:-systemctl restart unifi}"
+    if [ ! -f "${DEPLOY_UNIFI_CORE_CONFIG:-/data/unifi-core/config}/unifi-core.key" ]; then
+      _reload_cmd="${_reload_cmd:+$_reload_cmd && }$_unifi_reload"
+    else
+      _info "Stopping Unifi Controller for later restart."
+      _unifi_stop=$(echo "${_unifi_reload}" | sed -e 's/restart/stop/')
+      $_unifi_stop
+      _reload_cmd="${_reload_cmd:+$_reload_cmd && }$_unifi_reload"
+      _info "Unifi Controller stopped."
     fi
     _services_updated="${_services_updated} unifi"
     _info "Install Unifi Controller certificate success!"
@@ -181,13 +193,24 @@ unifi_deploy() {
       return 1
     fi
     # Cloud Key expects to load the keystore from /etc/ssl/private/unifi.keystore.jks.
-    # Normally /usr/lib/unifi/data/keystore is a symlink there (so the keystore was
-    # updated above), but if not, we don't know how to handle this installation:
-    if ! cmp -s "$_unifi_keystore" "${_cloudkey_certdir}/unifi.keystore.jks"; then
-      _err "Unsupported Cloud Key configuration: keystore not found at '${_cloudkey_certdir}/unifi.keystore.jks'"
-      return 1
+    # It appears that unifi won't start if this is a symlink, so we'll copy it instead.
+
+    # if ! cmp -s "$_unifi_keystore" "${_cloudkey_certdir}/unifi.keystore.jks"; then
+    #   _err "Unsupported Cloud Key configuration: keystore not found at '${_cloudkey_certdir}/unifi.keystore.jks'"
+    #   return 1
+    # fi
+
+    _info "Updating ${_cloudkey_certdir}/unifi.keystore.jks"
+    if [ -e "${_cloudkey_certdir}/unifi.keystore.jks" ]; then
+      if [ -L "${_cloudkey_certdir}/unifi.keystore.jks" ]; then
+        rm -f "${_cloudkey_certdir}/unifi.keystore.jks"
+      else
+        mv "${_cloudkey_certdir}/unifi.keystore.jks" "${_cloudkey_certdir}/unifi.keystore.jks_original"
+      fi
     fi
 
+    cp "_unifi_keystore" "${_cloudkey_certdir}/unifi.keystore.jks"
+
     cat "$_cfullchain" >"${_cloudkey_certdir}/cloudkey.crt"
     cat "$_ckey" >"${_cloudkey_certdir}/cloudkey.key"
     (cd "$_cloudkey_certdir" && tar -cf cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks)
@@ -215,14 +238,14 @@ unifi_deploy() {
     # Save the existing certs in case something goes wrong.
     cp -f "${_unifi_core_config}"/unifi-core.crt "${_unifi_core_config}"/unifi-core_original.crt
     cp -f "${_unifi_core_config}"/unifi-core.key "${_unifi_core_config}"/unifi-core_original.key
-    _info "Previous certificate and key saved to ${_unifi_core_config}/unifi-core_original.crt/key."
+    _info "Previous certificate and key saved to ${_unifi_core_config}/unifi-core_original.crt.key."
 
     cat "$_cfullchain" >"${_unifi_core_config}/unifi-core.crt"
     cat "$_ckey" >"${_unifi_core_config}/unifi-core.key"
 
-    if systemctl -q is-active unifi-core; then
-      _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl restart unifi-core"
-    fi
+    _unifi_os_reload="${DEPLOY_UNIFI_OS_RELOAD:-systemctl restart unifi-core}"
+    _reload_cmd="${_reload_cmd:+$_reload_cmd && }$_unifi_os_reload"
+
     _info "Install UnifiOS certificate success!"
     _services_updated="${_services_updated} unifi-core"
   elif [ "$DEPLOY_UNIFI_CORE_CONFIG" ]; then
@@ -261,6 +284,8 @@ unifi_deploy() {
   _savedeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR "$DEPLOY_UNIFI_CLOUDKEY_CERTDIR"
   _savedeployconf DEPLOY_UNIFI_CORE_CONFIG "$DEPLOY_UNIFI_CORE_CONFIG"
   _savedeployconf DEPLOY_UNIFI_RELOAD "$DEPLOY_UNIFI_RELOAD"
+  _savedeployconf DEPLOY_UNIFI_OS_RELOAD "$DEPLOY_UNIFI_OS_RELOAD"
+  _savedeployconf DEPLOY_UNIFI_SYSTEM_PROPERTIES "$DEPLOY_UNIFI_SYSTEM_PROPERTIES"
 
   return 0
 }

From 157d3f9dc9b8afaec83ec0219dd9da1c9fbeab66 Mon Sep 17 00:00:00 2001
From: Lorenz Stechauner <lorenz.stechauner@necronda.net>
Date: Sat, 30 Nov 2024 17:25:19 +0100
Subject: [PATCH 103/174] dns_word4you: Fix for OpenBSD

---
 dnsapi/dns_world4you.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_world4you.sh b/dnsapi/dns_world4you.sh
index 2e8efe82..0febbad9 100644
--- a/dnsapi/dns_world4you.sh
+++ b/dnsapi/dns_world4you.sh
@@ -218,7 +218,7 @@ _get_paketnr() {
   TLD="$domain"
   _debug domain "$domain"
   RECORD=$(echo "$fqdn" | cut -c"1-$((${#fqdn} - ${#TLD} - 1))")
-  PAKETNR=$(echo "$domains" | grep "$domain" | sed 's/^[^,]*, *\([0-9]*\).*$/\1/')
+  PAKETNR=$(echo "$domains" | grep -o " $domain.*" | sed 's/^[^,]*, *\([0-9]*\).*$/\1/')
   return 0
 }
 

From 22dfedf6ae447404616102b14c01bdf9ddb70caf Mon Sep 17 00:00:00 2001
From: Kevin Locke <kevin@kevinlocke.name>
Date: Mon, 13 Feb 2017 14:09:25 -0700
Subject: [PATCH 104/174] Avoid permissions errors for chown .well-known

When acme.sh is run as a non-root user different from the owner of the
webroot directory it is unable to change the owner of the files in
.well-known to that user, causing permissions errors.  Avoid this by
making the files world-readable.

These files should pose no disclosure risk since they are sent in
cleartext during the HTTP Identifier Validation Challenge[1] and may
already be exposed by directory enumeration, depending on server
settings.  AFAIK they should be safe to expose as world-readable in all
cases.

1.  https://ietf-wg-acme.github.io/acme/#rfc.section.7.2

Fixes Neilpang/acme.sh#32
Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
---
 acme.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index 9842e3f1..3e1c85bd 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5002,9 +5002,11 @@ $_authorizations_map"
 
         _debug "Writing token: $token to $wellknown_path/$token"
 
-        mkdir -p "$wellknown_path"
-
-        if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
+        # Ensure .well-known is visible to web server user/group
+        # https://github.com/Neilpang/acme.sh/pull/32
+        if ! (umask ugo+rx &&
+          mkdir -p "$wellknown_path" &&
+          printf "%s" "$keyauthorization" >"$wellknown_path/$token"); then
           _err "$d: Cannot write token to file: $wellknown_path/$token"
           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
           _clearup

From 11af6f49c6d8c3d1a9670d232ca2aebadbd46239 Mon Sep 17 00:00:00 2001
From: Anton Avramov <lukav@lukav.com>
Date: Thu, 5 Dec 2024 22:12:04 -0500
Subject: [PATCH 105/174] Add support for ZoneEdit.com

---
 dnsapi/dns_zoneedit.sh | 145 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 dnsapi/dns_zoneedit.sh

diff --git a/dnsapi/dns_zoneedit.sh b/dnsapi/dns_zoneedit.sh
new file mode 100644
index 00000000..7ea16f75
--- /dev/null
+++ b/dnsapi/dns_zoneedit.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env sh
+
+# https://github.com/blueslow/sslcertzoneedit
+
+# Only need to export the credentials once, acme.sh will save for automatic renewal.
+# export ZONEEDIT_ID="Your id"
+# export ZONEEDIT_Token="Your token"
+# acme.sh --issue --dns dns_zoneedit -d example.com -d www.example.com
+
+########  Public functions #####################
+
+# Usage: dns_zoneedit_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_zoneedit_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using Zoneedit"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  # Load the credentials from the account conf file
+  ZONEEDIT_ID="${ZONEEDIT_ID:-$(_readaccountconf_mutable ZONEEDIT_ID)}"
+  ZONEEDIT_Token="${ZONEEDIT_Token:-$(_readaccountconf_mutable ZONEEDIT_Token)}"
+  if [ -z "$ZONEEDIT_ID" ] || [ -z "$ZONEEDIT_Token" ]; then
+    ZONEEDIT_ID=""
+    ZONEEDIT_Token=""
+    _err "Please specify ZONEEDIT_ID and _Token."
+    _err "Please export as ZONEEDIT_ID and ZONEEDIT_Token then try again."
+    return 1
+  fi
+
+  # Save the credentials to the account conf file
+  _saveaccountconf_mutable ZONEEDIT_ID "$ZONEEDIT_ID"
+  _saveaccountconf_mutable ZONEEDIT_Token "$ZONEEDIT_Token"
+
+  if _zoneedit_api "CREATE" "$fulldomain" "$txtvalue"; then
+    _info "Added, OK"
+    return 0
+  else
+    _err "Add txt record error."
+    return 1
+  fi
+}
+
+# Usage: dns_zoneedit_rm   fulldomain   txtvalue
+dns_zoneedit_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using Zoneedit"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  # Load the credentials from the account conf file
+  ZONEEDIT_ID="${ZONEEDIT_ID:-$(_readaccountconf_mutable ZONEEDIT_ID)}"
+  ZONEEDIT_Token="${ZONEEDIT_Token:-$(_readaccountconf_mutable ZONEEDIT_Token)}"
+  if [ -z "$ZONEEDIT_ID" ] || [ -z "$ZONEEDIT_Token" ]; then
+    ZONEEDIT_ID=""
+    ZONEEDIT_Token=""
+    _err "Please specify ZONEEDIT_ID and _Token."
+    _err "Please export as ZONEEDIT_ID and ZONEEDIT_Token then try again."
+    return 1
+  fi
+
+  if _zoneedit_api "DELETE" "$fulldomain" "$txtvalue"; then
+    _info "Deleted, OK"
+    return 0
+  else
+    _err "Delete txt record error."
+    return 1
+  fi
+}
+
+####################  Private functions below ##################################
+
+#Usage: _zoneedit_api   <CREATE|DELETE>   fulldomain   txtvalue
+_zoneedit_api() {
+  cmd=$1
+  fulldomain=$2
+  txtvalue=$3
+
+  # Construct basic authorization header
+  credentials=$(printf "%s:%s" "$ZONEEDIT_ID" "$ZONEEDIT_Token" | _base64)
+  export _H1="Authorization: Basic ${credentials}"
+
+  # Generate request URL
+  case "$cmd" in
+  "CREATE")
+    # https://dynamic.zoneedit.com/txt-create.php?host=_acme-challenge.example.com&rdata=depE1VF_xshMm1IVY1Y56Kk9Zb_7jA2VFkP65WuNgu8W
+    geturl="https://dynamic.zoneedit.com/txt-create.php?host=${fulldomain}&rdata=${txtvalue}"
+    ;;
+  "DELETE")
+    # https://dynamic.zoneedit.com/txt-delete.php?host=_acme-challenge.example.com&rdata=depE1VF_xshMm1IVY1Y56Kk9Zb_7jA2VFkP65WuNgu8W
+    geturl="https://dynamic.zoneedit.com/txt-delete.php?host=${fulldomain}&rdata=${txtvalue}"
+    ze_sleep=2
+    ;;
+  *)
+    _err "Unknown parameter : $cmd"
+    return 1
+    ;;
+  esac
+
+  # Execute request
+  i=3 # Tries
+  while [ $i -gt 0 ]; do
+    i=$(_math "$i" - 1)
+
+    if ! response=$(_get "$geturl"); then
+      _err "_get() failed ($response)"
+      return 1
+    fi
+    _debug2 response "$response"
+    if _contains "$response" "SUCCESS.*200"; then
+      # Sleep (when needed) to work around a Zonedit API bug
+      # https://forum.zoneedit.com/threads/automating-changes-of-txt-records-in-dns.7394/page-2#post-23855
+      if [ "$ze_sleep" ]; then _sleep "$ze_sleep"; fi
+      return 0
+    elif _contains "$response" "ERROR.*Minimum.*seconds"; then
+      _info "Zoneedit responded with a rate limit of..."
+      ze_ratelimit=$(echo "$response" | sed -n 's/.*Minimum \([0-9]\+\) seconds.*/\1/p')
+      if [ "$ze_ratelimit" ] && [ ! "$(echo "$ze_ratelimit" | tr -d '0-9')" ]; then
+        _info "$ze_ratelimit seconds."
+      else
+        _err "$response"
+        _err "not a number, or blank ($ze_ratelimit), API change?"
+        unset ze_ratelimit
+      fi
+    else
+      _err "$response"
+      _err "Unknown response, API change?"
+    fi
+
+    # Retry
+    if [ "$i" -lt 1 ]; then
+      _err "Tries exceeded, giving up."
+      return 1
+    fi
+    if [ "$ze_ratelimit" ]; then
+      _info "Waiting $ze_ratelimit seconds..."
+      _sleep "$ze_ratelimit"
+    else
+      _err "Going to retry after 10 seconds..."
+      _sleep 10
+    fi
+  done
+  return 1
+}

From 223dc87cef686dd6c1160fb9f8cabcf47e4f8a9a Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sat, 7 Dec 2024 22:50:12 +0100
Subject: [PATCH 106/174] usage

---
 .github/workflows/pr_dns.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/pr_dns.yml b/.github/workflows/pr_dns.yml
index 4d7a325d..58630e8b 100644
--- a/.github/workflows/pr_dns.yml
+++ b/.github/workflows/pr_dns.yml
@@ -23,6 +23,7 @@ jobs:
                 First thing: don't send PR to the master branch, please send to the dev branch instead.
                 Please make sure you've read our [DNS API Dev Guide](../wiki/DNS-API-Dev-Guide) and [DNS-API-Test](../wiki/DNS-API-Test).
                 Then reply on this message, otherwise, your code will not be reviewed or merged.
+                Please also make sure to add/update the usage here: https://github.com/acmesh-official/acme.sh/wiki/dnsapi2
                 We look forward to reviewing your Pull request shortly ✨
                 注意: 必须通过了 [DNS-API-Test](../wiki/DNS-API-Test) 才会被 review. 无论是修改, 还是新加的 dns api, 都必须确保通过这个测试.
                 `

From 3fbdb7a0078b396841eba3d62af8f67ec016c01b Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Tue, 10 Dec 2024 20:58:02 +0100
Subject: [PATCH 107/174] fix format

---
 dnsapi/dns_fornex.sh   | 2 +-
 dnsapi/dns_zoneedit.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_fornex.sh b/dnsapi/dns_fornex.sh
index d1a10af8..91e5491b 100644
--- a/dnsapi/dns_fornex.sh
+++ b/dnsapi/dns_fornex.sh
@@ -88,7 +88,7 @@ _get_root() {
 
   i=1
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
     _debug h "$h"
     if [ -z "$h" ]; then
       #not valid
diff --git a/dnsapi/dns_zoneedit.sh b/dnsapi/dns_zoneedit.sh
index 7ea16f75..df01d8cf 100644
--- a/dnsapi/dns_zoneedit.sh
+++ b/dnsapi/dns_zoneedit.sh
@@ -100,7 +100,7 @@ _zoneedit_api() {
 
   # Execute request
   i=3 # Tries
-  while [ $i -gt 0 ]; do
+  while [ "$i" -gt 0 ]; do
     i=$(_math "$i" - 1)
 
     if ! response=$(_get "$geturl"); then

From 03e9c612b9138a8174aaf8a3a9c81b7866fdbccf Mon Sep 17 00:00:00 2001
From: Alex <alexander.noack@web.de>
Date: Fri, 20 Dec 2024 10:34:51 +0100
Subject: [PATCH 108/174] Correct file ownership according to keystore
 directory

---
 deploy/unifi.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 4d8c058e..9ee7114c 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -135,6 +135,15 @@ unifi_deploy() {
       cp -f "$_import_pkcs12" "$_unifi_keystore"
     fi
 
+    # correct file ownership according to the directory, the keystore is placed in
+    _unifi_keystore_dir=$(dirname "${_unifi_keystore}")
+    _unifi_keystore_dir_owner=$(ls -ld "${_unifi_keystore_dir}" | awk '{print $3}')
+    _unifi_keystore_owner=$(ls -l "${_unifi_keystore}" | awk '{print $3}')
+    if ! [ "${_unifi_keystore_owner}" = "${_unifi_keystore_dir_owner}" ] ; then
+      _debug "Changing keystore owner to ${_unifi_keystore_dir_owner}"
+      chown $_unifi_keystore_dir_owner "${_unifi_keystore}" >/dev/null 2>&1 # fail quietly if we're not running as root
+    fi
+
     # Update unifi service for certificate cipher compatibility
     if ${ACME_OPENSSL_BIN:-openssl} pkcs12 \
       -in "$_import_pkcs12" \

From 0e1d90dd0c6eb8ce2c57a9e71ba79b41283b4b07 Mon Sep 17 00:00:00 2001
From: Alex <alexander.noack@web.de>
Date: Fri, 20 Dec 2024 10:36:45 +0100
Subject: [PATCH 109/174] Properly guess system.properties location

---
 deploy/unifi.sh | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 9ee7114c..9ae54f2b 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -150,14 +150,21 @@ unifi_deploy() {
       -password pass:aircontrolenterprise \
       -nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
       -noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
-      cp -f /usr/lib/unifi/data/system.properties /usr/lib/unifi/data/system.properties_original
-      _info "Updating system configuration for cipher compatibility."
-      _info "Saved original system config to /usr/lib/unifi/data/system.properties_original"
-      sed -i '/unifi\.https\.ciphers/d' /usr/lib/unifi/data/system.properties
-      echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>/usr/lib/unifi/data/system.properties
-      sed -i '/unifi\.https\.sslEnabledProtocols/d' /usr/lib/unifi/data/system.properties
-      echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>/usr/lib/unifi/data/system.properties
-      _info "System configuration updated."
+      if [ -f "$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties" ] ; then
+        _unifi_system_properties="$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties"
+      else
+        _unifi_system_properties="/usr/lib/unifi/data/system.properties"
+      fi
+      if [ -f "${_unifi_system_properties}" ] ; then
+        cp -f "${_unifi_system_properties}" "${_unifi_system_properties}"_original
+        _info "Updating system configuration for cipher compatibility."
+        _info "Saved original system config to ${_unifi_system_properties}_original"
+        sed -i '/unifi\.https\.ciphers/d' "${_unifi_system_properties}"
+        echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>"${_unifi_system_properties}"
+        sed -i '/unifi\.https\.sslEnabledProtocols/d' "${_unifi_system_properties}"
+        echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>"${_unifi_system_properties}"
+        _info "System configuration updated."
+      fi
     fi
 
     rm "$_import_pkcs12"

From d75077c6f905c30caf983e076cf66b640d260967 Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sun, 22 Dec 2024 13:36:43 +0100
Subject: [PATCH 110/174] fix format

---
 deploy/unifi.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 9ae54f2b..23784099 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -139,7 +139,7 @@ unifi_deploy() {
     _unifi_keystore_dir=$(dirname "${_unifi_keystore}")
     _unifi_keystore_dir_owner=$(ls -ld "${_unifi_keystore_dir}" | awk '{print $3}')
     _unifi_keystore_owner=$(ls -l "${_unifi_keystore}" | awk '{print $3}')
-    if ! [ "${_unifi_keystore_owner}" = "${_unifi_keystore_dir_owner}" ] ; then
+    if ! [ "${_unifi_keystore_owner}" = "${_unifi_keystore_dir_owner}" ]; then
       _debug "Changing keystore owner to ${_unifi_keystore_dir_owner}"
       chown $_unifi_keystore_dir_owner "${_unifi_keystore}" >/dev/null 2>&1 # fail quietly if we're not running as root
     fi
@@ -150,12 +150,12 @@ unifi_deploy() {
       -password pass:aircontrolenterprise \
       -nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
       -noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
-      if [ -f "$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties" ] ; then
+      if [ -f "$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties" ]; then
         _unifi_system_properties="$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties"
       else
         _unifi_system_properties="/usr/lib/unifi/data/system.properties"
       fi
-      if [ -f "${_unifi_system_properties}" ] ; then
+      if [ -f "${_unifi_system_properties}" ]; then
         cp -f "${_unifi_system_properties}" "${_unifi_system_properties}"_original
         _info "Updating system configuration for cipher compatibility."
         _info "Saved original system config to ${_unifi_system_properties}_original"

From a9f97e1fe2a914acb7bfa2fd04c9829b2e40957a Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sun, 22 Dec 2024 14:17:33 +0100
Subject: [PATCH 111/174] fix format

---
 deploy/unifi.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 23784099..a50b06ff 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -141,7 +141,7 @@ unifi_deploy() {
     _unifi_keystore_owner=$(ls -l "${_unifi_keystore}" | awk '{print $3}')
     if ! [ "${_unifi_keystore_owner}" = "${_unifi_keystore_dir_owner}" ]; then
       _debug "Changing keystore owner to ${_unifi_keystore_dir_owner}"
-      chown $_unifi_keystore_dir_owner "${_unifi_keystore}" >/dev/null 2>&1 # fail quietly if we're not running as root
+      chown "$_unifi_keystore_dir_owner" "${_unifi_keystore}" >/dev/null 2>&1 # fail quietly if we're not running as root
     fi
 
     # Update unifi service for certificate cipher compatibility
@@ -150,8 +150,8 @@ unifi_deploy() {
       -password pass:aircontrolenterprise \
       -nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
       -noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
-      if [ -f "$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties" ]; then
-        _unifi_system_properties="$(dirname ${DEPLOY_UNIFI_KEYSTORE})/system.properties"
+      if [ -f "$(dirname "${DEPLOY_UNIFI_KEYSTORE}")/system.properties" ]; then
+        _unifi_system_properties="$(dirname "${DEPLOY_UNIFI_KEYSTORE}")/system.properties"
       else
         _unifi_system_properties="/usr/lib/unifi/data/system.properties"
       fi

From 02da1700e0ff5bff4bb8f72e60f5e4394f13e8b9 Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sun, 22 Dec 2024 14:19:58 +0100
Subject: [PATCH 112/174] fix format

---
 deploy/unifi.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index a50b06ff..1c9dfb44 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -137,8 +137,8 @@ unifi_deploy() {
 
     # correct file ownership according to the directory, the keystore is placed in
     _unifi_keystore_dir=$(dirname "${_unifi_keystore}")
-    _unifi_keystore_dir_owner=$(ls -ld "${_unifi_keystore_dir}" | awk '{print $3}')
-    _unifi_keystore_owner=$(ls -l "${_unifi_keystore}" | awk '{print $3}')
+    _unifi_keystore_dir_owner=$(find "${_unifi_keystore_dir}" -maxdepth 0 -printf '%u\n')
+    _unifi_keystore_owner=$(find "${_unifi_keystore}" -maxdepth 0 -printf '%u\n')
     if ! [ "${_unifi_keystore_owner}" = "${_unifi_keystore_dir_owner}" ]; then
       _debug "Changing keystore owner to ${_unifi_keystore_dir_owner}"
       chown "$_unifi_keystore_dir_owner" "${_unifi_keystore}" >/dev/null 2>&1 # fail quietly if we're not running as root

From e42ad9be242dadc565ab7d93fc96b63519101563 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mail.ru>
Date: Mon, 23 Dec 2024 14:50:28 +1000
Subject: [PATCH 113/174] fix   don't use debug3, use debug2   add # shellcheck
 disable=SC2034

---
 dnsapi/dns_selectel.sh | 49 +++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 511ab7f5..7782fa44 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env sh
+# shellcheck disable=SC2034
 
 # Variables that must be defined before running
 #   export SL_Ver="v1"                    - version API: 'v2' (actual) or 'v1' (legacy).
@@ -35,11 +36,11 @@ dns_selectel_add() {
   if ! _sl_init_vars; then
     return 1
   fi
-  _debug3 SL_Ver "$SL_Ver"
-  _debug3 SL_Expire "$SL_Expire"
-  _debug3 SL_Login_Name "$SL_Login_Name"
-  _debug3 SL_Login_ID "$SL_Login_ID"
-  _debug3 SL_Project_Name "$SL_Project_Name"
+  _debug2 SL_Ver "$SL_Ver"
+  _debug2 SL_Expire "$SL_Expire"
+  _debug2 SL_Login_Name "$SL_Login_Name"
+  _debug2 SL_Login_ID "$SL_Login_ID"
+  _debug2 SL_Project_Name "$SL_Project_Name"
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -95,9 +96,9 @@ dns_selectel_add() {
         # preparing _data
         _tmp_str="${_record_array},{\"content\":\"${_text_tmp}\"}"
         _data="{\"ttl\": 60, \"records\": [${_tmp_str}]}"
-        _debug3 _record_seg "$_record_seg"
-        _debug3 _record_array "$_record_array"
-        _debug3 _record_array "$_record_id"
+        _debug2 _record_seg "$_record_seg"
+        _debug2 _record_array "$_record_array"
+        _debug2 _record_array "$_record_id"
         _debug "New data for record" "$_data"
         if _sl_rest PATCH "${_ext_uri}${_record_id}" "$_data"; then
           _info "Added, OK"
@@ -121,11 +122,11 @@ dns_selectel_rm() {
   if ! _sl_init_vars "nosave"; then
     return 1
   fi
-  _debug3 SL_Ver "$SL_Ver"
-  _debug3 SL_Expire "$SL_Expire"
-  _debug3 SL_Login_Name "$SL_Login_Name"
-  _debug3 SL_Login_ID "$SL_Login_ID"
-  _debug3 SL_Project_Name "$SL_Project_Name"
+  _debug2 SL_Ver "$SL_Ver"
+  _debug2 SL_Expire "$SL_Expire"
+  _debug2 SL_Login_Name "$SL_Login_Name"
+  _debug2 SL_Login_ID "$SL_Login_ID"
+  _debug2 SL_Project_Name "$SL_Project_Name"
   #
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -166,7 +167,7 @@ dns_selectel_rm() {
     _err "Error. Unsupported version API $SL_Ver"
     return 1
   fi
-  _debug3 "_record_seg" "$_record_seg"
+  _debug2 "_record_seg" "$_record_seg"
   if [ -z "$_record_seg" ]; then
     _err "can not find _record_seg"
     return 1
@@ -181,7 +182,7 @@ dns_selectel_rm() {
     _err "can not find _record_id"
     return 1
   fi
-  _debug3 "_record_id" "$_record_id"
+  _debug2 "_record_id" "$_record_id"
   # delete all record type TXT with text $txtvalue
   if [ "$SL_Ver" = "v2" ]; then
     # actual
@@ -199,7 +200,7 @@ dns_selectel_rm() {
     else
       # update a record by removing one element in content
       _data="{\"ttl\": 60, \"records\": [${_new_arr}]}"
-      _debug3 _data "$_data"
+      _debug2 _data "$_data"
       # REST API PATCH call
       if _sl_rest PATCH "${_del_uri}" "$_data"; then
         _info "Patched, OK: ${_del_uri}"
@@ -314,15 +315,16 @@ _sl_rest() {
   fi
   export _H1="${_h1_name}: ${_token}"
   export _H2="Content-Type: application/json"
-  _debug3 "Full URI: " "$SL_Api/${SL_Ver}${ep}"
-  _debug3 "_H1:" "$_H1"
-  _debug3 "_H2:" "$_H2"
+  _debug2 "Full URI: " "$SL_Api/${SL_Ver}${ep}"
+  _debug2 "_H1:" "$_H1"
+  _debug2 "_H2:" "$_H2"
   if [ "$m" != "GET" ]; then
     _debug data "$data"
     response="$(_post "$data" "$SL_Api/${SL_Ver}${ep}" "" "$m")"
   else
     response="$(_get "$SL_Api/${SL_Ver}${ep}")"
   fi
+  # shellcheck disable=SC2181
   if [ "$?" != "0" ]; then
     _err "error $ep"
     return 1
@@ -353,13 +355,12 @@ _get_auth_token() {
       _project_name=$(_getfield "$token_v2" 4 "$_sl_sep")
       _receipt_time=$(_getfield "$token_v2" 5 "$_sl_sep")
       _login_id=$(_getfield "$token_v2" 3 "$_sl_sep")
-      _debug3 _login_name "$_login_name"
-      _debug3 _login_id "$_login_id"
-      _debug3 _project_name "$_project_name"
-      # _debug3 _receipt_time "$(date -d @"$_receipt_time" -u)"
+      _debug2 _login_name "$_login_name"
+      _debug2 _login_id "$_login_id"
+      _debug2 _project_name "$_project_name"
       # check the validity of the token for the user and the project and its lifetime
       _dt_diff_minute=$((($(date +%s) - _receipt_time) / 60))
-      _debug3 _dt_diff_minute "$_dt_diff_minute"
+      _debug2 _dt_diff_minute "$_dt_diff_minute"
       [ "$_dt_diff_minute" -gt "$SL_Expire" ] && unset _token_keystone
       if [ "$_project_name" != "$SL_Project_Name" ] || [ "$_login_name" != "$SL_Login_Name" ] || [ "$_login_id" != "$SL_Login_ID" ]; then
         unset _token_keystone

From 112bfccfd52f05db43f68946c9047399a541bfc5 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mail.ru>
Date: Tue, 24 Dec 2024 16:00:01 +1000
Subject: [PATCH 114/174] fix _get_root() make it start from 1. because we need
 to support --domain-alias (only version api actual v2)

---
 dnsapi/dns_selectel.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 7782fa44..309c6b17 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -267,7 +267,7 @@ _get_root() {
       _err "Error read records of all domains $SL_Ver"
       return 1
     fi
-    i=2
+    i=1
     p=1
     while true; do
       h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)

From 4cc460be642d1fd9f3bddf82e953e1d783fd1def Mon Sep 17 00:00:00 2001
From: Peter Vos <pvos@dev.cloudsync.nl>
Date: Tue, 24 Dec 2024 13:33:15 +0100
Subject: [PATCH 115/174] Added dns challenge for mijn.host

---
 dnsapi/dns_mijn_host.sh | 145 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 dnsapi/dns_mijn_host.sh

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
new file mode 100644
index 00000000..5caf5a22
--- /dev/null
+++ b/dnsapi/dns_mijn_host.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_mijnhost_info='mijn.host
+Domains: mijn.host
+Site: mijn.host
+Docs: https://mijn.host/api/doc/api-3563900
+Options:
+ MIJN_HOST_API_KEY API Key
+'
+
+########  Public functions ###################### Constants for your mijn-host API
+MIJN_HOST_API="https://mijn.host/api/v2"
+
+# Add TXT record for domain verification
+dns_mijn_host_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  MIJN_HOST_API_KEY="${MIJN_HOST_API_KEY:-$(_readaccountconf_mutable MIJN_HOST_API_KEY)}"
+  if [ -z "$MIJN_HOST_API_KEY" ]; then
+    MIJN_HOST_API_KEY=""
+    _err "You haven't specified mijn-host API key yet."
+    _err "Please set it and try again."
+    return 1
+  fi
+
+  # Save the API key for future use
+  _saveaccountconf_mutable MIJN_HOST_API_KEY "$MIJN_HOST_API_KEY"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _debug "Add TXT record"
+
+  # Build the payload for the API
+  data="{\"type\":\"TXT\",\"name\":\"$subdomain\",\"value\":\"$txtvalue\",\"ttl\":120}"
+
+  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H2="Content-Type: application/json"
+
+  extracted_domain="${fulldomain#*_acme-challenge.}"
+
+  # Construct the API URL
+  api_url="$MIJN_HOST_API/domains/$extracted_domain/dns"
+
+  # Getting preivous records
+  get_response="$(_get "$api_url")"
+  records=$(echo "$get_response" | jq -r '.data.records')
+
+  # Updating the records
+  updated_records=$(echo "$records" | jq --argjson data "$data" '. += [$data]')
+
+  # data
+  data="{\"records\": $updated_records}"
+
+  # Use the _post method to make the API request
+  response="$(_post "$data" "$api_url" "" "PUT")"
+
+  if _contains "$response" "error"; then
+    _err "Error adding TXT record: $response"
+    return 1
+  fi
+
+  _info "TXT record added successfully"
+  return 0
+}
+
+# Remove TXT record after verification
+dns_mijn_host_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  MIJN_HOST_API_KEY="${MIJN_HOST_API_KEY:-$(_readaccountconf_mutable MIJN_HOST_API_KEY)}"
+  if [ -z "$MIJN_HOST_API_KEY" ]; then
+    MIJN_HOST_API_KEY=""
+    _err "You haven't specified mijn-host API key yet."
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _debug "Removing TXT record"
+
+  # Build the payload for the API
+  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H2="Content-Type: application/json"
+
+  extracted_domain="${fulldomain#*_acme-challenge.}"
+
+  # Construct the API URL
+  api_url="$MIJN_HOST_API/domains/$extracted_domain/dns"
+
+  # Get current records
+  response="$(_get "$api_url")"
+
+  updated_records=$(echo "$response" | jq '.data.records')
+
+  updated_records=$(echo "$updated_records" | jq --arg value "$txtvalue" 'map(select(.value != $value))')
+
+  # Build the new payload
+  data="{\"records\": $updated_records}"
+
+  # Use the _put method to update the records
+  response="$(_post "$data" "$api_url" "" "PUT")"
+
+  if _contains "$response" "error"; then
+    _err "Error updating TXT record: $response"
+    return 1
+  fi
+
+  _info "TXT record removed successfully"
+  return 0
+}
+
+# Helper function to detect the root zone
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f "$i"-)
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if _contains "$(dig ns "$h")" "mijn.host"; then
+      root_zone="$h"
+      subdomain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
+      return 0
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+
+  return 1
+}

From 5e9a067e8754a180b37f718154b33acde3651c80 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Tue, 24 Dec 2024 16:55:26 +0100
Subject: [PATCH 116/174] Fixed root domain detection and processing.

---
 dnsapi/dns_mijn_host.sh | 61 ++++++++++++++++++++++++-----------------
 1 file changed, 36 insertions(+), 25 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 5caf5a22..e8ad398d 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -3,7 +3,7 @@
 dns_mijnhost_info='mijn.host
 Domains: mijn.host
 Site: mijn.host
-Docs: https://mijn.host/api/doc/api-3563900
+Docs: https://mijn.host/api/doc/
 Options:
  MIJN_HOST_API_KEY API Key
 '
@@ -33,23 +33,26 @@ dns_mijn_host_add() {
     return 1
   fi
 
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
   _debug "Add TXT record"
 
   # Build the payload for the API
-  data="{\"type\":\"TXT\",\"name\":\"$subdomain\",\"value\":\"$txtvalue\",\"ttl\":120}"
+  data="{\"type\":\"TXT\",\"name\":\"$_sub_domain\",\"value\":\"$txtvalue\",\"ttl\":120}"
 
   export _H1="API-Key: $MIJN_HOST_API_KEY"
   export _H2="Content-Type: application/json"
 
-  extracted_domain="${fulldomain#*_acme-challenge.}"
-
   # Construct the API URL
-  api_url="$MIJN_HOST_API/domains/$extracted_domain/dns"
+  api_url="$MIJN_HOST_API/domains/$_domain/dns"
 
-  # Getting preivous records
+  # Getting previous records
   get_response="$(_get "$api_url")"
   records=$(echo "$get_response" | jq -r '.data.records')
 
+  _debug2 "previous records" "$records"
+
   # Updating the records
   updated_records=$(echo "$records" | jq --argjson data "$data" '. += [$data]')
 
@@ -59,7 +62,9 @@ dns_mijn_host_add() {
   # Use the _post method to make the API request
   response="$(_post "$data" "$api_url" "" "PUT")"
 
-  if _contains "$response" "error"; then
+  _debug2 "Response" "$response"
+
+  if ! _contains "$response" "200"; then
     _err "Error adding TXT record: $response"
     return 1
   fi
@@ -92,10 +97,8 @@ dns_mijn_host_rm() {
   export _H1="API-Key: $MIJN_HOST_API_KEY"
   export _H2="Content-Type: application/json"
 
-  extracted_domain="${fulldomain#*_acme-challenge.}"
-
   # Construct the API URL
-  api_url="$MIJN_HOST_API/domains/$extracted_domain/dns"
+  api_url="$MIJN_HOST_API/domains/$_domain/dns"
 
   # Get current records
   response="$(_get "$api_url")"
@@ -110,7 +113,7 @@ dns_mijn_host_rm() {
   # Use the _put method to update the records
   response="$(_post "$data" "$api_url" "" "PUT")"
 
-  if _contains "$response" "error"; then
+  if ! _contains "$response" "200"; then
     _err "Error updating TXT record: $response"
     return 1
   fi
@@ -122,24 +125,32 @@ dns_mijn_host_rm() {
 # Helper function to detect the root zone
 _get_root() {
   domain=$1
-  i=2
-  p=1
 
-  while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f "$i"-)
-    if [ -z "$h" ]; then
-      return 1
-    fi
+  # Get all domains 
+  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H2="Content-Type: application/json"
 
-    if _contains "$(dig ns "$h")" "mijn.host"; then
-      root_zone="$h"
-      subdomain=$(printf "%s" "$domain" | cut -d . -f 1-"$p")
+  # Construct the API URL
+  api_url="$MIJN_HOST_API/domains"
+
+  # Get current records
+  response="$(_get "$api_url")"
+
+  if ! _contains "$response" "200"; then
+    _err "Error listing domains: $response"
+    return 1
+  fi
+  
+  # Extract root oomains from response
+  rootDomains=$(echo "$response" | jq -r '.data.domains[].domain')
+
+  for rootDomain in $rootDomains; do
+    if _contains "$domain" "$rootDomain"; then
+      _domain="$rootDomain"
+      _sub_domain=$(printf '%s\n' "${domain//."$rootDomain"/}")
       return 0
     fi
-
-    p=$i
-    i=$(_math "$i" + 1)
   done
 
-  return 1
+  return 1    
 }

From ab1a2045d9e5c1cca112a037d3b44d9e4174e834 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Tue, 24 Dec 2024 17:10:30 +0100
Subject: [PATCH 117/174] Made string removal in root domain detection posix
 compliant

---
 dnsapi/dns_mijn_host.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index e8ad398d..55cd49a2 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -126,7 +126,7 @@ dns_mijn_host_rm() {
 _get_root() {
   domain=$1
 
-  # Get all domains 
+  # Get all domains
   export _H1="API-Key: $MIJN_HOST_API_KEY"
   export _H2="Content-Type: application/json"
 
@@ -140,17 +140,17 @@ _get_root() {
     _err "Error listing domains: $response"
     return 1
   fi
-  
+
   # Extract root oomains from response
   rootDomains=$(echo "$response" | jq -r '.data.domains[].domain')
 
   for rootDomain in $rootDomains; do
     if _contains "$domain" "$rootDomain"; then
       _domain="$rootDomain"
-      _sub_domain=$(printf '%s\n' "${domain//."$rootDomain"/}")
+      _sub_domain=$(echo "$domain" | sed "s/$rootDomain//g")
       return 0
     fi
   done
 
-  return 1    
+  return 1
 }

From c7cecd5b4fec49d9f4a67dbd04fe33fd21681de3 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Tue, 24 Dec 2024 17:30:50 +0100
Subject: [PATCH 118/174] Removed "." from _sub_domain to create a valid
 domain.

---
 dnsapi/dns_mijn_host.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 55cd49a2..0e279a98 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -147,7 +147,7 @@ _get_root() {
   for rootDomain in $rootDomains; do
     if _contains "$domain" "$rootDomain"; then
       _domain="$rootDomain"
-      _sub_domain=$(echo "$domain" | sed "s/$rootDomain//g")
+      _sub_domain=$(echo "$domain" | sed "s/.$rootDomain//g")
       return 0
     fi
   done

From 07220a324d53a3275659a0280a5d79932223a5d0 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Tue, 24 Dec 2024 23:21:50 +0100
Subject: [PATCH 119/174] Removed all jq references

---
 dnsapi/dns_mijn_host.sh | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 0e279a98..16d652b7 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -49,20 +49,24 @@ dns_mijn_host_add() {
 
   # Getting previous records
   get_response="$(_get "$api_url")"
-  records=$(echo "$get_response" | jq -r '.data.records')
+  records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
 
-  _debug2 "previous records" "$records"
+  _debug "Current records" "$records"
 
   # Updating the records
-  updated_records=$(echo "$records" | jq --argjson data "$data" '. += [$data]')
+  updated_records=$(echo "$records" | sed -E "s/\]( *$)/,$data\]/")
+  
+  _debug "Updated records" "$updatedrecords"
 
   # data
   data="{\"records\": $updated_records}"
 
+  _debug "json data add_dns PUT call:" "$data"
+
   # Use the _post method to make the API request
   response="$(_post "$data" "$api_url" "" "PUT")"
 
-  _debug2 "Response" "$response"
+  _debug "Response to PUT dns_add" "$response"
 
   if ! _contains "$response" "200"; then
     _err "Error adding TXT record: $response"
@@ -102,17 +106,27 @@ dns_mijn_host_rm() {
 
   # Get current records
   response="$(_get "$api_url")"
+  
+  _debug "Get current records response:" "$response"
 
-  updated_records=$(echo "$response" | jq '.data.records')
+  records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
+  
+  _debug "Current records:" "$records"
 
-  updated_records=$(echo "$updated_records" | jq --arg value "$txtvalue" 'map(select(.value != $value))')
+  updated_records=$(echo "$updated_records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
+  
+  _debug "Updated records:" "$updated_records"
 
   # Build the new payload
   data="{\"records\": $updated_records}"
+  
+  _debug "Payload:" "$data"
 
   # Use the _put method to update the records
   response="$(_post "$data" "$api_url" "" "PUT")"
 
+  _debug "Response:" "$response"
+
   if ! _contains "$response" "200"; then
     _err "Error updating TXT record: $response"
     return 1
@@ -141,8 +155,10 @@ _get_root() {
     return 1
   fi
 
-  # Extract root oomains from response
-  rootDomains=$(echo "$response" | jq -r '.data.domains[].domain')
+  # Extract root domains from response
+  rootDomains=$(echo "$response" | _egrep_o '"domain":"[^"]*"' | sed -E 's/"domain":"([^"]*)"/\1/')
+
+  _debug "Root domains:" "$rootDomains"
 
   for rootDomain in $rootDomains; do
     if _contains "$domain" "$rootDomain"; then

From 35f3b7088d4b50ccd14a3cd7e63036562cb65f11 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Wed, 25 Dec 2024 00:00:19 +0100
Subject: [PATCH 120/174] Updated PUT request to hold only fqdn domain name
 values#

---
 dnsapi/dns_mijn_host.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 16d652b7..62b0c144 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -39,7 +39,7 @@ dns_mijn_host_add() {
   _debug "Add TXT record"
 
   # Build the payload for the API
-  data="{\"type\":\"TXT\",\"name\":\"$_sub_domain\",\"value\":\"$txtvalue\",\"ttl\":120}"
+  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":120}"
 
   export _H1="API-Key: $MIJN_HOST_API_KEY"
   export _H2="Content-Type: application/json"
@@ -55,8 +55,8 @@ dns_mijn_host_add() {
 
   # Updating the records
   updated_records=$(echo "$records" | sed -E "s/\]( *$)/,$data\]/")
-  
-  _debug "Updated records" "$updatedrecords"
+
+  _debug "Updated records" "$updated_records"
 
   # data
   data="{\"records\": $updated_records}"
@@ -106,20 +106,20 @@ dns_mijn_host_rm() {
 
   # Get current records
   response="$(_get "$api_url")"
-  
+
   _debug "Get current records response:" "$response"
 
   records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
-  
+
   _debug "Current records:" "$records"
 
   updated_records=$(echo "$updated_records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
-  
+
   _debug "Updated records:" "$updated_records"
 
   # Build the new payload
   data="{\"records\": $updated_records}"
-  
+
   _debug "Payload:" "$data"
 
   # Use the _put method to update the records

From 3cfa882fe1d88d49b99d55ab6c919e79957944f7 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Wed, 25 Dec 2024 08:52:09 +0100
Subject: [PATCH 121/174] Fixed error in dns_mijn_host_rm

---
 dnsapi/dns_mijn_host.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 62b0c144..e3f5bb60 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -39,7 +39,7 @@ dns_mijn_host_add() {
   _debug "Add TXT record"
 
   # Build the payload for the API
-  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":120}"
+  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
 
   export _H1="API-Key: $MIJN_HOST_API_KEY"
   export _H2="Content-Type: application/json"
@@ -95,7 +95,7 @@ dns_mijn_host_rm() {
     return 1
   fi
 
-  _debug "Removing TXT record"
+  _debug "Removing TXT record" "$txtvalue"
 
   # Build the payload for the API
   export _H1="API-Key: $MIJN_HOST_API_KEY"
@@ -105,7 +105,7 @@ dns_mijn_host_rm() {
   api_url="$MIJN_HOST_API/domains/$_domain/dns"
 
   # Get current records
-  response="$(_get "$api_url")"
+  get_response="$(_get "$api_url")"
 
   _debug "Get current records response:" "$response"
 

From 7512dbffbbc0b7a9e2cd7cb55fc3c6a74c289df3 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Wed, 25 Dec 2024 09:50:27 +0100
Subject: [PATCH 122/174] Fixed yet another error in dns_rm

---
 dnsapi/dns_mijn_host.sh | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index e3f5bb60..5a5634dd 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -107,25 +107,23 @@ dns_mijn_host_rm() {
   # Get current records
   get_response="$(_get "$api_url")"
 
-  _debug "Get current records response:" "$response"
+  _debug "Get current records response:" "$get_response"
 
   records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
 
   _debug "Current records:" "$records"
 
-  updated_records=$(echo "$updated_records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
+  updated_records=$(echo "$records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
 
   _debug "Updated records:" "$updated_records"
 
   # Build the new payload
   data="{\"records\": $updated_records}"
 
-  _debug "Payload:" "$data"
-
   # Use the _put method to update the records
   response="$(_post "$data" "$api_url" "" "PUT")"
 
-  _debug "Response:" "$response"
+  _debug "Response to PUT dns_rm:" "$response"
 
   if ! _contains "$response" "200"; then
     _err "Error updating TXT record: $response"

From 150c708726248e2dda8e2691e2e2211feac0fe5a Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Wed, 25 Dec 2024 14:11:52 +0100
Subject: [PATCH 123/174] Better debug messages for root domain detection

---
 dnsapi/dns_mijn_host.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijn_host.sh
index 5a5634dd..2cd9a865 100644
--- a/dnsapi/dns_mijn_host.sh
+++ b/dnsapi/dns_mijn_host.sh
@@ -162,6 +162,9 @@ _get_root() {
     if _contains "$domain" "$rootDomain"; then
       _domain="$rootDomain"
       _sub_domain=$(echo "$domain" | sed "s/.$rootDomain//g")
+
+      _debug "Found root domain" "$_domain" "and subdomain" "$_sub_domain" "for" "$domain"
+
       return 0
     fi
   done

From 3f262fe872071c2fdc37c0528380e7f9d17ce669 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mail.ru>
Date: Thu, 26 Dec 2024 08:12:36 +1000
Subject: [PATCH 124/174] keep content: # dns_selectel_info='Selectel.com #
 Domains: Selectel.ru # Site: Selectel.com # Docs:
 github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_selectel # Options: #
 Variables that must be defined before running

---
 dnsapi/dns_selectel.sh | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 309c6b17..1e1a769a 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -1,26 +1,28 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
 
+# dns_selectel_info='Selectel.com
+# Domains: Selectel.ru
+# Site: Selectel.com
+# Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_selectel
+# Options:
 # Variables that must be defined before running
-#   export SL_Ver="v1"                    - version API: 'v2' (actual) or 'v1' (legacy).
-#                                           Default: v1
-# If SL_Ver="v1"
-#   export SL_Key="API_Key"               - Token Selectel (API key)
-#                                           You can view or create in the control panel in the upper right corner, open the menu: "Profile and setting -> Keys API".
-#                                           https://my.selectel.ru/profile/apikeys
-# If SL_Ver="v2"
-#   export SL_Expire=60                   - token lifetime in minutes (0-1440).
-#                                           Default: 1400 minutes
-#   export SL_Login_ID=<account_id>       - account number in the control panel;
-#   export SL_Project_Name=<project_name> - name project.
-#   export SL_Login_Name=<username>       - service user name. You can view the name in the control panel:
-#                                           in the upper right corner open menu: "Profile and setting → User management → Service users
-#   export SL_Pswd='pswd'                 - service user password, can be viewed when creating a user or changed to a new one.
-# All these variables will be saved in ~/.acme.sh/account.conf and will be reused as needed.
+#   SL_Ver='v1', when using version API legacy (v1)
+#       OR  
+#   SL_Ver='v2', when using version API actual (v2)
+#   default = 'v1'
+# when using API version v1, i.e. SL_Ver is 'v1' or not defined:
+#   SL_Key - API Key, required
+# when using API version v2:
+#   SL_Ver          - required as 'v2'
+#   SL_Login_ID     - account ID, required
+#   SL_Project_Name - name project, required
+#   SL_Login_Name   - service user name, required
+#   SL_Pswd         - service user password, required
+#   SL_Expire       - token lifetime in minutes (0-1440), default 1400 minutes
+#
+# Issues: github.com/acmesh-official/acme.sh/issues/5126
 #
-# Authorization is described in:
-#   https://developers.selectel.ru/docs/control-panel/authorization/
-#   https://developers.selectel.com/docs/control-panel/authorization/
 
 SL_Api="https://api.selectel.ru/domains"
 auth_uri="https://cloud.api.selcloud.ru/identity/v3/auth/tokens"

From d3f3a703507fdc8d9733baea846420bcbe3558e5 Mon Sep 17 00:00:00 2001
From: Vladimir Alexeev <9141778236@mail.ru>
Date: Thu, 26 Dec 2024 08:45:03 +1000
Subject: [PATCH 125/174] keep content: # dns_selectel_info='Selectel.com #
 Domains: Selectel.ru # Site: Selectel.com # Docs:
 github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_selectel # Options: #
 Variables that must be defined before running

---
 dnsapi/dns_selectel.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_selectel.sh b/dnsapi/dns_selectel.sh
index 1e1a769a..434bc483 100644
--- a/dnsapi/dns_selectel.sh
+++ b/dnsapi/dns_selectel.sh
@@ -7,10 +7,9 @@
 # Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_selectel
 # Options:
 # Variables that must be defined before running
+#   SL_Ver can take one of the values 'v1' or 'v2', default is 'v1'
 #   SL_Ver='v1', when using version API legacy (v1)
-#       OR  
 #   SL_Ver='v2', when using version API actual (v2)
-#   default = 'v1'
 # when using API version v1, i.e. SL_Ver is 'v1' or not defined:
 #   SL_Key - API Key, required
 # when using API version v2:

From b0f566a80dc9ac0913d2acbe254e592aca023d67 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Thu, 26 Dec 2024 23:36:55 +0100
Subject: [PATCH 126/174] Name change to be in line with other API scripts
 Added time-out to _get calls at 120s to fix API timeouts

---
 dnsapi/{dns_mijn_host.sh => dns_mijnhost.sh} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename dnsapi/{dns_mijn_host.sh => dns_mijnhost.sh} (100%)

diff --git a/dnsapi/dns_mijn_host.sh b/dnsapi/dns_mijnhost.sh
similarity index 100%
rename from dnsapi/dns_mijn_host.sh
rename to dnsapi/dns_mijnhost.sh

From 9ad794f2cc9fa1d74b18cf81ca6b61d42a820fff Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Fri, 27 Dec 2024 08:56:16 +0100
Subject: [PATCH 127/174] Name change, function name change to mijnhost

---
 dnsapi/dns_mijnhost.sh | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 2cd9a865..760602c3 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -5,27 +5,27 @@ Domains: mijn.host
 Site: mijn.host
 Docs: https://mijn.host/api/doc/
 Options:
- MIJN_HOST_API_KEY API Key
+ MIJNHOST_API_KEY API Key
 '
 
 ########  Public functions ###################### Constants for your mijn-host API
-MIJN_HOST_API="https://mijn.host/api/v2"
+MIJNHOST_API="https://mijn.host/api/v2"
 
 # Add TXT record for domain verification
-dns_mijn_host_add() {
+dns_mijnhost_add() {
   fulldomain=$1
   txtvalue=$2
 
-  MIJN_HOST_API_KEY="${MIJN_HOST_API_KEY:-$(_readaccountconf_mutable MIJN_HOST_API_KEY)}"
-  if [ -z "$MIJN_HOST_API_KEY" ]; then
-    MIJN_HOST_API_KEY=""
+  MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
+  if [ -z "$MIJNHOST_API_KEY" ]; then
+    MIJNHOST_API_KEY=""
     _err "You haven't specified mijn-host API key yet."
     _err "Please set it and try again."
     return 1
   fi
 
   # Save the API key for future use
-  _saveaccountconf_mutable MIJN_HOST_API_KEY "$MIJN_HOST_API_KEY"
+  _saveaccountconf_mutable MIJNHOST_API_KEY "$MIJNHOST_API_KEY"
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -41,14 +41,14 @@ dns_mijn_host_add() {
   # Build the payload for the API
   data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
 
-  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H1="API-Key: $MIJNHOST_API_KEY"
   export _H2="Content-Type: application/json"
 
   # Construct the API URL
-  api_url="$MIJN_HOST_API/domains/$_domain/dns"
+  api_url="$MIJNHOST_API/domains/$_domain/dns"
 
   # Getting previous records
-  get_response="$(_get "$api_url")"
+  get_response="$(_get "$api_url" "" "120")"
   records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
 
   _debug "Current records" "$records"
@@ -78,13 +78,13 @@ dns_mijn_host_add() {
 }
 
 # Remove TXT record after verification
-dns_mijn_host_rm() {
+dns_mijnhost_rm() {
   fulldomain=$1
   txtvalue=$2
 
-  MIJN_HOST_API_KEY="${MIJN_HOST_API_KEY:-$(_readaccountconf_mutable MIJN_HOST_API_KEY)}"
-  if [ -z "$MIJN_HOST_API_KEY" ]; then
-    MIJN_HOST_API_KEY=""
+  MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
+  if [ -z "$MIJNHOST_API_KEY" ]; then
+    MIJNHOST_API_KEY=""
     _err "You haven't specified mijn-host API key yet."
     return 1
   fi
@@ -98,14 +98,14 @@ dns_mijn_host_rm() {
   _debug "Removing TXT record" "$txtvalue"
 
   # Build the payload for the API
-  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H1="API-Key: $MIJNHOST_API_KEY"
   export _H2="Content-Type: application/json"
 
   # Construct the API URL
-  api_url="$MIJN_HOST_API/domains/$_domain/dns"
+  api_url="$MIJNHOST_API/domains/$_domain/dns"
 
   # Get current records
-  get_response="$(_get "$api_url")"
+  get_response="$(_get "$api_url" "" "120")"
 
   _debug "Get current records response:" "$get_response"
 
@@ -139,14 +139,14 @@ _get_root() {
   domain=$1
 
   # Get all domains
-  export _H1="API-Key: $MIJN_HOST_API_KEY"
+  export _H1="API-Key: $MIJNHOST_API_KEY"
   export _H2="Content-Type: application/json"
 
   # Construct the API URL
-  api_url="$MIJN_HOST_API/domains"
+  api_url="$MIJNHOST_API/domains"
 
   # Get current records
-  response="$(_get "$api_url")"
+  response="$(_get "$api_url" "" "120")"
 
   if ! _contains "$response" "200"; then
     _err "Error listing domains: $response"

From d093476da5ab6241e78dfe170e973f71f8dc2155 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Fri, 27 Dec 2024 12:55:12 +0100
Subject: [PATCH 128/174] Refactored REST calls to add generic retries, as
 mijn.host API times out at times.

---
 dnsapi/dns_mijnhost.sh | 151 +++++++++++++++++++++++++----------------
 1 file changed, 94 insertions(+), 57 deletions(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 760602c3..3b0fc3f5 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -33,48 +33,47 @@ dns_mijnhost_add() {
     return 1
   fi
 
-  _debug _sub_domain "$_sub_domain"
-  _debug _domain "$_domain"
-
-  _debug "Add TXT record"
-
-  # Build the payload for the API
-  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
-
-  export _H1="API-Key: $MIJNHOST_API_KEY"
-  export _H2="Content-Type: application/json"
+  _debug2 _sub_domain "$_sub_domain"
+  _debug2 _domain "$_domain"
+  _debug "Adding TXT record"
 
   # Construct the API URL
   api_url="$MIJNHOST_API/domains/$_domain/dns"
 
   # Getting previous records
-  get_response="$(_get "$api_url" "" "120")"
-  records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
+  _mijnhost_rest GET "$api_url" ""
 
-  _debug "Current records" "$records"
+  if [ "$_code" != "200" ]; then
+    _err "Error getting current DNS enties ($_code)"
+    return 1
+  fi
+
+  records=$(echo "$response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
+
+  _debug2 "Current records" "$records"
+
+  # Build the payload for the API
+  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
+
+  _debug2 "Record to add: " "$data"
 
   # Updating the records
   updated_records=$(echo "$records" | sed -E "s/\]( *$)/,$data\]/")
 
-  _debug "Updated records" "$updated_records"
+  _debug2 "Updated records" "$updated_records"
 
   # data
   data="{\"records\": $updated_records}"
 
-  _debug "json data add_dns PUT call:" "$data"
-
-  # Use the _post method to make the API request
-  response="$(_post "$data" "$api_url" "" "PUT")"
+  _mijnhost_rest PUT "$api_url" "$data"
 
-  _debug "Response to PUT dns_add" "$response"
-
-  if ! _contains "$response" "200"; then
-    _err "Error adding TXT record: $response"
+  if [ "$_code" = "200" ]; then
+    _info "DNS record succesfully added"
+    return 0
+  else
+    _err "Error adding DNS record ($_code)"
     return 1
   fi
-
-  _info "TXT record added successfully"
-  return 0
 }
 
 # Remove TXT record after verification
@@ -95,79 +94,117 @@ dns_mijnhost_rm() {
     return 1
   fi
 
-  _debug "Removing TXT record" "$txtvalue"
-
-  # Build the payload for the API
-  export _H1="API-Key: $MIJNHOST_API_KEY"
-  export _H2="Content-Type: application/json"
+  _debug "Removing TXT record" "$txtvalue" "for" "$fulldomain"
 
   # Construct the API URL
   api_url="$MIJNHOST_API/domains/$_domain/dns"
 
   # Get current records
-  get_response="$(_get "$api_url" "" "120")"
+  _mijnhost_rest GET "$api_url" ""
+
+  if [ "$_code" != "200" ]; then
+    _err "Error getting current DNS enties ($_code)"
+    return 1
+  fi
 
-  _debug "Get current records response:" "$get_response"
+  _debug2 "Get current records response:" "$response"
 
-  records=$(echo "$get_response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
+  records=$(echo "$response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
 
-  _debug "Current records:" "$records"
+  _debug2 "Current records:" "$records"
 
   updated_records=$(echo "$records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
 
-  _debug "Updated records:" "$updated_records"
+  _debug2 "Updated records:" "$updated_records"
 
   # Build the new payload
   data="{\"records\": $updated_records}"
 
   # Use the _put method to update the records
-  response="$(_post "$data" "$api_url" "" "PUT")"
-
-  _debug "Response to PUT dns_rm:" "$response"
+  _mijnhost_rest PUT "$api_url" "$data"
 
-  if ! _contains "$response" "200"; then
-    _err "Error updating TXT record: $response"
+  if [ "$_code" = "200" ]; then
+    _info "DNS record removed successfully"
+    return 0
+  else
+    _err "Error removing DNS record ($_code)"
     return 1
   fi
-
-  _info "TXT record removed successfully"
-  return 0
 }
 
 # Helper function to detect the root zone
 _get_root() {
   domain=$1
 
-  # Get all domains
-  export _H1="API-Key: $MIJNHOST_API_KEY"
-  export _H2="Content-Type: application/json"
-
-  # Construct the API URL
-  api_url="$MIJNHOST_API/domains"
-
   # Get current records
-  response="$(_get "$api_url" "" "120")"
+  _debug "Getting current domains"
+  _mijnhost_rest GET "$MIJNHOST_API/domains" ""
 
-  if ! _contains "$response" "200"; then
-    _err "Error listing domains: $response"
+  if [ "$_code" != "200" ]; then
+    _err "error getting current domains ($_code)"
     return 1
   fi
 
   # Extract root domains from response
   rootDomains=$(echo "$response" | _egrep_o '"domain":"[^"]*"' | sed -E 's/"domain":"([^"]*)"/\1/')
-
   _debug "Root domains:" "$rootDomains"
 
   for rootDomain in $rootDomains; do
     if _contains "$domain" "$rootDomain"; then
       _domain="$rootDomain"
       _sub_domain=$(echo "$domain" | sed "s/.$rootDomain//g")
-
       _debug "Found root domain" "$_domain" "and subdomain" "$_sub_domain" "for" "$domain"
-
       return 0
     fi
   done
-
   return 1
 }
+
+# Helper function for rest calls
+_mijnhost_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+
+  MAX_REQUEST_RETRY_TIMES=5
+  _request_retry_times=0
+  while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
+    _debug3 _request_retry_times "$_request_retry_times"
+    export _H1="API-Key: $MIJNHOST_API_KEY"
+    export _H2="Content-Type: application/json"
+    # clear headers from previous request to avoid getting wrong http code on timeouts
+    : >"$HTTP_HEADER"
+    _debug "$ep"
+    if [ "$m" != "GET" ]; then
+      _debug2 "data $data"
+      response="$(_post "$data" "$ep" "" "$m")"
+    else
+      response="$(_get "$ep")"
+    fi
+    _ret="$?"
+    _debug2 "response $response"
+    _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+    _debug "http response code $_code"
+    if [ "$_code" = "401" ]; then
+      # we have an invalid API token, maybe it is expired?
+      _err "Access denied. Invalid API token."
+      return 1
+    fi
+
+    if [ "$_ret" != "0" ] || [ -z "$_code" ]; then
+      _request_retry_times="$(_math "$_request_retry_times" + 1)"
+      _info "REST call error $_code retrying $ep in $_request_retry_times s"
+      # Sleep 10 times the number of retries in seconds, to increase backoff time
+      _sleep "$(_math "$_request_retry_times" \* 10)"
+      continue
+    fi
+    break
+  done
+  if [ "$_request_retry_times" = "$MAX_REQUEST_RETRY_TIMES" ]; then
+    _err "Error mijn.host API call was retried $MAX_REQUEST_RETRY_TIMES times."
+    _err "Calling $ep failed."
+    return 1
+  fi
+  response="$(echo "$response" | _normalizeJson)"
+  return 0
+}

From ac9852f9df6c904719e6241f8e9b049db06b21e4 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Fri, 27 Dec 2024 16:47:02 +0100
Subject: [PATCH 129/174] Added fix for specific API error that mijn.host
 sometimes throws.

---
 dnsapi/dns_mijnhost.sh | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 3b0fc3f5..ea204353 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -19,8 +19,8 @@ dns_mijnhost_add() {
   MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
   if [ -z "$MIJNHOST_API_KEY" ]; then
     MIJNHOST_API_KEY=""
-    _err "You haven't specified mijn-host API key yet."
-    _err "Please set it and try again."
+    _err "You haven't specified your mijn-host API key yet."
+    _err "Please add MIJNHOST_API_KEY to the env."
     return 1
   fi
 
@@ -35,7 +35,7 @@ dns_mijnhost_add() {
 
   _debug2 _sub_domain "$_sub_domain"
   _debug2 _domain "$_domain"
-  _debug "Adding TXT record"
+  _debug "Adding DNS record" "${fulldomain}."
 
   # Construct the API URL
   api_url="$MIJNHOST_API/domains/$_domain/dns"
@@ -55,7 +55,7 @@ dns_mijnhost_add() {
   # Build the payload for the API
   data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
 
-  _debug2 "Record to add: " "$data"
+  _debug2 "Record to add" "$data"
 
   # Updating the records
   updated_records=$(echo "$records" | sed -E "s/\]( *$)/,$data\]/")
@@ -68,10 +68,10 @@ dns_mijnhost_add() {
   _mijnhost_rest PUT "$api_url" "$data"
 
   if [ "$_code" = "200" ]; then
-    _info "DNS record succesfully added"
+    _info "DNS record succesfully added."
     return 0
   else
-    _err "Error adding DNS record ($_code)"
+    _err "Error adding DNS record ($_code)."
     return 1
   fi
 }
@@ -84,17 +84,18 @@ dns_mijnhost_rm() {
   MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
   if [ -z "$MIJNHOST_API_KEY" ]; then
     MIJNHOST_API_KEY=""
-    _err "You haven't specified mijn-host API key yet."
+    _err "You haven't specified your mijn-host API key yet."
+    _err "Please add MIJNHOST_API_KEY to the env."
     return 1
   fi
 
-  _debug "First detect the root zone"
+  _debug "Detecting root zone for" "${fulldomain}."
   if ! _get_root "$fulldomain"; then
     _err "Invalid domain"
     return 1
   fi
 
-  _debug "Removing TXT record" "$txtvalue" "for" "$fulldomain"
+  _debug "Removing DNS record for TXT value" "${txtvalue}."
 
   # Construct the API URL
   api_url="$MIJNHOST_API/domains/$_domain/dns"
@@ -124,10 +125,10 @@ dns_mijnhost_rm() {
   _mijnhost_rest PUT "$api_url" "$data"
 
   if [ "$_code" = "200" ]; then
-    _info "DNS record removed successfully"
+    _info "DNS record removed successfully."
     return 0
   else
-    _err "Error removing DNS record ($_code)"
+    _err "Error removing DNS record ($_code)."
     return 1
   fi
 }
@@ -191,7 +192,7 @@ _mijnhost_rest() {
       return 1
     fi
 
-    if [ "$_ret" != "0" ] || [ -z "$_code" ]; then
+    if [ "$_ret" != "0" ] || [ -z "$_code" ] || [ "$_code" = "400" ] || _contains "$response" "DNS records not managed by mijn.host"; then #Sometimes API errors out
       _request_retry_times="$(_math "$_request_retry_times" + 1)"
       _info "REST call error $_code retrying $ep in $_request_retry_times s"
       # Sleep 10 times the number of retries in seconds, to increase backoff time

From 588123ed117de0dfddeeea4d85a8d9b3a1f8d458 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Fri, 27 Dec 2024 23:56:13 +0100
Subject: [PATCH 130/174] Updated backoff algorithm

---
 dnsapi/dns_mijnhost.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index ea204353..5fe43d93 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -169,6 +169,8 @@ _mijnhost_rest() {
 
   MAX_REQUEST_RETRY_TIMES=5
   _request_retry_times=0
+  _retry_sleep=5 #Initial sleep time in seconds.
+
   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
     _debug3 _request_retry_times "$_request_retry_times"
     export _H1="API-Key: $MIJNHOST_API_KEY"
@@ -195,8 +197,8 @@ _mijnhost_rest() {
     if [ "$_ret" != "0" ] || [ -z "$_code" ] || [ "$_code" = "400" ] || _contains "$response" "DNS records not managed by mijn.host"; then #Sometimes API errors out
       _request_retry_times="$(_math "$_request_retry_times" + 1)"
       _info "REST call error $_code retrying $ep in $_request_retry_times s"
-      # Sleep 10 times the number of retries in seconds, to increase backoff time
-      _sleep "$(_math "$_request_retry_times" \* 10)"
+      _sleep "$_retry_sleep"
+      _retry_sleep="$(_math "$_retry_sleep" \* 2)"
       continue
     fi
     break

From 7a6101c4175efbfb0b781fb4543a25ce3b92a171 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Fri, 27 Dec 2024 23:56:13 +0100
Subject: [PATCH 131/174] Corrected sleep time message

---
 dnsapi/dns_mijnhost.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index ea204353..5fe43d93 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -169,6 +169,8 @@ _mijnhost_rest() {
 
   MAX_REQUEST_RETRY_TIMES=5
   _request_retry_times=0
+  _retry_sleep=5 #Initial sleep time in seconds.
+
   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
     _debug3 _request_retry_times "$_request_retry_times"
     export _H1="API-Key: $MIJNHOST_API_KEY"
@@ -195,8 +197,8 @@ _mijnhost_rest() {
     if [ "$_ret" != "0" ] || [ -z "$_code" ] || [ "$_code" = "400" ] || _contains "$response" "DNS records not managed by mijn.host"; then #Sometimes API errors out
       _request_retry_times="$(_math "$_request_retry_times" + 1)"
       _info "REST call error $_code retrying $ep in $_request_retry_times s"
-      # Sleep 10 times the number of retries in seconds, to increase backoff time
-      _sleep "$(_math "$_request_retry_times" \* 10)"
+      _sleep "$_retry_sleep"
+      _retry_sleep="$(_math "$_retry_sleep" \* 2)"
       continue
     fi
     break

From 42862852b81e2b8071a3e3515f6f30f000e5d100 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Sat, 28 Dec 2024 12:41:26 +0100
Subject: [PATCH 132/174] Corrected sleep message

---
 dnsapi/dns_mijnhost.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 5fe43d93..6dc9b8e0 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -196,7 +196,7 @@ _mijnhost_rest() {
 
     if [ "$_ret" != "0" ] || [ -z "$_code" ] || [ "$_code" = "400" ] || _contains "$response" "DNS records not managed by mijn.host"; then #Sometimes API errors out
       _request_retry_times="$(_math "$_request_retry_times" + 1)"
-      _info "REST call error $_code retrying $ep in $_request_retry_times s"
+      _info "REST call error $_code retrying $ep in $_retry_sleep s"
       _sleep "$_retry_sleep"
       _retry_sleep="$(_math "$_retry_sleep" \* 2)"
       continue

From 234bc93ddbbe701348e9838014c7ec97cc1ef9a9 Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Sat, 28 Dec 2024 12:42:50 +0100
Subject: [PATCH 133/174] Removed superfluous debug message

---
 dnsapi/dns_mijnhost.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 6dc9b8e0..c1f74389 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -172,7 +172,7 @@ _mijnhost_rest() {
   _retry_sleep=5 #Initial sleep time in seconds.
 
   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
-    _debug3 _request_retry_times "$_request_retry_times"
+    _debug2 _request_retry_times "$_request_retry_times"
     export _H1="API-Key: $MIJNHOST_API_KEY"
     export _H2="Content-Type: application/json"
     # clear headers from previous request to avoid getting wrong http code on timeouts

From 6ad469c6379636fc822f344235ee4341d5f1e5ac Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 28 Dec 2024 17:38:22 +0200
Subject: [PATCH 134/174] dnsapi: Fix structured info

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_azure.sh      |  2 +-
 dnsapi/dns_technitium.sh |  7 +++----
 dnsapi/dns_zoneedit.sh   | 20 ++++++++++++--------
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 3f0dfa3d..03feaf63 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -9,7 +9,7 @@ Options:
  AZUREDNS_APPID App ID. App ID of the service principal
  AZUREDNS_CLIENTSECRET Client Secret. Secret from creating the service principal
  AZUREDNS_MANAGEDIDENTITY Use Managed Identity. Use Managed Identity assigned to a resource instead of a service principal. "true"/"false"
- AZUREDNS_BEARERTOKEN Optional Bearer Token. Used instead of service principal credentials or managed identity
+ AZUREDNS_BEARERTOKEN Bearer Token. Used instead of service principal credentials or managed identity. Optional.
 '
 
 wiki=https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS
diff --git a/dnsapi/dns_technitium.sh b/dnsapi/dns_technitium.sh
index a50db97c..7bc0dd48 100755
--- a/dnsapi/dns_technitium.sh
+++ b/dnsapi/dns_technitium.sh
@@ -1,13 +1,12 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
-dns_Technitium_info='Technitium DNS Server
-
-Site: https://technitium.com/dns/
+dns_technitium_info='Technitium DNS Server
+Site: Technitium.com/dns/
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_technitium
 Options:
  Technitium_Server Server Address
  Technitium_Token API Token
-Issues:https://github.com/acmesh-official/acme.sh/issues/6116
+Issues: github.com/acmesh-official/acme.sh/issues/6116
 Author: Henning Reich <acmesh@qupfer.de>
 '
 
diff --git a/dnsapi/dns_zoneedit.sh b/dnsapi/dns_zoneedit.sh
index df01d8cf..77553f3c 100644
--- a/dnsapi/dns_zoneedit.sh
+++ b/dnsapi/dns_zoneedit.sh
@@ -1,19 +1,23 @@
 #!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_zoneedit_info='ZoneEdit.com
+Site: ZoneEdit.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_zoneedit
+Options:
+ ZONEEDIT_ID ID
+ ZONEEDIT_Token API Token
+Issues: github.com/acmesh-official/acme.sh/issues/6135
+'
 
 # https://github.com/blueslow/sslcertzoneedit
 
-# Only need to export the credentials once, acme.sh will save for automatic renewal.
-# export ZONEEDIT_ID="Your id"
-# export ZONEEDIT_Token="Your token"
-# acme.sh --issue --dns dns_zoneedit -d example.com -d www.example.com
-
 ########  Public functions #####################
 
 # Usage: dns_zoneedit_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_zoneedit_add() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using Zoneedit"
+  _info "Using ZoneEdit"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
 
@@ -45,7 +49,7 @@ dns_zoneedit_add() {
 dns_zoneedit_rm() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using Zoneedit"
+  _info "Using ZoneEdit"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
 
@@ -114,7 +118,7 @@ _zoneedit_api() {
       if [ "$ze_sleep" ]; then _sleep "$ze_sleep"; fi
       return 0
     elif _contains "$response" "ERROR.*Minimum.*seconds"; then
-      _info "Zoneedit responded with a rate limit of..."
+      _info "ZoneEdit responded with a rate limit of..."
       ze_ratelimit=$(echo "$response" | sed -n 's/.*Minimum \([0-9]\+\) seconds.*/\1/p')
       if [ "$ze_ratelimit" ] && [ ! "$(echo "$ze_ratelimit" | tr -d '0-9')" ]; then
         _info "$ze_ratelimit seconds."

From 9526dbadad48811f39bdc566dd99336aaa71e04c Mon Sep 17 00:00:00 2001
From: peterv99 <_hidden_>
Date: Sat, 28 Dec 2024 17:26:52 +0100
Subject: [PATCH 135/174] mijn.host API unreliable, upped retry times to 15

---
 dnsapi/dns_mijnhost.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index 699436ef..b52d65d9 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -167,7 +167,7 @@ _mijnhost_rest() {
   ep="$2"
   data="$3"
 
-  MAX_REQUEST_RETRY_TIMES=5
+  MAX_REQUEST_RETRY_TIMES=15
   _request_retry_times=0
   _retry_sleep=5 #Initial sleep time in seconds.
 

From a3250fac6dd20734941acd5b3dddae2b80a7ea20 Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sat, 28 Dec 2024 22:31:24 +0200
Subject: [PATCH 136/174] dnsapi: Add structured info for lima-city and west.cn

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_limacity.sh | 18 +++++++++---------
 dnsapi/dns_west_cn.sh  | 14 +++++++++-----
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_limacity.sh b/dnsapi/dns_limacity.sh
index fb12f8c6..96bae77f 100644
--- a/dnsapi/dns_limacity.sh
+++ b/dnsapi/dns_limacity.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env sh
-
-# Created by Laraveluser
-#
-# Pass credentials before "acme.sh --issue --dns dns_limacity ..."
-# --
-# export LIMACITY_APIKEY="<API-KEY>"
-# --
-#
-# Pleas note: APIKEY must have following roles: dns.admin, domains.reader
+# shellcheck disable=SC2034
+dns_limacity_info='lima-city.de
+Site: www.lima-city.de/
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_limacity
+Options:
+ LIMACITY_APIKEY API Key. Note: The API Key must have following roles: dns.admin, domains.reader
+Issues: github.com/acmesh-official/acme.sh/issues/4758
+Author: @Laraveluser
+'
 
 ########  Public functions #####################
 
diff --git a/dnsapi/dns_west_cn.sh b/dnsapi/dns_west_cn.sh
index d0bb7d49..b873bfc0 100644
--- a/dnsapi/dns_west_cn.sh
+++ b/dnsapi/dns_west_cn.sh
@@ -1,9 +1,13 @@
 #!/usr/bin/env sh
-
-# West.cn Domain api
-#WEST_Username="username"
-#WEST_Key="sADDsdasdgdsf"
-#Set key at https://www.west.cn/manager/API/APIconfig.asp
+# shellcheck disable=SC2034
+dns_west_cn_info='West.cn
+Site: West.cn
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_west_cn
+Options:
+ WEST_Username API username
+ WEST_Key API Key. Set at https://www.west.cn/manager/API/APIconfig.asp
+Issues: github.com/acmesh-official/acme.sh/issues/4894
+'
 
 REST_API="https://api.west.cn/API/v2"
 

From 1ae7dd9b113513a24a6dcc7ef71ef6aa3943fa72 Mon Sep 17 00:00:00 2001
From: peterv99 <145142820+peterv99@users.noreply.github.com>
Date: Sun, 29 Dec 2024 09:30:48 +0100
Subject: [PATCH 137/174] Updated info block

---
 dnsapi/dns_mijnhost.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_mijnhost.sh b/dnsapi/dns_mijnhost.sh
index b52d65d9..9dafc702 100644
--- a/dnsapi/dns_mijnhost.sh
+++ b/dnsapi/dns_mijnhost.sh
@@ -4,6 +4,8 @@ dns_mijnhost_info='mijn.host
 Domains: mijn.host
 Site: mijn.host
 Docs: https://mijn.host/api/doc/
+Issues: https://github.com/acmesh-official/acme.sh/issues/6177
+Author: peterv99
 Options:
  MIJNHOST_API_KEY API Key
 '

From 4bb41cf88637a54ee530bee2df4c3ad819e47d2e Mon Sep 17 00:00:00 2001
From: 3VAbdAVE <dcollodel@outlook.com>
Date: Sun, 29 Dec 2024 12:52:09 -0500
Subject: [PATCH 138/174] Fixed bad variable.

---
 deploy/unifi.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/unifi.sh b/deploy/unifi.sh
index 706b24e8..3e57f198 100644
--- a/deploy/unifi.sh
+++ b/deploy/unifi.sh
@@ -209,7 +209,7 @@ unifi_deploy() {
       fi
     fi
 
-    cp "_unifi_keystore" "${_cloudkey_certdir}/unifi.keystore.jks"
+    cp "${_unifi_keystore}" "${_cloudkey_certdir}/unifi.keystore.jks"
 
     cat "$_cfullchain" >"${_cloudkey_certdir}/cloudkey.crt"
     cat "$_ckey" >"${_cloudkey_certdir}/cloudkey.key"

From 11de3aed51b42dcbbaeb64b099ce6f4930593b1a Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sun, 29 Dec 2024 13:59:08 +0200
Subject: [PATCH 139/174] dnsapi: structured info minor fixes

Extend dns_myapi.sh info with samples.
omglol: Split Address option by a dot to avoid incorrect parsing with a dot from omg.lol

Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
---
 dnsapi/dns_limacity.sh     |  2 +-
 dnsapi/dns_myapi.sh        | 10 ++++++----
 dnsapi/dns_omglol.sh       |  4 ++--
 dnsapi/dns_openprovider.sh |  1 +
 dnsapi/dns_pdns.sh         |  2 +-
 dnsapi/dns_yandex360.sh    |  2 +-
 6 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/dnsapi/dns_limacity.sh b/dnsapi/dns_limacity.sh
index 96bae77f..5734be9e 100644
--- a/dnsapi/dns_limacity.sh
+++ b/dnsapi/dns_limacity.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
 dns_limacity_info='lima-city.de
-Site: www.lima-city.de/
+Site: www.lima-city.de
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_limacity
 Options:
  LIMACITY_APIKEY API Key. Note: The API Key must have following roles: dns.admin, domains.reader
diff --git a/dnsapi/dns_myapi.sh b/dnsapi/dns_myapi.sh
index c9f5eb9f..101854d5 100755
--- a/dnsapi/dns_myapi.sh
+++ b/dnsapi/dns_myapi.sh
@@ -1,12 +1,14 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
 dns_myapi_info='Custom API Example
- A sample custom DNS API script.
-Domains: example.com
+ A sample custom DNS API script description.
+Domains: example.com example.net
 Site: github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
-Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_duckdns
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_myapi
 Options:
- MYAPI_Token API Token. Get API Token from https://example.com/api/. Optional.
+ MYAPI_Token API Token. Get API Token from https://example.com/api/
+ MYAPI_Variable2 Option 2. Default "default value".
+ MYAPI_Variable2 Option 3. Optional.
 Issues: github.com/acmesh-official/acme.sh
 Author: Neil Pang <neilgit@neilpang.com>
 '
diff --git a/dnsapi/dns_omglol.sh b/dnsapi/dns_omglol.sh
index 5c137c3f..df080bcf 100644
--- a/dnsapi/dns_omglol.sh
+++ b/dnsapi/dns_omglol.sh
@@ -4,8 +4,8 @@ dns_omglol_info='omg.lol
 Site: omg.lol
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_omglol
 Options:
- OMG_ApiKey API Key from omg.lol. This is accessible from the bottom of the account page at https://home.omg.lol/account
- OMG_Address This is your omg.lol address, without the preceding @ - you can see your list on your dashboard at https://home.omg.lol/dashboard
+ OMG_ApiKey API Key. This is accessible from the bottom of the account page at https://home.omg.lol/account
+ OMG_Address Address. This is your omg.lol address, without the preceding @ - you can see your list on your dashboard at https://home.omg.lol/dashboard
 Issues: github.com/acmesh-official/acme.sh/issues/5299
 Author: @Kholin <kholin+acme.omglolapi@omg.lol>
 '
diff --git a/dnsapi/dns_openprovider.sh b/dnsapi/dns_openprovider.sh
index b584fad2..2dec9934 100755
--- a/dnsapi/dns_openprovider.sh
+++ b/dnsapi/dns_openprovider.sh
@@ -2,6 +2,7 @@
 # shellcheck disable=SC2034
 dns_openprovider_info='OpenProvider.eu
 Site: OpenProvider.eu
+Domains: OpenProvider.com
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_openprovider
 Options:
  OPENPROVIDER_USER Username
diff --git a/dnsapi/dns_pdns.sh b/dnsapi/dns_pdns.sh
index 2478e19f..ec19ad25 100755
--- a/dnsapi/dns_pdns.sh
+++ b/dnsapi/dns_pdns.sh
@@ -7,7 +7,7 @@ Options:
  PDNS_Url API URL. E.g. "http://ns.example.com:8081"
  PDNS_ServerId Server ID. E.g. "localhost"
  PDNS_Token API Token
- PDNS_Ttl=60 Domain TTL. Default: "60".
+ PDNS_Ttl Domain TTL. Default: "60".
 '
 
 DEFAULT_PDNS_TTL=60
diff --git a/dnsapi/dns_yandex360.sh b/dnsapi/dns_yandex360.sh
index c6b6053d..18d01361 100644
--- a/dnsapi/dns_yandex360.sh
+++ b/dnsapi/dns_yandex360.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 # shellcheck disable=SC2034
 dns_yandex360_info='Yandex 360 for Business DNS API.
-Yandex 360 for Business is a digital environment for effective collaboration.
+ Yandex 360 for Business is a digital environment for effective collaboration.
 Site: https://360.yandex.com/
 Docs: https://github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_yandex360
 Options:

From d37553e7b88e154ee2a72c5991397eb26d3a9972 Mon Sep 17 00:00:00 2001
From: Ludovic Ortega <ludovic.ortega@adminafk.fr>
Date: Tue, 31 Dec 2024 18:04:39 +0100
Subject: [PATCH 140/174] fix: remove control characters

Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr>
---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 407395a3..6a008bd7 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -217,7 +217,7 @@ truenas_deploy() {
           _app_id=$(echo "$_app_id_list" | sed -n "${i}p")
           _app_config="$(_post "\"$_app_id\"" "$_api_url/app/config" "" "POST" "application/json")"
           # Check if the app use the same certificate TrueNAS web UI
-          _app_active_cert_config=$(echo "$_app_config" | _json_decode | jq -r ".ix_certificates[\"$_active_cert_id\"]")
+          _app_active_cert_config=$(echo "$_app_config" | tr -d '\000-\037' | _json_decode | jq -r ".ix_certificates[\"$_active_cert_id\"]")
           if [ "$_app_active_cert_config" != "null" ]; then
             _info "Updating certificate from $_active_cert_id to $_cert_id for app: $_app_id"
             #Replace the old certificate id with the new one in path

From 0241552c0d5475d10e8e1a4f455d3c247b25c0c3 Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Thu, 2 Jan 2025 00:26:47 +0100
Subject: [PATCH 141/174] update dns_cyon for updated field names and add
 validation

---
 dnsapi/dns_cyon.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 04a515aa..b5ab8369 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -232,7 +232,7 @@ _cyon_add_txt() {
   _info "  - Adding DNS TXT entry..."
 
   add_txt_url="https://my.cyon.ch/domain/dnseditor/add-record-async"
-  add_txt_data="zone=${fulldomain_idn}.&ttl=900&type=TXT&value=${txtvalue}"
+  add_txt_data="name=${fulldomain_idn}.&ttl=900&type=TXT&dnscontent=${txtvalue}"
 
   add_txt_response="$(_post "$add_txt_data" "$add_txt_url")"
   _debug add_txt_response "${add_txt_response}"
@@ -241,9 +241,10 @@ _cyon_add_txt() {
 
   add_txt_message="$(printf "%s" "${add_txt_response}" | _cyon_get_response_message)"
   add_txt_status="$(printf "%s" "${add_txt_response}" | _cyon_get_response_status)"
+  add_txt_validation="$(printf "%s" "${add_txt_response}" | _cyon_get_validation_status)"
 
   # Bail if adding TXT entry fails.
-  if [ "${add_txt_status}" != "true" ]; then
+  if [ "${add_txt_status}" != "true" ] || [ "${add_txt_validation}" != "true" ] ; then
     _err "    ${add_txt_message}"
     _err ""
     return 1
@@ -308,6 +309,10 @@ _cyon_get_response_status() {
   _egrep_o '"status":\w*' | cut -d : -f 2
 }
 
+_cyon_get_validation_status() {
+  _egrep_o '"valid":\w*' | cut -d : -f 2
+}
+
 _cyon_get_response_success() {
   _egrep_o '"onSuccess":"[^"]*"' | cut -d : -f 2 | tr -d '"'
 }

From 524b40b75ff46f875ddd754d4bdd0715b212b752 Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Thu, 2 Jan 2025 00:36:28 +0100
Subject: [PATCH 142/174] adhere to shell formatting

---
 dnsapi/dns_cyon.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index b5ab8369..9a95d317 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -244,7 +244,7 @@ _cyon_add_txt() {
   add_txt_validation="$(printf "%s" "${add_txt_response}" | _cyon_get_validation_status)"
 
   # Bail if adding TXT entry fails.
-  if [ "${add_txt_status}" != "true" ] || [ "${add_txt_validation}" != "true" ] ; then
+  if [ "${add_txt_status}" != "true" ] || [ "${add_txt_validation}" != "true" ]; then
     _err "    ${add_txt_message}"
     _err ""
     return 1

From 6328496bfb13716cd44b4371d1309fa71c49a452 Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Thu, 2 Jan 2025 00:41:59 +0100
Subject: [PATCH 143/174] run tests

---
 dnsapi/dns_cyon.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 9a95d317..5510bfc2 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -228,6 +228,7 @@ _cyon_change_domain_env() {
   _info ""
 }
 
+
 _cyon_add_txt() {
   _info "  - Adding DNS TXT entry..."
 

From 0e4fd5269b4b25ade954ce0648069e2c317f611c Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Thu, 2 Jan 2025 00:49:20 +0100
Subject: [PATCH 144/174] run tests

---
 dnsapi/dns_cyon.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 5510bfc2..9a95d317 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -228,7 +228,6 @@ _cyon_change_domain_env() {
   _info ""
 }
 
-
 _cyon_add_txt() {
   _info "  - Adding DNS TXT entry..."
 

From 04aefbf28da6ceb27a3cece5484fc0b2ecca9988 Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Fri, 3 Jan 2025 00:31:27 +0100
Subject: [PATCH 145/174] moved the env change check to its own function

---
 dnsapi/dns_cyon.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 9a95d317..175877c6 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -215,10 +215,8 @@ _cyon_change_domain_env() {
 
   if ! _cyon_check_if_2fa_missed "${domain_env_response}"; then return 1; fi
 
-  domain_env_success="$(printf "%s" "${domain_env_response}" | _egrep_o '"authenticated":\w*' | cut -d : -f 2)"
-
   # Bail if domain environment change fails.
-  if [ "${domain_env_success}" != "true" ]; then
+  if [ "$(printf "%s" "${domain_env_response}" | _cyon_get_envchange_success)" != "true" ]; then
     _err "    $(printf "%s" "${domain_env_response}" | _cyon_get_response_message)"
     _err ""
     return 1
@@ -317,6 +315,10 @@ _cyon_get_response_success() {
   _egrep_o '"onSuccess":"[^"]*"' | cut -d : -f 2 | tr -d '"'
 }
 
+_cyon_get_envchange_success() {
+  _egrep_o '"authenticated":\w*' | cut -d : -f 2
+}
+
 _cyon_check_if_2fa_missed() {
   # Did we miss the 2FA?
   if test "${1#*multi_factor_form}" != "${1}"; then

From b29d17f5228b15d1fae005adcf326a25b46c974d Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Fri, 3 Jan 2025 13:04:04 +0100
Subject: [PATCH 146/174] changed char class for compatibility with openbsd

---
 dnsapi/dns_cyon.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 175877c6..4b0dbfc0 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -216,7 +216,7 @@ _cyon_change_domain_env() {
   if ! _cyon_check_if_2fa_missed "${domain_env_response}"; then return 1; fi
 
   # Bail if domain environment change fails.
-  if [ "$(printf "%s" "${domain_env_response}" | _cyon_get_envchange_success)" != "true" ]; then
+  if [ "$(printf "%s" "${domain_env_response}" | _cyon_get_environment_change_status)" != "true" ]; then
     _err "    $(printf "%s" "${domain_env_response}" | _cyon_get_response_message)"
     _err ""
     return 1
@@ -315,8 +315,8 @@ _cyon_get_response_success() {
   _egrep_o '"onSuccess":"[^"]*"' | cut -d : -f 2 | tr -d '"'
 }
 
-_cyon_get_envchange_success() {
-  _egrep_o '"authenticated":\w*' | cut -d : -f 2
+_cyon_get_environment_change_status() {
+  _egrep_o '"authenticated":[a-zA-z0-9]*' | cut -d : -f 2
 }
 
 _cyon_check_if_2fa_missed() {

From 1b123054b36fe3acdad6f871ec6f9f8b30caba17 Mon Sep 17 00:00:00 2001
From: Markus Schenk <ms@theschenks.ch>
Date: Fri, 3 Jan 2025 13:08:18 +0100
Subject: [PATCH 147/174] also updated the other validation functions

---
 dnsapi/dns_cyon.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index 4b0dbfc0..a585e772 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -304,11 +304,11 @@ _cyon_get_response_message() {
 }
 
 _cyon_get_response_status() {
-  _egrep_o '"status":\w*' | cut -d : -f 2
+  _egrep_o '"status":[a-zA-z0-9]*' | cut -d : -f 2
 }
 
 _cyon_get_validation_status() {
-  _egrep_o '"valid":\w*' | cut -d : -f 2
+  _egrep_o '"valid":[a-zA-z0-9]*' | cut -d : -f 2
 }
 
 _cyon_get_response_success() {

From fef4574c3c4523b9c6c8ba4f6ea305cad6b8483f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <25136274+markkuleinio@users.noreply.github.com>
Date: Sat, 4 Jan 2025 21:34:14 +0200
Subject: [PATCH 148/174] Fix option description

---
 dnsapi/dns_he_ddns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
index 0893f938..7d56104c 100644
--- a/dnsapi/dns_he_ddns.sh
+++ b/dnsapi/dns_he_ddns.sh
@@ -4,7 +4,7 @@ dns_he_ddns_info='Hurricane Electric HE.net DDNS
 Site: dns.he.net
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_he_ddns
 Options:
- HE_DDNS_KEY The DDNS key for updating the TXT record
+ HE_DDNS_KEY The DDNS key
 Author: Markku Leiniö
 '
 

From 5610d4782fe0954d884943f3e1f205923344bc47 Mon Sep 17 00:00:00 2001
From: Jan-Piet Mens <jp@mens.de>
Date: Tue, 7 Jan 2025 13:13:27 +0100
Subject: [PATCH 149/174] Correct typo in acme.sh

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 9842e3f1..bcd6b928 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6061,7 +6061,7 @@ installcronjob() {
     _script="$(_readlink "$_SCRIPT_")"
     _debug _script "$_script"
     if [ -f "$_script" ]; then
-      _info "Usinging the current script from: $_script"
+      _info "Using the current script from: $_script"
       lesh="$_script"
     else
       _err "Cannot install cronjob, $PROJECT_ENTRY not found."

From 6a249ca1dd62d1e6b71acfe670f20443b4d30b79 Mon Sep 17 00:00:00 2001
From: Yann DEMOULIN <yann.demoulin@gmail.com>
Date: Tue, 7 Jan 2025 22:23:27 +0100
Subject: [PATCH 150/174] Create script for deploy certificate on Proxmox
 Backup Server

---
 deploy/proxmoxbs.sh | 120 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 120 insertions(+)
 create mode 100644 deploy/proxmoxbs.sh

diff --git a/deploy/proxmoxbs.sh b/deploy/proxmoxbs.sh
new file mode 100644
index 00000000..d1146454
--- /dev/null
+++ b/deploy/proxmoxbs.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env sh
+
+# Deploy certificates to a proxmox backup server using the API.
+#
+# Environment variables that can be set are:
+# `DEPLOY_PROXMOXBS_SERVER`: The hostname of the proxmox backup server. Defaults to
+#                            _cdomain.
+# `DEPLOY_PROXMOXBS_SERVER_PORT`: The port number the management interface is on.
+#                                 Defaults to 8007.
+# `DEPLOY_PROXMOXBS_USER`: The user we'll connect as. Defaults to root.
+# `DEPLOY_PROXMOXBS_USER_REALM`: The authentication realm the user authenticates
+#                                with. Defaults to pam.
+# `DEPLOY_PROXMOXBS_API_TOKEN_NAME`: The name of the API token created for the
+#                                    user account. Defaults to acme.
+# `DEPLOY_PROXMOXBS_API_TOKEN_KEY`: The API token. Required.
+
+proxmoxbs_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug2 _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  # "Sane" defaults.
+  _getdeployconf DEPLOY_PROXMOXBS_SERVER
+  if [ -z "$DEPLOY_PROXMOXBS_SERVER" ]; then
+    _target_hostname="$_cdomain"
+  else
+    _target_hostname="$DEPLOY_PROXMOXBS_SERVER"
+    _savedeployconf DEPLOY_PROXMOXBS_SERVER "$DEPLOY_PROXMOXBS_SERVER"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_SERVER "$_target_hostname"
+
+  _getdeployconf DEPLOY_PROXMOXBS_SERVER_PORT
+  if [ -z "$DEPLOY_PROXMOXBS_SERVER_PORT" ]; then
+    _target_port="8007"
+  else
+    _target_port="$DEPLOY_PROXMOXBS_SERVER_PORT"
+    _savedeployconf DEPLOY_PROXMOXBS_SERVER_PORT "$DEPLOY_PROXMOXBS_SERVER_PORT"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_SERVER_PORT "$_target_port"
+
+  # Complete URL.
+  _target_url="https://${_target_hostname}:${_target_port}/api2/json/nodes/localhost/certificates/custom"
+  _debug TARGET_URL "$_target_url"
+
+  # More "sane" defaults.
+  _getdeployconf DEPLOY_PROXMOXBS_USER
+  if [ -z "$DEPLOY_PROXMOXBS_USER" ]; then
+    _proxmoxbs_user="root"
+  else
+    _proxmoxbs_user="$DEPLOY_PROXMOXBS_USER"
+    _savedeployconf DEPLOY_PROXMOXBS_USER "$DEPLOY_PROXMOXBS_USER"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_USER "$_proxmoxbs_user"
+
+  _getdeployconf DEPLOY_PROXMOXBS_USER_REALM
+  if [ -z "$DEPLOY_PROXMOXBS_USER_REALM" ]; then
+    _proxmoxbs_user_realm="pam"
+  else
+    _proxmoxbs_user_realm="$DEPLOY_PROXMOXBS_USER_REALM"
+    _savedeployconf DEPLOY_PROXMOXBS_USER_REALM "$DEPLOY_PROXMOXBS_USER_REALM"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_USER_REALM "$_proxmoxbs_user_realm"
+
+  _getdeployconf DEPLOY_PROXMOXBS_API_TOKEN_NAME
+  if [ -z "$DEPLOY_PROXMOXBS_API_TOKEN_NAME" ]; then
+    _proxmoxbs_api_token_name="acme"
+  else
+    _proxmoxbs_api_token_name="$DEPLOY_PROXMOXBS_API_TOKEN_NAME"
+    _savedeployconf DEPLOY_PROXMOXBS_API_TOKEN_NAME "$DEPLOY_PROXMOXBS_API_TOKEN_NAME"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_API_TOKEN_NAME "$_proxmoxbs_api_token_name"
+
+  # This is required.
+  _getdeployconf DEPLOY_PROXMOXBS_API_TOKEN_KEY
+  if [ -z "$DEPLOY_PROXMOXBS_API_TOKEN_KEY" ]; then
+    _err "API key not provided."
+    return 1
+  else
+    _proxmoxbs_api_token_key="$DEPLOY_PROXMOXBS_API_TOKEN_KEY"
+    _savedeployconf DEPLOY_PROXMOXBS_API_TOKEN_KEY "$DEPLOY_PROXMOXBS_API_TOKEN_KEY"
+  fi
+  _debug2 DEPLOY_PROXMOXBS_API_TOKEN_KEY "$_proxmoxbs_api_token_key"
+
+  # PBS API Token header value. Used in "Authorization: PBSAPIToken".
+  _proxmoxbs_header_api_token="${_proxmoxbs_user}@${_proxmoxbs_user_realm}!${_proxmoxbs_api_token_name}:${_proxmoxbs_api_token_key}"
+  _debug2 "Auth Header" "$_proxmoxbs_header_api_token"
+
+  # Ugly. I hate putting heredocs inside functions because heredocs don't
+  # account for whitespace correctly but it _does_ work and is several times
+  # cleaner than anything else I had here.
+  #
+  # This dumps the json payload to a variable that should be passable to the
+  # _psot function.
+  _json_payload=$(
+    cat <<HEREDOC
+{
+  "certificates": "$(tr '\n' ':' <"$_cfullchain" | sed 's/:/\\n/g')",
+  "key": "$(tr '\n' ':' <"$_ckey" | sed 's/:/\\n/g')",
+  "node":"localhost",
+  "restart":true,
+  "force":true
+}
+HEREDOC
+  )
+  _debug2 Payload "$_json_payload"
+
+  _info "Push certificates to server"
+  export HTTPS_INSECURE=1
+  export _H1="Authorization: PBSAPIToken=${_proxmoxbs_header_api_token}"
+  _post "$_json_payload" "$_target_url" "" POST "application/json"
+
+}

From b826123d987d96c4b94ab18c4ce951f077e1406e Mon Sep 17 00:00:00 2001
From: Geert Hendrickx <geert@hendrickx.be>
Date: Fri, 10 Jan 2025 12:39:30 +0100
Subject: [PATCH 151/174] Portability: use `uname -n` instead of `hostname`.
 `hostname` is not available by default on some modern Linux distributions
 (eg. Arch Linux), whereas `uname -n` is defined by POSIX, so guaranteed.

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 9842e3f1..23bd9bc0 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6813,7 +6813,7 @@ _send_notify() {
 
   _nsource="$NOTIFY_SOURCE"
   if [ -z "$_nsource" ]; then
-    _nsource="$(hostname)"
+    _nsource="$(uname -n)"
   fi
 
   _nsubject="$_nsubject by $_nsource"

From 6c555cb6663ff5903af9ae7149813c8095335206 Mon Sep 17 00:00:00 2001
From: Lindsay Zhou <i@lin.moe>
Date: Mon, 13 Jan 2025 10:22:46 +0800
Subject: [PATCH 152/174] fix regex of matching hetzner dns api error responses

---
 dnsapi/dns_hetzner.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100644 => 100755 dnsapi/dns_hetzner.sh

diff --git a/dnsapi/dns_hetzner.sh b/dnsapi/dns_hetzner.sh
old mode 100644
new mode 100755
index 5a9cf2d9..f1bddc61
--- a/dnsapi/dns_hetzner.sh
+++ b/dnsapi/dns_hetzner.sh
@@ -212,7 +212,7 @@ _get_root() {
 _response_has_error() {
   unset _response_error
 
-  err_part="$(echo "$response" | _egrep_o '"error":{[^}]*}')"
+  err_part="$(echo "$response" | _egrep_o '"error":\{[^\}]*\}')"
 
   if [ -n "$err_part" ]; then
     err_code=$(echo "$err_part" | _egrep_o '"code":[0-9]+' | cut -d : -f 2)

From 077868604d275b9051baa8f27f2a66654e4f0785 Mon Sep 17 00:00:00 2001
From: ARNik <arnik@arnik.ru>
Date: Wed, 15 Jan 2025 09:40:31 +0300
Subject: [PATCH 153/174] dnsapi: Add Beget.com DNS API

---
 dnsapi/dns_beget.sh | 225 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 225 insertions(+)
 create mode 100755 dnsapi/dns_beget.sh

diff --git a/dnsapi/dns_beget.sh b/dnsapi/dns_beget.sh
new file mode 100755
index 00000000..2df41e2e
--- /dev/null
+++ b/dnsapi/dns_beget.sh
@@ -0,0 +1,225 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_beget_info='Beget.com
+Site: Beget.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_beget
+Options:
+ BEGET_User API user
+ BEGET_Password API password
+Issues: github.com/acmesh-official/acme.sh/issues/6200
+Author: ARNik arnik@arnik.ru
+'
+
+Beget_Api="https://api.beget.com/api"
+
+########  Public functions #####################
+
+# Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+dns_beget_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug "dns_beget_add $fulldomain $txtvalue"
+
+  Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
+  Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"
+
+  if [ -z "$Beget_Username" ] || [ -z "$Beget_Password" ]; then
+    Beget_Username=""
+    Beget_Password=""
+    _err "You must export variables: Beget_Username, and Beget_Password"
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable Beget_Username "$Beget_Username"
+  _saveaccountconf_mutable Beget_Password "$Beget_Password"
+
+  _info "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  if [ -n "$_sub_domain" ]; then
+    _debug "Create subdomen for the record"
+    data="{\"subdomain\":\"$_sub_domain\",\"domain_id\":$_domain_id}"
+    res=$(_api_call "$Beget_Api/domain/addSubdomainVirtual" "$data")
+
+    if _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":[0-9]*}}$"; then
+      _debug "Cleanup subdomen records"
+      data="{\"fqdn\":\"$fulldomain\",\"records\":{}}"
+      res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+      data="{\"fqdn\":\"www.$fulldomain\",\"records\":{}}"
+      res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+    fi
+  fi
+
+  _info "Get current domain records"
+  data="{\"fqdn\":\"$fulldomain\"}"
+  res=$(_api_call "$Beget_Api/dns/getData" "$data")
+
+  if ! _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":{.*}}}$"; then
+    _err "Can't get domain records."
+    return 1
+  fi
+
+  _info "Add new TXT record"
+  data="{\"fqdn\":\"$fulldomain\",\"records\":{"
+  data=${data}$(_parce_records "$res" "A")
+  data=${data}$(_parce_records "$res" "AAAA")
+  data=${data}$(_parce_records "$res" "CAA")
+  data=${data}$(_parce_records "$res" "MX")
+  data=${data}$(_parce_records "$res" "SRV")
+  data=${data}$(_parce_records "$res" "TXT")
+  data=$(echo "$data" | sed 's/,$//')
+  data=${data}'}}'
+
+  str=$(_txt_to_dns_json "$txtvalue")
+  data=$(_add_record "$data" "TXT" "$str")
+
+  res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+
+  return 0
+}
+
+# Usage: fulldomain txtvalue
+# Used to remove the txt record after validation
+dns_beget_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug "dns_beget_rm $fulldomain $txtvalue"
+
+  Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
+  Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"
+
+  _info "Get current domain records"
+  data="{\"fqdn\":\"$fulldomain\"}"
+  res=$(_api_call "$Beget_Api/dns/getData" "$data")
+
+  if ! _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":{.*}}}$"; then
+    _err Can\'t get domain records.
+    return 1
+  fi
+
+  _info "Remove TXT record"
+  data="{\"fqdn\":\"$fulldomain\",\"records\":{"
+  data=${data}$(_parce_records "$res" "A")
+  data=${data}$(_parce_records "$res" "AAAA")
+  data=${data}$(_parce_records "$res" "CAA")
+  data=${data}$(_parce_records "$res" "MX")
+  data=${data}$(_parce_records "$res" "SRV")
+  data=${data}$(_parce_records "$res" "TXT")
+  data=$(echo "$data" | sed 's/,$//')
+  data=${data}'}}'
+
+  str=$(_txt_to_dns_json "$txtvalue")
+  data=$(_rm_record "$data" "$str")
+
+  res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+
+  return 0
+}
+
+####################  Private functions below ##################################
+
+# Usage: _get_root _acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=32436365
+_get_root() {
+  fulldomain=$1
+  i=1
+  p=1
+
+  _debug "Request domain list"
+  res=$(_api_call "$Beget_Api/domain/getList")
+
+  while true; do
+    h=$(printf "%s" "$fulldomain" | cut -d . -f "$i"-100)
+    _debug h "$h"
+
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if _contains "$res" "$h"; then
+      _domain_id=$(echo "$res" | _egrep_o "\"id\":[0-9]*,\"fqdn\":\"$h\"" | cut -d , -f1 | cut -d : -f2)
+      if [ "$_domain_id" ]; then
+        if [ "$h" != "$fulldomain" ]; then
+          _sub_domain=$(echo "$fulldomain" | cut -d . -f 1-"$p")
+        else
+          _sub_domain=""
+        fi
+        _domain=$h
+        return 0
+      fi
+      return 1
+    fi
+    p="$i"
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+# Parce DNS records from json string
+# Usage: _parce_records [j_str] [record_name]
+_parce_records() {
+  j_str=$1
+  record_name=$2
+  res="\"$record_name\":["
+  res=${res}$(echo "$j_str" | _egrep_o "\"$record_name\":\[.*" | cut -d '[' -f2 | cut -d ']' -f1)
+  res=${res}"],"
+  echo "$res"
+}
+
+# Usage: _add_record [data] [record_name] [record_data]
+_add_record() {
+  data=$1
+  record_name=$2
+  record_data=$3
+  echo "$data" | sed "s/\"$record_name\":\[/\"$record_name\":\[$record_data,/" | sed "s/,\]/\]/"
+}
+
+# Usage: _rm_record [data] [record_data]
+_rm_record() {
+  data=$1
+  record_data=$2
+  echo "$data" | sed "s/$record_data,//" | sed "s/,$record_data//" | sed "s/$record_data//"
+}
+
+_txt_to_dns_json() {
+  echo "{\"ttl\":600,\"txtdata\":\"$1\"}"
+}
+
+# Usage: _api_call [api_url] [input_data]
+_api_call() {
+  api_url="$1"
+  input_data="$2"
+
+  _debug "_api_call $api_url"
+  _debug "Request: $input_data"
+
+  # res=$(curl -s -L -D ./http.header \
+  # "$api_url" \
+  # --data-urlencode login=$Beget_Username \
+  # --data-urlencode passwd=$Beget_Password \
+  # --data-urlencode input_format=json \
+  # --data-urlencode output_format=json \
+  # --data-urlencode "input_data=$input_data")
+
+  url="$api_url?login=$Beget_Username&passwd=$Beget_Password&input_format=json&output_format=json"
+  if [ -n "$input_data" ]; then
+    url=${url}"&input_data="
+    url=${url}$(echo "$input_data" | _url_encode)
+  fi
+
+  res=$(_get "$url")
+
+  _debug "Reply: $res"
+  echo "$res"
+}

From 66dd51a09a0baadcf4f481a28e58c17881cff6ae Mon Sep 17 00:00:00 2001
From: ARNik <arnik@arnik.ru>
Date: Thu, 16 Jan 2025 16:28:12 +0300
Subject: [PATCH 154/174] dnsapi: check Beget.com API replies

---
 dnsapi/dns_beget.sh | 40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/dnsapi/dns_beget.sh b/dnsapi/dns_beget.sh
index 2df41e2e..3e738e3f 100755
--- a/dnsapi/dns_beget.sh
+++ b/dnsapi/dns_beget.sh
@@ -19,7 +19,7 @@ Beget_Api="https://api.beget.com/api"
 dns_beget_add() {
   fulldomain=$1
   txtvalue=$2
-  _debug "dns_beget_add $fulldomain $txtvalue"
+  _debug "dns_beget_add() $fulldomain $txtvalue"
 
   Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
   Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"
@@ -49,20 +49,27 @@ dns_beget_add() {
     data="{\"subdomain\":\"$_sub_domain\",\"domain_id\":$_domain_id}"
     res=$(_api_call "$Beget_Api/domain/addSubdomainVirtual" "$data")
 
-    if _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":[0-9]*}}$"; then
+    if _is_api_reply_ok "$res"; then
       _debug "Cleanup subdomen records"
       data="{\"fqdn\":\"$fulldomain\",\"records\":{}}"
       res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+      if ! _is_api_reply_ok "$res"; then
+        _err "Can't cleanup subdomain records."
+        return 1
+      fi
       data="{\"fqdn\":\"www.$fulldomain\",\"records\":{}}"
       res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+      if ! _is_api_reply_ok "$res"; then
+        _err "Can't cleanup subdomain records."
+        return 1
+      fi
     fi
   fi
 
   _info "Get current domain records"
   data="{\"fqdn\":\"$fulldomain\"}"
   res=$(_api_call "$Beget_Api/dns/getData" "$data")
-
-  if ! _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":{.*}}}$"; then
+  if ! _is_api_reply_ok "$res"; then
     _err "Can't get domain records."
     return 1
   fi
@@ -82,6 +89,10 @@ dns_beget_add() {
   data=$(_add_record "$data" "TXT" "$str")
 
   res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't change domain records."
+    return 1
+  fi
 
   return 0
 }
@@ -91,7 +102,7 @@ dns_beget_add() {
 dns_beget_rm() {
   fulldomain=$1
   txtvalue=$2
-  _debug "dns_beget_rm $fulldomain $txtvalue"
+  _debug "dns_beget_rm() $fulldomain $txtvalue"
 
   Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
   Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"
@@ -99,9 +110,8 @@ dns_beget_rm() {
   _info "Get current domain records"
   data="{\"fqdn\":\"$fulldomain\"}"
   res=$(_api_call "$Beget_Api/dns/getData" "$data")
-
-  if ! _contains "$res" "^{\"status\":\"success\",\"answer\":{\"status\":\"success\",\"result\":{.*}}}$"; then
-    _err Can\'t get domain records.
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't get domain records."
     return 1
   fi
 
@@ -120,6 +130,10 @@ dns_beget_rm() {
   data=$(_rm_record "$data" "$str")
 
   res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't change domain records."
+    return 1
+  fi
 
   return 0
 }
@@ -138,6 +152,10 @@ _get_root() {
 
   _debug "Request domain list"
   res=$(_api_call "$Beget_Api/domain/getList")
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't get domain list."
+    return 1
+  fi
 
   while true; do
     h=$(printf "%s" "$fulldomain" | cut -d . -f "$i"-100)
@@ -217,9 +235,13 @@ _api_call() {
     url=${url}"&input_data="
     url=${url}$(echo "$input_data" | _url_encode)
   fi
-
   res=$(_get "$url")
 
   _debug "Reply: $res"
   echo "$res"
 }
+
+# Usage: _is_api_reply_ok [api_reply]
+_is_api_reply_ok() {
+  _contains "$1" '^{"status":"success","answer":{"status":"success","result":.*}}$'
+}

From 2fef0ebea83a792f437123fd90128d3192d240c8 Mon Sep 17 00:00:00 2001
From: ARNik <arnik@arnik.ru>
Date: Thu, 16 Jan 2025 20:14:07 +0300
Subject: [PATCH 155/174] dnsapi: Beget.com subdomain preparation rework

---
 dnsapi/dns_beget.sh | 94 ++++++++++++++++++++++++++++++---------------
 1 file changed, 62 insertions(+), 32 deletions(-)

diff --git a/dnsapi/dns_beget.sh b/dnsapi/dns_beget.sh
index 3e738e3f..0213e3ef 100755
--- a/dnsapi/dns_beget.sh
+++ b/dnsapi/dns_beget.sh
@@ -12,7 +12,7 @@ Author: ARNik arnik@arnik.ru
 
 Beget_Api="https://api.beget.com/api"
 
-########  Public functions #####################
+####################  Public functions ####################
 
 # Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 # Used to add txt record
@@ -35,38 +35,13 @@ dns_beget_add() {
   _saveaccountconf_mutable Beget_Username "$Beget_Username"
   _saveaccountconf_mutable Beget_Password "$Beget_Password"
 
-  _info "First detect the root zone"
-  if ! _get_root "$fulldomain"; then
-    _err "invalid domain"
+  _info "Prepare subdomain."
+  if ! _prepare_subdomain "$fulldomain"; then
+    _err "Can't prepare subdomain."
     return 1
   fi
-  _debug _domain_id "$_domain_id"
-  _debug _sub_domain "$_sub_domain"
-  _debug _domain "$_domain"
 
-  if [ -n "$_sub_domain" ]; then
-    _debug "Create subdomen for the record"
-    data="{\"subdomain\":\"$_sub_domain\",\"domain_id\":$_domain_id}"
-    res=$(_api_call "$Beget_Api/domain/addSubdomainVirtual" "$data")
-
-    if _is_api_reply_ok "$res"; then
-      _debug "Cleanup subdomen records"
-      data="{\"fqdn\":\"$fulldomain\",\"records\":{}}"
-      res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
-      if ! _is_api_reply_ok "$res"; then
-        _err "Can't cleanup subdomain records."
-        return 1
-      fi
-      data="{\"fqdn\":\"www.$fulldomain\",\"records\":{}}"
-      res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
-      if ! _is_api_reply_ok "$res"; then
-        _err "Can't cleanup subdomain records."
-        return 1
-      fi
-    fi
-  fi
-
-  _info "Get current domain records"
+  _info "Get domain records"
   data="{\"fqdn\":\"$fulldomain\"}"
   res=$(_api_call "$Beget_Api/dns/getData" "$data")
   if ! _is_api_reply_ok "$res"; then
@@ -138,7 +113,62 @@ dns_beget_rm() {
   return 0
 }
 
-####################  Private functions below ##################################
+####################  Private functions below ####################
+
+# Create subdomain if needed
+# Usage: _prepare_subdomain [fulldomain]
+_prepare_subdomain() {
+  fulldomain=$1
+
+  _info "Detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  if [ -z "$_sub_domain" ]; then
+    _debug "$fulldomain is a root domain."
+    return 0
+  fi
+
+  _info "Get subdomain list"
+  res=$(_api_call "$Beget_Api/domain/getSubdomainList")
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't get subdomain list."
+    return 1
+  fi
+
+  if _contains "$res" "\"fqdn\":\"$fulldomain\""; then
+    _debug "Subdomain $fulldomain already exist."
+    return 0
+  fi
+
+  _info "Subdomain $fulldomain does not exist. Let's create one."
+  data="{\"subdomain\":\"$_sub_domain\",\"domain_id\":$_domain_id}"
+  res=$(_api_call "$Beget_Api/domain/addSubdomainVirtual" "$data")
+  if ! _is_api_reply_ok "$res"; then
+    _err "Can't create subdomain."
+    return 1
+  fi
+
+  _debug "Cleanup subdomen records"
+  data="{\"fqdn\":\"$fulldomain\",\"records\":{}}"
+  res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+  if ! _is_api_reply_ok "$res"; then
+    _debug "Can't cleanup $fulldomain records."
+  fi
+
+  data="{\"fqdn\":\"www.$fulldomain\",\"records\":{}}"
+  res=$(_api_call "$Beget_Api/dns/changeRecords" "$data")
+  if ! _is_api_reply_ok "$res"; then
+    _debug "Can't cleanup www.$fulldomain records."
+  fi
+
+  return 0
+}
 
 # Usage: _get_root _acme-challenge.www.domain.com
 #returns
@@ -150,7 +180,7 @@ _get_root() {
   i=1
   p=1
 
-  _debug "Request domain list"
+  _debug "Get domain list"
   res=$(_api_call "$Beget_Api/domain/getList")
   if ! _is_api_reply_ok "$res"; then
     _err "Can't get domain list."

From aa6feb4b62b269c335e15a19ef65ab42dcd6a6be Mon Sep 17 00:00:00 2001
From: ARNik <arnik@arnik.ru>
Date: Thu, 16 Jan 2025 19:25:56 +0300
Subject: [PATCH 156/174] dnsapi: Beget.com fix rm record

---
 dnsapi/dns_beget.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_beget.sh b/dnsapi/dns_beget.sh
index 0213e3ef..e570fa10 100755
--- a/dnsapi/dns_beget.sh
+++ b/dnsapi/dns_beget.sh
@@ -237,7 +237,9 @@ _add_record() {
 _rm_record() {
   data=$1
   record_data=$2
-  echo "$data" | sed "s/$record_data,//" | sed "s/,$record_data//" | sed "s/$record_data//"
+  echo "$data" | sed "s/$record_data//g" | sed "s/,\+/,/g" |
+    sed "s/{,/{/g" | sed "s/,}/}/g" |
+    sed "s/\[,/\[/g" | sed "s/,\]/\]/g"
 }
 
 _txt_to_dns_json() {

From 26a5d48f634a49036a4de6e1a78962fa066179a9 Mon Sep 17 00:00:00 2001
From: ARNik <arnik@arnik.ru>
Date: Thu, 16 Jan 2025 21:49:31 +0300
Subject: [PATCH 157/174] dnsapi: Beget.com fix case-sensitive domain names

---
 dnsapi/dns_beget.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_beget.sh b/dnsapi/dns_beget.sh
index e570fa10..aa43caed 100755
--- a/dnsapi/dns_beget.sh
+++ b/dnsapi/dns_beget.sh
@@ -20,6 +20,7 @@ dns_beget_add() {
   fulldomain=$1
   txtvalue=$2
   _debug "dns_beget_add() $fulldomain $txtvalue"
+  fulldomain=$(echo "$fulldomain" | _lower_case)
 
   Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
   Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"
@@ -78,6 +79,7 @@ dns_beget_rm() {
   fulldomain=$1
   txtvalue=$2
   _debug "dns_beget_rm() $fulldomain $txtvalue"
+  fulldomain=$(echo "$fulldomain" | _lower_case)
 
   Beget_Username="${Beget_Username:-$(_readaccountconf_mutable Beget_Username)}"
   Beget_Password="${Beget_Password:-$(_readaccountconf_mutable Beget_Password)}"

From 6dbe49089e2ed8e53d5110c528e2f7099c968b3c Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sat, 25 Jan 2025 21:00:25 +0100
Subject: [PATCH 158/174] minor

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2ad50e6a..3f400283 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,11 +15,11 @@ RUN apk --no-cache add -f \
   jq \
   cronie
 
-ENV LE_CONFIG_HOME /acme.sh
+ENV LE_CONFIG_HOME=/acme.sh
 
 ARG AUTO_UPGRADE=1
 
-ENV AUTO_UPGRADE $AUTO_UPGRADE
+ENV AUTO_UPGRADE=$AUTO_UPGRADE
 
 #Install
 COPY ./ /install_acme.sh/

From def41a787899098eb014b669ca56116b2fd2ad76 Mon Sep 17 00:00:00 2001
From: David Ha <davidha@users.noreply.github.com>
Date: Sun, 9 Feb 2025 22:56:46 +0000
Subject: [PATCH 159/174] Fix bug saving SYNO_LOCAL_HOSTNAME

Exporting SYNO_LOCAL_HOSTNAME=1 only works on the first deploy invocation. Subsequent deploys using the saved config fails because it saves $SYNO_HOSTNAME instead of $SYNO_LOCAL_HOSTNAME.
---
 deploy/synology_dsm.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 0d01e199..5ea48ca1 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -186,7 +186,7 @@ synology_dsm_deploy() {
       if [ -n "$SYNO_USE_TEMP_ADMIN" ]; then
         _getdeployconf SYNO_LOCAL_HOSTNAME
         _debug SYNO_LOCAL_HOSTNAME "${SYNO_LOCAL_HOSTNAME:-}"
-        if [ "$SYNO_LOCAL_HOSTNAME" != "1" ] && [ "$SYNO_LOCAL_HOSTNAME" == "$SYNO_HOSTNAME" ]; then
+        if [ "$SYNO_LOCAL_HOSTNAME" != "1" ]; then
           if [ "$SYNO_HOSTNAME" != "localhost" ] && [ "$SYNO_HOSTNAME" != "127.0.0.1" ]; then
             _err "SYNO_USE_TEMP_ADMIN=1 only support local deployment, though if you are sure that the hostname $SYNO_HOSTNAME is targeting to your **current local machine**, execute 'export SYNO_LOCAL_HOSTNAME=1' then rerun."
             return 1
@@ -320,7 +320,7 @@ synology_dsm_deploy() {
     _cleardeployconf SYNO_DEVICE_ID
     _cleardeployconf SYNO_DEVICE_NAME
     _savedeployconf SYNO_USE_TEMP_ADMIN "$SYNO_USE_TEMP_ADMIN"
-    _savedeployconf SYNO_LOCAL_HOSTNAME "$SYNO_HOSTNAME"
+    _savedeployconf SYNO_LOCAL_HOSTNAME "$SYNO_LOCAL_HOSTNAME"
   else
     _savedeployconf SYNO_USERNAME "$SYNO_USERNAME"
     _savedeployconf SYNO_PASSWORD "$SYNO_PASSWORD"

From 899da0c6ea0fabd0709f185ef1dd3ee880bf2068 Mon Sep 17 00:00:00 2001
From: David Ha <davidha@users.noreply.github.com>
Date: Sun, 9 Feb 2025 23:43:55 +0000
Subject: [PATCH 160/174] Update synology_dsm.sh

fix check logic
---
 deploy/synology_dsm.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 5ea48ca1..0c3dfb95 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -186,8 +186,8 @@ synology_dsm_deploy() {
       if [ -n "$SYNO_USE_TEMP_ADMIN" ]; then
         _getdeployconf SYNO_LOCAL_HOSTNAME
         _debug SYNO_LOCAL_HOSTNAME "${SYNO_LOCAL_HOSTNAME:-}"
-        if [ "$SYNO_LOCAL_HOSTNAME" != "1" ]; then
-          if [ "$SYNO_HOSTNAME" != "localhost" ] && [ "$SYNO_HOSTNAME" != "127.0.0.1" ]; then
+        if [ "$SYNO_HOSTNAME" != "localhost" ] && [ "$SYNO_HOSTNAME" != "127.0.0.1" ]; then
+          if [ "$SYNO_LOCAL_HOSTNAME" != "1" ]; then
             _err "SYNO_USE_TEMP_ADMIN=1 only support local deployment, though if you are sure that the hostname $SYNO_HOSTNAME is targeting to your **current local machine**, execute 'export SYNO_LOCAL_HOSTNAME=1' then rerun."
             return 1
           fi

From b2eb70439489ada91988276d6cbf2f116b2aac36 Mon Sep 17 00:00:00 2001
From: tomo <49612544+tomo2403@users.noreply.github.com>
Date: Sat, 15 Feb 2025 15:16:52 +0100
Subject: [PATCH 161/174] allowed deploying of pfx cert

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 9842e3f1..1f3b9c93 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5818,7 +5818,7 @@ _deploy() {
         return 1
       fi
 
-      if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
+      if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH" "$CERT_PFX_PATH"; then
         _err "Error deploying for domain: $_d"
         return 1
       fi

From 7f19f8cf0ec8bb151e99a33e86ccfa15066734e8 Mon Sep 17 00:00:00 2001
From: tomo <49612544+tomo2403@users.noreply.github.com>
Date: Sat, 15 Feb 2025 15:18:10 +0100
Subject: [PATCH 162/174] implemented deploying pfx to docker container

---
 deploy/docker.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/deploy/docker.sh b/deploy/docker.sh
index c9815d5b..264963ae 100755
--- a/deploy/docker.sh
+++ b/deploy/docker.sh
@@ -18,6 +18,7 @@ docker_deploy() {
   _ccert="$3"
   _cca="$4"
   _cfullchain="$5"
+  _cpfx="$6"
   _debug _cdomain "$_cdomain"
   _getdeployconf DEPLOY_DOCKER_CONTAINER_LABEL
   _debug2 DEPLOY_DOCKER_CONTAINER_LABEL "$DEPLOY_DOCKER_CONTAINER_LABEL"
@@ -88,6 +89,12 @@ docker_deploy() {
     _savedeployconf DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE"
   fi
 
+  _getdeployconf DEPLOY_DOCKER_CONTAINER_PFX_FILE
+  _debug2 DEPLOY_DOCKER_CONTAINER_PFX_FILE "$DEPLOY_DOCKER_CONTAINER_PFX_FILE"
+  if [ "$DEPLOY_DOCKER_CONTAINER_PFX_FILE" ]; then
+    _savedeployconf DEPLOY_DOCKER_CONTAINER_PFX_FILE "$DEPLOY_DOCKER_CONTAINER_PFX_FILE"
+  fi
+
   _getdeployconf DEPLOY_DOCKER_CONTAINER_RELOAD_CMD
   _debug2 DEPLOY_DOCKER_CONTAINER_RELOAD_CMD "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
   if [ "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD" ]; then
@@ -125,6 +132,12 @@ docker_deploy() {
     fi
   fi
 
+  if [ "$DEPLOY_DOCKER_CONTAINER_PFX_FILE" ]; then
+    if ! _docker_cp "$_cid" "$_cpfx" "$DEPLOY_DOCKER_CONTAINER_PFX_FILE"; then
+      return 1
+    fi
+  fi
+
   if [ "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD" ]; then
     _info "Reloading: $DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
     if ! _docker_exec "$_cid" "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"; then

From 449c542d5ae2d5fd8a5938a60d0d3a6e1376867d Mon Sep 17 00:00:00 2001
From: tomo <49612544+tomo2403@users.noreply.github.com>
Date: Sat, 15 Feb 2025 17:16:07 +0100
Subject: [PATCH 163/174] fixed env warning while building

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2ad50e6a..3f400283 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,11 +15,11 @@ RUN apk --no-cache add -f \
   jq \
   cronie
 
-ENV LE_CONFIG_HOME /acme.sh
+ENV LE_CONFIG_HOME=/acme.sh
 
 ARG AUTO_UPGRADE=1
 
-ENV AUTO_UPGRADE $AUTO_UPGRADE
+ENV AUTO_UPGRADE=$AUTO_UPGRADE
 
 #Install
 COPY ./ /install_acme.sh/

From 091c1f7ef10db6fa6401cc8fb416dbca275edccb Mon Sep 17 00:00:00 2001
From: Scruel Tao <me@scruel.com>
Date: Thu, 20 Feb 2025 17:16:23 +0800
Subject: [PATCH 164/174] chore(synology): remove personal mail

---
 deploy/synology_dsm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 0c3dfb95..3bfc9b02 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -411,7 +411,7 @@ _temp_admin_create() {
   _username="$1"
   _password="$2"
   synouser --del "$_username" >/dev/null 2>/dev/null
-  synouser --add "$_username" "$_password" "" 0 "scruelt@hotmail.com" 0 >/dev/null
+  synouser --add "$_username" "$_password" "" 0 "" 0 >/dev/null
 }
 
 _temp_admin_cleanup() {

From 1d628bcf9e50a45089a33833dd40e5b1da20b323 Mon Sep 17 00:00:00 2001
From: Lorenz Stechauner <lorenz.stechauner@necronda.net>
Date: Sat, 22 Feb 2025 18:56:15 +0100
Subject: [PATCH 165/174] dns_world4you: Adapt to change in world4you.com

---
 dnsapi/dns_world4you.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_world4you.sh b/dnsapi/dns_world4you.sh
index 0febbad9..46cdc4fe 100644
--- a/dnsapi/dns_world4you.sh
+++ b/dnsapi/dns_world4you.sh
@@ -202,7 +202,7 @@ _get_paketnr() {
   fqdn="$1"
   form="$2"
 
-  domains=$(echo "$form" | grep '<ul class="nav header-paket-list">' | sed 's/<li/\n<li/g' | sed 's/<[^>]*>/ /g' | sed 's/^.*>\([^>]*\)$/\1/')
+  domains=$(echo "$form" | grep 'paketListData' | grep -o '"fqdn":"[^"]*"' | sed 's/.*:"\(.*\)"/\1/')
   _debug domains "$domains"
   domain=''
   for domain in $domains; do
@@ -218,7 +218,7 @@ _get_paketnr() {
   TLD="$domain"
   _debug domain "$domain"
   RECORD=$(echo "$fqdn" | cut -c"1-$((${#fqdn} - ${#TLD} - 1))")
-  PAKETNR=$(echo "$domains" | grep -o " $domain.*" | sed 's/^[^,]*, *\([0-9]*\).*$/\1/')
+  PAKETNR=$(echo "$form" | grep -o "\"id\":[^{}]*\"fqdn\":\"$domain\"" | sed 's/"id":\([0-9]*\).*$/\1/')
   return 0
 }
 

From 5236e810687b79cf15fb05ff501ca99b9f64aff3 Mon Sep 17 00:00:00 2001
From: neil <gitpc@neilpang.com>
Date: Sun, 23 Feb 2025 09:28:14 +0100
Subject: [PATCH 166/174] version 3.1.1

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 51d6f886..3d4e6108 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=3.1.0
+VER=3.1.1
 
 PROJECT_NAME="acme.sh"
 

From 661c3bbdb0f956f154fc0658348d30ed3f57ef09 Mon Sep 17 00:00:00 2001
From: aafbsd <45147422+aafbsd@users.noreply.github.com>
Date: Mon, 24 Feb 2025 12:33:42 +0000
Subject: [PATCH 167/174] Support FreeBSD's sed -i

FreeBSD's sed requires an extension for the backup file when -i is used. However, it may be zero-length to indicate that no backup is desired.
---
 acme.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/acme.sh b/acme.sh
index 3d4e6108..f03d79d4 100755
--- a/acme.sh
+++ b/acme.sh
@@ -921,6 +921,9 @@ _sed_i() {
   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
     _debug "Using sed  -i"
     sed -i "$options" "$filename"
+  elif sed -h 2>&1 | grep "\-i extension" >/dev/null 2>&1; then
+    _debug "Using FreeBSD sed -i"
+    sed -i "" "$options" "$filename"
   else
     _debug "No -i support in sed"
     text="$(cat "$filename")"

From dd2199c4725797fae6f70131370ca9e40abf7a0e Mon Sep 17 00:00:00 2001
From: Giovannimaria Gandossi <giogando96@gmail.com>
Date: Wed, 19 Feb 2025 14:39:36 +0100
Subject: [PATCH 168/174] Adding support for FreeMyIP dns API

---
 dnsapi/dns_freemyip.sh | 105 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 105 insertions(+)
 create mode 100644 dnsapi/dns_freemyip.sh

diff --git a/dnsapi/dns_freemyip.sh b/dnsapi/dns_freemyip.sh
new file mode 100644
index 00000000..0bad3809
--- /dev/null
+++ b/dnsapi/dns_freemyip.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_freemyip_info='FreeMyIP.com
+Site: freemyip.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_freemyip
+Options:
+ FREEMYIP_Token API Token
+Issues: github.com/acmesh-official/acme.sh/issues/{XXXX}
+Author: Recolic Keghart <root@recolic.net>, @Giova96
+'
+
+FREEMYIP_DNS_API="https://freemyip.com/update?"
+
+################ Public functions ################
+
+#Usage: dns_freemyip_add    fulldomain    txtvalue
+dns_freemyip_add() {
+  fulldomain="$1"
+  txtvalue="$2"
+
+  _info "Add TXT record $txtvalue for $fulldomain using freemyip.com api"
+
+  FREEMYIP_Token="${FREEMYIP_Token:-$(_readaccountconf_mutable FREEMYIP_Token)}"
+  if [ -z "$FREEMYIP_Token" ]; then
+    FREEMYIP_Token=""
+    _err "You don't specify FREEMYIP_Token yet."
+    _err "Please specify your token and try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable FREEMYIP_Token "$FREEMYIP_Token"
+
+  if _is_root_domain_published "$fulldomain"; then
+    _err "freemyip API don't allow you to set multiple TXT record for the same subdomain!"
+    _err "You must apply certificate for only one domain at a time!"
+    _err "===="
+    _err "For example, aaa.yourdomain.freemyip.com and bbb.yourdomain.freemyip.com and yourdomain.freemyip.com ALWAYS share the same TXT record. They will overwrite each other if you apply multiple domain at the same time."
+    _debug "If you are testing this workflow in github pipeline or acmetest, please set TEST_DNS_NO_SUBDOMAIN=1 and TEST_DNS_NO_WILDCARD=1"
+    return 1
+  fi
+
+  # txtvalue must be url-encoded. But it's not necessary for acme txt value.
+  _freemyip_get_until_ok "${FREEMYIP_DNS_API}token=$FREEMYIP_Token&domain=$fulldomain&txt=$txtvalue" 2>&1
+  return $?
+}
+
+#Usage: dns_freemyip_rm    fulldomain    txtvalue
+dns_freemyip_rm() {
+  fulldomain="$1"
+  txtvalue="$2"
+
+  _info "Delete TXT record $txtvalue for $fulldomain using freemyip.com api"
+
+  FREEMYIP_Token="${FREEMYIP_Token:-$(_readaccountconf_mutable FREEMYIP_Token)}"
+  if [ -z "$FREEMYIP_Token" ]; then
+    FREEMYIP_Token=""
+    _err "You don't specify FREEMYIP_Token yet."
+    _err "Please specify your token and try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable FREEMYIP_Token "$FREEMYIP_Token"
+
+  # Leave the TXT record as empty or "null" to delete the record.
+  _freemyip_get_until_ok "${FREEMYIP_DNS_API}token=$FREEMYIP_Token&domain=$fulldomain&txt=" 2>&1
+  return $?
+}
+
+################ Private functions below  ################
+_get_root() {
+  _fmi_d="$1"
+
+  echo "$_fmi_d" | rev | cut -d '.' -f 1-3 | rev
+}
+
+# There is random failure while calling freemyip API too fast. This function automatically retry until success.
+_freemyip_get_until_ok() {
+  _fmi_url="$1"
+  for i in $(seq 1 8); do
+    _debug "HTTP GET freemyip.com API '$_fmi_url', retry $i/8..."
+    _get "$_fmi_url" | tee /dev/fd/2 | grep OK && return 0
+    _sleep 1 # DO NOT send the request too fast
+  done
+  _err "Failed to request freemyip API: $_fmi_url . Server does not say 'OK'"
+  return 1
+}
+
+# Verify in public dns if domain is already there.
+_is_root_domain_published() {
+  _fmi_d="$1"
+  _webroot="$(_get_root "$_fmi_d")"
+
+  _info "Verifying '""$_fmi_d""' freemyip webroot (""$_webroot"") is not published yet"
+  for i in $(seq 1 3); do
+    _debug "'$_webroot' ns lookup, retry $i/3..."
+    if [ "$(_ns_lookup "$_fmi_d" TXT)" ]; then
+      _debug "'$_webroot' already has a TXT record published!"
+      return 0
+    fi
+    _sleep 10 # Give it some time to propagate the TXT record
+  done
+  return 1
+}

From dc8cf0e02ec2b41892bd1b2e82cd492b16dfe46a Mon Sep 17 00:00:00 2001
From: metaforget <97219459+metaforget@users.noreply.github.com>
Date: Mon, 3 Mar 2025 10:37:38 +0800
Subject: [PATCH 169/174] =?UTF-8?q?cqhttp=20notify-hook=EF=BC=9ACompatibil?=
 =?UTF-8?q?ity=20with=20QQ=20Headless=20Project=20Napcat?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 notify/cqhttp.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/notify/cqhttp.sh b/notify/cqhttp.sh
index ac76f5b8..28010ffd 100644
--- a/notify/cqhttp.sh
+++ b/notify/cqhttp.sh
@@ -52,7 +52,7 @@ cqhttp_send() {
   _finalUrl="$CQHTTP_APIROOT$CQHTTP_APIPATH?access_token=$_access_token&user_id=$_user_id&message=$_message"
   response="$(_get "$_finalUrl")"
 
-  if [ "$?" = "0" ] && _contains "$response" "\"retcode\":0,\"status\":\"ok\""; then
+  if [ "$?" = "0" ] && _contains "$response" "\"retcode\":0" && _contains "$response" "\"status\":\"ok\""; then
     _info "QQ send success."
     return 0
   fi

From ebdd221c72c3db413aacba7fe92c0d6bf064b204 Mon Sep 17 00:00:00 2001
From: copyliu <1076640+copyliu@users.noreply.github.com>
Date: Wed, 5 Mar 2025 11:33:41 +0800
Subject: [PATCH 170/174] routeros: file-name should in quotes in newer (7.18)
 version

---
 deploy/routeros.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index 90f0ad1a..ef9c6954 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -144,8 +144,8 @@ source=\"/certificate remove [ find name=$_cdomain.cer_0 ];\
 \n/certificate remove [ find name=$_cdomain.cer_1 ];\
 \n/certificate remove [ find name=$_cdomain.cer_2 ];\
 \ndelay 1;\
-\n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\";\
-\n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\";\
+\n/certificate import file-name=\\\"$_cdomain.cer\\\" passphrase=\\\"\\\";\
+\n/certificate import file-name=\\\"$_cdomain.key\\\" passphrase=\\\"\\\";\
 \ndelay 1;\
 \n:do {/file remove $_cdomain.cer; } on-error={ }\
 \n:do {/file remove $_cdomain.key; } on-error={ }\

From 262fa74f5e7ba00ba1f23e9f5921c6412ab35cf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markku=20Leini=C3=B6?=
 <markkuleinio@users.noreply.github.com>
Date: Wed, 5 Mar 2025 19:45:01 +0200
Subject: [PATCH 171/174] dns_he_ddns: Add empty dns_he_ddns_rm() to remove
 warnings

---
 dnsapi/dns_he_ddns.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_he_ddns.sh b/dnsapi/dns_he_ddns.sh
index 7d56104c..cd7d1ec2 100644
--- a/dnsapi/dns_he_ddns.sh
+++ b/dnsapi/dns_he_ddns.sh
@@ -34,5 +34,11 @@ dns_he_ddns_add() {
   _contains "$response" "good" && return 0 || return 1
 }
 
-# dns_he_ddns_rm() is not implemented because the API call always updates the
+# dns_he_ddns_rm() is not doing anything because the API call always updates the
 # contents of the existing record (that the API key gives access to).
+
+dns_he_ddns_rm() {
+  fulldomain=$1
+  _debug "Delete TXT record called for '${fulldomain}', not doing anything."
+  return 0
+}

From 7e320d274859d7b90acb6004f3abd19c28ad3914 Mon Sep 17 00:00:00 2001
From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 11 Mar 2025 12:04:00 +0100
Subject: [PATCH 172/174] haproxy: don't leak private keys when doing --debug

It was reported in issue #6267 that the private key was leaked when
using the DEPLOY_HAPROXY_HOT_UPDATE=yes feature.

Indeed, the debugging code which sends commands to HAProxy was using
_debug even when passing the private key.

This patch fixes the issue by using _secure_debug when doing that.
---
 deploy/haproxy.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/haproxy.sh b/deploy/haproxy.sh
index c8491d92..19509e3b 100644
--- a/deploy/haproxy.sh
+++ b/deploy/haproxy.sh
@@ -357,7 +357,7 @@ haproxy_deploy() {
         _info "Update existing certificate '${_pem}' over HAProxy ${_socketname}."
       fi
       _socat_cert_set_cmd="echo -e '${_cmdpfx}set ssl cert ${_pem} <<\n$(cat "${_pem}")\n' | socat '${_statssock}' - | grep -q 'Transaction created'"
-      _debug _socat_cert_set_cmd "${_socat_cert_set_cmd}"
+      _secure_debug _socat_cert_set_cmd "${_socat_cert_set_cmd}"
       eval "${_socat_cert_set_cmd}"
       _ret=$?
       if [ "${_ret}" != "0" ]; then

From f1dc79f0b51ca3e727d397c601a0cc85ab8d03b1 Mon Sep 17 00:00:00 2001
From: Martin Brodbeck <martin@brodbeck-online.de>
Date: Thu, 20 Mar 2025 10:13:12 +0100
Subject: [PATCH 173/174] support NTFY_TOKEN

---
 notify/ntfy.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/notify/ntfy.sh b/notify/ntfy.sh
index 650d1c74..21e39559 100644
--- a/notify/ntfy.sh
+++ b/notify/ntfy.sh
@@ -4,6 +4,7 @@
 
 #NTFY_URL="https://ntfy.sh"
 #NTFY_TOPIC="xxxxxxxxxxxxx"
+#NTFY_TOKEN="xxxxxxxxxxxxx"
 
 ntfy_send() {
   _subject="$1"
@@ -23,6 +24,12 @@ ntfy_send() {
     _saveaccountconf_mutable NTFY_TOPIC "$NTFY_TOPIC"
   fi
 
+  NTFY_TOKEN="${NTFY_TOKEN:-$(_readaccountconf_mutable NTFY_TOKEN)}"
+  if [ "$NTFY_TOKEN" ]; then
+    _saveaccountconf_mutable NTFY_TOKEN "$NTFY_TOKEN"
+    export _H1="Authorization: Bearer $NTFY_TOKEN"
+  fi
+
   _data="${_subject}. $_content"
   response="$(_post "$_data" "$NTFY_URL/$NTFY_TOPIC" "" "POST" "")"
 

From 5c7b1cd5f2d2aaa7ba9810e81294bcabbfbfc3ad Mon Sep 17 00:00:00 2001
From: Sikro <yxx95lz@163.com>
Date: Tue, 3 Dec 2024 15:07:37 +0800
Subject: [PATCH 174/174] add environment variable for notify/telegram.sh

Since the server in mainland China cannot connect to Telegram, add the TELEGRAM_BOT_URLBASE environment variable
Please add the proxy address you set. If this variable is not added, it will be the default value (https://api.telegram.org)
---
 notify/telegram.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/notify/telegram.sh b/notify/telegram.sh
index cca8ee25..ccbd1533 100644
--- a/notify/telegram.sh
+++ b/notify/telegram.sh
@@ -4,6 +4,7 @@
 
 #TELEGRAM_BOT_APITOKEN=""
 #TELEGRAM_BOT_CHATID=""
+#TELEGRAM_BOT_URLBASE=""
 
 telegram_send() {
   _subject="$1"
@@ -27,6 +28,12 @@ telegram_send() {
   fi
   _saveaccountconf_mutable TELEGRAM_BOT_CHATID "$TELEGRAM_BOT_CHATID"
 
+  TELEGRAM_BOT_URLBASE="${TELEGRAM_BOT_URLBASE:-$(_readaccountconf_mutable TELEGRAM_BOT_URLBASE)}"
+  if [ -z "$TELEGRAM_BOT_URLBASE" ]; then
+    TELEGRAM_BOT_URLBASE="https://api.telegram.org"
+  fi
+  _saveaccountconf_mutable TELEGRAM_BOT_URLBASE "$TELEGRAM_BOT_URLBASE"
+
   _subject="$(printf "%s" "$_subject" | sed 's/\\/\\\\\\\\/g' | sed 's/\]/\\\\\]/g' | sed 's/\([_*[()~`>#+--=|{}.!]\)/\\\\\1/g')"
   _content="$(printf "%s" "$_content" | sed 's/\\/\\\\\\\\/g' | sed 's/\]/\\\\\]/g' | sed 's/\([_*[()~`>#+--=|{}.!]\)/\\\\\1/g')"
   _content="$(printf "*%s*\n%s" "$_subject" "$_content" | _json_encode)"
@@ -38,7 +45,7 @@ telegram_send() {
   _debug "$_data"
 
   export _H1="Content-Type: application/json"
-  _telegram_bot_url="https://api.telegram.org/bot${TELEGRAM_BOT_APITOKEN}/sendMessage"
+  _telegram_bot_url="${TELEGRAM_BOT_URLBASE}/bot${TELEGRAM_BOT_APITOKEN}/sendMessage"
   if _post "$_data" "$_telegram_bot_url" >/dev/null; then
     # shellcheck disable=SC2154
     _message=$(printf "%s\n" "$response" | sed -n 's/.*"ok":\([^,]*\).*/\1/p')