neil
8 years ago
11 changed files with 550 additions and 32 deletions
-
4README.md
-
268acme.sh
-
1deploy/README.md
-
81deploy/kong.sh
-
21dnsapi/README.md
-
2dnsapi/dns_ali.sh
-
4dnsapi/dns_aws.sh
-
4dnsapi/dns_cx.sh
-
183dnsapi/dns_linode.sh
-
12dnsapi/dns_lua.sh
-
2dnsapi/dns_me.sh
@ -0,0 +1 @@ |
|||||
|
#Using deploy api |
||||
@ -0,0 +1,81 @@ |
|||||
|
#!/usr/bin/env sh |
||||
|
|
||||
|
# This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter. |
||||
|
# Note that ssl plugin should be available on Kong instance |
||||
|
# The hook will match cdomain to request_host, in case of multiple domain it will always take the first |
||||
|
# one (acme.sh behaviour). |
||||
|
# If ssl config already exist it will update only cert and key not touching other parameter |
||||
|
# If ssl config doesn't exist it will only upload cert and key and not set other parameter |
||||
|
# Not that we deploy full chain |
||||
|
# See https://getkong.org/plugins/dynamic-ssl/ for other options |
||||
|
# Written by Geoffroi Genot <ggenot@voxbone.com> |
||||
|
|
||||
|
######## Public functions ##################### |
||||
|
|
||||
|
#domain keyfile certfile cafile fullchain |
||||
|
kong_deploy() { |
||||
|
_cdomain="$1" |
||||
|
_ckey="$2" |
||||
|
_ccert="$3" |
||||
|
_cca="$4" |
||||
|
_cfullchain="$5" |
||||
|
_info "Deploying certificate on Kong instance" |
||||
|
if [ -z "$KONG_URL" ]; then |
||||
|
_debug "KONG_URL Not set, using default http://localhost:8001" |
||||
|
KONG_URL="http://localhost:8001" |
||||
|
fi |
||||
|
|
||||
|
_debug _cdomain "$_cdomain" |
||||
|
_debug _ckey "$_ckey" |
||||
|
_debug _ccert "$_ccert" |
||||
|
_debug _cca "$_cca" |
||||
|
_debug _cfullchain "$_cfullchain" |
||||
|
|
||||
|
#Get uuid linked to the domain |
||||
|
uuid=$(_get "$KONG_URL/apis?request_host=$_cdomain" | _normalizeJson | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') |
||||
|
if [ -z "$uuid" ]; then |
||||
|
_err "Unable to get Kong uuid for domain $_cdomain" |
||||
|
_err "Make sure that KONG_URL is correctly configured" |
||||
|
_err "Make sure that a Kong api request_host match the domain" |
||||
|
_err "Kong url: $KONG_URL" |
||||
|
return 1 |
||||
|
fi |
||||
|
#Save kong url if it's succesful (First run case) |
||||
|
_saveaccountconf KONG_URL "$KONG_URL" |
||||
|
#Generate DEIM |
||||
|
delim="-----MultipartDelimeter$(date "+%s%N")" |
||||
|
nl="\015\012" |
||||
|
#Set Header |
||||
|
_H1="Content-Type: multipart/form-data; boundary=$delim" |
||||
|
#Generate data for request (Multipart/form-data with mixed content) |
||||
|
#set name to ssl |
||||
|
content="--$delim${nl}Content-Disposition: form-data; name=\"name\"${nl}${nl}ssl" |
||||
|
#add key |
||||
|
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")" |
||||
|
#Add cert |
||||
|
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.cert\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")" |
||||
|
#Close multipart |
||||
|
content="$content${nl}--$delim--${nl}" |
||||
|
#Convert CRLF |
||||
|
content=$(printf %b "$content") |
||||
|
#DEBUG |
||||
|
_debug header "$_H1" |
||||
|
_debug content "$content" |
||||
|
#Check if ssl plugins is aready enabled (if not => POST else => PATCH) |
||||
|
ssl_uuid=$(_get "$KONG_URL/apis/$uuid/plugins" | _egrep_o '"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"' | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') |
||||
|
_debug ssl_uuid "$ssl_uuid" |
||||
|
if [ -z "$ssl_uuid" ]; then |
||||
|
#Post certificate to Kong |
||||
|
response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins" "" "POST") |
||||
|
else |
||||
|
#patch |
||||
|
response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins/$ssl_uuid" "" "PATCH") |
||||
|
fi |
||||
|
if ! [ "$(echo "$response" | _egrep_o "ssl")" = "ssl" ]; then |
||||
|
_err "An error occured with cert upload. Check response:" |
||||
|
_err "$response" |
||||
|
return 1 |
||||
|
fi |
||||
|
_debug response "$response" |
||||
|
_info "Certificate successfully deployed" |
||||
|
} |
||||
@ -0,0 +1,183 @@ |
|||||
|
#!/usr/bin/env sh |
||||
|
|
||||
|
#Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net> |
||||
|
|
||||
|
LINODE_API_URL="https://api.linode.com/?api_key=$LINODE_API_KEY&api_action=" |
||||
|
|
||||
|
######## Public functions ##################### |
||||
|
|
||||
|
#Usage: dns_linode_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs" |
||||
|
dns_linode_add() { |
||||
|
fulldomain="${1}" |
||||
|
txtvalue="${2}" |
||||
|
|
||||
|
if ! _Linode_API; then |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_info "Using Linode" |
||||
|
_debug "Calling: dns_linode_add() '${fulldomain}' '${txtvalue}'" |
||||
|
|
||||
|
_debug "First detect the root zone" |
||||
|
if ! _get_root "$fulldomain"; then |
||||
|
_err "Domain does not exist." |
||||
|
return 1 |
||||
|
fi |
||||
|
_debug _domain_id "$_domain_id" |
||||
|
_debug _sub_domain "$_sub_domain" |
||||
|
_debug _domain "$_domain" |
||||
|
|
||||
|
_parameters="&DomainID=$_domain_id&Type=TXT&Name=$_sub_domain&Target=$txtvalue" |
||||
|
|
||||
|
if _rest GET "domain.resource.create" "$_parameters" && [ -n "$response" ]; then |
||||
|
_resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1) |
||||
|
_debug _resource_id "$_resource_id" |
||||
|
|
||||
|
if [ -z "$_resource_id" ]; then |
||||
|
_err "Error adding the domain resource." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_info "Domain resource successfully added." |
||||
|
return 0 |
||||
|
fi |
||||
|
|
||||
|
return 1 |
||||
|
} |
||||
|
|
||||
|
#Usage: dns_linode_rm _acme-challenge.www.domain.com |
||||
|
dns_linode_rm() { |
||||
|
fulldomain="${1}" |
||||
|
|
||||
|
if ! _Linode_API; then |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_info "Using Linode" |
||||
|
_debug "Calling: dns_linode_rm() '${fulldomain}'" |
||||
|
|
||||
|
_debug "First detect the root zone" |
||||
|
if ! _get_root "$fulldomain"; then |
||||
|
_err "Domain does not exist." |
||||
|
return 1 |
||||
|
fi |
||||
|
_debug _domain_id "$_domain_id" |
||||
|
_debug _sub_domain "$_sub_domain" |
||||
|
_debug _domain "$_domain" |
||||
|
|
||||
|
_parameters="&DomainID=$_domain_id" |
||||
|
|
||||
|
if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then |
||||
|
response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')" |
||||
|
|
||||
|
resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")" |
||||
|
if [ "$resource" ]; then |
||||
|
_resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"RESOURCEID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ ) |
||||
|
if [ "$_resource_id" ]; then |
||||
|
_debug _resource_id "$_resource_id" |
||||
|
|
||||
|
_parameters="&DomainID=$_domain_id&ResourceID=$_resource_id" |
||||
|
|
||||
|
if _rest GET "domain.resource.delete" "$_parameters" && [ -n "$response" ]; then |
||||
|
_resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1) |
||||
|
_debug _resource_id "$_resource_id" |
||||
|
|
||||
|
if [ -z "$_resource_id" ]; then |
||||
|
_err "Error deleting the domain resource." |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_info "Domain resource successfully deleted." |
||||
|
return 0 |
||||
|
fi |
||||
|
fi |
||||
|
|
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
return 0 |
||||
|
fi |
||||
|
|
||||
|
return 1 |
||||
|
} |
||||
|
|
||||
|
#################### Private functions below ################################## |
||||
|
|
||||
|
_Linode_API() { |
||||
|
if [ -z "$LINODE_API_KEY" ]; then |
||||
|
LINODE_API_KEY="" |
||||
|
|
||||
|
_err "You didn't specify the Linode API key yet." |
||||
|
_err "Please create your key and try again." |
||||
|
|
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
_saveaccountconf LINODE_API_KEY "$LINODE_API_KEY" |
||||
|
} |
||||
|
|
||||
|
#################### Private functions below ################################## |
||||
|
#_acme-challenge.www.domain.com |
||||
|
#returns |
||||
|
# _sub_domain=_acme-challenge.www |
||||
|
# _domain=domain.com |
||||
|
# _domain_id=12345 |
||||
|
_get_root() { |
||||
|
domain=$1 |
||||
|
i=2 |
||||
|
p=1 |
||||
|
|
||||
|
if _rest GET "domain.list"; then |
||||
|
response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')" |
||||
|
while true; do |
||||
|
h=$(printf "%s" "$domain" | cut -d . -f $i-100) |
||||
|
_debug h "$h" |
||||
|
if [ -z "$h" ]; then |
||||
|
#not valid |
||||
|
return 1 |
||||
|
fi |
||||
|
|
||||
|
hostedzone="$(echo "$response" | _egrep_o "{.*\"DOMAIN\":\s*\"$h\".*}")" |
||||
|
if [ "$hostedzone" ]; then |
||||
|
_domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"DOMAINID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ ) |
||||
|
if [ "$_domain_id" ]; then |
||||
|
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p) |
||||
|
_domain=$h |
||||
|
return 0 |
||||
|
fi |
||||
|
return 1 |
||||
|
fi |
||||
|
p=$i |
||||
|
i=$(_math "$i" + 1) |
||||
|
done |
||||
|
fi |
||||
|
return 1 |
||||
|
} |
||||
|
|
||||
|
#method method action data |
||||
|
_rest() { |
||||
|
mtd="$1" |
||||
|
ep="$2" |
||||
|
data="$3" |
||||
|
|
||||
|
_debug mtd "$mtd" |
||||
|
_debug ep "$ep" |
||||
|
|
||||
|
export _H1="Accept: application/json" |
||||
|
export _H2="Content-Type: application/json" |
||||
|
|
||||
|
if [ "$mtd" != "GET" ]; then |
||||
|
# both POST and DELETE. |
||||
|
_debug data "$data" |
||||
|
response="$(_post "$data" "$LINODE_API_URL$ep" "" "$mtd")" |
||||
|
else |
||||
|
response="$(_get "$LINODE_API_URL$ep$data")" |
||||
|
fi |
||||
|
|
||||
|
if [ "$?" != "0" ]; then |
||||
|
_err "error $ep" |
||||
|
return 1 |
||||
|
fi |
||||
|
_debug2 response "$response" |
||||
|
return 0 |
||||
|
} |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue