neil
8 years ago
11 changed files with 550 additions and 32 deletions
-
4README.md
-
268acme.sh
-
1deploy/README.md
-
81deploy/kong.sh
-
21dnsapi/README.md
-
2dnsapi/dns_ali.sh
-
4dnsapi/dns_aws.sh
-
4dnsapi/dns_cx.sh
-
183dnsapi/dns_linode.sh
-
12dnsapi/dns_lua.sh
-
2dnsapi/dns_me.sh
@ -0,0 +1 @@ |
|||
#Using deploy api |
|||
@ -0,0 +1,81 @@ |
|||
#!/usr/bin/env sh |
|||
|
|||
# This deploy hook will deploy ssl cert on kong proxy engine based on api request_host parameter. |
|||
# Note that ssl plugin should be available on Kong instance |
|||
# The hook will match cdomain to request_host, in case of multiple domain it will always take the first |
|||
# one (acme.sh behaviour). |
|||
# If ssl config already exist it will update only cert and key not touching other parameter |
|||
# If ssl config doesn't exist it will only upload cert and key and not set other parameter |
|||
# Not that we deploy full chain |
|||
# See https://getkong.org/plugins/dynamic-ssl/ for other options |
|||
# Written by Geoffroi Genot <ggenot@voxbone.com> |
|||
|
|||
######## Public functions ##################### |
|||
|
|||
#domain keyfile certfile cafile fullchain |
|||
kong_deploy() { |
|||
_cdomain="$1" |
|||
_ckey="$2" |
|||
_ccert="$3" |
|||
_cca="$4" |
|||
_cfullchain="$5" |
|||
_info "Deploying certificate on Kong instance" |
|||
if [ -z "$KONG_URL" ]; then |
|||
_debug "KONG_URL Not set, using default http://localhost:8001" |
|||
KONG_URL="http://localhost:8001" |
|||
fi |
|||
|
|||
_debug _cdomain "$_cdomain" |
|||
_debug _ckey "$_ckey" |
|||
_debug _ccert "$_ccert" |
|||
_debug _cca "$_cca" |
|||
_debug _cfullchain "$_cfullchain" |
|||
|
|||
#Get uuid linked to the domain |
|||
uuid=$(_get "$KONG_URL/apis?request_host=$_cdomain" | _normalizeJson | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') |
|||
if [ -z "$uuid" ]; then |
|||
_err "Unable to get Kong uuid for domain $_cdomain" |
|||
_err "Make sure that KONG_URL is correctly configured" |
|||
_err "Make sure that a Kong api request_host match the domain" |
|||
_err "Kong url: $KONG_URL" |
|||
return 1 |
|||
fi |
|||
#Save kong url if it's succesful (First run case) |
|||
_saveaccountconf KONG_URL "$KONG_URL" |
|||
#Generate DEIM |
|||
delim="-----MultipartDelimeter$(date "+%s%N")" |
|||
nl="\015\012" |
|||
#Set Header |
|||
_H1="Content-Type: multipart/form-data; boundary=$delim" |
|||
#Generate data for request (Multipart/form-data with mixed content) |
|||
#set name to ssl |
|||
content="--$delim${nl}Content-Disposition: form-data; name=\"name\"${nl}${nl}ssl" |
|||
#add key |
|||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")" |
|||
#Add cert |
|||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"config.cert\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")" |
|||
#Close multipart |
|||
content="$content${nl}--$delim--${nl}" |
|||
#Convert CRLF |
|||
content=$(printf %b "$content") |
|||
#DEBUG |
|||
_debug header "$_H1" |
|||
_debug content "$content" |
|||
#Check if ssl plugins is aready enabled (if not => POST else => PATCH) |
|||
ssl_uuid=$(_get "$KONG_URL/apis/$uuid/plugins" | _egrep_o '"id":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"[a-zA-Z0-9\-\,\"_\:]*"name":"ssl"' | _egrep_o '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') |
|||
_debug ssl_uuid "$ssl_uuid" |
|||
if [ -z "$ssl_uuid" ]; then |
|||
#Post certificate to Kong |
|||
response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins" "" "POST") |
|||
else |
|||
#patch |
|||
response=$(_post "$content" "$KONG_URL/apis/$uuid/plugins/$ssl_uuid" "" "PATCH") |
|||
fi |
|||
if ! [ "$(echo "$response" | _egrep_o "ssl")" = "ssl" ]; then |
|||
_err "An error occured with cert upload. Check response:" |
|||
_err "$response" |
|||
return 1 |
|||
fi |
|||
_debug response "$response" |
|||
_info "Certificate successfully deployed" |
|||
} |
|||
@ -0,0 +1,183 @@ |
|||
#!/usr/bin/env sh |
|||
|
|||
#Author: Philipp Grosswiler <philipp.grosswiler@swiss-design.net> |
|||
|
|||
LINODE_API_URL="https://api.linode.com/?api_key=$LINODE_API_KEY&api_action=" |
|||
|
|||
######## Public functions ##################### |
|||
|
|||
#Usage: dns_linode_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs" |
|||
dns_linode_add() { |
|||
fulldomain="${1}" |
|||
txtvalue="${2}" |
|||
|
|||
if ! _Linode_API; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Using Linode" |
|||
_debug "Calling: dns_linode_add() '${fulldomain}' '${txtvalue}'" |
|||
|
|||
_debug "First detect the root zone" |
|||
if ! _get_root "$fulldomain"; then |
|||
_err "Domain does not exist." |
|||
return 1 |
|||
fi |
|||
_debug _domain_id "$_domain_id" |
|||
_debug _sub_domain "$_sub_domain" |
|||
_debug _domain "$_domain" |
|||
|
|||
_parameters="&DomainID=$_domain_id&Type=TXT&Name=$_sub_domain&Target=$txtvalue" |
|||
|
|||
if _rest GET "domain.resource.create" "$_parameters" && [ -n "$response" ]; then |
|||
_resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1) |
|||
_debug _resource_id "$_resource_id" |
|||
|
|||
if [ -z "$_resource_id" ]; then |
|||
_err "Error adding the domain resource." |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Domain resource successfully added." |
|||
return 0 |
|||
fi |
|||
|
|||
return 1 |
|||
} |
|||
|
|||
#Usage: dns_linode_rm _acme-challenge.www.domain.com |
|||
dns_linode_rm() { |
|||
fulldomain="${1}" |
|||
|
|||
if ! _Linode_API; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Using Linode" |
|||
_debug "Calling: dns_linode_rm() '${fulldomain}'" |
|||
|
|||
_debug "First detect the root zone" |
|||
if ! _get_root "$fulldomain"; then |
|||
_err "Domain does not exist." |
|||
return 1 |
|||
fi |
|||
_debug _domain_id "$_domain_id" |
|||
_debug _sub_domain "$_sub_domain" |
|||
_debug _domain "$_domain" |
|||
|
|||
_parameters="&DomainID=$_domain_id" |
|||
|
|||
if _rest GET "domain.resource.list" "$_parameters" && [ -n "$response" ]; then |
|||
response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')" |
|||
|
|||
resource="$(echo "$response" | _egrep_o "{.*\"NAME\":\s*\"$_sub_domain\".*}")" |
|||
if [ "$resource" ]; then |
|||
_resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"RESOURCEID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ ) |
|||
if [ "$_resource_id" ]; then |
|||
_debug _resource_id "$_resource_id" |
|||
|
|||
_parameters="&DomainID=$_domain_id&ResourceID=$_resource_id" |
|||
|
|||
if _rest GET "domain.resource.delete" "$_parameters" && [ -n "$response" ]; then |
|||
_resource_id=$(printf "%s\n" "$response" | _egrep_o "\"ResourceID\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1) |
|||
_debug _resource_id "$_resource_id" |
|||
|
|||
if [ -z "$_resource_id" ]; then |
|||
_err "Error deleting the domain resource." |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Domain resource successfully deleted." |
|||
return 0 |
|||
fi |
|||
fi |
|||
|
|||
return 1 |
|||
fi |
|||
|
|||
return 0 |
|||
fi |
|||
|
|||
return 1 |
|||
} |
|||
|
|||
#################### Private functions below ################################## |
|||
|
|||
_Linode_API() { |
|||
if [ -z "$LINODE_API_KEY" ]; then |
|||
LINODE_API_KEY="" |
|||
|
|||
_err "You didn't specify the Linode API key yet." |
|||
_err "Please create your key and try again." |
|||
|
|||
return 1 |
|||
fi |
|||
|
|||
_saveaccountconf LINODE_API_KEY "$LINODE_API_KEY" |
|||
} |
|||
|
|||
#################### Private functions below ################################## |
|||
#_acme-challenge.www.domain.com |
|||
#returns |
|||
# _sub_domain=_acme-challenge.www |
|||
# _domain=domain.com |
|||
# _domain_id=12345 |
|||
_get_root() { |
|||
domain=$1 |
|||
i=2 |
|||
p=1 |
|||
|
|||
if _rest GET "domain.list"; then |
|||
response="$(echo "$response" | tr -d "\n" | sed 's/{/\n&/g')" |
|||
while true; do |
|||
h=$(printf "%s" "$domain" | cut -d . -f $i-100) |
|||
_debug h "$h" |
|||
if [ -z "$h" ]; then |
|||
#not valid |
|||
return 1 |
|||
fi |
|||
|
|||
hostedzone="$(echo "$response" | _egrep_o "{.*\"DOMAIN\":\s*\"$h\".*}")" |
|||
if [ "$hostedzone" ]; then |
|||
_domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"DOMAINID\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ ) |
|||
if [ "$_domain_id" ]; then |
|||
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p) |
|||
_domain=$h |
|||
return 0 |
|||
fi |
|||
return 1 |
|||
fi |
|||
p=$i |
|||
i=$(_math "$i" + 1) |
|||
done |
|||
fi |
|||
return 1 |
|||
} |
|||
|
|||
#method method action data |
|||
_rest() { |
|||
mtd="$1" |
|||
ep="$2" |
|||
data="$3" |
|||
|
|||
_debug mtd "$mtd" |
|||
_debug ep "$ep" |
|||
|
|||
export _H1="Accept: application/json" |
|||
export _H2="Content-Type: application/json" |
|||
|
|||
if [ "$mtd" != "GET" ]; then |
|||
# both POST and DELETE. |
|||
_debug data "$data" |
|||
response="$(_post "$data" "$LINODE_API_URL$ep" "" "$mtd")" |
|||
else |
|||
response="$(_get "$LINODE_API_URL$ep$data")" |
|||
fi |
|||
|
|||
if [ "$?" != "0" ]; then |
|||
_err "error $ep" |
|||
return 1 |
|||
fi |
|||
_debug2 response "$response" |
|||
return 0 |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue