bundles/bind-acme/metadata.py

@@ -2,19 +2,16 @@
     'dns',
 )
 def acme_records(metadata):
-    domains = set()
-    
-    for other_node in repo.nodes:
-        for domain, conf in other_node.metadata.get('letsencrypt/domains', {}).items():
-            domains.add(domain)
-            domains.update(conf.get('aliases', []))
-    
+    if metadata.get('bind/type') == 'slave':
+        return {}
+
     return {
         'dns': {
             f'_acme-challenge.{domain}': {
                 'CNAME': {f"{domain}.{metadata.get('bind/acme_zone')}."},
             }
-                for domain in domains
+                for other_node in repo.nodes
+                for domain in other_node.metadata.get('letsencrypt/domains', {}).keys()
         }
     }
 
@@ -23,13 +20,16 @@ def acme_records(metadata):
     'bind/zones',
 )
 def acme_zone(metadata):
+    if metadata.get('bind/type') == 'slave':
+        return {}
+
     return {
         'bind': {
             'zones': {
                 metadata.get('bind/acme_zone'): {
                     'dynamic': True,
-                    'views': ['external'],
                     'records': set(),
+                    'views': ['external'],
                 },
             },
         },

bundles/letsencrypt/files/domains.txt

@@ -1,3 +1,3 @@
-% for domain, conf in sorted(domains.items()):
-${domain} ${' '.join(sorted(conf.get('aliases', [])))}
+% for domain, aliases in sorted(node.metadata.get('letsencrypt/domains', {}).items()):
+${domain} ${' '.join(sorted(aliases))}
 % endfor

bundles/letsencrypt/files/hook.sh

@@ -1,55 +1,79 @@
-set -e
-set -u
-set -o pipefail
-
 deploy_challenge() {
-  echo "
-    server ${server}
-    zone ${zone}.
-    update add $1.${zone}. 60 IN TXT \"$3\"
-    send
-  " | tee | nsupdate -y hmac-sha512:${zone}:${acme_key}
+  set -e
+  set -u
+  set -o pipefail
   
-  sleep 10
+  ACME_ZONE=${zone}
+  SERVER=${server}
+  DOMAIN=$1
+  CHALLENGE=$3
+  KEY=hmac-sha512:acme.sublimity.de:${acme_key}
+  cmd="
+    server $SERVER
+    zone $ACME_ZONE.
+    update add $DOMAIN.$ACME_ZONE. 60 IN TXT \"$CHALLENGE\"
+    send
+  "
+  echo "$cmd"
+  echo "$cmd" | nsupdate -y $KEY
+  
+  sleep 15
 }
 
 clean_challenge() {
-  echo "
-    server ${server}
-    zone ${zone}.
-    update delete $1.${zone}. TXT
-    send
-  " | tee | nsupdate -y hmac-sha512:${zone}:${acme_key}
-}
-
-deploy_cert() {
-  DOMAIN="$1"
-  KEYFILE="$2"
-  CERTFILE="$3"
-  FULLCHAINFILE="$4"
-  CHAINFILE="$5"
+  set -e
+  set -u
+  set -o pipefail
   
-  % for domain, conf in sorted(domains.items()):
-  % if conf.get('location', None):
-  if [[ $DOMAIN = ${domain} ]]
-  then
-    cat "$KEYFILE" > "${conf['location']}/privkey.pem"
-    cat "$CERTFILE" > "${conf['location']}/cert.pem"
-    cat "$FULLCHAINFILE" > "${conf['location']}/fullchain.pem"
-    cat "$CHAINFILE" > "${conf['location']}/chain.pem"
-  fi
-  % endif
-  % if conf.get('owner', None):
-  chown ${conf['owner']} "${conf['location']}/privkey.pem" "${conf['location']}/cert.pem" "${conf['location']}/fullchain.pem" "${conf['location']}/chain.pem"
-  % endif
-  % for service in sorted(conf.get('reload', [])):
-  systemctl reload-or-restart ${service}
-  % endfor
-  % endfor
+  ACME_ZONE=${zone}
+  SERVER=${server}
+  DOMAIN=$1
+  CHALLENGE=$3
+  KEY=hmac-sha512:acme.sublimity.de:${acme_key}
+  cmd="
+    server $SERVER
+    zone $ACME_ZONE.
+    update delete $DOMAIN.$ACME_ZONE. TXT
+    send
+  "
+  echo "$cmd"
+  echo "$cmd" | nsupdate -y $KEY
 }
 
+deploy_cert() {<%text>
+    local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"</%text>
+% for service, config in node.metadata.get('letsencrypt/concat_and_deploy', {}).items():
+
+    # concat_and_deploy ${service}
+    if [ "$DOMAIN" = "${config['match_domain']}" ]; then
+        cat $KEYFILE > ${config['target']}
+        cat $FULLCHAINFILE >> ${config['target']}
+%  if 'chown' in config:
+        chown ${config['chown']} ${config['target']}
+%  endif
+%  if 'chmod' in config:
+        chmod ${config['chmod']} ${config['target']}
+%  endif
+%  if 'commands' in config:
+%   for command in config['commands']:
+        ${command}
+%   endfor
+%  endif
+    fi
+% endfor
+}
+
+
+exit_hook() {<%text>
+    local ERROR="${1:-}"</%text>
+
+% for service in sorted(node.metadata.get('letsencrypt/reload_after', set())):
+    systemctl reload-or-restart ${service}
+% endfor
+}
+
+<%text>
 HANDLER="$1"; shift
-if [[ $HANDLER =~ ^(deploy_cert|deploy_challenge|clean_challenge)$ ]]
-then
+if [[ "${HANDLER}" =~ ^(deploy_cert|exit_hook|deploy_challenge|clean_challenge)$ ]]; then
     "$HANDLER" "$@"
-fi
+fi</%text>

bundles/letsencrypt/items.py

@@ -13,9 +13,6 @@ directories = {
 files = {
     '/etc/dehydrated/domains.txt': {
         'content_type': 'mako',
-        'context': {
-            'domains': node.metadata.get('letsencrypt/domains'),
-        },
         'triggers': {
             'action:letsencrypt_update_certificates',
         },
@@ -31,7 +28,6 @@ files = {
             'server': ip_interface(acme_node.metadata.get('network/external/ipv4')).ip,
             'zone': acme_node.metadata.get('bind/acme_zone'),
             'acme_key': acme_node.metadata.get('bind/keys/' + acme_node.metadata.get('bind/acme_zone')),
-            'domains': node.metadata.get('letsencrypt/domains'),
         },
         'mode': '0755',
     },

bundles/letsencrypt/metadata.py

@@ -53,19 +53,22 @@ def renew(metadata):
 )
 def delegated_domains(metadata):
     delegated_domains = {
-        domain: conf
+        domain
             for other_node in repo.nodes
             if other_node.has_bundle('letsencrypt')
-            and other_node.metadata.get('letsencrypt/delegate_to_node', None) == node.name
-            for domain, conf in other_node.metadata.get('letsencrypt/domains').items()
+                and other_node.metadata.get('letsencrypt/delegate_to_node', None) == node.name
+            for domain in other_node.metadata.get('letsencrypt/domains').keys()
     }
 
     return {
         'letsencrypt': {
-            'domains': delegated_domains,
+            'domains': {
+                domain: set()
+                    for domain in delegated_domains
+            },
         },
         'dns': {
             domain: repo.libs.dns.get_a_records(metadata, internal=False)
-                for domain in delegated_domains.keys()
+                for domain in delegated_domains
         },
     }

bundles/mailserver/metadata.py

@@ -60,9 +60,7 @@ def letsencrypt(metadata):
     return {
         'letsencrypt': {
             'domains': {
-                metadata.get('mailserver/hostname'): {
-                    'reload': {'dovecot', 'postfix'},
-                },
+                metadata.get('mailserver/hostname'): set(),
             },
         },
     } 

bundles/mosquitto/metadata.py

@@ -84,7 +84,7 @@ def letsencrypt(metadata):
     return  {
         'letsencrypt': {
             'domains': {
-                metadata.get('mosquitto/hostname'): {},
+                metadata.get('mosquitto/hostname'): set(),
             },
         },
     }

bundles/nginx/metadata.py

@@ -104,10 +104,10 @@ def letsencrypt(metadata):
     return {
         'letsencrypt': {
             'domains': {
-                domain: {
-                    'reload': {'nginx'},
-                }
-                    for domain in metadata.get('nginx/vhosts').keys()
+                domain: set() for domain in metadata.get('nginx/vhosts').keys()
+            },
+            'reload_after': {
+                'nginx',
             },
         },
     }

nodes/htz.mails.py

@@ -63,15 +63,9 @@
         },
         'letsencrypt': {
             'domains': {
-                'ckn.li': {},
-                'test6.ckn.li': {
-                    'aliases': {'www.test6.ckn.li'},
-                    'location': '/root/temp',
-                    'owner': 'telegraf',
-                    'reload': {'telegraf'},
-                },
-                'sublimity.de': {},
-                'freibrief.net': {},
+                'ckn.li': set(),
+                'sublimity.de': set(),
+                'freibrief.net': set(),
             },
         },
         'mailserver': {