62 lines
1.7 KiB
Bash
62 lines
1.7 KiB
Bash
set -e
|
|
set -u
|
|
set -o pipefail
|
|
|
|
deploy_challenge() {
|
|
echo "
|
|
server 10.0.11.3
|
|
zone ${zone}.
|
|
update add $1.${zone}. 60 IN TXT \"$3\"
|
|
send
|
|
" | tee | nsupdate -y hmac-sha512:${acme_key_name}:${acme_key}
|
|
}
|
|
|
|
clean_challenge() {
|
|
echo "
|
|
server 10.0.11.3
|
|
zone ${zone}.
|
|
update delete $1.${zone}. TXT
|
|
send
|
|
" | tee | nsupdate -y hmac-sha512:${acme_key_name}:${acme_key}
|
|
}
|
|
|
|
deploy_cert() {
|
|
DOMAIN="$1"
|
|
KEYFILE="$2"
|
|
CERTFILE="$3"
|
|
FULLCHAINFILE="$4"
|
|
CHAINFILE="$5"
|
|
|
|
case $DOMAIN in
|
|
% for domain, conf in sorted(domains.items()):
|
|
<% if not conf: continue %>\
|
|
${domain})
|
|
% if conf.get('location', None):
|
|
cat "$KEYFILE" > "${conf['location']}/${conf.get('privkey_name', 'privkey.pem')}"
|
|
cat "$CERTFILE" > "${conf['location']}/${conf.get('cert_name', 'cert.pem')}"
|
|
cat "$FULLCHAINFILE" > "${conf['location']}/${conf.get('fullchain_name', 'fullchain.pem')}"
|
|
cat "$CHAINFILE" > "${conf['location']}/${conf.get('chain_name', 'chain.pem')}"
|
|
% endif
|
|
% if conf.get('owner', None):
|
|
chown ${conf['owner']}:${conf.get('group', '')} \
|
|
"${conf['location']}/${conf.get('privkey_name', 'privkey.pem')}" \
|
|
"${conf['location']}/${conf.get('cert_name', 'cert.pem')}" \
|
|
"${conf['location']}/${conf.get('fullchain_name', 'fullchain.pem')}" \
|
|
"${conf['location']}/${conf.get('chain_name', 'chain.pem')}"
|
|
% endif
|
|
% for service in sorted(conf.get('reload', [])):
|
|
systemctl reload-or-restart ${service}
|
|
% endfor
|
|
% for service in sorted(conf.get('start', [])):
|
|
systemctl start ${service}
|
|
% endfor
|
|
;;
|
|
% endfor
|
|
esac
|
|
}
|
|
|
|
HANDLER="$1"; shift
|
|
if [[ $HANDLER =~ ^(deploy_cert|deploy_challenge|clean_challenge)$ ]]
|
|
then
|
|
"$HANDLER" "$@"
|
|
fi
|