applications/luci-app-acme/luasrc/model/cbi/acme.lua

   1 --[[
   2 LuCI - Lua Configuration Interface
   3
   4 Copyright 2016 Toke Høiland-Jørgensen <toke@toke.dk>
   5
   6 # This program is free software; you can redistribute it and/or modify it under
   7 # the terms of the GNU General Public License as published by the Free Software
   8 # Foundation; either version 3 of the License, or (at your option) any later
   9 # version.
  10
  11 ]]--
  12
  13 local fs = require "nixio.fs"
  14
  15 local nginx_presence = fs.access("/usr/sbin/nginx") or false
  16 local uhttpd_presence = fs.access("/usr/sbin/uhttpd") or false
  17
  18 m = Map("acme", translate("ACME certificates"),
  19         translate("This configures ACME (Letsencrypt) automatic certificate installation. " ..
  20                   "Simply fill out this to have the router configured with Letsencrypt-issued " ..
  21                   "certificates for the web interface. " ..
  22                   "Note that the domain names in the certificate must already be configured to " ..
  23                   "point at the router's public IP address. " ..
  24                   "Once configured, issuing certificates can take a while. " ..
  25                   "Check the logs for progress and any errors."))
  26
  27 s = m:section(TypedSection, "acme", translate("ACME global config"))
  28 s.anonymous = true
  29
  30 st = s:option(Value, "state_dir", translate("State directory"),
  31               translate("Where certs and other state files are kept."))
  32 st.rmempty = false
  33 st.datatype = "directory"
  34
  35 ae = s:option(Value, "account_email", translate("Account email"),
  36               translate("Email address to associate with account key."))
  37 ae.rmempty = false
  38 ae.datatype = "minlength(1)"
  39
  40 d = s:option(Flag, "debug", translate("Enable debug logging"))
  41 d.rmempty = false
  42
  43 cs = m:section(TypedSection, "cert", translate("Certificate config"))
  44 cs.anonymous = false
  45 cs.addremove = true
  46
  47 e = cs:option(Flag, "enabled", translate("Enabled"))
  48 e.rmempty = false
  49
  50 us = cs:option(Flag, "use_staging", translate("Use staging server"),
  51                translate("Get certificate from the Letsencrypt staging server " ..
  52                          "(use for testing; the certificate won't be valid)."))
  53 us.rmempty = false
  54
  55 kl = cs:option(ListValue, "keylength", translate("Key size"),
  56                translate("Key size (and type) for the generated certificate."))
  57 kl:value("2048", "RSA 2048 bits")
  58 kl:value("3072", "RSA 3072 bits")
  59 kl:value("4096", "RSA 4096 bits")
  60 kl:value("ec-256", "ECC 256 bits")
  61 kl:value("ec-384", "ECC 384 bits")
  62 kl.default = "2048"
  63 kl.rmempty = false
  64
  65 if uhttpd_presence then
  66 u = cs:option(Flag, "update_uhttpd", translate("Use for uhttpd"),
  67               translate("Update the uhttpd config with this certificate once issued " ..
  68                         "(only select this for one certificate)." ..
  69                         "Is also available luci-app-uhttpd to configure uhttpd form the LuCI interface."))
  70 u.rmempty = false
  71 end
  72
  73 if nginx_presence then
  74 u = cs:option(Flag, "update_nginx", translate("Use for nginx"),
  75               translate("Update the nginx config with this certificate once issued " ..
  76                         "(only select this for one certificate)." ..
  77                         "Nginx must support ssl, if not it won't start as it needs to be " ..
  78                         "compiled with ssl support to use cert options"))
  79 u.rmempty = false
  80 end
  81
  82 wr = cs:option(Value, "webroot", translate("Webroot directory"),
  83                translate("Webserver root directory. Set this to the webserver " ..
  84                          "document root to run Acme in webroot mode. The web " ..
  85                          "server must be accessible from the internet on port 80."))
  86 wr.optional = true
  87
  88 dom = cs:option(DynamicList, "domains", translate("Domain names"),
  89                 translate("Domain names to include in the certificate. " ..
  90                           "The first name will be the subject name, subsequent names will be alt names. " ..
  91                           "Note that all domain names must point at the router in the global DNS."))
  92 dom.datatype = "list(string)"
  93
  94 dns = cs:option(Value, "dns", translate("DNS API"),
  95                 translate("To use DNS mode to issue certificates, set this to the name of a DNS API supported by acme.sh. " ..
  96                           "See https://github.com/acmesh-official/acme.sh/wiki/dnsapi for the list of available APIs. " ..
  97                           "In DNS mode, the domain name does not have to resolve to the router IP. " ..
  98                           "DNS mode is also the only mode that supports wildcard certificates. " ..
  99                           "Using this mode requires the acme-dnsapi package to be installed."))
 100
 101 cred = cs:option(DynamicList, "credentials", translate("DNS API credentials"),
 102                  translate("The credentials for the DNS API mode selected above. " ..
 103                            "See https://github.com/acmesh-official/acme.sh/wiki/dnsapi for the format of credentials required by each API. " ..
 104                            "Add multiple entries here in KEY=VAL shell variable format to supply multiple credential variables."))
 105 cred.datatype = "list(string)"
 106
 107 calias = cs:option(Value, "calias", translate("Challenge Alias"),
 108                 translate("The challenge alias to use for ALL domains. " ..
 109                 "See https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode for the details of this process. " ..
 110                 "LUCI only supports one challenge alias per certificate."))
 111
 112 dalias = cs:option(Value, "dalias", translate("Domain Alias"),
 113                 translate("The domain alias to use for ALL domains. " ..
 114                 "See https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode for the details of this process. " ..
 115                 "LUCI only supports one challenge domain per certificate."))
 116
 117 return m