net/acme/files/run.sh

   1 #!/bin/sh
   2 # Wrapper for acme.sh to work on openwrt.
   3 #
   4 # This program is free software; you can redistribute it and/or modify it under
   5 # the terms of the GNU General Public License as published by the Free Software
   6 # Foundation; either version 3 of the License, or (at your option) any later
   7 # version.
   8 #
   9 # Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10
  11 CHECK_CRON=$1
  12 ACME=/usr/lib/acme/acme.sh
  13 # We export both ca variables in an attempts to keep backwards
  14 # compatibility with older versions of curl that was linked against
  15 # openssl
  16 export SSL_CERT_DIR=/etc/ssl/certs
  17 export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
  18 export NO_TIMESTAMP=1
  19
  20 UHTTPD_LISTEN_HTTP=
  21 STATE_DIR='/etc/acme'
  22 ACCOUNT_EMAIL=
  23 DEBUG=0
  24
  25 . /lib/functions.sh
  26
  27 check_cron()
  28 {
  29     [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
  30     echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
  31     /etc/init.d/cron start
  32 }
  33
  34 debug()
  35 {
  36     [ "$DEBUG" -eq "1" ] && echo "$@" >&2
  37 }
  38
  39 pre_checks()
  40 {
  41     echo "Running pre checks."
  42     check_cron
  43
  44     [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
  45
  46     if [ -e /etc/init.d/uhttpd ]; then
  47
  48        UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
  49
  50        uci set uhttpd.main.listen_http=''
  51        uci commit uhttpd
  52        /etc/init.d/uhttpd reload || return 1
  53     fi
  54
  55     iptables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
  56     ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
  57     debug "v4 input_rule: $(iptables -nvL input_rule)"
  58     debug "v6 input_rule: $(ip6tables -nvL input_rule)"
  59     debug "port80 listens: $(netstat -ntpl | grep :80)"
  60     return 0
  61 }
  62
  63 post_checks()
  64 {
  65     echo "Running post checks (cleanup)."
  66     iptables -D input_rule -p tcp --dport 80 -j ACCEPT
  67     ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT
  68
  69     if [ -e /etc/init.d/uhttpd ]; then
  70         uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  71         uci commit uhttpd
  72         /etc/init.d/uhttpd reload
  73     fi
  74 }
  75
  76 err_out()
  77 {
  78     post_checks
  79     exit 1
  80 }
  81
  82 int_out()
  83 {
  84     post_checks
  85     trap - INT
  86     kill -INT $$
  87 }
  88
  89 is_staging()
  90 {
  91     local main_domain="$1"
  92
  93     grep -q "acme-staging" "$STATE_DIR/$main_domain/${main_domain}.conf"
  94     return $?
  95 }
  96
  97 issue_cert()
  98 {
  99     local section="$1"
 100     local acme_args=
 101     local enabled
 102     local use_staging
 103     local update_uhttpd
 104     local keylength
 105     local domains
 106     local main_domain
 107     local moved_staging=0
 108     local failed_dir
 109
 110     config_get_bool enabled "$section" enabled 0
 111     config_get_bool use_staging "$section" use_staging
 112     config_get_bool update_uhttpd "$section" update_uhttpd
 113     config_get domains "$section" domains
 114     config_get keylength "$section" keylength
 115
 116     [ "$enabled" -eq "1" ] || return
 117
 118     [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
 119
 120     set -- $domains
 121     main_domain=$1
 122
 123     if [ -e "$STATE_DIR/$main_domain" ]; then
 124         if [ "$use_staging" -eq "0" ] && is_staging "$main_domain"; then
 125             echo "Found previous cert issued using staging server. Moving it out of the way."
 126             mv "$STATE_DIR/$main_domain" "$STATE_DIR/$main_domain.staging"
 127             moved_staging=1
 128         else
 129             echo "Found previous cert config. Issuing renew."
 130             $ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1
 131             return 0
 132         fi
 133     fi
 134
 135
 136     acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
 137     acme_args="$acme_args --standalone"
 138     acme_args="$acme_args --keylength $keylength"
 139     [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
 140     [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
 141
 142     if ! $ACME --home "$STATE_DIR" --issue $acme_args; then
 143         failed_dir="$STATE_DIR/${main_domain}.failed-$(date +%s)"
 144         echo "Issuing cert for $main_domain failed. Moving state to $failed_dir" >&2
 145         [ -d "$STATE_DIR/$main_domain" ] && mv "$STATE_DIR/$main_domain" "$failed_dir"
 146         if [ "$moved_staging" -eq "1" ]; then
 147             echo "Restoring staging certificate" >&2
 148             mv "$STATE_DIR/${main_domain}.staging" "$STATE_DIR/${main_domain}"
 149         fi
 150         return 1
 151     fi
 152
 153     if [ "$update_uhttpd" -eq "1" ]; then
 154         uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
 155         uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
 156         # commit and reload is in post_checks
 157     fi
 158
 159 }
 160
 161 load_vars()
 162 {
 163     local section="$1"
 164
 165     STATE_DIR=$(config_get "$section" state_dir)
 166     ACCOUNT_EMAIL=$(config_get "$section" account_email)
 167     DEBUG=$(config_get "$section" debug)
 168 }
 169
 170 if [ -n "$CHECK_CRON" ]; then
 171     check_cron
 172     exit 0
 173 fi
 174
 175 config_load acme
 176 config_foreach load_vars acme
 177
 178 pre_checks || exit 1
 179 trap err_out HUP TERM
 180 trap int_out INT
 181
 182 config_foreach issue_cert cert
 183 post_checks
 184
 185 exit 0