Merge remote-tracking branch 'upstream/dev' into dev
3VAbdAVE
2 months ago
commit
b2eead386d
@ -0,0 +1,120 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
# Deploy certificates to a proxmox backup server using the API.
|
||||
#
|
||||
# Environment variables that can be set are:
|
||||
# `DEPLOY_PROXMOXBS_SERVER`: The hostname of the proxmox backup server. Defaults to
|
||||
# _cdomain.
|
||||
# `DEPLOY_PROXMOXBS_SERVER_PORT`: The port number the management interface is on.
|
||||
# Defaults to 8007.
|
||||
# `DEPLOY_PROXMOXBS_USER`: The user we'll connect as. Defaults to root.
|
||||
# `DEPLOY_PROXMOXBS_USER_REALM`: The authentication realm the user authenticates
|
||||
# with. Defaults to pam.
|
||||
# `DEPLOY_PROXMOXBS_API_TOKEN_NAME`: The name of the API token created for the
|
||||
# user account. Defaults to acme.
|
||||
# `DEPLOY_PROXMOXBS_API_TOKEN_KEY`: The API token. Required.
|
||||
|
||||
proxmoxbs_deploy() {
|
||||
_cdomain="$1"
|
||||
_ckey="$2"
|
||||
_ccert="$3"
|
||||
_cca="$4"
|
||||
_cfullchain="$5"
|
||||
|
||||
_debug _cdomain "$_cdomain"
|
||||
_debug2 _ckey "$_ckey"
|
||||
_debug _ccert "$_ccert"
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
# "Sane" defaults.
|
||||
_getdeployconf DEPLOY_PROXMOXBS_SERVER
|
||||
if [ -z "$DEPLOY_PROXMOXBS_SERVER" ]; then
|
||||
_target_hostname="$_cdomain"
|
||||
else
|
||||
_target_hostname="$DEPLOY_PROXMOXBS_SERVER"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_SERVER "$DEPLOY_PROXMOXBS_SERVER"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_SERVER "$_target_hostname"
|
||||
|
||||
_getdeployconf DEPLOY_PROXMOXBS_SERVER_PORT
|
||||
if [ -z "$DEPLOY_PROXMOXBS_SERVER_PORT" ]; then
|
||||
_target_port="8007"
|
||||
else
|
||||
_target_port="$DEPLOY_PROXMOXBS_SERVER_PORT"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_SERVER_PORT "$DEPLOY_PROXMOXBS_SERVER_PORT"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_SERVER_PORT "$_target_port"
|
||||
|
||||
# Complete URL.
|
||||
_target_url="https://${_target_hostname}:${_target_port}/api2/json/nodes/localhost/certificates/custom"
|
||||
_debug TARGET_URL "$_target_url"
|
||||
|
||||
# More "sane" defaults.
|
||||
_getdeployconf DEPLOY_PROXMOXBS_USER
|
||||
if [ -z "$DEPLOY_PROXMOXBS_USER" ]; then
|
||||
_proxmoxbs_user="root"
|
||||
else
|
||||
_proxmoxbs_user="$DEPLOY_PROXMOXBS_USER"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_USER "$DEPLOY_PROXMOXBS_USER"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_USER "$_proxmoxbs_user"
|
||||
|
||||
_getdeployconf DEPLOY_PROXMOXBS_USER_REALM
|
||||
if [ -z "$DEPLOY_PROXMOXBS_USER_REALM" ]; then
|
||||
_proxmoxbs_user_realm="pam"
|
||||
else
|
||||
_proxmoxbs_user_realm="$DEPLOY_PROXMOXBS_USER_REALM"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_USER_REALM "$DEPLOY_PROXMOXBS_USER_REALM"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_USER_REALM "$_proxmoxbs_user_realm"
|
||||
|
||||
_getdeployconf DEPLOY_PROXMOXBS_API_TOKEN_NAME
|
||||
if [ -z "$DEPLOY_PROXMOXBS_API_TOKEN_NAME" ]; then
|
||||
_proxmoxbs_api_token_name="acme"
|
||||
else
|
||||
_proxmoxbs_api_token_name="$DEPLOY_PROXMOXBS_API_TOKEN_NAME"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_API_TOKEN_NAME "$DEPLOY_PROXMOXBS_API_TOKEN_NAME"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_API_TOKEN_NAME "$_proxmoxbs_api_token_name"
|
||||
|
||||
# This is required.
|
||||
_getdeployconf DEPLOY_PROXMOXBS_API_TOKEN_KEY
|
||||
if [ -z "$DEPLOY_PROXMOXBS_API_TOKEN_KEY" ]; then
|
||||
_err "API key not provided."
|
||||
return 1
|
||||
else
|
||||
_proxmoxbs_api_token_key="$DEPLOY_PROXMOXBS_API_TOKEN_KEY"
|
||||
_savedeployconf DEPLOY_PROXMOXBS_API_TOKEN_KEY "$DEPLOY_PROXMOXBS_API_TOKEN_KEY"
|
||||
fi
|
||||
_debug2 DEPLOY_PROXMOXBS_API_TOKEN_KEY "$_proxmoxbs_api_token_key"
|
||||
|
||||
# PBS API Token header value. Used in "Authorization: PBSAPIToken".
|
||||
_proxmoxbs_header_api_token="${_proxmoxbs_user}@${_proxmoxbs_user_realm}!${_proxmoxbs_api_token_name}:${_proxmoxbs_api_token_key}"
|
||||
_debug2 "Auth Header" "$_proxmoxbs_header_api_token"
|
||||
|
||||
# Ugly. I hate putting heredocs inside functions because heredocs don't
|
||||
# account for whitespace correctly but it _does_ work and is several times
|
||||
# cleaner than anything else I had here.
|
||||
#
|
||||
# This dumps the json payload to a variable that should be passable to the
|
||||
# _psot function.
|
||||
_json_payload=$(
|
||||
cat <<HEREDOC
|
||||
{
|
||||
"certificates": "$(tr '\n' ':' <"$_cfullchain" | sed 's/:/\\n/g')",
|
||||
"key": "$(tr '\n' ':' <"$_ckey" | sed 's/:/\\n/g')",
|
||||
"node":"localhost",
|
||||
"restart":true,
|
||||
"force":true
|
||||
}
|
||||
HEREDOC
|
||||
)
|
||||
_debug2 Payload "$_json_payload"
|
||||
|
||||
_info "Push certificates to server"
|
||||
export HTTPS_INSECURE=1
|
||||
export _H1="Authorization: PBSAPIToken=${_proxmoxbs_header_api_token}"
|
||||
_post "$_json_payload" "$_target_url" "" POST "application/json"
|
||||
|
||||
}
|
||||
@ -0,0 +1,215 @@
|
||||
#!/usr/bin/env sh
|
||||
# shellcheck disable=SC2034
|
||||
dns_mijnhost_info='mijn.host
|
||||
Domains: mijn.host
|
||||
Site: mijn.host
|
||||
Docs: https://mijn.host/api/doc/
|
||||
Issues: https://github.com/acmesh-official/acme.sh/issues/6177
|
||||
Author: peterv99
|
||||
Options:
|
||||
MIJNHOST_API_KEY API Key
|
||||
'
|
||||
|
||||
######## Public functions ###################### Constants for your mijn-host API
|
||||
MIJNHOST_API="https://mijn.host/api/v2"
|
||||
|
||||
# Add TXT record for domain verification
|
||||
dns_mijnhost_add() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
|
||||
MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
|
||||
if [ -z "$MIJNHOST_API_KEY" ]; then
|
||||
MIJNHOST_API_KEY=""
|
||||
_err "You haven't specified your mijn-host API key yet."
|
||||
_err "Please add MIJNHOST_API_KEY to the env."
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Save the API key for future use
|
||||
_saveaccountconf_mutable MIJNHOST_API_KEY "$MIJNHOST_API_KEY"
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "Invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug2 _sub_domain "$_sub_domain"
|
||||
_debug2 _domain "$_domain"
|
||||
_debug "Adding DNS record" "${fulldomain}."
|
||||
|
||||
# Construct the API URL
|
||||
api_url="$MIJNHOST_API/domains/$_domain/dns"
|
||||
|
||||
# Getting previous records
|
||||
_mijnhost_rest GET "$api_url" ""
|
||||
|
||||
if [ "$_code" != "200" ]; then
|
||||
_err "Error getting current DNS enties ($_code)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
records=$(echo "$response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
|
||||
|
||||
_debug2 "Current records" "$records"
|
||||
|
||||
# Build the payload for the API
|
||||
data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"ttl\":300}"
|
||||
|
||||
_debug2 "Record to add" "$data"
|
||||
|
||||
# Updating the records
|
||||
updated_records=$(echo "$records" | sed -E "s/\]( *$)/,$data\]/")
|
||||
|
||||
_debug2 "Updated records" "$updated_records"
|
||||
|
||||
# data
|
||||
data="{\"records\": $updated_records}"
|
||||
|
||||
_mijnhost_rest PUT "$api_url" "$data"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
_info "DNS record succesfully added."
|
||||
return 0
|
||||
else
|
||||
_err "Error adding DNS record ($_code)."
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Remove TXT record after verification
|
||||
dns_mijnhost_rm() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
|
||||
MIJNHOST_API_KEY="${MIJNHOST_API_KEY:-$(_readaccountconf_mutable MIJNHOST_API_KEY)}"
|
||||
if [ -z "$MIJNHOST_API_KEY" ]; then
|
||||
MIJNHOST_API_KEY=""
|
||||
_err "You haven't specified your mijn-host API key yet."
|
||||
_err "Please add MIJNHOST_API_KEY to the env."
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "Detecting root zone for" "${fulldomain}."
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "Invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "Removing DNS record for TXT value" "${txtvalue}."
|
||||
|
||||
# Construct the API URL
|
||||
api_url="$MIJNHOST_API/domains/$_domain/dns"
|
||||
|
||||
# Get current records
|
||||
_mijnhost_rest GET "$api_url" ""
|
||||
|
||||
if [ "$_code" != "200" ]; then
|
||||
_err "Error getting current DNS enties ($_code)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug2 "Get current records response:" "$response"
|
||||
|
||||
records=$(echo "$response" | _egrep_o '"records":\[.*\]' | sed 's/"records"://')
|
||||
|
||||
_debug2 "Current records:" "$records"
|
||||
|
||||
updated_records=$(echo "$records" | sed -E "s/\{[^}]*\"value\":\"$txtvalue\"[^}]*\},?//g" | sed 's/,]/]/g')
|
||||
|
||||
_debug2 "Updated records:" "$updated_records"
|
||||
|
||||
# Build the new payload
|
||||
data="{\"records\": $updated_records}"
|
||||
|
||||
# Use the _put method to update the records
|
||||
_mijnhost_rest PUT "$api_url" "$data"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
_info "DNS record removed successfully."
|
||||
return 0
|
||||
else
|
||||
_err "Error removing DNS record ($_code)."
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Helper function to detect the root zone
|
||||
_get_root() {
|
||||
domain=$1
|
||||
|
||||
# Get current records
|
||||
_debug "Getting current domains"
|
||||
_mijnhost_rest GET "$MIJNHOST_API/domains" ""
|
||||
|
||||
if [ "$_code" != "200" ]; then
|
||||
_err "error getting current domains ($_code)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Extract root domains from response
|
||||
rootDomains=$(echo "$response" | _egrep_o '"domain":"[^"]*"' | sed -E 's/"domain":"([^"]*)"/\1/')
|
||||
_debug "Root domains:" "$rootDomains"
|
||||
|
||||
for rootDomain in $rootDomains; do
|
||||
if _contains "$domain" "$rootDomain"; then
|
||||
_domain="$rootDomain"
|
||||
_sub_domain=$(echo "$domain" | sed "s/.$rootDomain//g")
|
||||
_debug "Found root domain" "$_domain" "and subdomain" "$_sub_domain" "for" "$domain"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# Helper function for rest calls
|
||||
_mijnhost_rest() {
|
||||
m=$1
|
||||
ep="$2"
|
||||
data="$3"
|
||||
|
||||
MAX_REQUEST_RETRY_TIMES=15
|
||||
_request_retry_times=0
|
||||
_retry_sleep=5 #Initial sleep time in seconds.
|
||||
|
||||
while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
|
||||
_debug2 _request_retry_times "$_request_retry_times"
|
||||
export _H1="API-Key: $MIJNHOST_API_KEY"
|
||||
export _H2="Content-Type: application/json"
|
||||
# clear headers from previous request to avoid getting wrong http code on timeouts
|
||||
: >"$HTTP_HEADER"
|
||||
_debug "$ep"
|
||||
if [ "$m" != "GET" ]; then
|
||||
_debug2 "data $data"
|
||||
response="$(_post "$data" "$ep" "" "$m")"
|
||||
else
|
||||
response="$(_get "$ep")"
|
||||
fi
|
||||
_ret="$?"
|
||||
_debug2 "response $response"
|
||||
_code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
|
||||
_debug "http response code $_code"
|
||||
if [ "$_code" = "401" ]; then
|
||||
# we have an invalid API token, maybe it is expired?
|
||||
_err "Access denied. Invalid API token."
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [ "$_ret" != "0" ] || [ -z "$_code" ] || [ "$_code" = "400" ] || _contains "$response" "DNS records not managed by mijn.host"; then #Sometimes API errors out
|
||||
_request_retry_times="$(_math "$_request_retry_times" + 1)"
|
||||
_info "REST call error $_code retrying $ep in ${_retry_sleep}s"
|
||||
_sleep "$_retry_sleep"
|
||||
_retry_sleep="$(_math "$_retry_sleep" \* 2)"
|
||||
continue
|
||||
fi
|
||||
break
|
||||
done
|
||||
if [ "$_request_retry_times" = "$MAX_REQUEST_RETRY_TIMES" ]; then
|
||||
_err "Error mijn.host API call was retried $MAX_REQUEST_RETRY_TIMES times."
|
||||
_err "Calling $ep failed."
|
||||
return 1
|
||||
fi
|
||||
response="$(echo "$response" | _normalizeJson)"
|
||||
return 0
|
||||
}
|
||||
Loading…
Reference in New Issue