You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

181 lines
4.5 KiB

  1. #!/bin/sh
  2. # Wrapper for acme.sh to work on openwrt.
  3. #
  4. # This program is free software; you can redistribute it and/or modify it under
  5. # the terms of the GNU General Public License as published by the Free Software
  6. # Foundation; either version 3 of the License, or (at your option) any later
  7. # version.
  8. #
  9. # Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10. CHECK_CRON=$1
  11. ACME=/usr/lib/acme/acme.sh
  12. export SSL_CERT_DIR=/etc/ssl/certs
  13. export NO_TIMESTAMP=1
  14. UHTTPD_LISTEN_HTTP=
  15. STATE_DIR='/etc/acme'
  16. ACCOUNT_EMAIL=
  17. DEBUG=0
  18. . /lib/functions.sh
  19. check_cron()
  20. {
  21. [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
  22. echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
  23. /etc/init.d/cron start
  24. }
  25. debug()
  26. {
  27. [ "$DEBUG" -eq "1" ] && echo "$@" >&2
  28. }
  29. pre_checks()
  30. {
  31. echo "Running pre checks."
  32. check_cron
  33. [ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
  34. if [ -e /etc/init.d/uhttpd ]; then
  35. UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
  36. uci set uhttpd.main.listen_http=''
  37. uci commit uhttpd
  38. /etc/init.d/uhttpd reload || return 1
  39. fi
  40. iptables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
  41. ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
  42. debug "v4 input_rule: $(iptables -nvL input_rule)"
  43. debug "v6 input_rule: $(ip6tables -nvL input_rule)"
  44. debug "port80 listens: $(netstat -ntpl | grep :80)"
  45. return 0
  46. }
  47. post_checks()
  48. {
  49. echo "Running post checks (cleanup)."
  50. iptables -D input_rule -p tcp --dport 80 -j ACCEPT
  51. ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT
  52. if [ -e /etc/init.d/uhttpd ]; then
  53. uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
  54. uci commit uhttpd
  55. /etc/init.d/uhttpd reload
  56. fi
  57. }
  58. err_out()
  59. {
  60. post_checks
  61. exit 1
  62. }
  63. int_out()
  64. {
  65. post_checks
  66. trap - INT
  67. kill -INT $$
  68. }
  69. is_staging()
  70. {
  71. local main_domain="$1"
  72. grep -q "acme-staging" "$STATE_DIR/$main_domain/${main_domain}.conf"
  73. return $?
  74. }
  75. issue_cert()
  76. {
  77. local section="$1"
  78. local acme_args=
  79. local enabled
  80. local use_staging
  81. local update_uhttpd
  82. local keylength
  83. local domains
  84. local main_domain
  85. local moved_staging=0
  86. local failed_dir
  87. config_get_bool enabled "$section" enabled 0
  88. config_get_bool use_staging "$section" use_staging
  89. config_get_bool update_uhttpd "$section" update_uhttpd
  90. config_get domains "$section" domains
  91. config_get keylength "$section" keylength
  92. [ "$enabled" -eq "1" ] || return
  93. [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
  94. set -- $domains
  95. main_domain=$1
  96. if [ -e "$STATE_DIR/$main_domain" ]; then
  97. if [ "$use_staging" -eq "0" ] && is_staging "$main_domain"; then
  98. echo "Found previous cert issued using staging server. Moving it out of the way."
  99. mv "$STATE_DIR/$main_domain" "$STATE_DIR/$main_domain.staging"
  100. moved_staging=1
  101. else
  102. echo "Found previous cert config. Issuing renew."
  103. $ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1
  104. return 0
  105. fi
  106. fi
  107. acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
  108. acme_args="$acme_args --standalone"
  109. acme_args="$acme_args --keylength $keylength"
  110. [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
  111. [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
  112. if ! $ACME --home "$STATE_DIR" --issue $acme_args; then
  113. failed_dir="$STATE_DIR/${main_domain}.failed-$(date +%s)"
  114. echo "Issuing cert for $main_domain failed. Moving state to $failed_dir" >&2
  115. [ -d "$STATE_DIR/$main_domain" ] && mv "$STATE_DIR/$main_domain" "$failed_dir"
  116. if [ "$moved_staging" -eq "1" ]; then
  117. echo "Restoring staging certificate" >&2
  118. mv "$STATE_DIR/${main_domain}.staging" "$STATE_DIR/${main_domain}"
  119. fi
  120. return 1
  121. fi
  122. if [ "$update_uhttpd" -eq "1" ]; then
  123. uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
  124. uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
  125. # commit and reload is in post_checks
  126. fi
  127. }
  128. load_vars()
  129. {
  130. local section="$1"
  131. STATE_DIR=$(config_get "$section" state_dir)
  132. ACCOUNT_EMAIL=$(config_get "$section" account_email)
  133. DEBUG=$(config_get "$section" debug)
  134. }
  135. if [ -n "$CHECK_CRON" ]; then
  136. check_cron
  137. exit 0
  138. fi
  139. config_load acme
  140. config_foreach load_vars acme
  141. pre_checks || exit 1
  142. trap err_out HUP TERM
  143. trap int_out INT
  144. config_foreach issue_cert cert
  145. post_checks
  146. exit 0