From a1d617bd8b43bde0d1e064653a6ff0ccb107f560 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= Date: Fri, 5 Aug 2016 17:26:25 +0200 Subject: [PATCH] acme: Add package. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This adds a package wrapping the acme.sh script from https://github.com/Neilpang/acme.sh in Uci config and hooks to interact correctly with uhttpd. Signed-off-by: Toke Høiland-Jørgensen --- net/acme/Makefile | 58 ++++++++ net/acme/files/acme.config | 11 ++ net/acme/files/acme.init | 34 +++++ net/acme/files/run.sh | 144 +++++++++++++++++++ net/acme/patches/0001-remove-timestamp.patch | 14 ++ 5 files changed, 261 insertions(+) create mode 100644 net/acme/Makefile create mode 100644 net/acme/files/acme.config create mode 100644 net/acme/files/acme.init create mode 100644 net/acme/files/run.sh create mode 100644 net/acme/patches/0001-remove-timestamp.patch diff --git a/net/acme/Makefile b/net/acme/Makefile new file mode 100644 index 000000000..f2e179beb --- /dev/null +++ b/net/acme/Makefile @@ -0,0 +1,58 @@ +# +# Copyright (C) 2016 Toke Høiland-Jørgensen +# +# This is free software, licensed under the GNU General Public License v3 or +# later. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=acme +PKG_SOURCE_VERSION:=1e6b68f5d187fa3d64c889d04a77ee1c79726282 +PKG_VERSION:=1.0 +PKG_RELEASE:=1 +PKG_LICENSE:=GPLv3 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE).tar.xz +PKG_SOURCE_URL:=git://github.com/Neilpang/acme.sh.git +PKG_SOURCE_PROTO:=git +PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE) +PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE) + +include $(INCLUDE_DIR)/package.mk + +define Package/acme + SECTION:=net + CATEGORY:=Network + DEPENDS:=+curl +ca-certificates +uhttpd-mod-tls +openssl-util + TITLE:=ACME (Letsencrypt) client + PKGARCH:=all + MAINTAINER:=Toke Høiland-Jørgensen +endef + +define Package/acme/description + A client for issuing Letsencrypt certificates. +endef + +define Package/acme/conffiles +/etc/config/acme +/etc/acme +endef + +define Build/Configure +endef + +define Build/Compile +endef + +define Package/acme/install + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/acme.config $(1)/etc/config/acme + $(INSTALL_DIR) $(1)/etc/init.d + $(INSTALL_BIN) ./files/acme.init $(1)/etc/init.d/acme + $(INSTALL_DIR) $(1)/usr/lib/acme + $(INSTALL_BIN) ./files/run.sh $(1)/usr/lib/acme/run-acme + $(INSTALL_BIN) $(PKG_BUILD_DIR)/acme.sh $(1)/usr/lib/acme/acme.sh +endef + +$(eval $(call BuildPackage,acme)) diff --git a/net/acme/files/acme.config b/net/acme/files/acme.config new file mode 100644 index 000000000..7fce6982b --- /dev/null +++ b/net/acme/files/acme.config @@ -0,0 +1,11 @@ +config acme 'main' + option state_dir '/etc/acme' + option account_email 'email@example.org' + option debug 0 + +config cert 'example' + option enabled 0 + option use_staging 0 + option keylength 2048 + option update_uhttpd 1 + list domains example.org diff --git a/net/acme/files/acme.init b/net/acme/files/acme.init new file mode 100644 index 000000000..6de12b7d0 --- /dev/null +++ b/net/acme/files/acme.init @@ -0,0 +1,34 @@ +#!/bin/sh /etc/rc.common + +USE_PROCD=1 + +START=50 +SCRIPT=/usr/lib/acme/run-acme + +start_service() +{ + procd_open_instance + procd_set_param command $SCRIPT + procd_set_param file /etc/config/acme + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_close_instance +} + +reload_service() { + rc_procd start_service "$@" + return 0 +} + +stop_service() { + return 0 +} + +boot() { + $SCRIPT check_cron +} + +service_triggers() +{ + procd_add_reload_trigger acme +} diff --git a/net/acme/files/run.sh b/net/acme/files/run.sh new file mode 100644 index 000000000..de303d5f0 --- /dev/null +++ b/net/acme/files/run.sh @@ -0,0 +1,144 @@ +#!/bin/sh +# Wrapper for acme.sh to work on openwrt. +# +# This program is free software; you can redistribute it and/or modify it under +# the terms of the GNU General Public License as published by the Free Software +# Foundation; either version 3 of the License, or (at your option) any later +# version. +# +# Author: Toke Høiland-Jørgensen + +CHECK_CRON=$1 +ACME=/usr/lib/acme/acme.sh +export SSL_CERT_DIR=/etc/ssl/certs + +UHTTPD_REDIRECT_HTTPS= +UHTTPD_LISTEN_HTTP= +STATE_DIR='/etc/acme' +ACCOUNT_EMAIL= +DEBUG=0 + +. /lib/functions.sh + +check_cron() +{ + [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return + echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root + /etc/init.d/cron start +} + +pre_checks() +{ + echo "Running pre checks." + check_cron + + UHTTPD_REDIRECT_HTTPS=$(uci get uhttpd.main.redirect_https) + UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http) + + uci set uhttpd.main.redirect_https=1 + uci set uhttpd.main.listen_http='0.0.0.0:80' + uci commit uhttpd + /etc/init.d/uhttpd reload || return 1 + + iptables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1 + return 0 +} + +post_checks() +{ + echo "Running post checks (cleanup)." + iptables -D input_rule -p tcp --dport 80 -j ACCEPT + + uci set uhttpd.main.redirect_https="$UHTTPD_REDIRECT_HTTPS" + uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP" + uci commit uhttpd + /etc/init.d/uhttpd reload +} + +err_out() +{ + post_checks + exit 1 +} + +int_out() +{ + post_checks + trap - SIGINT + kill -SIGINT $$ +} + +issue_cert() +{ + local section="$1" + local acme_args= + local enabled + local use_staging + local update_uhttpd + local keylength + local domains + local main_domain + + config_get_bool enabled "$section" enabled 0 + config_get_bool use_staging "$section" use_staging + config_get_bool update_uhttpd "$section" update_uhttpd + config_get domains "$section" domains + config_get keylength "$section" keylength + + [ "$enabled" -eq "1" ] || return + + [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug" + + set -- $domains + main_domain=$1 + + if [ -e "$STATE_DIR/$main_domain" ]; then + $ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1 + return 0 + fi + + + acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)" + acme_args="$acme_args --webroot $(uci get uhttpd.main.home)" + acme_args="$acme_args --keylength $keylength" + [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL" + [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging" + + if ! $ACME --home "$STATE_DIR" --issue $acme_args; then + echo "Issuing cert for $main_domain failed. It may be necessary to remove $STATE_DIR/$main_domain to recover." >&2 + return 1 + fi + + if [ "$update_uhttpd" -eq "1" ]; then + uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key" + uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer" + # commit and reload is in post_checks + fi + +} + +load_vars() +{ + local section="$1" + + STATE_DIR=$(config_get "$section" state_dir) + ACCOUNT_EMAIL=$(config_get "$section" account_email) + DEBUG=$(config_get "$section" debug) +} + +if [ -n "$CHECK_CRON" ]; then + check_cron + exit 0 +fi + +config_load acme +config_foreach load_vars acme + +pre_checks || exit 1 +trap err_out SIGHUP SIGTERM +trap int_out SIGINT + +config_foreach issue_cert cert +post_checks + +exit 0 diff --git a/net/acme/patches/0001-remove-timestamp.patch b/net/acme/patches/0001-remove-timestamp.patch new file mode 100644 index 000000000..989429514 --- /dev/null +++ b/net/acme/patches/0001-remove-timestamp.patch @@ -0,0 +1,14 @@ +--- a/acme.sh 2016-08-05 17:00:58.000000000 +0200 ++++ b/acme.sh 2016-08-05 17:13:58.582459764 +0200 +@@ -48,9 +48,9 @@ + + _info() { + if [ -z "$2" ] ; then +- echo "[$(date)] $1" ++ echo "$1" + else +- echo "[$(date)] $1='$2'" ++ echo "$1='$2'" + fi + } +