blob: 1bb9b0396cb00d4df096240d44420e23ccc6a543 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
#!/bin/sh
# acme user's setup script
set -ex
cd "$HOME"
if ! [ -e "sign.sec" ] ; then
rm -f sign.pub || echo ""
signify -G -n -p sign.pub -s sign.sec
fi
cat sign.pub
if ! [ -e "age.key" ] ; then
age-keygen -o age.key
fi
if [ -n "$AGE_RECIPIENTS" ] ; then
echo "$AGE_RECIPIENTS" > recipients.txt
fi
awk '/public key/{print $4}' age.key >> recipients.txt
if [ -z "$ACME_EMAIL" ] ; then
echo "ACME_EMAIL must be set"
exit 1
fi
if [ -z "$ACME_DELEGATION_DOMAIN" ] ; then
echo "ACME_DELEGATION_DOMAIN must be set"
exit 1
fi
if [ -z "$DOMAINS" ] ; then
echo "DOMAINS must be set"
exit 1
fi
cp /usr/bin/acme.sh ./
sh ./acme.sh --install \
--home "$HOME/acme_home" \
--config-home "$HOME/acme_conf" \
--cert-home "$HOME/certs" \
--accountemail "$ACME_EMAIL" \
--accountkey "$HOME/acme_account.key" \
--accountconf "$HOME/acme_account.conf" \
--no-cron
#shellcheck disable=SC1091
. "$HOME/acme_home/acme.sh.env"
acme.sh --upgrade
for domain in $DOMAINS ; do
#shellcheck disable=SC2086
if ! [ -f "certs/$domain/$domain.cer" ] ; then
acme.sh $ACMESH_FLAGS \
--issue \
--dns dns_aws \
--challenge-alias "$ACME_DELEGATION_DOMAIN" \
-d "$domain" -d "*.${domain}"
fi
cd "certs/$domain"
sha256sum "${domain}.cer" "${domain}.key" \
> "/var/www/acme/${domain}.sha256sum"
age -e -a -R "$HOME"/recipients.txt "${domain}.key" \
> "/var/www/acme/${domain}.key.enc"
cp "${domain}.cer" /var/www/acme/
cp "fullchain.cer" /var/www/acme/"${domain}".fullchain
cd /var/www/acme
sha256sum "${domain}.fullchain" >> "${domain}.sha256sum"
sha256sum "${domain}.key.enc" >> "${domain}.sha256sum"
rm -f "${domain}.sha256sum.sig" || echo ""
signify -S -m "${domain}.sha256sum" -s "$HOME/sign.sec" \
-x "${domain}.sha256sum.sig"
cd "$HOME"
done
cp sign.pub /var/www/acme/
|
