75 lines
1.5 KiB
Text
75 lines
1.5 KiB
Text
|
#!/usr/bin/env bash
|
||
|
|
|
||
|
|
if [[ -z "$1" ]] || [[ "$1" == '--help' ]]
|
||
|
|
then
|
||
|
|
echo "Usage: $0 <wildcard-domain>"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
set -e
|
||
|
|
|
||
|
|
domain=$1
|
||
|
|
certalias="_.$1"
|
||
|
|
|
||
|
|
tmpdir=$(mktemp -d)
|
||
|
|
trap 'cd /; rm -Rf "$tmpdir"' EXIT
|
||
|
|
|
||
|
|
export BW_REPO_PATH="${BW_REPO_PATH:-$PWD}"
|
||
|
|
|
||
|
|
cd -- "$tmpdir"
|
||
|
|
git clone https://github.com/dehydrated-io/dehydrated.git
|
||
|
|
cd dehydrated
|
||
|
|
git checkout "$(git describe --tags --abbrev=0)"
|
||
|
|
|
||
|
|
cat >config <<EOF
|
||
|
|
BASEDIR=$tmpdir
|
||
|
|
KEYSIZE=4096
|
||
|
|
HOOK=$tmpdir/dehydrated/hook
|
||
|
|
RENEW_DAYS=90
|
||
|
|
CHALLENGETYPE=dns-01
|
||
|
|
EOF
|
||
|
|
|
||
|
|
cat >hook <<"EOF"
|
||
|
|
#!/usr/bin/env bash
|
||
|
|
|
||
|
|
if [[ "$1" == 'deploy_challenge' ]]
|
||
|
|
then
|
||
|
|
domain=$2
|
||
|
|
token_value=$4
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo You must now provide this DNS record:
|
||
|
|
echo "$(tput bold)_acme-challenge.$domain. IN TXT $token_value$(tput sgr0)"
|
||
|
|
echo
|
||
|
|
echo "Hit ENTER once it's available."
|
||
|
|
read
|
||
|
|
fi
|
||
|
|
EOF
|
||
|
|
chmod +x hook
|
||
|
|
|
||
|
|
cat <<EOF
|
||
|
|
|
||
|
|
You will soon be asked to create several DNS records.
|
||
|
|
$(tput bold)Please create all of them. The second one does NOT replace
|
||
|
|
the first one.$(tput sgr0)
|
||
|
|
|
||
|
|
EOF
|
||
|
|
|
||
|
|
./dehydrated --register --accept-terms -f config
|
||
|
|
./dehydrated -c -d "$domain" --alias "$certalias" -d "*.$domain" -f config
|
||
|
|
|
||
|
|
cd -- "$tmpdir"/certs/"$certalias"
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo Copying final files:
|
||
|
|
echo
|
||
|
|
bw_repo=$(bw debug -c 'print(repo.path)')
|
||
|
|
cp -v cert.pem "$bw_repo"/data/ssl/"$certalias".crt.pem
|
||
|
|
cp -v chain.pem "$bw_repo"/data/ssl/"$certalias".crt_intermediate.pem
|
||
|
|
|
||
|
|
echo "Encrypting private key via bw ..."
|
||
|
|
bw debug -c "repo.vault.encrypt_file('$tmpdir/certs/$certalias/privkey.pem', 'ssl/$certalias.key.pem.vault')"
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "Certificate and key created."
|