27 lines
819 B
Bash
27 lines
819 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ ${EUID} -ne 0 ]]; then
|
|
echo "This script must run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
DOMAIN=ck.yydd.ai
|
|
TLS_ROOT=/etc/cangku-tls
|
|
CF_CREDENTIALS=${TLS_ROOT}/cloudflare.ini
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq certbot python3-certbot-dns-cloudflare >/dev/null
|
|
install -d -m 0700 "${TLS_ROOT}"
|
|
|
|
if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
|
|
if [[ ! -f "${CF_CREDENTIALS}" ]]; then
|
|
echo "Missing ${CF_CREDENTIALS}; store a scoped Cloudflare API token there with mode 0600" >&2
|
|
exit 1
|
|
fi
|
|
chmod 0600 "${CF_CREDENTIALS}"
|
|
certbot certonly --dns-cloudflare --dns-cloudflare-credentials "${CF_CREDENTIALS}" \
|
|
-d "${DOMAIN}" --email certs@yydd.ai --agree-tos --non-interactive --no-eff-email
|
|
fi
|
|
|
|
systemctl enable --now certbot.timer
|