58 lines
1.7 KiB
Bash
58 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ ${EUID} -ne 0 ]]; then
|
|
echo "This script must run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
DOMAIN=ck.yydd.ai
|
|
WEBROOT=/var/www/cangku-bootstrap-acme
|
|
TEMP_SITE=/etc/nginx/sites-available/cangku-bootstrap-acme
|
|
TLS_ROOT=/etc/cangku-tls
|
|
EAB_FILE=${TLS_ROOT}/eab.json
|
|
ACME_SERVER=https://acme.zerossl.com/v2/DV90
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq certbot >/dev/null
|
|
install -d -m 0755 "${WEBROOT}/.well-known/acme-challenge"
|
|
install -d -m 0700 "${TLS_ROOT}"
|
|
|
|
if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
|
|
if [[ ! -f "${EAB_FILE}" ]]; then
|
|
echo "Missing ${EAB_FILE}; create ZeroSSL EAB credentials and store them there with mode 0600" >&2
|
|
exit 1
|
|
fi
|
|
umask 0022
|
|
{
|
|
printf 'server {\n'
|
|
printf ' listen 80;\n'
|
|
printf ' listen [::]:80;\n'
|
|
printf ' server_name %s;\n' "${DOMAIN}"
|
|
printf ' location /.well-known/acme-challenge/ { root %s; }\n' "${WEBROOT}"
|
|
printf ' location / { return 404; }\n'
|
|
printf '}\n'
|
|
} > "${TEMP_SITE}"
|
|
ln -sfn "${TEMP_SITE}" /etc/nginx/sites-enabled/cangku-bootstrap-acme
|
|
nginx -t
|
|
systemctl reload nginx
|
|
readarray -t eab < <(python3 - "${EAB_FILE}" <<'PY'
|
|
import json
|
|
import sys
|
|
|
|
with open(sys.argv[1], encoding='utf-8') as handle:
|
|
value = json.load(handle)
|
|
print(value['eab_kid'])
|
|
print(value['eab_hmac_key'])
|
|
PY
|
|
)
|
|
certbot certonly --server "${ACME_SERVER}" \
|
|
--eab-kid "${eab[0]}" --eab-hmac-key "${eab[1]}" \
|
|
--webroot -w "${WEBROOT}" -d "${DOMAIN}" \
|
|
--email certs@yydd.ai --agree-tos --non-interactive --no-eff-email
|
|
unlink "${EAB_FILE}"
|
|
unlink /etc/nginx/sites-enabled/cangku-bootstrap-acme
|
|
unlink "${TEMP_SITE}"
|
|
fi
|
|
|
|
systemctl enable --now certbot.timer
|