Skip to content

Commit 73fdf4b

Browse files
authored
Merge pull request #6286 from acmesh-official/dev
sync
2 parents c459b5e + a1de136 commit 73fdf4b

File tree

10 files changed

+147
-13
lines changed

10 files changed

+147
-13
lines changed

Dockerfile

+5-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@ ARG AUTO_UPGRADE=1
2222
ENV AUTO_UPGRADE=$AUTO_UPGRADE
2323

2424
#Install
25-
COPY ./ /install_acme.sh/
25+
COPY ./acme.sh /install_acme.sh/acme.sh
26+
COPY ./deploy /install_acme.sh/deploy
27+
COPY ./dnsapi /install_acme.sh/dnsapi
28+
COPY ./notify /install_acme.sh/notify
29+
2630
RUN cd /install_acme.sh && ([ -f /install_acme.sh/acme.sh ] && /install_acme.sh/acme.sh --install || curl https://get.acme.sh | sh) && rm -rf /install_acme.sh/
2731

2832

acme.sh

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env sh
22

3-
VER=3.1.0
3+
VER=3.1.1
44

55
PROJECT_NAME="acme.sh"
66

@@ -921,6 +921,9 @@ _sed_i() {
921921
if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
922922
_debug "Using sed -i"
923923
sed -i "$options" "$filename"
924+
elif sed -h 2>&1 | grep "\-i extension" >/dev/null 2>&1; then
925+
_debug "Using FreeBSD sed -i"
926+
sed -i "" "$options" "$filename"
924927
else
925928
_debug "No -i support in sed"
926929
text="$(cat "$filename")"
@@ -5002,9 +5005,11 @@ $_authorizations_map"
50025005

50035006
_debug "Writing token: $token to $wellknown_path/$token"
50045007

5005-
mkdir -p "$wellknown_path"
5006-
5007-
if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
5008+
# Ensure .well-known is visible to web server user/group
5009+
# https://github.com/Neilpang/acme.sh/pull/32
5010+
if ! (umask ugo+rx &&
5011+
mkdir -p "$wellknown_path" &&
5012+
printf "%s" "$keyauthorization" >"$wellknown_path/$token"); then
50085013
_err "$d: Cannot write token to file: $wellknown_path/$token"
50095014
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
50105015
_clearup
@@ -7015,7 +7020,7 @@ Parameters:
70157020
70167021
--accountconf <file> Specifies a customized account config file.
70177022
--home <directory> Specifies the home dir for $PROJECT_NAME.
7018-
--cert-home <directory> Specifies the home dir to save all the certs, only valid for '--install' command.
7023+
--cert-home <directory> Specifies the home dir to save all the certs.
70197024
--config-home <directory> Specifies the home dir to save all the configurations.
70207025
--useragent <string> Specifies the user agent string. it will be saved for future use too.
70217026
-m, --email <email> Specifies the account email, only valid for the '--install' and '--update-account' command.

deploy/haproxy.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ haproxy_deploy() {
357357
_info "Update existing certificate '${_pem}' over HAProxy ${_socketname}."
358358
fi
359359
_socat_cert_set_cmd="echo -e '${_cmdpfx}set ssl cert ${_pem} <<\n$(cat "${_pem}")\n' | socat '${_statssock}' - | grep -q 'Transaction created'"
360-
_debug _socat_cert_set_cmd "${_socat_cert_set_cmd}"
360+
_secure_debug _socat_cert_set_cmd "${_socat_cert_set_cmd}"
361361
eval "${_socat_cert_set_cmd}"
362362
_ret=$?
363363
if [ "${_ret}" != "0" ]; then

deploy/routeros.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -144,8 +144,8 @@ source=\"/certificate remove [ find name=$_cdomain.cer_0 ];\
144144
\n/certificate remove [ find name=$_cdomain.cer_1 ];\
145145
\n/certificate remove [ find name=$_cdomain.cer_2 ];\
146146
\ndelay 1;\
147-
\n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\";\
148-
\n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\";\
147+
\n/certificate import file-name=\\\"$_cdomain.cer\\\" passphrase=\\\"\\\";\
148+
\n/certificate import file-name=\\\"$_cdomain.key\\\" passphrase=\\\"\\\";\
149149
\ndelay 1;\
150150
\n:do {/file remove $_cdomain.cer; } on-error={ }\
151151
\n:do {/file remove $_cdomain.key; } on-error={ }\

dnsapi/dns_freemyip.sh

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
#!/usr/bin/env sh
2+
# shellcheck disable=SC2034
3+
dns_freemyip_info='FreeMyIP.com
4+
Site: freemyip.com
5+
Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_freemyip
6+
Options:
7+
FREEMYIP_Token API Token
8+
Issues: github.com/acmesh-official/acme.sh/issues/{XXXX}
9+
Author: Recolic Keghart <[email protected]>, @Giova96
10+
'
11+
12+
FREEMYIP_DNS_API="https://freemyip.com/update?"
13+
14+
################ Public functions ################
15+
16+
#Usage: dns_freemyip_add fulldomain txtvalue
17+
dns_freemyip_add() {
18+
fulldomain="$1"
19+
txtvalue="$2"
20+
21+
_info "Add TXT record $txtvalue for $fulldomain using freemyip.com api"
22+
23+
FREEMYIP_Token="${FREEMYIP_Token:-$(_readaccountconf_mutable FREEMYIP_Token)}"
24+
if [ -z "$FREEMYIP_Token" ]; then
25+
FREEMYIP_Token=""
26+
_err "You don't specify FREEMYIP_Token yet."
27+
_err "Please specify your token and try again."
28+
return 1
29+
fi
30+
31+
#save the credentials to the account conf file.
32+
_saveaccountconf_mutable FREEMYIP_Token "$FREEMYIP_Token"
33+
34+
if _is_root_domain_published "$fulldomain"; then
35+
_err "freemyip API don't allow you to set multiple TXT record for the same subdomain!"
36+
_err "You must apply certificate for only one domain at a time!"
37+
_err "===="
38+
_err "For example, aaa.yourdomain.freemyip.com and bbb.yourdomain.freemyip.com and yourdomain.freemyip.com ALWAYS share the same TXT record. They will overwrite each other if you apply multiple domain at the same time."
39+
_debug "If you are testing this workflow in github pipeline or acmetest, please set TEST_DNS_NO_SUBDOMAIN=1 and TEST_DNS_NO_WILDCARD=1"
40+
return 1
41+
fi
42+
43+
# txtvalue must be url-encoded. But it's not necessary for acme txt value.
44+
_freemyip_get_until_ok "${FREEMYIP_DNS_API}token=$FREEMYIP_Token&domain=$fulldomain&txt=$txtvalue" 2>&1
45+
return $?
46+
}
47+
48+
#Usage: dns_freemyip_rm fulldomain txtvalue
49+
dns_freemyip_rm() {
50+
fulldomain="$1"
51+
txtvalue="$2"
52+
53+
_info "Delete TXT record $txtvalue for $fulldomain using freemyip.com api"
54+
55+
FREEMYIP_Token="${FREEMYIP_Token:-$(_readaccountconf_mutable FREEMYIP_Token)}"
56+
if [ -z "$FREEMYIP_Token" ]; then
57+
FREEMYIP_Token=""
58+
_err "You don't specify FREEMYIP_Token yet."
59+
_err "Please specify your token and try again."
60+
return 1
61+
fi
62+
63+
#save the credentials to the account conf file.
64+
_saveaccountconf_mutable FREEMYIP_Token "$FREEMYIP_Token"
65+
66+
# Leave the TXT record as empty or "null" to delete the record.
67+
_freemyip_get_until_ok "${FREEMYIP_DNS_API}token=$FREEMYIP_Token&domain=$fulldomain&txt=" 2>&1
68+
return $?
69+
}
70+
71+
################ Private functions below ################
72+
_get_root() {
73+
_fmi_d="$1"
74+
75+
echo "$_fmi_d" | rev | cut -d '.' -f 1-3 | rev
76+
}
77+
78+
# There is random failure while calling freemyip API too fast. This function automatically retry until success.
79+
_freemyip_get_until_ok() {
80+
_fmi_url="$1"
81+
for i in $(seq 1 8); do
82+
_debug "HTTP GET freemyip.com API '$_fmi_url', retry $i/8..."
83+
_get "$_fmi_url" | tee /dev/fd/2 | grep OK && return 0
84+
_sleep 1 # DO NOT send the request too fast
85+
done
86+
_err "Failed to request freemyip API: $_fmi_url . Server does not say 'OK'"
87+
return 1
88+
}
89+
90+
# Verify in public dns if domain is already there.
91+
_is_root_domain_published() {
92+
_fmi_d="$1"
93+
_webroot="$(_get_root "$_fmi_d")"
94+
95+
_info "Verifying '""$_fmi_d""' freemyip webroot (""$_webroot"") is not published yet"
96+
for i in $(seq 1 3); do
97+
_debug "'$_webroot' ns lookup, retry $i/3..."
98+
if [ "$(_ns_lookup "$_fmi_d" TXT)" ]; then
99+
_debug "'$_webroot' already has a TXT record published!"
100+
return 0
101+
fi
102+
_sleep 10 # Give it some time to propagate the TXT record
103+
done
104+
return 1
105+
}

dnsapi/dns_he_ddns.sh

+7-1
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,11 @@ dns_he_ddns_add() {
3434
_contains "$response" "good" && return 0 || return 1
3535
}
3636

37-
# dns_he_ddns_rm() is not implemented because the API call always updates the
37+
# dns_he_ddns_rm() is not doing anything because the API call always updates the
3838
# contents of the existing record (that the API key gives access to).
39+
40+
dns_he_ddns_rm() {
41+
fulldomain=$1
42+
_debug "Delete TXT record called for '${fulldomain}', not doing anything."
43+
return 0
44+
}

dnsapi/dns_hetzner.sh

100644100755
+1-1
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ _get_root() {
212212
_response_has_error() {
213213
unset _response_error
214214

215-
err_part="$(echo "$response" | _egrep_o '"error":{[^}]*}')"
215+
err_part="$(echo "$response" | _egrep_o '"error":\{[^\}]*\}')"
216216

217217
if [ -n "$err_part" ]; then
218218
err_code=$(echo "$err_part" | _egrep_o '"code":[0-9]+' | cut -d : -f 2)

notify/cqhttp.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ cqhttp_send() {
5252
_finalUrl="$CQHTTP_APIROOT$CQHTTP_APIPATH?access_token=$_access_token&user_id=$_user_id&message=$_message"
5353
response="$(_get "$_finalUrl")"
5454

55-
if [ "$?" = "0" ] && _contains "$response" "\"retcode\":0,\"status\":\"ok\""; then
55+
if [ "$?" = "0" ] && _contains "$response" "\"retcode\":0" && _contains "$response" "\"status\":\"ok\""; then
5656
_info "QQ send success."
5757
return 0
5858
fi

notify/ntfy.sh

+7
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
#NTFY_URL="https://ntfy.sh"
66
#NTFY_TOPIC="xxxxxxxxxxxxx"
7+
#NTFY_TOKEN="xxxxxxxxxxxxx"
78

89
ntfy_send() {
910
_subject="$1"
@@ -23,6 +24,12 @@ ntfy_send() {
2324
_saveaccountconf_mutable NTFY_TOPIC "$NTFY_TOPIC"
2425
fi
2526

27+
NTFY_TOKEN="${NTFY_TOKEN:-$(_readaccountconf_mutable NTFY_TOKEN)}"
28+
if [ "$NTFY_TOKEN" ]; then
29+
_saveaccountconf_mutable NTFY_TOKEN "$NTFY_TOKEN"
30+
export _H1="Authorization: Bearer $NTFY_TOKEN"
31+
fi
32+
2633
_data="${_subject}. $_content"
2734
response="$(_post "$_data" "$NTFY_URL/$NTFY_TOPIC" "" "POST" "")"
2835

notify/telegram.sh

+8-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
#TELEGRAM_BOT_APITOKEN=""
66
#TELEGRAM_BOT_CHATID=""
7+
#TELEGRAM_BOT_URLBASE=""
78

89
telegram_send() {
910
_subject="$1"
@@ -27,6 +28,12 @@ telegram_send() {
2728
fi
2829
_saveaccountconf_mutable TELEGRAM_BOT_CHATID "$TELEGRAM_BOT_CHATID"
2930

31+
TELEGRAM_BOT_URLBASE="${TELEGRAM_BOT_URLBASE:-$(_readaccountconf_mutable TELEGRAM_BOT_URLBASE)}"
32+
if [ -z "$TELEGRAM_BOT_URLBASE" ]; then
33+
TELEGRAM_BOT_URLBASE="https://api.telegram.org"
34+
fi
35+
_saveaccountconf_mutable TELEGRAM_BOT_URLBASE "$TELEGRAM_BOT_URLBASE"
36+
3037
_subject="$(printf "%s" "$_subject" | sed 's/\\/\\\\\\\\/g' | sed 's/\]/\\\\\]/g' | sed 's/\([_*[()~`>#+--=|{}.!]\)/\\\\\1/g')"
3138
_content="$(printf "%s" "$_content" | sed 's/\\/\\\\\\\\/g' | sed 's/\]/\\\\\]/g' | sed 's/\([_*[()~`>#+--=|{}.!]\)/\\\\\1/g')"
3239
_content="$(printf "*%s*\n%s" "$_subject" "$_content" | _json_encode)"
@@ -38,7 +45,7 @@ telegram_send() {
3845
_debug "$_data"
3946

4047
export _H1="Content-Type: application/json"
41-
_telegram_bot_url="https://api.telegram.org/bot${TELEGRAM_BOT_APITOKEN}/sendMessage"
48+
_telegram_bot_url="${TELEGRAM_BOT_URLBASE}/bot${TELEGRAM_BOT_APITOKEN}/sendMessage"
4249
if _post "$_data" "$_telegram_bot_url" >/dev/null; then
4350
# shellcheck disable=SC2154
4451
_message=$(printf "%s\n" "$response" | sed -n 's/.*"ok":\([^,]*\).*/\1/p')

0 commit comments

Comments
 (0)