RecycledCloud/cdist-recycledcloud
Archived
6
0
Fork 0
Code Releases Activity

Import __uacme* and __recycledcloud_nginx* logic

Browse source
This commit is contained in:
Timothée Floure 2020-11-20 08:27:59 +01:00
parent ca4f833a56
commit 2dfb059b20
29 changed files with 792 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
type/__recycledcloud_nginx/man.rst Normal file
View file

@ -0,0 +1,33 @@
cdist-type__recycledcloud_nginx(7)
===================================
NAME
----
cdist-type__recycledcloud_nginx - Serve web content with NGINX
DESCRIPTION
-----------
Leverages `__recycledcloud_nginx_vhost` to serve web content.
REQUIRED PARAMETERS
-------------------
domain
Domain name to be served.
OPTIONAL PARAMETERS
-------------------
config
Custom NGINX logic, templated within a standard `server` section with
`server_name` and TLS parameters set. Defaults to simple static hosting.
AUTHORS
-------
Timothée Floure <timothee.floure@posteo.net>
COPYING
-------
Copyright \(C) 2020 Joachim Desroches. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

49
type/__recycledcloud_nginx/manifest Normal file
View file

@ -0,0 +1,49 @@
#!/bin/sh
os="$(cat "${__global:?}"/explorer/os)"
case "$os" in
alpine)
nginx_user=nginx
nginx_certdir=/etc/nginx/ssl
;;
*)
echo "This type does not support $os yet. Aborting." >&2;
exit 1;
;;
esac
if [ -f "${__object:?}/parameter/domain" ];
then
domain="$(cat "${__object:?}/parameter/domain")"
else
domain="${__object_id:?}"
fi
# Deploy simple HTTP vhost, allowing to serve ACME challenges.
__recycledcloud_nginx_vhost "301-to-https-$domain" \
--domain "$domain" --to-https
# Obtaining TLS cert.
__uacme_account
require="__recycledcloud_nginx_vhost/301-to-https-$domain __uacme_account" \
__uacme_obtain "$domain" --owner $nginx_user \
--install-key-to "$nginx_certdir/$domain/privkey.pem" \
--install-cert-to "/$nginx_certdir/$domain/fullchain.pem" \
--renew-hook "service nginx reload"
# Deploy HTTPS nginx vhost.
if [ -f "${__object:?}/parameter/config" ]; then
if [ "$(cat "${__object:?}/parameter/config")" = "-" ]; then
nginx_logic="${__object:?}/stdin"
else
nginx_logic="${__object:?}/parameter/config"
fi
mkdir -p "${__object:?}/files"
cat "$nginx_logic" > "${__object:?}/files/config"
require="__uacme_obtain/$domain" __recycledcloud_nginx_vhost "$domain" \
--config "${__object:?}/files/config"
else
require="__uacme_obtain/$domain" __recycledcloud_nginx_vhost "$domain"
fi

2
type/__recycledcloud_nginx/parameter/optional Normal file
View file

@ -0,0 +1,2 @@
config
domain

4
type/__recycledcloud_nginx_vhost/files/301-to-https Normal file
View file

@ -0,0 +1,4 @@
# Redirect request to this page in HTTPS.
location / {
return 301 https://$host$request_uri;
}

37
type/__recycledcloud_nginx_vhost/files/generic.conf.sh Executable file
View file

@ -0,0 +1,37 @@
#!/bin/sh
# Template for static NGINX hosting.
echo 'server {'
# Listen
cat <<- EOF
listen ${LPORT:?} $TLS;
listen [::]:${LPORT:?} $TLS;
EOF
# Name
echo "server_name ${DOMAIN:?};"
# ACME challenges.
cat << EOF
location /.well-known/acme-challenge/ {
alias ${ACME_CHALLENGE_DIR:?};
}
EOF
if [ -n "$TLS" ];
then
if [ -n "$HSTS" ];
then
echo 'include snippets/hsts;'
fi
cat <<- EOF
ssl_certificate ${NGINX_CERTDIR:?}/${DOMAIN:?}/fullchain.pem;
ssl_certificate_key ${NGINX_CERTDIR:?}/${DOMAIN:?}/privkey.pem;
EOF
fi
echo "${NGINX_LOGIC:?}"
echo '}'

1
type/__recycledcloud_nginx_vhost/files/hsts Normal file
View file

@ -0,0 +1 @@
add_header Strict-Transport-Security "max-age=31536000" always;

12
type/__recycledcloud_nginx_vhost/files/index.html Normal file
View file

@ -0,0 +1,12 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>cdist configured!</title>
</head>
<body>
You have successfully configured a vhost with
<a href="https://cdi.st">cdist</a>. You can now upload content!
</body>
</html>

13
type/__recycledcloud_nginx_vhost/files/static.conf.sh Executable file
View file

@ -0,0 +1,13 @@
#!/bin/sh
# Template for static NGINX hosting.
NGINX_LOGIC="$(cat << EOF
location / {
root ${NGINX_WEBROOT:?}/${DOMAIN:?};
index index.html;
}
EOF
)"
export NGINX_LOGIC
"${__object:?}/files/generic.conf.sh"

25
type/__recycledcloud_nginx_vhost/files/to-https.conf.sh Executable file
View file

@ -0,0 +1,25 @@
#!/bin/sh
# Template for HTTPS redirection.
echo 'server {'
# Listen
cat <<- EOF
listen ${LPORT:?};
listen [::]:${LPORT:?};
EOF
# Name
echo "server_name ${DOMAIN:?};"
# ACME challenges.
cat << EOF
location /.well-known/acme-challenge/ {
alias ${ACME_CHALLENGE_DIR:?};
}
EOF
# HTTPS redirection.
echo 'include snippets/301-to-https;'
echo '}'

15
type/__recycledcloud_nginx_vhost/gencode-remote Normal file
View file

@ -0,0 +1,15 @@
#!/bin/sh
# Check configuration and reload if valid.
# TODO: only check if configuration was changed (= listen for __file's
# messages).
cat << EOF
if nginx -t; then
service nginx --ifstarted reload
service nginx --ifstopped start
else
echo "NGINX configuration is invalid. Exiting." >2&
nginx -t >2&
exit 1
fi
EOF

80
type/__recycledcloud_nginx_vhost/man.rst Normal file
View file

@ -0,0 +1,80 @@
cdist-type__nginx_vhost(7)
===================================
NAME
----
cdist-type__nginx_vhost - Have nginx serve content for a virtual host
DESCRIPTION
-----------
This type setups up nginx with reasonable defaults and creates a vhost to be
served, optionally with TLS certificates obtained from the Let's Encrypt CA
through the ACME HTTP-01 challenge-response mechanism.
By default, if no rules are specified, then the vhost will serve as-is the
contents of the `WEBROOT/foo.com` directory, where WEBROOT is
determined depending on the OS, adhering as close to `hier(7)` as possible.
NGINX expects files in the vhost to be served to be at least readable by the
`USER` group, that it creates if it does not exist. It is recommended to have
the user owning the files to be someone else, and the files beeing
group-readable but not writeable.
Finally, if TLS is not disabled, then this type makes nginx expect the
fullchain certificate and the private key in
`CERTDIR/domain/{fullchain,privkey}.pem`.
+------------------+---------+-------------------+-----------------------------+
| Operating System | USER | WEBROOT | CERTDIR |
+==================+=========+===================+=============================+
| Alpine Linux | `nginx` | `/srv/www/` | `/etc/nginx/ssl/` |
+------------------+---------+-------------------+-----------------------------+
| Arch Linux | `www` | `/srv/www/` | `/etc/nginx/ssl/` |
+------------------+---------+-------------------+-----------------------------+
| FreeBSD | `www` | `/usr/local/www/` | `/usr/local/etc/nginx/ssl/` |
+------------------+---------+-------------------+-----------------------------+
OPTIONAL PARAMETERS
-------------------
config
A custom configuration file for the vhost, inserted in a server section
populated with `server_name` and TLS parameters unless `--standalone-config`
is specified. Can be specified either as a file path, or if the value of this
flag is '-', then the configuration is read from stdin.
domain
The domain this server will respond to. If this is omitted, then the
`__object_id` is used.
lport
The port to which we listen. If this is omitted, the defaults of `80` for
HTTP and `443` for HTTPS are used.
BOOLEAN PARAMETERS
------------------
no-hsts
Do not use HSTS pinning.
no-tls
Do not serve over HTTPS.
to-https
Ignore --config flag and redirect to HTTPS. Implies --no-tls.
standalone-config
Insert the content of
AUTHORS
-------
Joachim Desroches <joachim.desroches@epfl.ch>
Timothée Floure <timothee.floure@posteo.net>
COPYING
-------
Copyright \(C) 2020 Joachim Desroches. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

144
type/__recycledcloud_nginx_vhost/manifest Normal file
View file

@ -0,0 +1,144 @@
#!/bin/sh
#
# 2020 Joachim Desroches <joachim.desroches@epfl.ch>
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#
# Create NGINX vhosts
os="$(cat "${__global:?}"/explorer/os)"
mkdir -p "${__object:?}/files"
case "$os" in
"alpine")
__package nginx
nginx_confdir="/etc/nginx"
install_reqs="__package/nginx"
require="$install_reqs" __service nginx --action start
require="$install_reqs" __start_on_boot nginx
export NGINX_SITEDIR="$nginx_confdir/conf.d"
export NGINX_CERTDIR="$nginx_confdir/ssl"
export NGINX_SNIPPETSDIR="$nginx_confdir/snippets"
export NGINX_WEBROOT="/var/www"
export ACME_CHALLENGE_DIR="$NGINX_WEBROOT/.well-known/acme-challenge/"
;;
*)
echo "__nginx_vhost does not support $os yet. Aborting." >&2;
exit 1;
esac
# Domain
if [ -f "${__object:?}/parameter/domain" ];
then
DOMAIN="$(cat "${__object:?}/parameter/domain")"
else
DOMAIN="${__object_id:?}"
fi
export DOMAIN
# Use TLS ?
if [ -f "${__object:?}/parameter/no-tls" ];
then
TLS=
echo "WARNING: you have disabled TLS for vhost $DOMAIN" >&2
else
TLS=ssl
fi
export TLS
# Use HSTS ?
if [ -f "${__object:?}/parameter/no-hsts" ];
then
HSTS=
else
HSTS=true
fi
export HSTS
# Redirect to HTTPS ?
if [ -f "${__object:?}/parameter/to-https" ];
then
TO_HTTPS=true
else
TO_HTTPS=
fi
export HSTS
# Port to listen on
if [ -f "${__object:?}/parameter/lport" ];
then
LPORT="$(cat "${__object:?}/parameter/lport")"
else
if [ -n "$TLS" ] && [ -z "$TO_HTTPS" ];
then
LPORT=443
else
LPORT=80
fi
fi
export LPORT
# Server definition
if [ -n "$TO_HTTPS" ];
then
# Ignore configuration, simply serve ACME challenge and redirect to HTTPS.
"${__type:?}/files/to-https.conf.sh" > "${__object:?}/files/vhost.conf"
vhost_conf="${__object:?}/files/vhost.conf"
elif [ -f "${__object:?}/parameter/config" ];
then
# Extract nginx config from type parameter.
if [ "$(cat "${__object:?}/parameter/config")" = "-" ];
then
vhost_partial="${__object:?}/stdin"
else
vhost_partial=$(cat "${__object:?}/parameter/config")
fi
# Either use config as-in or template it in generic vhost structure.
if [ -f "${__object:?}/parameter/standalone-config" ]; then
vhost_conf=$vhost_partial
else
NGINX_LOGIC=$(cat "$vhost_partial") "${__type:?}/files/generic.conf.sh" \
> "${__object:?}/files/vhost.conf"
vhost_conf="${__object:?}/files/vhost.conf"
fi
else
# Default to simple static configuration.
"${__type:?}/files/static.conf.sh" > "${__object:?}/files/vhost.conf"
vhost_conf="${__object:?}/files/vhost.conf"
require="$install_reqs" __directory "$NGINX_WEBROOT/$DOMAIN"
require="__directory$NGINX_WEBROOT/$DOMAIN" \
__file "$NGINX_WEBROOT/$DOMAIN/index.html" --state exists \
--source "${__type:?}/files/index.html" \
--mode 0644
fi
# Install snippets.
require="$install_reqs" __directory "$NGINX_SNIPPETSDIR"
for snippet in hsts 301-to-https; do
require="__directory/$NGINX_SNIPPETSDIR" __file \
"$NGINX_SNIPPETSDIR/$snippet" --source "${__type:?}/files/$snippet"
done
# Install vhost.
require="$install_reqs" __file "$NGINX_SITEDIR/$__object_id.conf" \
--source "$vhost_conf" \
--mode 0644

4
type/__recycledcloud_nginx_vhost/parameter/boolean Normal file
View file

@ -0,0 +1,4 @@
no-tls
no-hsts
to-https
standalone-config

7
type/__recycledcloud_nginx_vhost/parameter/boolean.orig Normal file
View file

@ -0,0 +1,7 @@
<<<<<<< HEAD
noindex
=======
no-tls
no-hsts
obtain-cert
>>>>>>> 65f3457... Move out ungleich legacy type; merge presets, static and vhost.

1
type/__recycledcloud_nginx_vhost/parameter/default/index Normal file
View file

@ -0,0 +1 @@
index.html index.htm

3
type/__recycledcloud_nginx_vhost/parameter/optional Normal file
View file

@ -0,0 +1,3 @@
domain
lport
config

7
type/__recycledcloud_nginx_vhost/parameter/optional.orig Normal file
View file

@ -0,0 +1,7 @@
<<<<<<< HEAD
index
=======
domain
lport
config
>>>>>>> 65f3457... Move out ungleich legacy type; merge presets, static and vhost.

32
type/__uacme_account/gencode-remote Normal file
View file

@ -0,0 +1,32 @@
#!/bin/sh
os="$(cat "${__global:?}"/explorer/os)"
case "$os" in
'alpine')
default_confdir=/etc/ssl/uacme
;;
*)
echo "This type currently has no implementation for $os. Aborting." >&2;
exit 1
;;
esac
admin_mail=
if [ -f "${__object:?}/parameter/admin-mail" ];
then
admin_mail="$(cat "${__object:?}/parameter/admin-mail")";
fi
confdir="${default_confdir:?}"
if [ -f "${__object:?}/parameter/confdir" ];
then
confdir="$(cat "${__object:?}/parameter/confdir")"
fi
cat << EOF
if ! [ -f "${confdir}/private/key.pem" ];
then
uacme -y new ${admin_mail}
fi
EOF

50
type/__uacme_account/man.rst Normal file
View file

@ -0,0 +1,50 @@
cdist-type__uacme_account(7)
============================
NAME
----
cdist-type__uacme_account - Install uacme and register Let's Encrypt account.
DESCRIPTION
-----------
This type is used to bootstrap acquiring certificates from the Let's Encrypt
C.A. This type is expected to be used internally, by the `__uacme_obtain`.
OPTIONAL PARAMETERS
-------------------
confdir
An alternative configuration directory for uacme's private keys and
certificates.
admin-mail
Administrative contact email to register the account with.
EXAMPLES
--------
.. code-block:: sh
# Create account with default settings for the OS.
__uacme_account
# Create an account with email and custom location.
__uacme_account --confdir /opt/custom/uacme --admin-mail admin@domain.tld
SEE ALSO
--------
:strong:`cdist-type__letsencrypt_cert`\ (7)
:strong:`cdist-type__uacme_obtain`\ (7)
AUTHORS
-------
Joachim Desroches <joachim.desroches@epfl.ch>
COPYING
-------
Copyright \(C) 2020 Joachim Desroches. You can redistribute it and/or modify it
under the terms of the GNU General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.

3
type/__uacme_account/manifest Normal file
View file

@ -0,0 +1,3 @@
#!/bin/sh
__package uacme

2
type/__uacme_account/parameter/optional Normal file
View file

@ -0,0 +1,2 @@
confdir
admin-mail

0
type/__uacme_account/singleton Normal file
View file

38
type/__uacme_obtain/files/renew.sh.sh Executable file
View file

@ -0,0 +1,38 @@
#!/bin/sh
cat << EOF
#!/bin/sh
set -x
CERT_SOURCE=$CONFDIR/$MAIN_DOMAIN/cert.pem
KEY_SOURCE=$CONFDIR/private/$MAIN_DOMAIN/key.pem
export UACME_CHALLENGE_PATH=$CHALLENGEDIR
# Issue certificate.
uacme issue -c $CONFDIR -h $HOOKSCRIPT $DISABLE_OCSP $MUST_STABLE $KEYTYPE \
$DOMAIN
if [ $? -eq 2 ]; then
# Note: exit code 0 means that certificate was issued.
# Note: exit code 1 means that certificate was still valid, hence not renewed.
# Note: exit code 2 means that something went wrong.
echo "Failed to renew certificate - exiting." >&2
exit 1
fi
# Re-deploy, if needed.
if [ -n "$KEY_TARGET" ] && [ -n "$CERT_TARGET" ]; then
set -e
mkdir -p $(dirname "$CERT_TARGET") $(dirname "$KEY_TARGET")
if ! cmp \$CERT_SOURCE $CERT_TARGET >/dev/null 2>&1; then
install -m 0640 \$KEY_SOURCE $KEY_TARGET
install -m 0644 \$CERT_SOURCE $CERT_TARGET
chown $OWNER $KEY_TARGET $CERT_TARGET
$RENEW_HOOK
fi
fi
EOF

23
type/__uacme_obtain/gencode-remote Normal file
View file

@ -0,0 +1,23 @@
#!/bin/sh
# FIXME: this code is duplicated from the manifest -> let's share it somehow.
os="$(cat "${__global:?}"/explorer/os)"
case "$os" in
alpine)
default_confdir=/etc/ssl/uacme
;;
*)
echo "__uacme_obtain currently has no implementation for $os. Aborting." >&2;
exit 1;
;;
esac
confdir="${default_confdir:?}"
if [ -f "${__object:?}/parameter/confdir" ];
then
confdir="$(cat "${__object:?}/parameter/confdir")"
fi
# Run renew script 'by hand' - renews will be handled by the cronjob.
echo "$confdir/${__object_id:?}/renew.sh"

78
type/__uacme_obtain/man.rst Normal file
View file

@ -0,0 +1,78 @@
cdist-type__uacme_obtain(7)
========================
NAME
----
cdist-type__uacme_obtain - obtain, renew and deploy Let's Encrypt certificates
DESCRIPTION
-----------
This type leverage uacme to issue abd renew Let's Encrypt certificates and
provides a simple deployment mechanism. It is expected to be called after
`__uacme_account`.
REQUIRED PARAMETERS
-------------------
None.
OPTIONAL PARAMETERS
-------------------
challengedir
Path to publicly available (served by a third-party HTTP server, under
`$DOMAIN/.well-known/acme-challenge`) challenge directory.
confdir
uacme configuration directory.
hookscript
Path to challenge hook program.
owner
Owner of installed certificate (e.g. `www-data`), pass as argument to `chown`.
install-cert-to
Installation path of the issued certificate.
install-key-to
Installation path of the certificate's private key.
renew-hook
Renew hook executed on certificate renewal (e.g. `service nginx reload`).
OPTIONAL MULTIPLE PARAMETERS
-------------------
altdomains
Alternative domain names for this certificate.
BOOLEAN PARAMETERS
------------------
no-ocsp
When this flag is *not* specified and the certificate has an Authority
Information Access extension with an OCSP server location *uacme* makes an
OCSP request to the server; if the certificate is reported as revoked *uacme*
forces reissuance regardless of the expiration date.
must-staple
Request certificates with the RFC7633 Certificate Status Request
TLS Feature Extension, informally also known as "OCSP Must-Staple".
use-rsa
Use RSA instead of EC for the private key. Only applies to newly generated keys.
SEE ALSO
--------
:strong:`cdist-type__letsencrypt_cert`\ (7)
:strong:`cdist-type__uacme_account`\ (7)
AUTHORS
-------
Joachim Desroches <joachim.desroches@epfl.ch>
Timothée Floure <timothee.floure@posteo.net>
COPYING
-------
Copyright \(C) 2020 Joachim Desroches. You can redistribute it
and/or modify it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

118
type/__uacme_obtain/manifest Normal file
View file

@ -0,0 +1,118 @@
#!/bin/sh
os="$(cat "${__global:?}"/explorer/os)"
case "$os" in
alpine)
__package uacme
default_challengedir=/var/www/.well-known/acme-challenge
default_hookscript=/usr/share/uacme/uacme.sh
default_confdir=/etc/ssl/uacme
;;
*)
echo "__uacme_obtain currently has no implementation for $os. Aborting." >&2;
exit 1;
;;
esac
CHALLENGEDIR=$default_challengedir
if [ -f "${__object:?}/parameter/challengedir" ];
then
CHALLENGEDIR="$(cat "${__object:?}/parameter/challengedir")"
fi
export CHALLENGEDIR
CONFDIR="${default_confdir:?}"
if [ -f "${__object:?}/parameter/confdir" ];
then
CONFDIR="$(cat "${__object:?}/parameter/confdir")"
fi
export CONFDIR
DISABLE_OCSP=
if [ -f "${__object:?}/parameter/no-ocsp" ];
then
DISABLE_OCSP="--no-ocsp"
fi
export DISABLE_OCSP
MAIN_DOMAIN=${__object_id:?}
DOMAIN=$MAIN_DOMAIN
if [ -f "${__object:?}/parameter/altdomains" ];
then
# shellcheck disable=SC2013
for altdomain in $(cat "${__object:?}/parameter/altdomains");
do
DOMAIN="$DOMAIN $altdomain"
done
fi
export MAIN_DOMAIN DOMAIN
HOOKSCRIPT=${default_hookscript}
if [ -f "${__object:?}/parameter/hookscript" ];
then
HOOKSCRIPT="$(cat "${__object:?}/parameter/hookscript")"
fi
export HOOKSCRIPT
KEYTYPE="-t EC"
if [ -f "${__object:?}/parameter/use-rsa" ];
then
KEYTYPE="-t RSA"
fi
export KEYTYPE
MUST_STAPLE=
if [ -f "${__object:?}/parameter/must-staple" ];
then
MUST_STAPLE="--must-staple"
fi
export MUST_STAPLE
OWNER=root
if [ -f "${__object:?}/parameter/owner" ];
then
OWNER="$(cat "${__object:?}/parameter/owner")"
fi
export OWNER
KEY_TARGET=
if [ -f "${__object:?}/parameter/install-key-to" ];
then
KEY_TARGET="$(cat "${__object:?}/parameter/install-key-to")"
fi
export KEY_TARGET
CERT_TARGET=
if [ -f "${__object:?}/parameter/install-cert-to" ];
then
CERT_TARGET="$(cat "${__object:?}/parameter/install-cert-to")"
fi
export CERT_TARGET
RENEW_HOOK=
if [ -f "${__object:?}/parameter/renew-hook" ];
then
RENEW_HOOK="$(cat "${__object:?}/parameter/renew-hook")"
fi
export RENEW_HOOK
if [ -n "$KEY_TARGET" ] && [ -z "$CERT_TARGET" ]; then
echo "You cannot specify --install-key-to without --install-cert-to." >&2
exit 1
elif [ -z "$KEY_TARGET" ] && [ -n "$CERT_TARGET" ]; then
echo "You cannot specify --install-cert-to without --install-key-to." >&2
exit 1
fi
# Generate and deploy renew script.
mkdir -p "${__object:?}/files"
"${__type:?}/files/renew.sh.sh" > "${__object:?}/files/uacme-renew.sh"
__directory "$CONFDIR/$MAIN_DOMAIN"
require="__directory/$CONFDIR/$MAIN_DOMAIN" __file "$CONFDIR/$MAIN_DOMAIN/renew.sh" \
--mode 0755 --source "${__object:?}/files/uacme-renew.sh"
# Set up renew cronjob - initial issue done in gencode-remote.
__cron "uacme-$MAIN_DOMAIN" --user root --hour 2 \
--command "$CONFDIR/$MAIN_DOMAIN/renew.sh"

3
type/__uacme_obtain/parameter/boolean Normal file
View file

@ -0,0 +1,3 @@
no-ocsp
must-staple
use-rsa

7
type/__uacme_obtain/parameter/optional Normal file
View file

@ -0,0 +1,7 @@
challengedir
confdir
hookscript
owner
install-cert-to
install-key-to
renew-hook

1
type/__uacme_obtain/parameter/optional_multiple Normal file
View file

@ -0,0 +1 @@
altdomains