aboutsummaryrefslogtreecommitdiff
path: root/net/acme
diff options
context:
space:
mode:
authorToke Høiland-Jørgensen <toke@toke.dk>2016-08-05 17:26:25 +0200
committerToke Høiland-Jørgensen <toke@toke.dk>2016-08-05 17:41:09 +0200
commita1d617bd8b43bde0d1e064653a6ff0ccb107f560 (patch)
tree4e90052d48575c2355f1cd2945322340aadfab92 /net/acme
parent10c7c26203ed078c1ed1da672e146c18e0c82365 (diff)
acme: Add package.
This adds a package wrapping the acme.sh script from https://github.com/Neilpang/acme.sh in Uci config and hooks to interact correctly with uhttpd. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Diffstat (limited to 'net/acme')
5 files changed, 261 insertions, 0 deletions
diff --git a/net/acme/Makefile b/net/acme/Makefile
new file mode 100644
index 000000000..f2e179beb
--- /dev/null
+++ b/net/acme/Makefile
@@ -0,0 +1,58 @@
+#
+# Copyright (C) 2016 Toke Høiland-Jørgensen
+#
+# This is free software, licensed under the GNU General Public License v3 or
+# later.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=acme
+PKG_SOURCE_VERSION:=1e6b68f5d187fa3d64c889d04a77ee1c79726282
+PKG_VERSION:=1.0
+PKG_RELEASE:=1
+PKG_LICENSE:=GPLv3
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE).tar.xz
+PKG_SOURCE_URL:=git://github.com/Neilpang/acme.sh.git
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE)
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)-$(PKG_RELEASE)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/acme
+ SECTION:=net
+ CATEGORY:=Network
+ DEPENDS:=+curl +ca-certificates +uhttpd-mod-tls +openssl-util
+ TITLE:=ACME (Letsencrypt) client
+ PKGARCH:=all
+ MAINTAINER:=Toke Høiland-Jørgensen <toke@toke.dk>
+endef
+
+define Package/acme/description
+ A client for issuing Letsencrypt certificates.
+endef
+
+define Package/acme/conffiles
+/etc/config/acme
+/etc/acme
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/acme/install
+ $(INSTALL_DIR) $(1)/etc/config
+ $(INSTALL_CONF) ./files/acme.config $(1)/etc/config/acme
+ $(INSTALL_DIR) $(1)/etc/init.d
+ $(INSTALL_BIN) ./files/acme.init $(1)/etc/init.d/acme
+ $(INSTALL_DIR) $(1)/usr/lib/acme
+ $(INSTALL_BIN) ./files/run.sh $(1)/usr/lib/acme/run-acme
+ $(INSTALL_BIN) $(PKG_BUILD_DIR)/acme.sh $(1)/usr/lib/acme/acme.sh
+endef
+
+$(eval $(call BuildPackage,acme))
diff --git a/net/acme/files/acme.config b/net/acme/files/acme.config
new file mode 100644
index 000000000..7fce6982b
--- /dev/null
+++ b/net/acme/files/acme.config
@@ -0,0 +1,11 @@
+config acme 'main'
+ option state_dir '/etc/acme'
+ option account_email 'email@example.org'
+ option debug 0
+
+config cert 'example'
+ option enabled 0
+ option use_staging 0
+ option keylength 2048
+ option update_uhttpd 1
+ list domains example.org
diff --git a/net/acme/files/acme.init b/net/acme/files/acme.init
new file mode 100644
index 000000000..6de12b7d0
--- /dev/null
+++ b/net/acme/files/acme.init
@@ -0,0 +1,34 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+
+START=50
+SCRIPT=/usr/lib/acme/run-acme
+
+start_service()
+{
+ procd_open_instance
+ procd_set_param command $SCRIPT
+ procd_set_param file /etc/config/acme
+ procd_set_param stdout 1
+ procd_set_param stderr 1
+ procd_close_instance
+}
+
+reload_service() {
+ rc_procd start_service "$@"
+ return 0
+}
+
+stop_service() {
+ return 0
+}
+
+boot() {
+ $SCRIPT check_cron
+}
+
+service_triggers()
+{
+ procd_add_reload_trigger acme
+}
diff --git a/net/acme/files/run.sh b/net/acme/files/run.sh
new file mode 100644
index 000000000..de303d5f0
--- /dev/null
+++ b/net/acme/files/run.sh
@@ -0,0 +1,144 @@
+#!/bin/sh
+# Wrapper for acme.sh to work on openwrt.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# Author: Toke Høiland-Jørgensen <toke@toke.dk>
+
+CHECK_CRON=$1
+ACME=/usr/lib/acme/acme.sh
+export SSL_CERT_DIR=/etc/ssl/certs
+
+UHTTPD_REDIRECT_HTTPS=
+UHTTPD_LISTEN_HTTP=
+STATE_DIR='/etc/acme'
+ACCOUNT_EMAIL=
+DEBUG=0
+
+. /lib/functions.sh
+
+check_cron()
+{
+ [ -f "/etc/crontabs/root" ] && grep -q '/etc/init.d/acme' /etc/crontabs/root && return
+ echo "0 0 * * * /etc/init.d/acme start" >> /etc/crontabs/root
+ /etc/init.d/cron start
+}
+
+pre_checks()
+{
+ echo "Running pre checks."
+ check_cron
+
+ UHTTPD_REDIRECT_HTTPS=$(uci get uhttpd.main.redirect_https)
+ UHTTPD_LISTEN_HTTP=$(uci get uhttpd.main.listen_http)
+
+ uci set uhttpd.main.redirect_https=1
+ uci set uhttpd.main.listen_http='0.0.0.0:80'
+ uci commit uhttpd
+ /etc/init.d/uhttpd reload || return 1
+
+ iptables -I input_rule -p tcp --dport 80 -j ACCEPT || return 1
+ return 0
+}
+
+post_checks()
+{
+ echo "Running post checks (cleanup)."
+ iptables -D input_rule -p tcp --dport 80 -j ACCEPT
+
+ uci set uhttpd.main.redirect_https="$UHTTPD_REDIRECT_HTTPS"
+ uci set uhttpd.main.listen_http="$UHTTPD_LISTEN_HTTP"
+ uci commit uhttpd
+ /etc/init.d/uhttpd reload
+}
+
+err_out()
+{
+ post_checks
+ exit 1
+}
+
+int_out()
+{
+ post_checks
+ trap - SIGINT
+ kill -SIGINT $$
+}
+
+issue_cert()
+{
+ local section="$1"
+ local acme_args=
+ local enabled
+ local use_staging
+ local update_uhttpd
+ local keylength
+ local domains
+ local main_domain
+
+ config_get_bool enabled "$section" enabled 0
+ config_get_bool use_staging "$section" use_staging
+ config_get_bool update_uhttpd "$section" update_uhttpd
+ config_get domains "$section" domains
+ config_get keylength "$section" keylength
+
+ [ "$enabled" -eq "1" ] || return
+
+ [ "$DEBUG" -eq "1" ] && acme_args="$acme_args --debug"
+
+ set -- $domains
+ main_domain=$1
+
+ if [ -e "$STATE_DIR/$main_domain" ]; then
+ $ACME --home "$STATE_DIR" --renew -d "$main_domain" $acme_args || return 1
+ return 0
+ fi
+
+
+ acme_args="$acme_args $(for d in $domains; do echo -n "-d $d "; done)"
+ acme_args="$acme_args --webroot $(uci get uhttpd.main.home)"
+ acme_args="$acme_args --keylength $keylength"
+ [ -n "$ACCOUNT_EMAIL" ] && acme_args="$acme_args --accountemail $ACCOUNT_EMAIL"
+ [ "$use_staging" -eq "1" ] && acme_args="$acme_args --staging"
+
+ if ! $ACME --home "$STATE_DIR" --issue $acme_args; then
+ echo "Issuing cert for $main_domain failed. It may be necessary to remove $STATE_DIR/$main_domain to recover." >&2
+ return 1
+ fi
+
+ if [ "$update_uhttpd" -eq "1" ]; then
+ uci set uhttpd.main.key="$STATE_DIR/${main_domain}/${main_domain}.key"
+ uci set uhttpd.main.cert="$STATE_DIR/${main_domain}/fullchain.cer"
+ # commit and reload is in post_checks
+ fi
+
+}
+
+load_vars()
+{
+ local section="$1"
+
+ STATE_DIR=$(config_get "$section" state_dir)
+ ACCOUNT_EMAIL=$(config_get "$section" account_email)
+ DEBUG=$(config_get "$section" debug)
+}
+
+if [ -n "$CHECK_CRON" ]; then
+ check_cron
+ exit 0
+fi
+
+config_load acme
+config_foreach load_vars acme
+
+pre_checks || exit 1
+trap err_out SIGHUP SIGTERM
+trap int_out SIGINT
+
+config_foreach issue_cert cert
+post_checks
+
+exit 0
diff --git a/net/acme/patches/0001-remove-timestamp.patch b/net/acme/patches/0001-remove-timestamp.patch
new file mode 100644
index 000000000..989429514
--- /dev/null
+++ b/net/acme/patches/0001-remove-timestamp.patch
@@ -0,0 +1,14 @@
+--- a/acme.sh 2016-08-05 17:00:58.000000000 +0200
++++ b/acme.sh 2016-08-05 17:13:58.582459764 +0200
+@@ -48,9 +48,9 @@
+
+ _info() {
+ if [ -z "$2" ] ; then
+- echo "[$(date)] $1"
++ echo "$1"
+ else
+- echo "[$(date)] $1='$2'"
++ echo "$1='$2'"
+ fi
+ }
+
Powered by cgit, Themed by Ted Yin.