aboutsummaryrefslogtreecommitdiff
path: root/net/acme-common
Commit message (Collapse)AuthorAge
* net/acme-common: Fix example configToke Høiland-Jørgensen2024-03-20
| | | | | | Make sure we quote all strings, and add missing "option" in second example. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme-common: simplify config exampleSergey Ponomarev2024-03-01
| | | | | | Make it more practical to easier get an idea Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
* acme-common: use validation_method option instead of guessingSergey Ponomarev2024-03-01
| | | | | | | | | | | | The new validation_method option can be: dns, webroot or standalone. Previously we guessed the challenge type: 1. if the DNS provider is specified then it's dns 2. if standalone=1 3. fallback to webroot The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner. Signed-off-by: Sergey Ponomarev <stokito@gmail.com>
* acme: standardize key_typeGlen Huang2023-05-18
| | | | | | | | | | keylength, being an acme.sh value type, uses pure numbers for rsa keys. This can be disorienting for other acme clients. This change introduces a new option "key_type" that aims to remove this ambiguity, and makes all key type names follow the same pattern, making acme-common more client agnostic. Signed-off-by: Glen Huang <me@glenhuang.com>
* acme-common: no exporting webrootGlen Huang2023-05-17
| | | | | | | | | ACME clients shouldn't deal with deprecated values. They should be processed by acme-common. Reformatting is done by shfmt. Signed-off-by: Glen Huang <me@glenhuang.com>
* acme: remove redundant postinstGlen Huang2023-04-26
| | | | | | | | | | opkg runs uci-defaults if a package installs one, in acme-common's case that's identical to postinst. prerm shouldn't be run a image builder, so it's unnecessary to check IPKG_INSTROOT Signed-off-by: Glen Huang <me@glenhuang.com>
* acme: fix incompatibilty with image builderGlen Huang2023-03-03
| | | | Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: merge cli into init scriptGlen Huang2023-03-01
| | | | Signed-off-by: Glen Huang <i@glenhuang.com>
* acme-common: Export canonical paths for storing certificates and challengesToke Høiland-Jørgensen2022-12-14
| | | | | | | | | | | | The contract between the acme-common framework and consumers and hook scripts is that certificates can be consumed from /etc/ssl/acme and that web challenges are stored in /var/run/acme/challenge. Make this explicit by exporting $CERT_DIR and $CHALLENGE_DIR as environment variables as well, instead of having knowledge of those paths depend on out-of-band information. We already exported $challenge_dir, but let's change it to upper-case to make it clear that it's not a user configuration variable. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: deprecate state_dirGlen Huang2022-12-14
| | | | | | | | | | | | | state_dir is actually a hardcoded value in conffiles. Allowing users to customize it could result in losing certificates after upgrading if they don't also specify the dir as being preserved. We shouldn't default to this dangerous behavior. With the new ACME package, certificates live in the standard location /etc/ssl/acme, users who need to do certificate customizations should look for them in that dir instead. Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: simplify flock usageGlen Huang2022-11-11
| | | | Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: update changed packages' versionsGlen Huang2022-10-24
| | | | Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: add dns_wait optionGlen Huang2022-10-24
| | | | | | | | | | | acme.sh by default use public DNS resolvers to check if TXT record was correctly added when using DNS-01. This can be undesirable in a private environment where the DNS server is not publicly accessible. This option allows bypassing such check and simply waiting for a specific length of time for the TXT record to take effect. Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: fix staging optionGlen Huang2022-10-24
| | | | | | | Legacy use_staging option was not respected, and the example config still use the legacy name. Signed-off-by: Glen Huang <i@glenhuang.com>
* amce: use procd to restart servicesGlen Huang2022-10-24
| | | | | | | Directly calling `/etc/init.d/<service> reload` in a hotplug script can inadvertently start a stopped service. Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: prevent concurrent running of acme getGlen Huang2022-10-24
| | | | | | Issuing certificates concurrently should not be supported. Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: make package create dir /etc/ssl/acmeGlen Huang2022-10-22
| | | | | | | Since the dir is a standardized one, it should not be created dynamically Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: not creating state_dir in MakefileGlen Huang2022-10-22
| | | | | | | Since state_dir can be customized, it should be create dynamically, which it already does. Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: remove help info of unused commandGlen Huang2022-10-06
| | | | Signed-off-by: Glen Huang <i@glenhuang.com>
* acme: use the hotplug systemGlen Huang2022-08-16
Signed-off-by: Glen Huang <heyhgl@gmail.com>
Powered by cgit, Themed by Ted Yin.