aboutsummaryrefslogtreecommitdiff
path: root/net/acme/files/run.sh
Commit message (Collapse)AuthorAge
* acme: use the hotplug systemGlen Huang2022-08-16
| | | | Signed-off-by: Glen Huang <heyhgl@gmail.com>
* acme: switch from iptables to nftToke Høiland-Jørgensen2022-05-20
| | | | | | | | Use nft instead of iptables to open port 80 in the firewall when getting a cert. Since nft doesn't allow deleting a rule by its contents, capture and save the handle when creating the rule, and use that to delete. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: update to 3.0.1Georgi Valkov2021-10-10
| | | | | | | | | | Default to letsencrypt because the upstream default may change. Passing --staging is no longer needed, since --serever will select a staging server if needed. Signed-off-by: Georgi Valkov <gvalkov@abv.bg> Tested-by: Georgi Valkov <gvalkov@abv.bg> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Fix uhttpd restart to load new certificatesDennis Schüsselbauer2021-09-01
| | | | | | Fixes issue #16256 Signed-off-by: Dennis Schüsselbauer <scde@users.noreply.github.com>
* acme: add haproxy supportWakatatsu Ryou2021-09-01
| | | | Signed-off-by: Wakatatsu Ryou <lialosiu@gmail.com>
* acme: run through shellcheckRosen Penev2021-06-25
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* acme: update to 2.9.0Rosen Penev2021-06-25
| | | | | | | | | Switch to AUTORELEASE to avoid bumping PKG_RELEASE all the time. Run shell scripts through shfmt -w -ci -bn -sr -s in order to have a standard style. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* acme: Get listener name from /proc/PID/exe instead of netstat outputToke Høiland-Jørgensen2021-03-26
| | | | | | | | | | It seems the command name output from netstat can be truncated in weird ways, so let's get the binary name from /proc instead and use that for matching which listener we have. Fixes #15071. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: adopt to new behavior of nginxPeter Stadler2021-02-08
| | | | Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* Add option for days until renewalJannis Pinter2020-10-29
| | | | Signed-off-by: Jannis Pinter <jannis+openwrt@pinterjann.is>
* acme: fix the 'Unknown parameter' problem caused by acme_serverMeano2020-10-19
| | | | Signed-off-by: Meano <meano@foxmail.com>
* acme: Allow custom ACME server directory URLJannis Pinter2020-10-16
| | | | | | The underlying `acme.sh` allows custom ACME server URLs (using `--server`). Adding the necessary field to specify a custom ACME server URL from UCI. Signed-off-by: Jannis Pinter <jannis+openwrt@pinterjann.is>
* acme: Make sure we don't handle the same listener twiceToke Høiland-Jørgensen2020-09-09
| | | | | | | | | | If a daemon listens on multiple addresses at once, it'll show up multiple times in get_listeners() which will clobber the config for uhttpd. Fix this by skipping subsequent handlings of the same daemon binary. Fixes #13325. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: fix alignment space vs tabsFlorian Eckert2020-08-05
| | | | Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* acme: Update acme.sh URL, add support for challenge & domain alises.Will O'Neill2020-05-10
| | | | Signed-off-by: Will O'Neill <0100wrxb@gmail.com>
* acme: add support for user-provided setup and cleanup scriptsAntti Seppälä2020-04-30
| | | | | | | | | | | Add possibility for user to provide setup and cleanup scripts for additional flexibility. Setup-script takes precedence over the built-in behavior of acme. This helps users with more complex use-cases to utilize acme to update certificates without adding complexity to the provided run.sh script. Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* acme: Handle ecc cert correctlyDavid Yang2020-04-27
| | | | | | | Error was: The domain 'example.com' seems to have a ECC cert already, please add '--ecc' parameter if you want to use that cert. Signed-off-by: David Yang <mmyangfl@gmail.com>
* acme: Handle log message correctlyDavid Yang2020-04-27
| | | | | | | Error was: logger: unrecognized option: renew Signed-off-by: David Yang <mmyangfl@gmail.com>
* acme: Correctly handle domain state dir for ECC certificatesToke Høiland-Jørgensen2020-01-12
| | | | | | | | | | When issuing an ECC certificate, acme.sh for some reason changes the name of the directory used for the certificate state. Handle this correctly when moving directories and updating config files. Fixes #7941. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* acme: Log acme.sh command invocationToke Høiland-Jørgensen2019-10-23
| | | | Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* ACME: Fix missing quotes in variable comparisonsToke Høiland-Jørgensen2019-03-22
| | | | | | | The variables can be empty if not set in the UCI config. Reported-by: Petr Novák <petrn@me.com> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* acme: Fix loading credentialsAdrien DAURIAT2019-02-08
| | | | | | | | Move loading credential function before cert renewal call as credentials might be needed for some renewal operations ( ex: DNS ) Signed-off-by: Adrien DAURIAT <16813527+dauriata@users.noreply.github.com> [toke@toke.dk: Port to master branch] Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* net/acme: commit uhttpd configuration if update_httpd setAlexey I. Froloff2019-02-07
| | | | | | uhttpd configuration should be commited when update_uhttpd set. Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
* net/acme: issue_cert should always call post_checks on exitAlexey I. Froloff2019-02-07
| | | | | | | | | | issue_cert fuction may return without calling post_checks, which leaves port 80 open and uhttpd configuration is not restored is listen_http was set. Always call post_checks when returning from issue_cert. Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
* acme: Fix arithmetic syntaxToke Høiland-Jørgensen2018-09-19
| | | | | | Thanks to @jow- for pointing out the mistake. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Fix whitespace and long lines, bump package revToke Høiland-Jørgensen2018-09-19
| | | | Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: add support for nginx webserverAnsuel Smith2018-09-19
| | | | | | This adds a metapakcge for acme luci ap without uhttpd dependency and adds entities and check to stop handle nginx server and modify the certificate set automatically. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* acme: Fix bugs from upstream's change to socatToke Høiland-Jørgensen2018-08-22
| | | | | | | | | | The upstream acme.sh package changed to using socat instead of netcat; update the dependencies to reflect this, and pass --listen-v6 when running in standalone mode (since socat only listens on IPv4 by default). Also add a missing cleanup call when certificate issuance fails. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Change boot init script logic to invoke startToke Høiland-Jørgensen2018-05-07
| | | | | | | | | | | The new procd config dependency tracking requires the start method to be called even on boot. So add a state file that is checked by the run script to condition the special-case boot run instead of the previous independent call to the run script. Ref: https://github.com/openwrt/luci/pull/1769 Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Support DNS modeZhong Jianxin2018-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tested with dynu.com ddns. Install acme-dnsapi: # opkg install acme-dnsapi Example `/etc/config/acme`: config acme option state_dir '/etc/acme' option account_email email@example.org' option debug '0' config cert 'foo' option enabled '1' option use_staging '1' option keylength '2048' option update_uhttpd '0' option dns 'dns_dynu' list domains 'foo.dynu.com' list domains '*.foo.dynu.com' list credentials 'Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"' list credentials 'Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"' Run: # /etc/init.d/acme start Signed-off-by: Zhong Jianxin <azuwis@gmail.com>
* Fix acme-challenge ./well-known check / webroot detection (#4339)Aleksei Nosachev2017-05-10
| | | | | | | | fixes webroot to be defined as _currentRoot='/www' instead of being interpreted as _currentRoot='"/www"' Signed-off-by: Aleksei Nosachev <nos1609@hotmail.com>
* acme: Support running in webroot mode, detect other daemons on port 80Toke Høiland-Jørgensen2017-04-26
| | | | | | | | | | | For configurations where another web server is running on port 80, running acme.sh in standalone mode fails. Try to detect this and refuse to run; and allow the user to configure a webroot directory to use the running webserver for certificate verification. This also updates acme.sh to the latest version. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Fix for curl linked against mbed TLS. (#4254)Daniel H2017-04-12
| | | | | | | Use newest acme.sh release (2.6.8). Remove dependency on ca-certificates and add dependency on ca-bundle. Update environment variable. Signed-off-by: Daniel Halmschlager <da@halms.at>
* acme: Update to v1.4.Toke Høiland-Jørgensen2016-11-28
| | | | | | | | This updates to the latest git version of acme.sh and drops the patch to disable timestamps from the output (since that is now supported upstream). Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Update to v1.3.Toke Høiland-Jørgensen2016-11-25
| | | | | | | | This version handles transitioning from a previous certificate that was issues using the staging server, adds more debug logging, and handles state directories better if issuing fails. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: New version 1.2.Toke Høiland-Jørgensen2016-11-04
| | | | | | | | | | | This version will use the standalone (netcat) mode of acme.sh during verification instead of exposing uhttpd to the internet for the duration of the verification. It will also add an ip6tables rule to also support verification over IPv6. Also contains an updated version of acme.sh. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Add package.Toke Høiland-Jørgensen2016-08-05
This adds a package wrapping the acme.sh script from https://github.com/Neilpang/acme.sh in Uci config and hooks to interact correctly with uhttpd. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Powered by cgit, Themed by Ted Yin.