From 8891d640bd5f9e250b20fe34b93189453ea26264 Mon Sep 17 00:00:00 2001
From: agboola <agboola@theonasanyas.com>
Date: Wed, 27 Aug 2025 14:13:11 +0100
Subject: [PATCH] Changes to propagation and logging

Removed propagation timeout and polling interval and introduced "--dns.propagation-wait 240s" to allow for proper dns propagation.
This is especially useful in an environment where dns queries are cached or locked down environment. 240s (4 minutes) is enough time for proper propagation of dns records.

added the logfile to the autorenew function to properly trac if cronjobs are actually run
---
 lego_wrapper.sh | 47 +++++++++++++++++++++++++----------------------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/lego_wrapper.sh b/lego_wrapper.sh
index 170088f..848e572 100644
--- a/lego_wrapper.sh
+++ b/lego_wrapper.sh
@@ -35,8 +35,6 @@ set_env_variables() {
   export CERT_PATH=/etc/acme
   export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx
   export DNS_PROVIDER=namecheap
-  export NAMECHEAP_PROPAGATION_TIMEOUT=60
-  export NAMECHEAP_POLLING_INTERVAL=2
   export NAMECHEAP_API_USER=xxxxxxxxxxxxxxxxxxxxxxxx
   export NAMECHEAP_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxx
 
@@ -45,7 +43,6 @@ set_env_variables() {
   export GOPATH=$HOME/.go
   export GO_HOME=/usr/local/go
   export PATH=$PATH:$GO_HOME/bin:$GOPATH/bin
-
 }
 
 check_dependencies() {
@@ -106,6 +103,7 @@ install_jq() {
 }
 
 install_git() {
+### Needed for updates
   if ! command -v git 2>&1 >/dev/null; then
     install_as_sudo
     echo 'git module not installed'
@@ -174,23 +172,17 @@ install_web_server() {
     case $option in
     "nginx")
       eval "echo $SUDO_PASS | sudo -S $install_cmd install nginx* -y"
-      printf "\n\n\n"
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
+      echo_message
       exit 0
       ;;
     "apache")
       eval "echo $SUDO_PASS | sudo -S $install_cmd install apach2e* -y"
-      printf "\n\n\n"
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
+      echo_message
       exit 0
       ;;
     "haproxy")
       eval "echo $SUDO_PASS | sudo -S $install_cmd install haproxy* -y"
-      printf "\n\n\n"
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
+      echo_message
       exit 0
       ;;
     esac
@@ -198,9 +190,18 @@ install_web_server() {
 
 }
 
+echo_message(){
+
+      printf "\n\n\n"
+      echo "run below command as admin if SELINUX is enabled to allow network connections"
+      echo "setsebool httpd_can_network_connect 1"
+      echo "Install firewall (firewall-cmd or ufw) for additional security"
+
+}
+
 update_lego() {
   export GO111MODULE=on
-  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest"
+  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest" 2>&1 | tee -a $LOG_FILE
 }
 
 get_system_information() {
@@ -220,7 +221,7 @@ get_system_information() {
 
 get_os_type() {
   #get OSTYPE - modify to know defualt package name to use for installation
-  os_type=$(awk -F'=' '/^ID/ {print $2}' /etc/os-release')
+  os_type=$(awk -F'=' '/ID_LIKE/ {print $2}' /etc/os-release | awk -F'"' '{print $2}')
   if [[ $os_type == *"debian"* ]]; then
     install_cmd="apt"
   elif [[ $os_type == *"ubuntu"* ]]; then
@@ -271,17 +272,20 @@ list() {
 autorenew() {
 
   ###to be used to store output from crontab renewals
-  LOG_FILE="$CERT_PATH/log"
-  if [ ! -d $LOG_FILE ]; then
-    mkdir -p $LOG_FILE
+  LOG_PATH="$CERT_PATH/log"
+  DATE=$(date +%F-%H%M)
+  LOG_FILE="$LOG_PATH/acme-$DATE"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $PATH
   fi
 
+
   for files in $(find $LEGO_PATH/certificates/*.json -type f); do
     IFS=$'\n'
     for file in $files; do
       temp_domain=$(cat $file | jq .domain | sed -e 's/^"//' -e 's/"$//')
       renew_command="$command -d $temp_domain renew"
-      eval $renew_command
+      eval " $renew_command" 2>&1 | tee -a $LOG_FILE
     done
   done
 
@@ -290,9 +294,8 @@ autorenew() {
 }
 
 functionlist() {
-  echo "Usage: {run, renew, revoke, list, update lego}"
   PS3="Select Option to enter option or and key to exit: "
-  options=("run" "revoke" "renew" "list" "update lego" "install web server")
+  options=("run" "revoke" "renew" "list" "update lego" "install webserver")
   select option in "${options[@]}"; do
     case $option in
     "run")
@@ -311,7 +314,7 @@ functionlist() {
       update_lego
       exit 0
       ;;
-    "install web server")
+    "install webserver")
       install_web_server
       exit 0
       ;;
@@ -349,7 +352,7 @@ cd $CERT_PATH
 echo "Acme Script for $DNS_PROVIDER"
 ## If no parameters are given, print which are avaiable.
 echo "Usage: only dns challenge function available"
-command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER "
+command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER --dns.propagation-wait 240s "
 IFS=","
 if [ -z "$1" ]; then
   functionlist