Changes to propagation and logging

Removed propagation timeout and polling interval and introduced "--dns.propagation-wait 240s" to allow for proper dns propagation.
This is especially useful in an environment where dns queries are cached or locked down environment. 240s (4 minutes) is enough time for proper propagation of dns records.

added the logfile to the autorenew function to properly trac if cronjobs are actually run

README.md

@@ -1,3 +1,15 @@
 # lego_acme_wrapper_script
 
  wrapper script for lego acme
+
+### Features
+ - Issue certificates
+ - Revoke certificates
+ - Check status
+ - Install Web-Servers (Nginx, HAProxy, Apache)
+ - Update Lego
+
+### Todo
+
+- Auto create default conf file for issued certificates in Nginx (Only well conversant with Nginx)
+ 

lego_wrapper.sh

@@ -1,110 +1,149 @@
 #!/bin/bash
 
+###TODO###
+#available functions - can be used as a function list or a  direct execute by passing action - done
+#would write domains into file/list on issuance so it can be used for renewal - done using cron
+#revoked certificate names would be removed from existing list of issued certificates - done
+#cron jobs would be created for renew function - done
+#add auto update for lego tool - (also to cron) - done, not using cron making manual from menu
+
+#add install for webserver type either apache/nginx - pending
+
+#auto create default config file for created domains (man i really wish i can do this. lol)
+
 #Export to be based on user preference
 #Enviromental  Variables for certificate paths, this is to make sure certificates are always issued in same path
 #if cert in used by multiple applications. can be placed in central path
-#Can be run without root - root only needed to install dependencies from apt
-
-#should be folder that doesn't have root permission
-export CERT_PATH=/etc/nginx/ssl
-export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx
+#Can be run without root - root only needed to install dependencies from apt/yum
+#should be folder that doesn't need root permission
 
 #Use case - namecheap (environment variable depends on dns provider)
 #check out https://go-acme.github.io/lego/dns/index.html for dns provider variables
+
+install_as_sudo() {
+  if [ -z "$SUDO_PASS" ] && [ "$EUID" -ne 0 ]; then
+    echo 'Sudo access needed to install dependencies'
+    read -sp 'Enter Sudo Password:' SUDO_PASS
+    printf '\n\n'
+
+  fi
+  get_os_type
+}
+
+set_env_variables() {
+  #envs for lego
+  export CERT_PATH=/etc/acme
+  export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx
   export DNS_PROVIDER=namecheap
-export NAMECHEAP_PROPAGATION_TIMEOUT=60
-export NAMECHEAP_POLLING_INTERVAL=2
   export NAMECHEAP_API_USER=xxxxxxxxxxxxxxxxxxxxxxxx
   export NAMECHEAP_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxx
 
-install_as_sudo() {
-
-  if [ -z "$SUDO_PASS"] && [ $EUID -ne 0 ]; then
-
-    echo 'Sudo access needed to install dependencies'
-    read -sp "Enter Sudo Password:" SUDO_PASS
-    printf "\n\n"
-
-  fi
-  env_file=~/.profile
+  #envs for path
+  export LEGO_PATH=$CERT_PATH
+  export GOPATH=$HOME/.go
+  export GO_HOME=/usr/local/go
+  export PATH=$PATH:$GO_HOME/bin:$GOPATH/bin
 }
 
 check_dependencies() {
-
   echo "Checking dependencies..."
-  check_install_curl
-  check_install_jq
-  check_install_go
-  check_install_lego
+  install_tar
+  install_curl
+  install_jq
+  install_git
+  install_go
+  install_lego
   echo "Check compelete"
   if [ "$dependency_install" == "yes" ]; then
     echo "restart shell session"
     exit 0
   fi
-
 }
 
-check_install_curl() {
+install_tar() {
+  if ! command -v tar 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'tar module not installed'
+    echo "now installing tar..."
 
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install tar -y"
+    echo "tar succcesfully installed"
+    eval "tar --version"
+    dependency_install=yes
+  fi
+}
+
+install_curl() {
   if ! command -v curl 2>&1 >/dev/null; then
     install_as_sudo
     echo 'curl module not installed'
     echo "now installing curl..."
 
     ###download and install curl
-    eval "sudo apt install curl -y"
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install curl -y"
     echo "curl succcesfully installed"
     eval "curl -V"
     dependency_install=yes
   fi
 }
 
-check_install_jq() {
-
+install_jq() {
   if ! command -v jq 2>&1 >/dev/null; then
     install_as_sudo
     echo 'jq module not installed'
     echo "now installing jq..."
 
     ###download and install curl
-    eval "sudo apt install jq -y"
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install jq -y"
     echo "jq succcesfully installed"
     eval "jq -V"
     dependency_install=yes
   fi
 }
 
-check_install_go() {
-
-  if ! command -v go 2>&1 >/dev/null; then
+install_git() {
+### Needed for updates
+  if ! command -v git 2>&1 >/dev/null; then
     install_as_sudo
-    echo 'go module not installed'
+    echo 'git module not installed'
+    echo "now installing git..."
 
-    echo "now installing go..."
-    echo "export GOPATH=$""HOME/go" >>$env_file
-    echo "export GO_HOME=/usr/local/go" >>$env_file
-    echo "export PATH=$""PATH:$""GO_HOME/bin:$""GOPATH/bin" >>$env_file
-    eval "source $env_file"
-
-    ###download and install go
-    get_system_information
-    eval "sudo rm -rf $GO_HOME"
-    command=$(curl $url | sudo tar -xz -C /usr/local)
-    eval "$command"
-
-    echo "go succcesfully installed"
-    eval "source $env_file"
-    eval "go version"
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install git -y"
+    echo "git succcesfully installed"
+    eval "git -v"
     dependency_install=yes
   fi
 }
 
-check_install_lego() {
+install_go() {
+  if ! command -v go 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'go module not installed'
+    echo "now installing go..."
 
+    ###download and install go
+    get_system_information
+    eval "echo $SUDO_PASS | sudo -S rm -rf $GO_HOME"
+    command=$(curl -o /tmp/$file_name $url)
+    eval "$command"
+    command=$(echo $SUDO_PASS | sudo -S tar -xf /tmp/$file_name -C /usr/local)
+    eval "$command"
+
+    echo "go succcesfully installed"
+    eval "go version"
+
+    command=$(rm /tmp/$file_name)
+    eval "$command"
+    dependency_install=yes
+  fi
+}
+
+install_lego() {
   if ! command -v lego 2>&1 >/dev/null; then
 
     echo 'lego could not be found'
-
     echo 'now installing lego...'
     export GO111MODULE=on
 
@@ -113,8 +152,6 @@ check_install_lego() {
       sudo chown $USER:$USER -R $CERT_PATH
     fi
 
-    echo "export LEGO_PATH=$CERT_PATH/lego" >>$env_file
-    eval "source $env_file"
     eval "go install github.com/go-acme/lego/v4/cmd/lego@latest"
 
     #add crontab for auto renewal of certificates (occurence is at monday,thursdays - can be changed)
@@ -126,24 +163,76 @@ check_install_lego() {
   fi
 }
 
-get_system_information() {
+install_web_server() {
+  install_as_sudo
+  echo "Install WebServer"
+  PS3="Select Option to enter option or and key to exit: "
+  options=("nginx" "apache" "haproxy")
+  select option in "${options[@]}"; do
+    case $option in
+    "nginx")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install nginx* -y"
+      echo_message
+      exit 0
+      ;;
+    "apache")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install apach2e* -y"
+      echo_message
+      exit 0
+      ;;
+    "haproxy")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install haproxy* -y"
+      echo_message
+      exit 0
+      ;;
+    esac
+  done
 
+}
+
+echo_message(){
+
+      printf "\n\n\n"
+      echo "run below command as admin if SELINUX is enabled to allow network connections"
+      echo "setsebool httpd_can_network_connect 1"
+      echo "Install firewall (firewall-cmd or ufw) for additional security"
+
+}
+
+update_lego() {
+  export GO111MODULE=on
+  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest" 2>&1 | tee -a $LOG_FILE
+}
+
+get_system_information() {
   ##go1.24.3.linux-amd64.tar.gz
   ##https://dl.google.com/go/go1.24.3.linux-amd64.tar.gz
   ###As at writing script - go version is 1.24.3 (could find api to get current version)
-  version="1.24.3"
+  version="1.24.5"
 
   #Get System Information (Adapted to Debian - This would need changes for other OS's)
   sys=$(uname -s)
   system=$(echo $sys | tr '[:upper:]' '[:lower:]')
-  archictecture=$(dpkg --print-architecture)
 
   #Form URL Based on system information
-  url="https://dl.google.com/go/go$version.$system-$archictecture.tar.gz"
-  printf "\n"
-  echo $url
-  printf "\n"
+  file_name="go$version.$system-amd64.tar.gz"
+  url="https://dl.google.com/go/$file_name"
+}
 
+get_os_type() {
+  #get OSTYPE - modify to know defualt package name to use for installation
+  os_type=$(awk -F'=' '/ID_LIKE/ {print $2}' /etc/os-release | awk -F'"' '{print $2}')
+  if [[ $os_type == *"debian"* ]]; then
+    install_cmd="apt"
+  elif [[ $os_type == *"ubuntu"* ]]; then
+    install_cmd="apt"
+  elif [[ $os_type == *"almalinux"* ]]; then
+    install_cmd="yum"
+  elif [[ $os_type == *"rhel"* ]]; then
+    install_cmd="yum"
+  elif [[ $os_type == *"centos"* ]]; then
+    install_cmd="yum"
+  fi
 }
 
 run() {
@@ -183,17 +272,20 @@ list() {
 autorenew() {
 
   ###to be used to store output from crontab renewals
-  LOG_FILE="$CERT_PATH/log"
-  if [ ! -d $LOG_FILE ]; then
-    mkdir -p $LOG_FILE
+  LOG_PATH="$CERT_PATH/log"
+  DATE=$(date +%F-%H%M)
+  LOG_FILE="$LOG_PATH/acme-$DATE"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $PATH
   fi
 
+
   for files in $(find $LEGO_PATH/certificates/*.json -type f); do
     IFS=$'\n'
     for file in $files; do
       temp_domain=$(cat $file | jq .domain | sed -e 's/^"//' -e 's/"$//')
       renew_command="$command -d $temp_domain renew"
-      eval $renew_command
+      eval " $renew_command" 2>&1 | tee -a $LOG_FILE
     done
   done
 
@@ -202,9 +294,8 @@ autorenew() {
 }
 
 functionlist() {
-  echo "Usage: {run, renew, revoke, list}"
   PS3="Select Option to enter option or and key to exit: "
-  options=("run" "revoke" "renew" "list")
+  options=("run" "revoke" "renew" "list" "update lego" "install webserver")
   select option in "${options[@]}"; do
     case $option in
     "run")
@@ -219,6 +310,14 @@ functionlist() {
     "list")
       list
       ;;
+    "update lego")
+      update_lego
+      exit 0
+      ;;
+    "install webserver")
+      install_web_server
+      exit 0
+      ;;
     *)
       exit 0
       ;;
@@ -227,7 +326,6 @@ functionlist() {
 }
 
 functionvar() {
-
   case $1 in
   "run")
     run
@@ -247,19 +345,15 @@ functionvar() {
   esac
 }
 
+set_env_variables
 check_dependencies
 
 cd $CERT_PATH
 echo "Acme Script for $DNS_PROVIDER"
 ## If no parameters are given, print which are avaiable.
 echo "Usage: only dns challenge function available"
-command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER "
+command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER --dns.propagation-wait 240s "
 IFS=","
-###TODO###
-#available functions - can be used as a function list or a  direct execute by passing action
-#would write domains into file/list on issuance so it can be used for renewal
-#revoked certificate names would be removed from existing list of issued certificates
-#cron jobs would be created for renew function
 if [ -z "$1" ]; then
   functionlist
   exit 0