Merge pull request 'added cloudflare DNS provider' (#6) from patch-1.4 into main

Reviewed-on: #6

README.md

@@ -1,3 +1,15 @@
 # lego_acme_wrapper_script
 
  wrapper script for lego acme
+
+### Features
+ - Issue certificates
+ - Revoke certificates
+ - Check status
+ - Install Web-Servers (Nginx, HAProxy, Apache)
+ - Update Lego
+
+### Todo
+
+- Auto create default conf file for issued certificates in Nginx (Only well conversant with Nginx)
+ 

lego_wrapper.sh

@@ -6,10 +6,10 @@
 #revoked certificate names would be removed from existing list of issued certificates - done
 #cron jobs would be created for renew function - done
 #add auto update for lego tool - (also to cron) - done, not using cron making manual from menu
+#add install for webserver type either apache/nginx - done
 
-#add install for webserver type either apache/nginx - pending
+#auto create default config file for created domains (man i really wish i can do this. lol) - pfff -  I definitely will - pending
-
+#RSYNC to  different servers when renewed (either through sshkey or password think sshkey would be nicer) - pending
-#auto create default config file for created domains (man i really wish i can do this. lol)
 
 #Export to be based on user preference
 #Enviromental  Variables for certificate paths, this is to make sure certificates are always issued in same path
@@ -17,6 +17,7 @@
 #Can be run without root - root only needed to install dependencies from apt/yum
 #should be folder that doesn't need root permission
 
+
 #Use case - namecheap (environment variable depends on dns provider)
 #check out https://go-acme.github.io/lego/dns/index.html for dns provider variables
 
@@ -33,14 +34,18 @@ install_as_sudo() {
 set_env_variables() {
   #envs for lego
   export CERT_PATH=/etc/acme
-  export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx
+  export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx@xxxx.xxx
-  export DNS_PROVIDER=namecheap
+  export DNS_PROVIDER=cloudflare
-  export NAMECHEAP_PROPAGATION_TIMEOUT=60
-  export NAMECHEAP_POLLING_INTERVAL=2
-  export NAMECHEAP_API_USER=xxxxxxxxxxxxxxxxxxxxxxxx
-  export NAMECHEAP_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxx
 
-  #envs for path
+  #namecheap envs for lego
+  #export NAMECHEAP_API_USER=xxxxxxxxxxxxxxxxxxxxxxxx
+  #export NAMECHEAP_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxx
+
+  #cloudflare envs for lego
+  export CLOUDFLARE_EMAIL=xxxxxxxxxxxxxxxxxxxxxxxx@xxxx.xxx
+  export CLOUDFLARE_DNS_API_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxx
+
+  #envs for path - (i'm doing this to avoid lego being run without using this script)
   export LEGO_PATH=$CERT_PATH
   export GOPATH=$HOME/.go
   export GO_HOME=/usr/local/go
@@ -106,6 +111,7 @@ install_jq() {
 }
 
 install_git() {
+### Needed for updates
   if ! command -v git 2>&1 >/dev/null; then
     install_as_sudo
     echo 'git module not installed'
@@ -174,23 +180,17 @@ install_web_server() {
     case $option in
     "nginx")
       eval "echo $SUDO_PASS | sudo -S $install_cmd install nginx* -y"
-      printf "\n\n\n"
+      echo_message
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
       exit 0
       ;;
     "apache")
-      eval "echo $SUDO_PASS | sudo -S $install_cmd install apach2e* -y"
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install apache2* -y"
-      printf "\n\n\n"
+      echo_message
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
       exit 0
       ;;
     "haproxy")
       eval "echo $SUDO_PASS | sudo -S $install_cmd install haproxy* -y"
-      printf "\n\n\n"
+      echo_message
-      echo "run below command as admin on rhel type OS to allow network connections"
-      echo "setsebool httpd_can_network_connect 1"
       exit 0
       ;;
     esac
@@ -198,9 +198,31 @@ install_web_server() {
 
 }
 
+echo_message(){
+
+      printf "\n\n\n"
+      echo "run below command as admin if SELINUX is enabled to allow network connections"
+      echo "setsebool httpd_can_network_connect 1"
+      echo "setsebool -P haproxy_connect_any=1"
+      echo "Install firewall (firewall-cmd or ufw) for additional security"
+
+}
+
 update_lego() {
+
+  ###to be used to store output from crontab renewals
+  LOG_PATH="$CERT_PATH/log"
+  DATE=$(date +%F-%H%M)
+  LOG_FILE="$LOG_PATH/lego-update-$DATE.log"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $LOG_PATH
+  fi
+
+  echo " "
+  eval " lego -v"
+  echo " "
   export GO111MODULE=on
-  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest"
+  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest" 2>&1 | tee -a $LOG_FILE
 }
 
 get_system_information() {
@@ -227,7 +249,7 @@ get_os_type() {
     install_cmd="apt"
   elif [[ $os_type == *"almalinux"* ]]; then
     install_cmd="yum"
-  elif [[ $os_type == *"redhat"* ]]; then
+  elif [[ $os_type == *"rhel"* ]]; then
     install_cmd="yum"
   elif [[ $os_type == *"centos"* ]]; then
     install_cmd="yum"
@@ -271,9 +293,11 @@ list() {
 autorenew() {
 
   ###to be used to store output from crontab renewals
-  LOG_FILE="$CERT_PATH/log"
+  LOG_PATH="$CERT_PATH/log"
-  if [ ! -d $LOG_FILE ]; then
+  DATE=$(date +%F-%H%M)
-    mkdir -p $LOG_FILE
+  LOG_FILE="$LOG_PATH/acme-$DATE.log"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $LOG_PATH
   fi
 
   for files in $(find $LEGO_PATH/certificates/*.json -type f); do
@@ -281,7 +305,7 @@ autorenew() {
     for file in $files; do
       temp_domain=$(cat $file | jq .domain | sed -e 's/^"//' -e 's/"$//')
       renew_command="$command -d $temp_domain renew"
-      eval $renew_command
+      eval " $renew_command" 2>&1 | tee -a $LOG_FILE
     done
   done
 
@@ -290,12 +314,11 @@ autorenew() {
 }
 
 functionlist() {
-  echo "Usage: {run, renew, revoke, list, update lego}"
   PS3="Select Option to enter option or and key to exit: "
-  options=("run" "revoke" "renew" "list" "update lego" "install web server")
+  options=("issue" "revoke" "renew" "list" "update lego" "install webserver")
   select option in "${options[@]}"; do
     case $option in
-    "run")
+    "issue")
       run
       ;;
     "revoke")
@@ -324,7 +347,7 @@ functionlist() {
 
 functionvar() {
   case $1 in
-  "run")
+  "issue")
     run
     ;;
   "revoke")
@@ -349,7 +372,7 @@ cd $CERT_PATH
 echo "Acme Script for $DNS_PROVIDER"
 ## If no parameters are given, print which are avaiable.
 echo "Usage: only dns challenge function available"
-command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER "
+command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER --dns.propagation-wait 240s "
 IFS=","
 if [ -z "$1" ]; then
   functionlist
@@ -357,4 +380,4 @@ if [ -z "$1" ]; then
 else
   functionvar $1
   exit 0
-fi
+f3