Merge pull request 'added cloudflare DNS provider' (#6) from patch-1.4 into main

Reviewed-on: #6

lego_wrapper.sh

@@ -0,0 +1,383 @@
+#!/bin/bash
+
+###TODO###
+#available functions - can be used as a function list or a  direct execute by passing action - done
+#would write domains into file/list on issuance so it can be used for renewal - done using cron
+#revoked certificate names would be removed from existing list of issued certificates - done
+#cron jobs would be created for renew function - done
+#add auto update for lego tool - (also to cron) - done, not using cron making manual from menu
+#add install for webserver type either apache/nginx - done
+
+#auto create default config file for created domains (man i really wish i can do this. lol) - pfff -  I definitely will - pending
+#RSYNC to  different servers when renewed (either through sshkey or password think sshkey would be nicer) - pending
+
+#Export to be based on user preference
+#Enviromental  Variables for certificate paths, this is to make sure certificates are always issued in same path
+#if cert in used by multiple applications. can be placed in central path
+#Can be run without root - root only needed to install dependencies from apt/yum
+#should be folder that doesn't need root permission
+
+
+#Use case - namecheap (environment variable depends on dns provider)
+#check out https://go-acme.github.io/lego/dns/index.html for dns provider variables
+
+install_as_sudo() {
+  if [ -z "$SUDO_PASS" ] && [ "$EUID" -ne 0 ]; then
+    echo 'Sudo access needed to install dependencies'
+    read -sp 'Enter Sudo Password:' SUDO_PASS
+    printf '\n\n'
+
+  fi
+  get_os_type
+}
+
+set_env_variables() {
+  #envs for lego
+  export CERT_PATH=/etc/acme
+  export CONTACT_MAIL=xxxxxxxxxxxxxxxxxxxxxxxx@xxxx.xxx
+  export DNS_PROVIDER=cloudflare
+
+  #namecheap envs for lego
+  #export NAMECHEAP_API_USER=xxxxxxxxxxxxxxxxxxxxxxxx
+  #export NAMECHEAP_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxx
+
+  #cloudflare envs for lego
+  export CLOUDFLARE_EMAIL=xxxxxxxxxxxxxxxxxxxxxxxx@xxxx.xxx
+  export CLOUDFLARE_DNS_API_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxx
+
+  #envs for path - (i'm doing this to avoid lego being run without using this script)
+  export LEGO_PATH=$CERT_PATH
+  export GOPATH=$HOME/.go
+  export GO_HOME=/usr/local/go
+  export PATH=$PATH:$GO_HOME/bin:$GOPATH/bin
+
+}
+
+check_dependencies() {
+  echo "Checking dependencies..."
+  install_tar
+  install_curl
+  install_jq
+  install_git
+  install_go
+  install_lego
+  echo "Check compelete"
+  if [ "$dependency_install" == "yes" ]; then
+    echo "restart shell session"
+    exit 0
+  fi
+}
+
+install_tar() {
+  if ! command -v tar 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'tar module not installed'
+    echo "now installing tar..."
+
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install tar -y"
+    echo "tar succcesfully installed"
+    eval "tar --version"
+    dependency_install=yes
+  fi
+}
+
+install_curl() {
+  if ! command -v curl 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'curl module not installed'
+    echo "now installing curl..."
+
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install curl -y"
+    echo "curl succcesfully installed"
+    eval "curl -V"
+    dependency_install=yes
+  fi
+}
+
+install_jq() {
+  if ! command -v jq 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'jq module not installed'
+    echo "now installing jq..."
+
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install jq -y"
+    echo "jq succcesfully installed"
+    eval "jq -V"
+    dependency_install=yes
+  fi
+}
+
+install_git() {
+### Needed for updates
+  if ! command -v git 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'git module not installed'
+    echo "now installing git..."
+
+    ###download and install curl
+    eval "echo $SUDO_PASS | sudo -S $install_cmd install git -y"
+    echo "git succcesfully installed"
+    eval "git -v"
+    dependency_install=yes
+  fi
+}
+
+install_go() {
+  if ! command -v go 2>&1 >/dev/null; then
+    install_as_sudo
+    echo 'go module not installed'
+    echo "now installing go..."
+
+    ###download and install go
+    get_system_information
+    eval "echo $SUDO_PASS | sudo -S rm -rf $GO_HOME"
+    command=$(curl -o /tmp/$file_name $url)
+    eval "$command"
+    command=$(echo $SUDO_PASS | sudo -S tar -xf /tmp/$file_name -C /usr/local)
+    eval "$command"
+
+    echo "go succcesfully installed"
+    eval "go version"
+
+    command=$(rm /tmp/$file_name)
+    eval "$command"
+    dependency_install=yes
+  fi
+}
+
+install_lego() {
+  if ! command -v lego 2>&1 >/dev/null; then
+
+    echo 'lego could not be found'
+    echo 'now installing lego...'
+    export GO111MODULE=on
+
+    if [ ! -d $CERT_PATH ]; then
+      sudo mkdir -p $CERT_PATH
+      sudo chown $USER:$USER -R $CERT_PATH
+    fi
+
+    eval "go install github.com/go-acme/lego/v4/cmd/lego@latest"
+
+    #add crontab for auto renewal of certificates (occurence is at monday,thursdays - can be changed)
+    eval "(crontab -l 2>/dev/null || true; echo '0 0 * * 1,4 $0 autorenew') | sort -u |crontab - "
+    printf "\n"
+    echo "lego succcesfully installed"
+    eval "lego -version"
+    dependency_install=yes
+  fi
+}
+
+install_web_server() {
+  install_as_sudo
+  echo "Install WebServer"
+  PS3="Select Option to enter option or and key to exit: "
+  options=("nginx" "apache" "haproxy")
+  select option in "${options[@]}"; do
+    case $option in
+    "nginx")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install nginx* -y"
+      echo_message
+      exit 0
+      ;;
+    "apache")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install apache2* -y"
+      echo_message
+      exit 0
+      ;;
+    "haproxy")
+      eval "echo $SUDO_PASS | sudo -S $install_cmd install haproxy* -y"
+      echo_message
+      exit 0
+      ;;
+    esac
+  done
+
+}
+
+echo_message(){
+
+      printf "\n\n\n"
+      echo "run below command as admin if SELINUX is enabled to allow network connections"
+      echo "setsebool httpd_can_network_connect 1"
+      echo "setsebool -P haproxy_connect_any=1"
+      echo "Install firewall (firewall-cmd or ufw) for additional security"
+
+}
+
+update_lego() {
+
+  ###to be used to store output from crontab renewals
+  LOG_PATH="$CERT_PATH/log"
+  DATE=$(date +%F-%H%M)
+  LOG_FILE="$LOG_PATH/lego-update-$DATE.log"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $LOG_PATH
+  fi
+
+  echo " "
+  eval " lego -v"
+  echo " "
+  export GO111MODULE=on
+  eval "go install github.com/go-acme/lego/v4/cmd/lego@latest" 2>&1 | tee -a $LOG_FILE
+}
+
+get_system_information() {
+  ##go1.24.3.linux-amd64.tar.gz
+  ##https://dl.google.com/go/go1.24.3.linux-amd64.tar.gz
+  ###As at writing script - go version is 1.24.3 (could find api to get current version)
+  version="1.24.5"
+
+  #Get System Information (Adapted to Debian - This would need changes for other OS's)
+  sys=$(uname -s)
+  system=$(echo $sys | tr '[:upper:]' '[:lower:]')
+
+  #Form URL Based on system information
+  file_name="go$version.$system-amd64.tar.gz"
+  url="https://dl.google.com/go/$file_name"
+}
+
+get_os_type() {
+  #get OSTYPE - modify to know defualt package name to use for installation
+  os_type=$(awk -F'=' '/ID_LIKE/ {print $2}' /etc/os-release | awk -F'"' '{print $2}')
+  if [[ $os_type == *"debian"* ]]; then
+    install_cmd="apt"
+  elif [[ $os_type == *"ubuntu"* ]]; then
+    install_cmd="apt"
+  elif [[ $os_type == *"almalinux"* ]]; then
+    install_cmd="yum"
+  elif [[ $os_type == *"rhel"* ]]; then
+    install_cmd="yum"
+  elif [[ $os_type == *"centos"* ]]; then
+    install_cmd="yum"
+  fi
+}
+
+run() {
+  read -p 'enter domain name(s) seperate with ,: ' -a domains
+  for domain in "${domains[@]}"; do
+    command+="-d $domain "
+  done
+  eval " $command run"
+  exit 0
+}
+
+revoke() {
+
+  read -p 'enter domain name(s) seperate with ,: ' -a domains
+  for domain in "${domains[@]}"; do
+    command+="-d $domain "
+  done
+  eval " $command revoke"
+  exit 0
+}
+
+renew() {
+
+  read -p 'enter domain name(s) seperate with ,: ' -a domains
+  for domain in "${domains[@]}"; do
+    command+="-d $domain "
+  done
+  eval " $command renew"
+  exit 0
+}
+
+list() {
+  eval " $command list"
+  exit 0
+}
+
+autorenew() {
+
+  ###to be used to store output from crontab renewals
+  LOG_PATH="$CERT_PATH/log"
+  DATE=$(date +%F-%H%M)
+  LOG_FILE="$LOG_PATH/acme-$DATE.log"
+  if [ ! -d $LOG_PATH ]; then
+    mkdir -p $LOG_PATH
+  fi
+
+  for files in $(find $LEGO_PATH/certificates/*.json -type f); do
+    IFS=$'\n'
+    for file in $files; do
+      temp_domain=$(cat $file | jq .domain | sed -e 's/^"//' -e 's/"$//')
+      renew_command="$command -d $temp_domain renew"
+      eval " $renew_command" 2>&1 | tee -a $LOG_FILE
+    done
+  done
+
+  exit 0
+
+}
+
+functionlist() {
+  PS3="Select Option to enter option or and key to exit: "
+  options=("issue" "revoke" "renew" "list" "update lego" "install webserver")
+  select option in "${options[@]}"; do
+    case $option in
+    "issue")
+      run
+      ;;
+    "revoke")
+      revoke
+      ;;
+    "renew")
+      renew
+      ;;
+    "list")
+      list
+      ;;
+    "update lego")
+      update_lego
+      exit 0
+      ;;
+    "install webserver")
+      install_web_server
+      exit 0
+      ;;
+    *)
+      exit 0
+      ;;
+    esac
+  done
+}
+
+functionvar() {
+  case $1 in
+  "issue")
+    run
+    ;;
+  "revoke")
+    revoke
+    ;;
+  "renew")
+    renew
+    ;;
+  "list")
+    list
+    ;;
+  "autorenew")
+    autorenew
+    ;;
+  esac
+}
+
+set_env_variables
+check_dependencies
+
+cd $CERT_PATH
+echo "Acme Script for $DNS_PROVIDER"
+## If no parameters are given, print which are avaiable.
+echo "Usage: only dns challenge function available"
+command="lego --email $CONTACT_MAIL --dns $DNS_PROVIDER --dns.propagation-wait 240s "
+IFS=","
+if [ -z "$1" ]; then
+  functionlist
+  exit 0
+else
+  functionvar $1
+  exit 0
+f3