forked from 0k/0k-charms
8 changed files with 306 additions and 157 deletions
-
99apache/lib/common
-
8apache/test/vhost
-
146apache/test/vhost_cert_provider
-
46letsencrypt/actions/add
-
58letsencrypt/hooks/dc-pre-run
-
71letsencrypt/hooks/init
-
25letsencrypt/lib/common
-
10letsencrypt/metadata.yml
@ -0,0 +1,146 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
exname=$(basename $0) |
||||
|
|
||||
|
prefix_cmd=" |
||||
|
. /etc/shlib |
||||
|
|
||||
|
include common |
||||
|
include parse |
||||
|
|
||||
|
. ../lib/common |
||||
|
|
||||
|
depends compose |
||||
|
|
||||
|
" |
||||
|
|
||||
|
## |
||||
|
## Mocks |
||||
|
## |
||||
|
|
||||
|
relation-get() { |
||||
|
local key="$1" |
||||
|
echo "$CFG" | shyaml get-value "$key" 2>/dev/null |
||||
|
} |
||||
|
export -f relation-get |
||||
|
|
||||
|
get_compose_relations() { |
||||
|
local service="$1" |
||||
|
printf "%s\0" "${RELATIONS[@]}" |
||||
|
} |
||||
|
export -f get_compose_relations |
||||
|
|
||||
|
merge_yaml_str() { |
||||
|
printf "<merge_yaml_str(" |
||||
|
printf "'%s', " "$@" |
||||
|
printf ")>" |
||||
|
} |
||||
|
export -f merge_yaml_str |
||||
|
|
||||
|
compose() { |
||||
|
printf "Calling: compose " |
||||
|
printf "%s " "$*" |
||||
|
echo |
||||
|
} |
||||
|
export -f compose |
||||
|
|
||||
|
yaml_key_val_str() { |
||||
|
printf "%s: %s" "$1" "$2" |
||||
|
} |
||||
|
export -f yaml_key_val_str |
||||
|
|
||||
|
file_put() { |
||||
|
echo "file_put $1" |
||||
|
cat - | prefix " | " |
||||
|
} |
||||
|
export -f file_put |
||||
|
|
||||
|
docker() { |
||||
|
echo "docker" "$@" |
||||
|
echo stdin: |
||||
|
cat - | prefix " | " |
||||
|
} |
||||
|
export -f docker |
||||
|
|
||||
|
config-add() { |
||||
|
echo "config-add" |
||||
|
echo "$1" | prefix " | " |
||||
|
} |
||||
|
export -f config-add |
||||
|
|
||||
|
mkdir() { |
||||
|
echo "called: $FUNCNAME $@" >&2 |
||||
|
} |
||||
|
export -f mkdir |
||||
|
|
||||
|
setfacl() { |
||||
|
echo "called: $FUNCNAME $@" >&2 |
||||
|
} |
||||
|
export -f setfacl |
||||
|
|
||||
|
chgrp() { |
||||
|
echo "called: $FUNCNAME $@" >&2 |
||||
|
} |
||||
|
export -f chgrp |
||||
|
|
||||
|
chmod() { |
||||
|
echo "called: $FUNCNAME $@" >&2 |
||||
|
} |
||||
|
export -f chmod |
||||
|
|
||||
|
|
||||
|
cached_cmd_on_base_image() { |
||||
|
echo "called: $FUNCNAME $@" >&2 |
||||
|
echo "stdout:" >&2 |
||||
|
echo "<GID>" | prefix " | " >&2 |
||||
|
echo "<GID>" |
||||
|
} |
||||
|
export -f cached_cmd_on_base_image |
||||
|
|
||||
|
|
||||
|
## |
||||
|
## cert-provider |
||||
|
## |
||||
|
|
||||
|
|
||||
|
try " |
||||
|
export SERVICE_CONFIGSTORE='\$SERVICE_CONFIGSTORE' |
||||
|
export CONFIGSTORE='\$CONFIGSTORE' |
||||
|
export BASE_SERVICE_NAME='\$BASE_SERVICE_NAME' |
||||
|
export MASTER_TARGET_SERVICE_NAME='\$MASTER_TARGET_SERVICE_NAME' |
||||
|
DOMAIN=www.example.com |
||||
|
DOCKER_SITE_PATH=/var/www/\$DOMAIN |
||||
|
CFG=' |
||||
|
ssl: |
||||
|
foo: | |
||||
|
a |
||||
|
b |
||||
|
' |
||||
|
RELATIONS=() |
||||
|
apache_vhost_create" "unknown cert key" |
||||
|
is errlvl 1 |
||||
|
is err reg 'Error: .*cert-provider.*' |
||||
|
|
||||
|
|
||||
|
try " |
||||
|
export SERVICE_CONFIGSTORE='\$SERVICE_CONFIGSTORE' |
||||
|
export CONFIGSTORE='\$CONFIGSTORE' |
||||
|
export DATASTORE='\$DATASTORE' |
||||
|
export BASE_SERVICE_NAME='\$BASE_SERVICE_NAME' |
||||
|
export MASTER_TARGET_SERVICE_NAME='\$MASTER_TARGET_SERVICE_NAME' |
||||
|
DOMAIN=www.example.com |
||||
|
DOCKER_SITE_PATH=/var/www/\$DOMAIN |
||||
|
CFG=' |
||||
|
ssl: |
||||
|
foo: 12 |
||||
|
' |
||||
|
RELATIONS=(cert-provider foo a True) |
||||
|
apache_vhost_create" "known cert key" |
||||
|
noerror |
||||
|
is out reg 'Calling: compose .*foo: options: <merge_yaml_str\(.a., .12., )>.*run foo.*' |
||||
|
is out part 'config-add |
||||
|
| services: |
||||
|
| $MASTER_TARGET_SERVICE_NAME: |
||||
|
| volumes: |
||||
|
| - $DATASTORE/foo/etc/letsencrypt:/etc/letsencrypt:ro' |
||||
|
|
||||
@ -1,46 +0,0 @@ |
|||||
#!/bin/bash |
|
||||
|
|
||||
## Load action gets a first argument a DIRECTORY holding the necessary files. |
|
||||
## |
|
||||
## |
|
||||
|
|
||||
if [ -z "$SERVICE_DATASTORE" ]; then |
|
||||
echo "This script is meant to be run through 'compose' to work properly." >&2 |
|
||||
exit 1 |
|
||||
fi |
|
||||
|
|
||||
usage="$exname [-h|--help] DOMAIN [DOMAIN...]" |
|
||||
|
|
||||
domains=() |
|
||||
while [ "$1" ]; do |
|
||||
case "$1" in |
|
||||
"--help"|"-h") |
|
||||
print_usage |
|
||||
exit 0 |
|
||||
;; |
|
||||
--*|-*) |
|
||||
err "Unexpected optional argument '$1'" |
|
||||
print_usage |
|
||||
exit 1 |
|
||||
;; |
|
||||
*) |
|
||||
domains+=("$1") |
|
||||
;; |
|
||||
esac |
|
||||
shift |
|
||||
done |
|
||||
|
|
||||
if [ -z "${domains[*]}" ]; then |
|
||||
err "You must provide at least one domain as positional argument." |
|
||||
print_usage |
|
||||
exit 1 |
|
||||
fi |
|
||||
|
|
||||
set -e |
|
||||
|
|
||||
## XXXvlab: should check that domain can be declared (with whois, check that the |
|
||||
## registrar is a provider that have config values declared in compose.conf) |
|
||||
mkdir -p "$SERVICE_DATASTORE/etc/letsencrypt" |
|
||||
echo "${domains[@]}" >> "$SERVICE_DATASTORE/etc/letsencrypt/domains.conf" |
|
||||
|
|
||||
info "Added '${domains[*]}' domains to letsencrypt domain lists." |
|
||||
@ -0,0 +1,58 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
## Init is run on host |
||||
|
## For now it is run every time the script is launched, but |
||||
|
## it should be launched only once after build. |
||||
|
|
||||
|
## Accessible variables are: |
||||
|
## - SERVICE_NAME Name of current service |
||||
|
## - DOCKER_BASE_IMAGE Base image from which this service might be built if any |
||||
|
## - SERVICE_DATASTORE Location on host of the DATASTORE of this service |
||||
|
## - SERVICE_CONFIGSTORE Location on host of the CONFIGSTORE of this service |
||||
|
|
||||
|
. lib/common || exit 1 |
||||
|
|
||||
|
set -e |
||||
|
|
||||
|
service_def=$(get_compose_service_def "$SERVICE_NAME") |
||||
|
|
||||
|
USER_EMAIL=$(echo "$service_def" | shyaml get-value options.email 2>/dev/null) || { |
||||
|
err "No ${WHITE}email${NORMAL} value in ${DARKYELLOW}$SERVICE_NAME${NORMAL} compose's ${WHITE}options${NORMAL}." |
||||
|
exit 1 |
||||
|
} |
||||
|
|
||||
|
config=" |
||||
|
$SERVICE_NAME: |
||||
|
environment: |
||||
|
LETSENCRYPT_USER_MAIL: $USER_EMAIL" |
||||
|
|
||||
|
if environment_def="$(printf "%s" "$service_def" | shyaml -y get-value options.env 2>/dev/null)"; then |
||||
|
while read-0 key value; do |
||||
|
config+="$(printf "\n %s: %s" "$key" "$value")" |
||||
|
done < <(printf "%s" "$environment_def" | yaml_opt_bash_env_ignore_first_level LEXICON) |
||||
|
|
||||
|
if ! provider=$(printf "%s" "$environment_def" | shyaml -y get-value provider 2>/dev/null); then |
||||
|
provider= |
||||
|
## If no provider is given, we fallback on the first found |
||||
|
|
||||
|
while read-0 key value; do |
||||
|
[[ "$(echo "$value" | shyaml get-type)" == "struct" ]] && { |
||||
|
provider="$key" |
||||
|
break |
||||
|
} |
||||
|
done < <(echo "$environment_def" | shyaml key-values-0) |
||||
|
warn "No ${WHITE}provider${NORMAL} key given, had to infer it, chose '$key'." |
||||
|
fi |
||||
|
|
||||
|
config+=$(echo -en "\n LEXICON_PROVIDER: $provider") |
||||
|
fi |
||||
|
|
||||
|
if ! challenge_type=$(printf "%s" "$service_def" | shyaml get-value "options.challenge-type" 2>/dev/null); then |
||||
|
warn "No ${WHITE}challenge-type${NORMAL} provided, defaulting to 'http'." |
||||
|
challenge_type=http |
||||
|
fi |
||||
|
config+=$(echo -en "\n CHALLENGE_TYPE: $challenge_type") |
||||
|
|
||||
|
init-config-add "$config" |
||||
|
|
||||
|
mkdir -p "$SERVICE_DATASTORE/etc/letsencrypt" |
||||
@ -1,71 +0,0 @@ |
|||||
#!/bin/bash |
|
||||
|
|
||||
## Init is run on host |
|
||||
## For now it is run every time the script is launched, but |
|
||||
## it should be launched only once after build. |
|
||||
|
|
||||
## Accessible variables are: |
|
||||
## - SERVICE_NAME Name of current service |
|
||||
## - DOCKER_BASE_IMAGE Base image from which this service might be built if any |
|
||||
## - SERVICE_DATASTORE Location on host of the DATASTORE of this service |
|
||||
## - SERVICE_CONFIGSTORE Location on host of the CONFIGSTORE of this service |
|
||||
|
|
||||
set -e |
|
||||
|
|
||||
service_def=$(get_compose_service_def "$SERVICE_NAME") |
|
||||
|
|
||||
USER_EMAIL=$(echo "$service_def" | shyaml get-value options.email 2>/dev/null) || { |
|
||||
err "No ${WHITE}email${NORMAL} value in ${DARKYELLOW}$SERVICE_NAME${NORMAL} compose's ${WHITE}options${NORMAL}." |
|
||||
exit 1 |
|
||||
} |
|
||||
|
|
||||
yaml_opt_bash_env() { |
|
||||
local prefix="$1" key value |
|
||||
while read-0 key value; do |
|
||||
new_prefix="${prefix}_${key^^}" |
|
||||
if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then |
|
||||
echo "$value" | yaml_opt_bash_env "${new_prefix}" |
|
||||
else |
|
||||
printf "%s\0%s\0" "${new_prefix}" "$value" |
|
||||
fi |
|
||||
done < <(shyaml key-values-0) |
|
||||
} |
|
||||
|
|
||||
yaml_opt_bash_env_ignore_first_level() { |
|
||||
local prefix="$1" key value |
|
||||
while read-0 key value; do |
|
||||
new_prefix="${prefix}_${key^^}" |
|
||||
if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then |
|
||||
echo "$value" | yaml_opt_bash_env "${new_prefix}" |
|
||||
fi |
|
||||
done < <(shyaml key-values-0) |
|
||||
} |
|
||||
|
|
||||
|
|
||||
config=" |
|
||||
$SERVICE_NAME: |
|
||||
environment: |
|
||||
LETSENCRYPT_USER_MAIL: $USER_EMAIL" |
|
||||
|
|
||||
|
|
||||
while read-0 key value; do |
|
||||
config+="$(printf "\n %s: %s" "$key" "$value")" |
|
||||
done < <(yaml_opt_bash_env_ignore_first_level LEXICON < <(echo "$service_def" | shyaml -y get-value options)) |
|
||||
|
|
||||
## XXXvlab: this is very temporary, we should change image to support more |
|
||||
## than one provider (cf: https://github.com/adferrand/docker-letsencrypt-dns/issues/24) |
|
||||
first_key= |
|
||||
while read-0 key value; do |
|
||||
[[ "$(echo "$value" | shyaml get-type)" == "struct" ]] && { |
|
||||
first_key="$key" |
|
||||
break |
|
||||
} |
|
||||
done < <(echo "$service_def" | shyaml key-values-0 options) |
|
||||
|
|
||||
config+=$(echo -en "\n LEXICON_PROVIDER: $first_key") |
|
||||
|
|
||||
init-config-add "$config" |
|
||||
|
|
||||
mkdir -p "$SERVICE_DATASTORE/etc/letsencrypt" |
|
||||
touch "$SERVICE_DATASTORE/etc/letsencrypt/domains.conf" |
|
||||
|
|
||||
@ -0,0 +1,25 @@ |
|||||
|
|
||||
|
|
||||
|
|
||||
|
|
||||
|
yaml_opt_bash_env() { |
||||
|
local prefix="$1" key value |
||||
|
while read-0 key value; do |
||||
|
new_prefix="${prefix}_${key^^}" |
||||
|
if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then |
||||
|
echo "$value" | yaml_opt_bash_env "${new_prefix}" |
||||
|
else |
||||
|
printf "%s\0%s\0" "${new_prefix/-/_}" "$value" |
||||
|
fi |
||||
|
done < <(shyaml key-values-0) |
||||
|
} |
||||
|
|
||||
|
yaml_opt_bash_env_ignore_first_level() { |
||||
|
local prefix="$1" key value |
||||
|
while read-0 key value; do |
||||
|
new_prefix="${prefix}_${key^^}" |
||||
|
if [[ "$(echo "$value" | shyaml get-type)" == "struct" ]]; then |
||||
|
echo "$value" | yaml_opt_bash_env "${new_prefix}" |
||||
|
fi |
||||
|
done < <(shyaml key-values-0) |
||||
|
} |
||||
@ -1,7 +1,9 @@ |
|||||
description: "Let's Encrypt" |
|
||||
|
description: "Let's Encrypt server" |
||||
|
type: run-once |
||||
maintainer: "Valentin Lab <valentin.lab@kalysto.org>" |
maintainer: "Valentin Lab <valentin.lab@kalysto.org>" |
||||
## XXXvlab: docker uses the 'build' directory or the 'image:' option here. |
## XXXvlab: docker uses the 'build' directory or the 'image:' option here. |
||||
docker-image: adferrand/letsencrypt-dns |
|
||||
|
docker-image: docker.0k.io/letsencrypt |
||||
data-resources: |
data-resources: |
||||
- /etc/letsencrypt |
|
||||
- /var/log/letsencrypt |
|
||||
|
- /etc/letsencrypt ## yes certificates are stored here, this is data |
||||
|
- /var/log/letsencrypt ## logs |
||||
|
- /var/lib/tldextract ## latest data about TLDs, this is used by lexicon... |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue