blob: b870e3b80d2e04cd7cc8f5f0b8ff1d806c6e0b08 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
#!/bin/sh
# Open Infrastructure: service-tools
# Copyright (C) 2014-2021 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>.
set -e
HOOK="$(basename "${0}")"
HOOK_ACTION="$(echo "${HOOK}" | awk -F. '{ print $1 }')"
# set nsupdate action
case "${HOOK}" in
clean_challenge.*)
HOOK_ACTION="delete"
;;
deploy_challenge.*)
HOOK_ACTION="add"
;;
*)
echo "'${HOOK}': no such hook action '${HOOK_ACTION}'" >&2
echo "'${HOOK}': use 'clean_challenge.' or 'deploy_challenge.' as prefix in your symlink" >&2
exit 1
;;
esac
# alternatives handling for dig
if command -v kdig > /dev/null 2>&1
then
# knot-dnsutils
DIG="kdig"
elif command -v dig > /dev/null 2>&1
then
# bind-dnsutils
DIG="dig"
else
echo "'${HOOK}': need dig from bind-dnsutils or knot-dnsutils" >&2
exit 1
fi
# alternatives handling for nsupdate
if command -v knsupdate > /dev/null 2>&1
then
# knot-dnsutils
NSUPDATE="knsupdate"
elif command -v nsupdate > /dev/null 2>&1
then
# bind-dnsutils
NSUPDATE="nsupdate"
else
echo "'${HOOK}': need nsupdate from bind-dnsutils or knot-dnsutils" >&2
exit 1
fi
# config
for FILE in /etc/default/dehydrated-nsupdate /etc/default/dehydrated-nsupdate.d/*
do
if [ -e "${FILE}" ]
then
. "${FILE}"
fi
done
# find txt record to update
CNAME="$(${DIG} +nocomments +noquestion "_acme-challenge.${DOMAIN}" 2>&1 | grep -v '^;' | awk '/CNAME/ { print $5 }' | tail -n1)"
if [ -n "${CNAME}" ]
then
TXT_RECORD="${CNAME}"
else
TXT_RECORD="_acme-challenge.${DOMAIN}"
fi
# find nameservers to update
ZONE="${TXT_RECORD}"
while true
do
NAMESERVERS="$(${DIG} +nocomments +noquestion NS "${ZONE}" 2>&1 | grep -v '^;' | awk '/NS/ { print $5 }')"
if [ -n "${NAMESERVERS}" ]
then
ZONE="$(${DIG} +nocomments +noquestion NS "${ZONE}" 2>&1 | grep -v '^;' | awk '/NS/ { print $1 }' | tail -n1)"
break
else
ZONE="$(echo "${ZONE}" | cut -d '.' -f 2-)"
fi
done
if [ -n "${TSIG_KEYFILE}" ] && [ -e "${TSIG_KEYFILE}" ]
then
NSUPDATE_OPTIONS="-k ${TSIG_KEYFILE}"
fi
# update nameservers
for NAMESERVER in ${NAMESERVERS}
do
echo -n " + sending '${HOOK_ACTION}' for ${TXT_RECORD} to ${NAMESERVER}..."
# shellcheck disable=SC2086
echo "server ${NAMESERVER}
zone ${ZONE}
ttl 0
update ${HOOK_ACTION} ${TXT_RECORD} 0 TXT ${TOKEN_VALUE}
send" | "${NSUPDATE}" ${NSUPDATE_OPTIONS}
echo " done."
done
|
