lets-encrypt-wrapper

#!/bin/bash

usage() {
  local op="$1"

  local -A msgs=(
  [default]="
Usage: ${0##*/} <op> [args]

  Known operations:
    enable
    disable
    cron
    renew
"

  [enable]="
Usage: ${0##*/} $op <vhost>

  Enables Let's Encrypt and issues a new certificate for the 
  specified vhost (with the domains currently added to the domain).
"

  [disable]="
Usage: ${0##*/} $op <vhost>

  Disables Let's Encrypt for the specified vhost.
"

  [renew]="
Usage: ${0##*/} $op [opts] <vhost>

  Options:
    -f                  force the renewal, even if the certficate is not
                        close to expire

    -d domain           main domain of the certificate (optional)


  Renew the certificate of the specified vhost.
"
  )

  if [ -z "$op" ]; then
    echo "${msgs[default]}"
  elif [ -n "${msgs[$op]}" ]; then
    echo "${msgs[$op]}"
  else
    echo "Error: unknown operation" 1>&2
  fi

  exit 1
}

disable_lets_encrypt_for_vhost() {
  local vhost="$1"

  save_opts_in_vhost_config "$vhost" \
    "- ssl.enabled" \
    "- ssl.type"
}

set_lets_encrypt_metadata_for_vhost() {
  local vhost="$1"

  save_opts_in_vhost_config "$vhost" \
    "ssl.enabled = yes" \
    "ssl.type = lets-encrypt"
}

cleanup() {
  if [ -n "$moved_htaccess" ]; then
    su -l -s /bin/bash -c "mv -n $htaccess_file_moved $htaccess_file"
  fi
}

# main
[ -z "$1" ] && usage

declare -a acme_args

self_bin=`readlink -e "$0"`
if [ $? -ne 0 ]; then
  echo "Error: unable to get self path" 1>&2
  exit 1
fi

self_dir="${self_bin%/*}"
sys_dir="${self_dir%/*}"

lib_f="$sys_dir/lib/functions"
if ! . "$lib_f"; then
  echo "Error: unable to import $lib_f" 1>&2
  exit 1
fi
load_devpanel_config || exit $?

acme_bin="$sys_dir/bin/packages/acme.sh/acme.sh"
if [ ! -f "$acme_bin" -a -x "$acme_bin" ]; then
  error "missing executable binary file at $acme_bin"
fi

hash -p "$acme_bin" acme.sh

op="$1"
shift

umask 022

case "$op" in
  enable)
    [ $# -lt 1 -o -z "$1" ] && usage "$op"

    while [ -n "$1" -a "${1:0:1}" == - ]; do
      opt="$1"
      case "$opt" in
        --include-base-domain)
          include_base_domain=yes
          shift
          ;;

        *)
          error "unknown option '$opt'"
          ;;
      esac
    done

    vhost="$1"
    shift

    if ! "$sys_dir/libexec/check-vhost-name" archive "$vhost"; then
      exit 1
    fi

    if ! load_vhost_config "$vhost"; then
      error "unable to load vhost configuration."
    fi

    if is_lets_encrypt_enabled_for_vhost "$vhost"; then
      error "Let's Encrypt is already enabled on vhost $vhost."
    elif is_ssl_enabled_on_vhost "$vhost"; then
      errmsg="SSL is already enabled on this vhost."
      errmsg+=" Please disable it first."
      error "$errmsg"
    fi

    linux_user="$v__vhost__linux_user"
    server_base_domain="$lamp__apache_vhosts__virtwww_domain"

    certs_dir="$v__ssl__dir/lets-encrypt"
    if [ -d "$certs_dir" ]; then
      chmod 700 "$certs_dir"
    else
      if ! mkdir -m 700 "$certs_dir"; then
        error "unable to create directory '$certs_dir'"
      fi
    fi

    acme_args+=( --home "$certs_dir" --renew-hook "$self_bin post-renew" )

    public_dir="$v__vhost__document_root"
    if [ ! -d "$public_dir" ]; then
      error "public directory not found: $public_dir"
    fi

    if [ -z "$include_base_domain" ] && \
      is_to_setup_lets_encrypt_on_base_domain ; then

      include_base_domain=yes
    fi

    declare -a domain_args=()
    unset first_domain
    for tmp_domain in $v__vhost__domains; do
      if [[ "$tmp_domain" != *.* ]]; then
        # domain doesn't include a dot, so consider it a local domain, as
        # it'll not be possible to validate it on Let's Encrypt
        continue
      elif [[ "$tmp_domain" == *.$server_base_domain ]] && \
           ! is_var_set_to_yes include_base_domain     ; then
        # domain is the base domain, but adding the base domain to LE is not
        # enabled
        continue
      else
        if [ ${#domain_args[@]} -eq 0 ] ; then
          first_domain="$tmp_domain"
        fi
        domain_args+=( -d "$tmp_domain" )
      fi
    done
      
    if [ ${#domain_args[@]} -eq 0 ]; then
      error "vhost '$vhost' doesn't have any custom domain. Need to add one first before using Let's Encrypt"
    fi

    trap cleanup EXIT

    htaccess_file="$public_dir/.htaccess"
    htaccess_file_moved="$htaccess_file.${RANDOM}_${RANDOM}"

    # if the .htaccess file exists, then move it out temporarily because
    # many apps have .htaccess rules that block the web validation of Let's
    # Encrypt. Will be brought back after the certificate generation
    unset moved_htaccess
    if [ -f "$htaccess_file" ]; then
      su -l -s /bin/bash -c "mv -n $htaccess_file $htaccess_file_moved" "$linux_user"
      if [ $? -eq 0 ]; then
        moved_htaccess=1
      fi
    fi

    # the first domain on command line is the one used as the name of the
    # directory that stores the certificates
    cert_dir="$certs_dir/$first_domain"
    ca_file="$cert_dir/ca.cer"
    ca_bundle_file="$cert_dir/fullchain.cer"
    csr_file="$cert_dir/$first_domain.csr"
    cert_file="$cert_dir/$first_domain.cer"
    priv_key_file="$cert_dir/$first_domain.key"

    acme.sh --issue --force "${acme_args[@]}" \
         -w "$public_dir" "${domain_args[@]}"

    if [ $? -eq 0 ]; then
      set_lets_encrypt_metadata_for_vhost "$vhost"

      for tmp_ext in conf key header; do
        if ls "$certs_dir/"*.$tmp_ext &>/dev/null; then
          chmod 600 "$certs_dir/"*.$tmp_ext
        fi

        if ls "$certs_dir/ca/"*.$tmp_ext &>/dev/null; then
          chmod 600 "$certs_dir/ca/"*.$tmp_ext
        fi
      done

      chmod 600 "$priv_key_file"
      chmod 644 "$ca_file" "$ca_bundle_file" "$csr_file" "$cert_file"
    else
      error "unable to generate certificate"
    fi

    echo
    echo "Configuring certificates on Apache..."
     
    "$sys_dir/libexec/apply-ssl-config" -C "$ca_bundle_file" \
      -c "$cert_file" -k "$priv_key_file" "$vhost"
    ;;

  cron)
    for vhost in $(get_list_of_vhosts); do
      load_vhost_config "$vhost" || continue
      if is_lets_encrypt_enabled_for_vhost "$vhost"; then
        le_dir="$v__ssl__dir/lets-encrypt"
        if [ -d "$le_dir" ]; then
          acme.sh --home "$le_dir" --cron
        fi
      fi
    done

    exit 0
    ;;

  renew)
    getopt_flags='fd:'
    unset force domain
    while getopts $getopt_flags OPTN; do
      case "$OPTN" in
        f)
          force=1
          ;;

        d)
          domain="$OPTARG"
          ;;
        *)
          error "unknown option: $OPTN"
          ;;
      esac
    done
    [ $OPTIND -gt 1 ] && shift $(( $OPTIND - 1 ))

    [ -z "$1" ] && usage "$op"
    vhost="$1"

    if ! "$sys_dir/libexec/check-vhost-name" archive "$vhost"; then
      exit 1
    fi

    if ! load_vhost_config "$vhost"; then
      error "unable to load vhost configuration."
    fi

    if ! is_lets_encrypt_enabled_for_vhost "$vhost"; then
      echo "Warning: Let's Encrypt is not enabled for this vhost." 1>&2
      exit 0
    fi

    le_dir="$v__ssl__dir/lets-encrypt"

    acme.sh --home "$le_dir" --cron ${force:+--force} \
      ${domain:+ -d "$domain"}

    ;;

  post-renew)
    reload_or_start_apache
    ;;

  disable)
    [ $# -lt 1 -o -z "$1" ] && usage "$op"

    vhost="$1"

    if ! load_vhost_config "$vhost"; then
      error "unable to load vhost configuration."
    fi

    if ! "$sys_dir/libexec/check-vhost-name" archive "$vhost"; then
      exit 1
    fi

    if ! is_lets_encrypt_enabled_for_vhost "$vhost"; then
      echo "Warning: Let's Encrypt is not enabled for this vhost." 1>&2
      exit 0
    fi

    "$self_dir/disable-ssl-config" "$vhost"
    if [ $? -ne 0 ]; then
      error "unable to disable SSL config for vhost $vhost"
    fi

    if ! disable_lets_encrypt_for_vhost "$vhost"; then
      error "unable to remove Let's Encrypt metadata for vhost $vhost"
    fi

    exit 0
    ;;
  *)
    usage
    ;;
esac