406 lines
11 KiB
Bash
406 lines
11 KiB
Bash
|
#!/usr/bin/env sh
|
||
|
|
|
||
|
|
# acme.sh DNS API for Timeweb Cloud provider (https://timeweb.cloud).
|
||
|
|
#
|
||
|
|
# Author: https://github.com/nikolaypronchev.
|
||
|
|
#
|
||
|
|
# Prerequisites:
|
||
|
|
# Timeweb Cloud API JWT token. Obtain one from the Timeweb Cloud control panel
|
||
|
|
# ("API and Terraform" section: https://timeweb.cloud/my/api-keys). The JWT token
|
||
|
|
# must be provided to this script in one of two ways:
|
||
|
|
# 1. As the "TW_Token" variable, for example: "export TW_Token=eyJhbG...zUxMiIs";
|
||
|
|
# 2. As a "TW_Token" config entry in acme.sh account config file
|
||
|
|
# (usually located at ~/.acme.sh/account.conf by default).
|
||
|
|
|
||
|
|
TW_Api="https://api.timeweb.cloud/api/v1"
|
||
|
|
|
||
|
|
################ Public functions ################
|
||
|
|
|
||
|
|
# Adds an ACME DNS-01 challenge DNS TXT record via the Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Param1: The ACME DNS-01 challenge FQDN.
|
||
|
|
# Param2: The value of the ACME DNS-01 challenge TXT record.
|
||
|
|
#
|
||
|
|
# Example: dns_timeweb_add "_acme-challenge.sub.domain.com" "D-52Wm...4uYM"
|
||
|
|
dns_timeweb_add() {
|
||
|
|
_debug "$(__green "Timeweb DNS API"): \"dns_timeweb_add\" started."
|
||
|
|
|
||
|
|
_timeweb_set_acme_fqdn "$1" || return 1
|
||
|
|
_timeweb_set_acme_txt "$2" || return 1
|
||
|
|
_timeweb_check_token || return 1
|
||
|
|
_timeweb_split_acme_fqdn || return 1
|
||
|
|
_timeweb_dns_txt_add || return 1
|
||
|
|
|
||
|
|
_debug "$(__green "Timeweb DNS API"): \"dns_timeweb_add\" finished."
|
||
|
|
}
|
||
|
|
|
||
|
|
# Removes a DNS TXT record via the Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Param1: The ACME DNS-01 challenge FQDN.
|
||
|
|
# Param2: The value of the ACME DNS-01 challenge TXT record.
|
||
|
|
#
|
||
|
|
# Example: dns_timeweb_rm "_acme-challenge.sub.domain.com" "D-52Wm...4uYM"
|
||
|
|
dns_timeweb_rm() {
|
||
|
|
_debug "$(__green "Timeweb DNS API"): \"dns_timeweb_rm\" started."
|
||
|
|
|
||
|
|
_timeweb_set_acme_fqdn "$1" || return 1
|
||
|
|
_timeweb_set_acme_txt "$2" || return 1
|
||
|
|
_timeweb_check_token || return 1
|
||
|
|
_timeweb_split_acme_fqdn || return 1
|
||
|
|
_timeweb_get_dns_txt || return 1
|
||
|
|
_timeweb_dns_txt_remove || return 1
|
||
|
|
|
||
|
|
_debug "$(__green "Timeweb DNS API"): \"dns_timeweb_rm\" finished."
|
||
|
|
}
|
||
|
|
|
||
|
|
################ Private functions ################
|
||
|
|
|
||
|
|
# Checks and sets the ACME DNS-01 challenge FQDN.
|
||
|
|
#
|
||
|
|
# Param1: The ACME DNS-01 challenge FQDN.
|
||
|
|
#
|
||
|
|
# Example: _timeweb_set_acme_fqdn "_acme-challenge.sub.domain.com"
|
||
|
|
#
|
||
|
|
# Sets the "Acme_Fqdn" variable (_acme-challenge.sub.domain.com)
|
||
|
|
_timeweb_set_acme_fqdn() {
|
||
|
|
Acme_Fqdn=$1
|
||
|
|
_debug "Setting ACME DNS-01 challenge FQDN \"$Acme_Fqdn\"."
|
||
|
|
[ -z "$Acme_Fqdn" ] && {
|
||
|
|
_err "ACME DNS-01 challenge FQDN is empty."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
# Checks and sets the value of the ACME DNS-01 challenge TXT record.
|
||
|
|
#
|
||
|
|
# Param1: Value of the ACME DNS-01 challenge TXT record.
|
||
|
|
#
|
||
|
|
# Example: _timeweb_set_acme_txt "D-52Wm...4uYM"
|
||
|
|
#
|
||
|
|
# Sets the "Acme_Txt" variable to the provided value (D-52Wm...4uYM)
|
||
|
|
_timeweb_set_acme_txt() {
|
||
|
|
Acme_Txt=$1
|
||
|
|
_debug "Setting the value of the ACME DNS-01 challenge TXT record to \"$Acme_Txt\"."
|
||
|
|
[ -z "$Acme_Txt" ] && {
|
||
|
|
_err "ACME DNS-01 challenge TXT record value is empty."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
# Checks if the Timeweb Cloud API JWT token is present (refer to the script description).
|
||
|
|
# Adds or updates the token in the acme.sh account configuration.
|
||
|
|
_timeweb_check_token() {
|
||
|
|
_debug "Checking for the presence of the Timeweb Cloud API JWT token."
|
||
|
|
|
||
|
|
TW_Token="${TW_Token:-$(_readaccountconf_mutable TW_Token)}"
|
||
|
|
|
||
|
|
[ -z "$TW_Token" ] && {
|
||
|
|
_err "Timeweb Cloud API JWT token was not found."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_saveaccountconf_mutable TW_Token "$TW_Token"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Divides the ACME DNS-01 challenge FQDN into its main domain and subdomain components.
|
||
|
|
_timeweb_split_acme_fqdn() {
|
||
|
|
_debug "Trying to divide \"$Acme_Fqdn\" into its main domain and subdomain components."
|
||
|
|
|
||
|
|
TW_Page_Limit=100
|
||
|
|
TW_Page_Offset=0
|
||
|
|
|
||
|
|
while [ -z "$TW_Domains_Total" ] ||
|
||
|
|
[ "$((TW_Domains_Total + TW_Page_Limit))" -gt "$((TW_Page_Offset + TW_Page_Limit))" ]; do
|
||
|
|
|
||
|
|
_timeweb_list_domains "$TW_Page_Limit" "$TW_Page_Offset" || return 1
|
||
|
|
|
||
|
|
# Remove the 'subdomains' subarray to prevent confusion with FQDNs.
|
||
|
|
|
||
|
|
TW_Domains=$(
|
||
|
|
echo "$TW_Domains" |
|
||
|
|
sed 's/"subdomains":\[[^]]*]//g'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -z "$TW_Domains" ] && {
|
||
|
|
_err "Failed to parse the list of domains."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
while
|
||
|
|
TW_Domain=$(
|
||
|
|
echo "$TW_Domains" |
|
||
|
|
sed -n 's/.*{[^{]*"fqdn":"\([^"]*\)"[^}]*}.*/\1/p'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -n "$TW_Domain" ] && {
|
||
|
|
_timeweb_is_main_domain "$TW_Domain" && return 0
|
||
|
|
|
||
|
|
TW_Domains=$(
|
||
|
|
echo "$TW_Domains" |
|
||
|
|
sed 's/{\([^{]*"fqdn":"'"$TW_Domain"'"[^}]*\)}//'
|
||
|
|
)
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
do :; done
|
||
|
|
|
||
|
|
TW_Page_Offset=$(_math "$TW_Page_Offset" + "$TW_Page_Limit")
|
||
|
|
done
|
||
|
|
|
||
|
|
_err "Failed to divide \"$Acme_Fqdn\" into its main domain and subdomain components."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# Searches for a previously added DNS TXT record.
|
||
|
|
#
|
||
|
|
# Sets the "TW_Dns_Txt_Id" variable.
|
||
|
|
_timeweb_get_dns_txt() {
|
||
|
|
_debug "Trying to locate a DNS TXT record with the value \"$Acme_Txt\"."
|
||
|
|
|
||
|
|
TW_Page_Limit=100
|
||
|
|
TW_Page_Offset=0
|
||
|
|
|
||
|
|
while [ -z "$TW_Dns_Records_Total" ] ||
|
||
|
|
[ "$((TW_Dns_Records_Total + TW_Page_Limit))" -gt "$((TW_Page_Offset + TW_Page_Limit))" ]; do
|
||
|
|
_timeweb_list_dns_records "$TW_Page_Limit" "$TW_Page_Offset" || return 1
|
||
|
|
|
||
|
|
while
|
||
|
|
Dns_Record=$(
|
||
|
|
echo "$TW_Dns_Records" |
|
||
|
|
sed -n 's/.*{\([^{]*{[^{]*'"$Acme_Txt"'[^}]*}[^}]*\)}.*/\1/p'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -n "$Dns_Record" ] && {
|
||
|
|
_timeweb_is_added_txt "$Dns_Record" && return 0
|
||
|
|
|
||
|
|
TW_Dns_Records=$(
|
||
|
|
echo "$TW_Dns_Records" |
|
||
|
|
sed 's/{\([^{]*{[^{]*'"$Acme_Txt"'[^}]*}[^}]*\)}//'
|
||
|
|
)
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
do :; done
|
||
|
|
|
||
|
|
TW_Page_Offset=$(_math "$TW_Page_Offset" + "$TW_Page_Limit")
|
||
|
|
done
|
||
|
|
|
||
|
|
_err "DNS TXT record was not found."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# Lists domains via the Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Param 1: Limit for listed domains.
|
||
|
|
# Param 2: Offset for domains list.
|
||
|
|
#
|
||
|
|
# Sets the "TW_Domains" variable.
|
||
|
|
# Sets the "TW_Domains_Total" variable.
|
||
|
|
_timeweb_list_domains() {
|
||
|
|
_debug "Listing domains via Timeweb Cloud API. Limit: $1, offset: $2."
|
||
|
|
|
||
|
|
export _H1="Authorization: Bearer $TW_Token"
|
||
|
|
|
||
|
|
if ! TW_Domains=$(_get "$TW_Api/domains?limit=$1&offset=$2"); then
|
||
|
|
_err "The request to the Timeweb Cloud API failed."
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
[ -z "$TW_Domains" ] && {
|
||
|
|
_err "Empty response from the Timeweb Cloud API."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
TW_Domains_Total=$(
|
||
|
|
echo "$TW_Domains" |
|
||
|
|
sed 's/.*"meta":{"total":\([0-9]*\)[^0-9].*/\1/'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -z "$TW_Domains_Total" ] && {
|
||
|
|
_err "Failed to extract the total count of domains."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
[ "$TW_Domains_Total" -eq "0" ] && {
|
||
|
|
_err "Domains are missing."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_debug "Total count of domains in the Timeweb Cloud account: $TW_Domains_Total."
|
||
|
|
}
|
||
|
|
|
||
|
|
# Lists domain DNS records via the Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Param 1: Limit for listed DNS records.
|
||
|
|
# Param 2: Offset for DNS records list.
|
||
|
|
#
|
||
|
|
# Sets the "TW_Dns_Records" variable.
|
||
|
|
# Sets the "TW_Dns_Records_Total" variable.
|
||
|
|
_timeweb_list_dns_records() {
|
||
|
|
_debug "Listing domain DNS records via the Timeweb Cloud API. Limit: $1, offset: $2."
|
||
|
|
|
||
|
|
export _H1="Authorization: Bearer $TW_Token"
|
||
|
|
|
||
|
|
if ! TW_Dns_Records=$(_get "$TW_Api/domains/$TW_Main_Domain/dns-records?limit=$1&offset=$2"); then
|
||
|
|
_err "The request to the Timeweb Cloud API failed."
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
[ -z "$TW_Dns_Records" ] && {
|
||
|
|
_err "Empty response from the Timeweb Cloud API."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
TW_Dns_Records_Total=$(
|
||
|
|
echo "$TW_Dns_Records" |
|
||
|
|
sed 's/.*"meta":{"total":\([0-9]*\)[^0-9].*/\1/'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -z "$TW_Dns_Records_Total" ] && {
|
||
|
|
_err "Failed to extract the total count of DNS records."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
[ "$TW_Dns_Records_Total" -eq "0" ] && {
|
||
|
|
_err "DNS records are missing."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_debug "Total count of DNS records: $TW_Dns_Records_Total."
|
||
|
|
}
|
||
|
|
|
||
|
|
# Verifies whether the domain is the primary domain for the ACME DNS-01 challenge FQDN.
|
||
|
|
# The requirement is that the provided domain is the top-level domain
|
||
|
|
# for the ACME DNS-01 challenge FQDN.
|
||
|
|
#
|
||
|
|
# Param 1: Domain object returned by Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Sets the "TW_Main_Domain" variable (e.g. "_acme-challenge.s1.domain.co.uk" → "domain.co.uk").
|
||
|
|
# Sets the "TW_Subdomains" variable (e.g. "_acme-challenge.s1.domain.co.uk" → "_acme-challenge.s1").
|
||
|
|
_timeweb_is_main_domain() {
|
||
|
|
_debug "Checking if \"$1\" is the main domain of the ACME DNS-01 challenge FQDN."
|
||
|
|
|
||
|
|
[ -z "$1" ] && {
|
||
|
|
_debug "Failed to extract FQDN. Skipping domain."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
! echo ".$Acme_Fqdn" | grep -qi "\.$1$" && {
|
||
|
|
_debug "Domain does not match the ACME DNS-01 challenge FQDN. Skipping domain."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
TW_Main_Domain=$1
|
||
|
|
TW_Subdomains=$(
|
||
|
|
echo "$Acme_Fqdn" |
|
||
|
|
sed "s/\.*.\{${#1}\}$//"
|
||
|
|
)
|
||
|
|
|
||
|
|
_debug "Matched domain. ACME DNS-01 challenge FQDN split as [$TW_Subdomains].[$TW_Main_Domain]."
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
# Verifies whether a DNS record was previously added based on the following criteria:
|
||
|
|
# - The value matches the ACME DNS-01 challenge TXT record value;
|
||
|
|
# - The record type is TXT;
|
||
|
|
# - The subdomain matches the ACME DNS-01 challenge FQDN.
|
||
|
|
#
|
||
|
|
# Param 1: DNS record object returned by Timeweb Cloud API.
|
||
|
|
#
|
||
|
|
# Sets the "TW_Dns_Txt_Id" variable.
|
||
|
|
_timeweb_is_added_txt() {
|
||
|
|
_debug "Checking if \"$1\" is a previously added DNS TXT record."
|
||
|
|
|
||
|
|
echo "$1" | grep -qv '"type":"TXT"' && {
|
||
|
|
_debug "Not a TXT record. Skipping the record."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
if [ -n "$TW_Subdomains" ]; then
|
||
|
|
echo "$1" | grep -qvi "\"subdomain\":\"$TW_Subdomains\"" && {
|
||
|
|
_debug "Subdomains do not match. Skipping the record."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
else
|
||
|
|
echo "$1" | grep -q '"subdomain\":"..*"' && {
|
||
|
|
_debug "Subdomains do not match. Skipping the record."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
fi
|
||
|
|
|
||
|
|
TW_Dns_Txt_Id=$(
|
||
|
|
echo "$1" |
|
||
|
|
sed 's/.*"id":\([0-9]*\)[^0-9].*/\1/'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -z "$TW_Dns_Txt_Id" ] && {
|
||
|
|
_debug "Failed to extract the DNS record ID. Skipping the record."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_debug "Matching DNS TXT record ID is \"$TW_Dns_Txt_Id\"."
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
# Adds a DNS TXT record via the Timeweb Cloud API.
|
||
|
|
_timeweb_dns_txt_add() {
|
||
|
|
_debug "Adding a new DNS TXT record via the Timeweb Cloud API."
|
||
|
|
|
||
|
|
export _H1="Authorization: Bearer $TW_Token"
|
||
|
|
export _H2="Content-Type: application/json"
|
||
|
|
|
||
|
|
if ! TW_Response=$(
|
||
|
|
_post "{
|
||
|
|
\"subdomain\":\"$TW_Subdomains\",
|
||
|
|
\"type\":\"TXT\",
|
||
|
|
\"value\":\"$Acme_Txt\"
|
||
|
|
}" \
|
||
|
|
"$TW_Api/domains/$TW_Main_Domain/dns-records"
|
||
|
|
); then
|
||
|
|
_err "The request to the Timeweb Cloud API failed."
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
[ -z "$TW_Response" ] && {
|
||
|
|
_err "An unexpected empty response was received from the Timeweb Cloud API."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
TW_Dns_Txt_Id=$(
|
||
|
|
echo "$TW_Response" |
|
||
|
|
sed 's/.*"id":\([0-9]*\)[^0-9].*/\1/'
|
||
|
|
)
|
||
|
|
|
||
|
|
[ -z "$TW_Dns_Txt_Id" ] && {
|
||
|
|
_err "Failed to extract the DNS TXT Record ID."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_debug "DNS TXT record has been added. ID: \"$TW_Dns_Txt_Id\"."
|
||
|
|
}
|
||
|
|
|
||
|
|
# Removes a DNS record via the Timeweb Cloud API.
|
||
|
|
_timeweb_dns_txt_remove() {
|
||
|
|
_debug "Removing DNS record via the Timeweb Cloud API."
|
||
|
|
|
||
|
|
export _H1="Authorization: Bearer $TW_Token"
|
||
|
|
|
||
|
|
if ! TW_Response=$(
|
||
|
|
_post \
|
||
|
|
"" \
|
||
|
|
"$TW_Api/domains/$TW_Main_Domain/dns-records/$TW_Dns_Txt_Id" \
|
||
|
|
"" \
|
||
|
|
"DELETE"
|
||
|
|
); then
|
||
|
|
_err "The request to the Timeweb Cloud API failed."
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
[ -n "$TW_Response" ] && {
|
||
|
|
_err "Received an unexpected response body from the Timeweb Cloud API."
|
||
|
|
return 1
|
||
|
|
}
|
||
|
|
|
||
|
|
_debug "DNS TXT record with ID \"$TW_Dns_Txt_Id\" has been removed."
|
||
|
|
}
|