nginx.sh.j2 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247
  1. #!/usr/bin/env bash
  2. {% if ansible_controlled is defined and ansible_controlled != "" %}
  3. #
  4. # {{ ansible_controlled }}
  5. #
  6. {% endif %}
  7. deploy_challenge() {
  8. local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"
  9. # This hook is called once for every domain that needs to be
  10. # validated, including any alternative names you may have listed.
  11. #
  12. # Parameters:
  13. # - DOMAIN
  14. # The domain name (CN or subject alternative name) being
  15. # validated.
  16. # - TOKEN_FILENAME
  17. # The name of the file containing the token to be served for HTTP
  18. # validation. Should be served by your web server as
  19. # /.well-known/acme-challenge/${TOKEN_FILENAME}.
  20. # - TOKEN_VALUE
  21. # The token value that needs to be served for validation. For DNS
  22. # validation, this is what you want to put in the _acme-challenge
  23. # TXT record. For HTTP validation it is the value that is expected
  24. # be found in the $TOKEN_FILENAME file.
  25. # Simple example: Use nsupdate with local named
  26. # printf 'server 127.0.0.1\nupdate add _acme-challenge.%s 300 IN TXT "%s"\nsend\n' "${DOMAIN}" "${TOKEN_VALUE}" | nsupdate -k /var/run/named/session.key
  27. }
  28. clean_challenge() {
  29. local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"
  30. # This hook is called after attempting to validate each domain,
  31. # whether or not validation was successful. Here you can delete
  32. # files or DNS records that are no longer needed.
  33. #
  34. # The parameters are the same as for deploy_challenge.
  35. # Simple example: Use nsupdate with local named
  36. # printf 'server 127.0.0.1\nupdate delete _acme-challenge.%s TXT "%s"\nsend\n' "${DOMAIN}" "${TOKEN_VALUE}" | nsupdate -k /var/run/named/session.key
  37. }
  38. sync_cert() {
  39. local KEYFILE="${1}" CERTFILE="${2}" FULLCHAINFILE="${3}" CHAINFILE="${4}" REQUESTFILE="${5}"
  40. # This hook is called after the certificates have been created but before
  41. # they are symlinked. This allows you to sync the files to disk to prevent
  42. # creating a symlink to empty files on unexpected system crashes.
  43. #
  44. # This hook is not intended to be used for further processing of certificate
  45. # files, see deploy_cert for that.
  46. #
  47. # Parameters:
  48. # - KEYFILE
  49. # The path of the file containing the private key.
  50. # - CERTFILE
  51. # The path of the file containing the signed certificate.
  52. # - FULLCHAINFILE
  53. # The path of the file containing the full certificate chain.
  54. # - CHAINFILE
  55. # The path of the file containing the intermediate certificate(s).
  56. # - REQUESTFILE
  57. # The path of the file containing the certificate signing request.
  58. # Simple example: sync the files before symlinking them
  59. # sync "${KEYFILE}" "${CERTFILE} "${FULLCHAINFILE}" "${CHAINFILE}" "${REQUESTFILE}"
  60. }
  61. deploy_cert() {
  62. local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"
  63. # This hook is called once for each certificate that has been
  64. # produced. Here you might, for instance, copy your new certificates
  65. # to service-specific locations and reload the service.
  66. #
  67. # Parameters:
  68. # - DOMAIN
  69. # The primary domain name, i.e. the certificate common
  70. # name (CN).
  71. # - KEYFILE
  72. # The path of the file containing the private key.
  73. # - CERTFILE
  74. # The path of the file containing the signed certificate.
  75. # - FULLCHAINFILE
  76. # The path of the file containing the full certificate chain.
  77. # - CHAINFILE
  78. # The path of the file containing the intermediate certificate(s).
  79. # - TIMESTAMP
  80. # Timestamp when the specified certificate was created.
  81. # Simple example: Copy file to nginx config
  82. # cp "${KEYFILE}" "${FULLCHAINFILE}" /etc/nginx/ssl/; chown -R nginx: /etc/nginx/ssl
  83. # systemctl reload nginx
  84. if systemctl -q is-active nginx ; then
  85. if nginx -q -t 2>/dev/null ; then
  86. systemctl reload-or-try-restart nginx
  87. else
  88. echo "Nginx configuration check failed with the following error:"
  89. nginx -t
  90. fi
  91. fi
  92. }
  93. deploy_ocsp() {
  94. local DOMAIN="${1}" OCSPFILE="${2}" TIMESTAMP="${3}"
  95. # This hook is called once for each updated ocsp stapling file that has
  96. # been produced. Here you might, for instance, copy your new ocsp stapling
  97. # files to service-specific locations and reload the service.
  98. #
  99. # Parameters:
  100. # - DOMAIN
  101. # The primary domain name, i.e. the certificate common
  102. # name (CN).
  103. # - OCSPFILE
  104. # The path of the ocsp stapling file
  105. # - TIMESTAMP
  106. # Timestamp when the specified ocsp stapling file was created.
  107. # Simple example: Copy file to nginx config
  108. # cp "${OCSPFILE}" /etc/nginx/ssl/; chown -R nginx: /etc/nginx/ssl
  109. # systemctl reload nginx
  110. if systemctl -q is-active nginx ; then
  111. if nginx -q -t 2>/dev/null ; then
  112. systemctl reload-or-try-restart nginx
  113. else
  114. echo "Nginx configuration check failed with the following error:"
  115. nginx -t
  116. fi
  117. fi
  118. }
  119. unchanged_cert() {
  120. local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}"
  121. # This hook is called once for each certificate that is still
  122. # valid and therefore wasn't reissued.
  123. #
  124. # Parameters:
  125. # - DOMAIN
  126. # The primary domain name, i.e. the certificate common
  127. # name (CN).
  128. # - KEYFILE
  129. # The path of the file containing the private key.
  130. # - CERTFILE
  131. # The path of the file containing the signed certificate.
  132. # - FULLCHAINFILE
  133. # The path of the file containing the full certificate chain.
  134. # - CHAINFILE
  135. # The path of the file containing the intermediate certificate(s).
  136. }
  137. invalid_challenge() {
  138. local DOMAIN="${1}" RESPONSE="${2}"
  139. # This hook is called if the challenge response has failed, so domain
  140. # owners can be aware and act accordingly.
  141. #
  142. # Parameters:
  143. # - DOMAIN
  144. # The primary domain name, i.e. the certificate common
  145. # name (CN).
  146. # - RESPONSE
  147. # The response that the verification server returned
  148. # Simple example: Send mail to root
  149. # printf "Subject: Validation of ${DOMAIN} failed!\n\nOh noez!" | sendmail root
  150. }
  151. request_failure() {
  152. local STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}" HEADERS="${4}"
  153. # This hook is called when an HTTP request fails (e.g., when the ACME
  154. # server is busy, returns an error, etc). It will be called upon any
  155. # response code that does not start with '2'. Useful to alert admins
  156. # about problems with requests.
  157. #
  158. # Parameters:
  159. # - STATUSCODE
  160. # The HTML status code that originated the error.
  161. # - REASON
  162. # The specified reason for the error.
  163. # - REQTYPE
  164. # The kind of request that was made (GET, POST...)
  165. # - HEADERS
  166. # HTTP headers returned by the CA
  167. # Simple example: Send mail to root
  168. # printf "Subject: HTTP request failed failed!\n\nA http request failed with status ${STATUSCODE}!" | sendmail root
  169. }
  170. generate_csr() {
  171. local DOMAIN="${1}" CERTDIR="${2}" ALTNAMES="${3}"
  172. # This hook is called before any certificate signing operation takes place.
  173. # It can be used to generate or fetch a certificate signing request with external
  174. # tools.
  175. # The output should be just the cerificate signing request formatted as PEM.
  176. #
  177. # Parameters:
  178. # - DOMAIN
  179. # The primary domain as specified in domains.txt. This does not need to
  180. # match with the domains in the CSR, it's basically just the directory name.
  181. # - CERTDIR
  182. # Certificate output directory for this particular certificate. Can be used
  183. # for storing additional files.
  184. # - ALTNAMES
  185. # All domain names for the current certificate as specified in domains.txt.
  186. # Again, this doesn't need to match with the CSR, it's just there for convenience.
  187. # Simple example: Look for pre-generated CSRs
  188. # if [ -e "${CERTDIR}/pre-generated.csr" ]; then
  189. # cat "${CERTDIR}/pre-generated.csr"
  190. # fi
  191. }
  192. startup_hook() {
  193. # This hook is called before the cron command to do some initial tasks
  194. # (e.g. starting a webserver).
  195. :
  196. }
  197. exit_hook() {
  198. local ERROR="${1:-}"
  199. # This hook is called at the end of the cron command and can be used to
  200. # do some final (cleanup or other) tasks.
  201. #
  202. # Parameters:
  203. # - ERROR
  204. # Contains error message if dehydrated exits with error
  205. }
  206. HANDLER="$1"
  207. shift
  208. if [[ "${HANDLER}" =~ ^(deploy_challenge|clean_challenge|sync_cert|deploy_cert|deploy_ocsp|unchanged_cert|invalid_challenge|request_failure|generate_csr|startup_hook|exit_hook)$ ]]; then
  209. "$HANDLER" "$@"
  210. fi
  211. exit 0