Erweitere das SSL/TLS Setup-Skript für den YourPart Daemon um Unterstützung für Let's Encrypt. Füge Funktionen zur Erstellung und Erneuerung von Let's Encrypt Zertifikaten hinzu, einschließlich automatischer Erneuerung über Cron Jobs. Ermögliche die Auswahl zwischen Self-Signed und Let's Encrypt Zertifikaten und verbessere die Benutzerführung bei der Zertifikatsauswahl.
This commit is contained in:
Torsten Schulz (local)
committed by
Torsten (PC)
Torsten (PC)
parent
8212e906a3
commit
664f2af346
236
setup-ssl-dns.sh
Executable file
236
setup-ssl-dns.sh
Executable file
@@ -0,0 +1,236 @@
|
||||
#!/bin/bash
|
||||
|
||||
# SSL/TLS Setup Script für YourPart Daemon mit DNS-01 Challenge
|
||||
# Für Domains mit DNS-Provider wie Cloudflare, Route53, etc.
|
||||
|
||||
set -e
|
||||
|
||||
# Farben für Logging
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
log_info() {
|
||||
echo -e "${BLUE}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_success() {
|
||||
echo -e "${GREEN}[SUCCESS]${NC} $1"
|
||||
}
|
||||
|
||||
log_warning() {
|
||||
echo -e "${YELLOW}[WARNING]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
CERT_DIR="/etc/yourpart"
|
||||
CERT_FILE="$CERT_DIR/server.crt"
|
||||
KEY_FILE="$CERT_DIR/server.key"
|
||||
LETSENCRYPT_CERT="/etc/letsencrypt/live/your-part.de/fullchain.pem"
|
||||
LETSENCRYPT_KEY="/etc/letsencrypt/live/your-part.de/privkey.pem"
|
||||
|
||||
log_info "SSL/TLS Setup mit DNS-01 Challenge für YourPart Daemon"
|
||||
|
||||
# Prüfe ob certbot installiert ist
|
||||
if ! command -v certbot &> /dev/null; then
|
||||
log_error "Certbot ist nicht installiert!"
|
||||
log_info "Installiere Certbot..."
|
||||
if command -v apt &> /dev/null; then
|
||||
sudo apt update
|
||||
sudo apt install -y certbot
|
||||
elif command -v zypper &> /dev/null; then
|
||||
sudo zypper install -y certbot
|
||||
else
|
||||
log_error "Paketmanager nicht unterstützt. Installiere Certbot manuell."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# DNS Provider Auswahl
|
||||
echo ""
|
||||
log_info "Wählen Sie Ihren DNS-Provider:"
|
||||
echo "1) Cloudflare"
|
||||
echo "2) Route53 (AWS)"
|
||||
echo "3) Manual (manuelle DNS-Einträge)"
|
||||
echo ""
|
||||
read -p "Ihre Wahl (1-3): " -n 1 -r
|
||||
echo ""
|
||||
|
||||
case $REPLY in
|
||||
1)
|
||||
DNS_PROVIDER="cloudflare"
|
||||
;;
|
||||
2)
|
||||
DNS_PROVIDER="route53"
|
||||
;;
|
||||
3)
|
||||
DNS_PROVIDER="manual"
|
||||
;;
|
||||
*)
|
||||
log_error "Ungültige Auswahl!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Erstelle Zertifikats-Verzeichnis
|
||||
if [ ! -d "$CERT_DIR" ]; then
|
||||
log_info "Erstelle Zertifikats-Verzeichnis: $CERT_DIR"
|
||||
sudo mkdir -p "$CERT_DIR"
|
||||
fi
|
||||
|
||||
# DNS-Provider spezifische Konfiguration
|
||||
case $DNS_PROVIDER in
|
||||
"cloudflare")
|
||||
log_info "Cloudflare DNS-01 Challenge Setup"
|
||||
|
||||
# Prüfe ob Cloudflare Plugin installiert ist
|
||||
if ! certbot plugins | grep -q cloudflare; then
|
||||
log_info "Installiere Cloudflare Plugin..."
|
||||
if command -v apt &> /dev/null; then
|
||||
sudo apt install -y python3-certbot-dns-cloudflare
|
||||
elif command -v zypper &> /dev/null; then
|
||||
sudo zypper install -y python3-certbot-dns-cloudflare
|
||||
else
|
||||
log_error "Cloudflare Plugin nicht verfügbar. Installiere manuell."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Erstelle Cloudflare Credentials Datei
|
||||
log_info "Erstelle Cloudflare Credentials..."
|
||||
read -p "Cloudflare API Token: " -s CF_TOKEN
|
||||
echo
|
||||
|
||||
CF_CREDENTIALS_FILE="/etc/yourpart/cloudflare.ini"
|
||||
sudo tee "$CF_CREDENTIALS_FILE" > /dev/null << EOF
|
||||
dns_cloudflare_api_token = $CF_TOKEN
|
||||
EOF
|
||||
sudo chmod 600 "$CF_CREDENTIALS_FILE"
|
||||
|
||||
# Erstelle Zertifikat
|
||||
log_info "Erstelle Let's Encrypt Zertifikat mit Cloudflare DNS-01 Challenge..."
|
||||
sudo certbot certonly \
|
||||
--dns-cloudflare \
|
||||
--dns-cloudflare-credentials "$CF_CREDENTIALS_FILE" \
|
||||
-d your-part.de \
|
||||
--non-interactive \
|
||||
--agree-tos \
|
||||
--email admin@your-part.de
|
||||
;;
|
||||
|
||||
"route53")
|
||||
log_info "Route53 DNS-01 Challenge Setup"
|
||||
|
||||
# Prüfe ob Route53 Plugin installiert ist
|
||||
if ! certbot plugins | grep -q route53; then
|
||||
log_info "Installiere Route53 Plugin..."
|
||||
if command -v apt &> /dev/null; then
|
||||
sudo apt install -y python3-certbot-dns-route53
|
||||
elif command -v zypper &> /dev/null; then
|
||||
sudo zypper install -y python3-certbot-dns-route53
|
||||
else
|
||||
log_error "Route53 Plugin nicht verfügbar. Installiere manuell."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Erstelle Zertifikat
|
||||
log_info "Erstelle Let's Encrypt Zertifikat mit Route53 DNS-01 Challenge..."
|
||||
log_warning "Stelle sicher, dass AWS-Credentials konfiguriert sind!"
|
||||
sudo certbot certonly \
|
||||
--dns-route53 \
|
||||
-d your-part.de \
|
||||
--non-interactive \
|
||||
--agree-tos \
|
||||
--email admin@your-part.de
|
||||
;;
|
||||
|
||||
"manual")
|
||||
log_info "Manuelle DNS-01 Challenge"
|
||||
log_warning "Sie müssen die DNS-TXT-Einträge manuell erstellen!"
|
||||
|
||||
# Erstelle Zertifikat mit manueller Bestätigung
|
||||
sudo certbot certonly \
|
||||
--manual \
|
||||
--preferred-challenges dns \
|
||||
-d your-part.de \
|
||||
--agree-tos \
|
||||
--email admin@your-part.de
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
log_success "Let's Encrypt Zertifikat erfolgreich erstellt!"
|
||||
|
||||
# Erstelle Symlinks zu den Zertifikaten
|
||||
sudo ln -sf "$LETSENCRYPT_CERT" "$CERT_FILE"
|
||||
sudo ln -sf "$LETSENCRYPT_KEY" "$KEY_FILE"
|
||||
|
||||
# Setze korrekte Berechtigungen
|
||||
sudo chown yourpart:yourpart "$CERT_FILE" "$KEY_FILE"
|
||||
sudo chmod 644 "$CERT_FILE"
|
||||
sudo chmod 600 "$KEY_FILE"
|
||||
|
||||
# Zeige Zertifikats-Informationen
|
||||
log_info "Let's Encrypt Zertifikats-Informationen:"
|
||||
openssl x509 -in "$CERT_FILE" -text -noout | grep -E "(Subject:|Not Before|Not After|DNS:)"
|
||||
|
||||
# Erstelle Auto-Renewal Script
|
||||
log_info "Richte automatische Zertifikats-Erneuerung ein..."
|
||||
|
||||
RENEWAL_SCRIPT="/etc/yourpart/renew-ssl-dns.sh"
|
||||
sudo tee "$RENEWAL_SCRIPT" > /dev/null << EOF
|
||||
#!/bin/bash
|
||||
# Automatische SSL-Zertifikats-Erneuerung für YourPart Daemon (DNS-01)
|
||||
|
||||
CERT_DIR="/etc/yourpart"
|
||||
LETSENCRYPT_CERT="/etc/letsencrypt/live/your-part.de/fullchain.pem"
|
||||
LETSENCRYPT_KEY="/etc/letsencrypt/live/your-part.de/privkey.pem"
|
||||
|
||||
# Erneuere Zertifikat
|
||||
certbot renew --quiet
|
||||
|
||||
if [ \$? -eq 0 ]; then
|
||||
# Aktualisiere Symlinks
|
||||
ln -sf "\$LETSENCRYPT_CERT" "\$CERT_DIR/server.crt"
|
||||
ln -sf "\$LETSENCRYPT_KEY" "\$CERT_DIR/server.key"
|
||||
|
||||
# Setze Berechtigungen
|
||||
chown yourpart:yourpart "\$CERT_DIR/server.crt" "\$CERT_DIR/server.key"
|
||||
chmod 644 "\$CERT_DIR/server.crt"
|
||||
chmod 600 "\$CERT_DIR/server.key"
|
||||
|
||||
# Starte Daemon neu
|
||||
systemctl reload yourpart-daemon
|
||||
|
||||
echo "\$(date): SSL-Zertifikat erfolgreich erneuert" >> /var/log/yourpart/ssl-renewal.log
|
||||
fi
|
||||
EOF
|
||||
|
||||
sudo chmod +x "$RENEWAL_SCRIPT"
|
||||
|
||||
# Füge Cron Job hinzu (täglich um 2:30 Uhr)
|
||||
(sudo crontab -l 2>/dev/null; echo "30 2 * * * $RENEWAL_SCRIPT") | sudo crontab -
|
||||
|
||||
log_success "Automatische Erneuerung eingerichtet (täglich um 2:30 Uhr)"
|
||||
|
||||
log_info ""
|
||||
log_info "Nächste Schritte:"
|
||||
log_info "1. Aktiviere SSL in der Konfiguration:"
|
||||
log_info " WEBSOCKET_SSL_ENABLED=true"
|
||||
log_info "2. Starte den Daemon neu:"
|
||||
log_info " sudo systemctl restart yourpart-daemon"
|
||||
log_info "3. Verbinde dich mit:"
|
||||
log_info " wss://your-part.de:4551"
|
||||
log_info ""
|
||||
log_success "Let's Encrypt Zertifikat ist produktionsbereit!"
|
||||
|
||||
else
|
||||
log_error "Let's Encrypt Zertifikat konnte nicht erstellt werden!"
|
||||
exit 1
|
||||
fi
|
||||
Reference in New Issue
Block a user