[type/__dtnrch_getssl_script_henet] Add dns.he.net script type

8 files changed, 159 insertions, 0 deletions

diff --git a/type/__dtnrch_getssl_script_henet/files/dns_add_henet b/type/__dtnrch_getssl_script_henet/files/dns_add_henet
new file mode 100644
index 0000000..e7533e7
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/files/dns_add_henet
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+test $# -eq 2 || {
+	printf 'Usage: %s [FULLDOMAIN] [DNS_TOKEN]\n' "$0" >&2
+	exit 1
+}
+
+FULLDOMAIN=${1:?}
+DNS_TOKEN=${2:?}
+
+trap echo EXIT
+
+hostname="_acme-challenge.${FULLDOMAIN}"
+
+curl -sS 'https://dyn.dns.he.net/nic/update' \
+	-d hostname="${hostname}" \
+	-d password=%%PASSWORD%% \
+	-d txt="${DNS_TOKEN}"
diff --git a/type/__dtnrch_getssl_script_henet/files/dns_del_henet b/type/__dtnrch_getssl_script_henet/files/dns_del_henet
new file mode 100644
index 0000000..746ebb7
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/files/dns_del_henet
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+
+# NOTE: DynDNS entries cannot be deleted in he.net, thus the old value will
+#       remain in DNS until the certificate needs to be renewed.
+true
diff --git a/type/__dtnrch_getssl_script_henet/man.rst b/type/__dtnrch_getssl_script_henet/man.rst
new file mode 100644
index 0000000..83995c3
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/man.rst
@@ -0,0 +1,61 @@
+cdist-type__dtnrch_getssl_script_henet(7)
+=========================================
+
+NAME
+----
+cdist-type__dtnrch_getssl_script_henet - Install the GetSSL DNS scripts for
+using dns.he.net to authenticate domains.
+
+
+DESCRIPTION
+-----------
+This type installs a DNS add and remove script to be used in combination with
+GetSSL to manage DNS entries used to have Let's Encrypt verify domains using
+`dns.he.net <https://dns.he.net/>`__.
+
+
+REQUIRED PARAMETERS
+-------------------
+password
+   The key configured in dns.he.net to be used to update the DDNS entries.
+
+   NB: this type only supports a single key for all domains.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+   Whether the script should be installed (``present``) or not (``absent``).
+
+
+BOOLEAN PARAMETERS
+------------------
+None.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+   # Install the script
+   __dtnrch_getssl_script_henet --password v9wdOmIR4V4mQqwt
+
+
+SEE ALSO
+--------
+- :strong:`cdist-type__dtnrch_getssl`\ (7)
+- :strong:`cdist-type__dtnrch_getssl_cert`\ (7)
+
+
+AUTHORS
+-------
+Dennis Camera <cdist--@--dtnr.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2021 Dennis Camera. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/type/__dtnrch_getssl_script_henet/manifest b/type/__dtnrch_getssl_script_henet/manifest
new file mode 100755
index 0000000..5986738
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/manifest
@@ -0,0 +1,71 @@
+#!/bin/sh -e
+#
+# 2021 Dennis Camera (cdist at dtnr.ch)
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; }
+
+SCRIPTS_DIR=/usr/local/share/getssl
+
+state_should=$(cat "${__object:?}/parameter/state")
+
+script_names='dns_add_henet dns_del_henet'
+
+case ${state_should}
+in
+	(present)
+		require=__dtnrch_getssl/ \
+		__directory "${SCRIPTS_DIR}" --state present \
+			--owner 0 --mode 0775 --parents
+
+		export require="__directory${SCRIPTS_DIR}"
+
+		# Prepare environment variables
+		SCR_PASSWORD=$(quote "$(head -n1 "${__object:?}/parameter/password")")
+		export SCR_PASSWORD
+
+		# Preprocess scripts
+		mkdir "${__object:?}/files"
+		for script in ${script_names}
+		do
+			# NOTE: Sequences like %%XYZ%% in the script will be replaced with
+			#       the values of the respective SCR_XYZ environment variable.
+			awk '
+			{
+				while (match($0, /%%[A-Z0-9_]+%%/)) {
+					envvar = substr($0, RSTART + 2, RLENGTH - 4)
+					sub("%%" envvar "%%", ENVIRON["SCR_" envvar])
+				}
+				print
+			}' "${__type:?}/files/${script}" >"${__object:?}/files/${script}"
+		done
+		;;
+	(absent)
+		;;
+	(*)
+		printf 'Invalid --state: %s\n' "${state_should}" >&2
+		exit 1
+		;;
+esac
+
+# Manage scripts
+for script in ${script_names}
+do
+	__file "${SCRIPTS_DIR}/${script}" \
+		--state "${state_should}" \
+		--owner 0 --group 0 --mode 0750 \
+		--source "${__object:?}/files/${script}"
+done
diff --git a/type/__dtnrch_getssl_script_henet/parameter/default/state b/type/__dtnrch_getssl_script_henet/parameter/default/state
new file mode 100644
index 0000000..e7f6134
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/type/__dtnrch_getssl_script_henet/parameter/optional b/type/__dtnrch_getssl_script_henet/parameter/optional
new file mode 100644
index 0000000..ff72b5c
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/parameter/optional
@@ -0,0 +1 @@
+state
diff --git a/type/__dtnrch_getssl_script_henet/parameter/required b/type/__dtnrch_getssl_script_henet/parameter/required
new file mode 100644
index 0000000..f3097ab
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/parameter/required
@@ -0,0 +1 @@
+password
diff --git a/type/__dtnrch_getssl_script_henet/singleton b/type/__dtnrch_getssl_script_henet/singleton
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/type/__dtnrch_getssl_script_henet/singleton