1. [root@fusion ~]# cat /etc/dehydrated/hook.sh
2. #!/usr/bin/env bash
3. # https://github.com/lukas2511/dehydrated/blob/master/docs/examples/hook.sh
4.  
5. set -eu -o pipefail
6.  
7. NSUPDATE="nsupdate -k /root/.secrets/Kfusion.+165+59352.private"
8. DNSSERVER="ns1.mydomain.com"
9. TTL=300
10.  
11.  
12. deploy_challenge() {
13.                 local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"
14.                 printf "server %s\nupdate add _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${1}" "${TTL}" "${3}" | $NSUPDATE
15.                 sleep 5
16.                 nslookup -q=txt _acme-challenge.${1}
17.  
18. }
19.  
20. clean_challenge() {
21.                 local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"
22.                 printf "server %s\nupdate delete _acme-challenge.%s. %d in TXT \"%s\"\nsend\n" "${DNSSERVER}" "${1}" "${TTL}" "${3}" | $NSUPDATE
23. }
24.  
25. deploy_cert() {
26.                 local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"
27.                 local ALLFILE=$(dirname ${2})-${TIMESTAMP}.pem
28.                 cat ${FULLCHAINFILE}  > ${ALLFILE}
29.                 cat ${KEYFILE}       >> ${ALLFILE}
30.                 cat ${CHAINFILE}     >> ${ALLFILE}
31.                 install -o freeswitch -g daemon -m 0600 ${ALLFILE} /etc/freeswitch/tls/all.pem
32.                 install -o freeswitch -g daemon -m 0600 ${CERTFILE} /etc/freeswitch/tls/cert.pem
33.                 install -o freeswitch -g daemon -m 0600 ${CHAINFILE} /etc/freeswitch/tls/chain.pem
34.                 install -o freeswitch -g daemon -m 0600 ${FULLCHAINFILE} /etc/freeswitch/tls/fullchain.pem
35.                 install -o freeswitch -g daemon -m 0600 ${KEYFILE} /etc/freeswitch/tls/privkey.pem
36.                 /usr/sbin/nginx -t && /usr/sbin/nginx -s reload
37.                 for dst in agent tls wss dtls-srtp ; do
38.                         ln -sf /etc/freeswitch/tls/all.pem /etc/freeswitch/tls/${dst}.pem
39.                 done
40.  
41. }
42.  
43. unchanged_cert() {
44.     local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}"
45.                 echo ""
46.                 echo "unchanged_cert()"
47.                 echo ""
48. }
49.  
50. invalid_challenge() {
51.     local DOMAIN="${1}" RESPONSE="${2}"
52.                 echo ""
53.                 echo "invalid_challenge()"
54.                 echo "${1}"
55.                 echo "${2}"
56.                 echo ""
57. }
58.  
59. request_failure() {
60.     local STATUSCODE="${1}" REASON="${2}" REQTYPE="${3}"
61.                 echo ""
62.                 echo "request_failure()"
63.                 echo "${1}"
64.                 echo "${2}"
65.                 echo "${3}"
66.                 echo ""
67. }
68.  
69. exit_hook() {
70.         find /etc/dehydrated/certs/ -mtime +120 -exec rm {} \;
71.                 echo ""
72.                 echo "done"
73.                 echo ""
74. }
75.  
76. HANDLER="$1"; shift
77. if [[ "${HANDLER}" =~ ^(deploy_challenge|clean_challenge|deploy_cert|unchanged_cert|invalid_challenge|request_failure|exit_hook)$ ]]; then
78.   "$HANDLER" "$@"
79. fi
80.