#!/usr/bin/env sh
# Jarl (BIND manager): a program for lego's "exec" DNS provider.
#
# lego runs it as "jarl-lego present FQDN VALUE" and "jarl-lego cleanup
# FQDN VALUE", where FQDN is the challenge name after lego has followed
# any CNAME. It publishes and removes the TXT record through the jarl CLI.
#
# Install it, then:
#   EXEC_PATH=/usr/local/bin/jarl-lego JARL_TOKEN=@/etc/jarl/lego.token \
#     lego run --accept-tos --email you@example.com --dns exec -d example.com -d '*.example.com'
#   (lego 4: lego --accept-tos --email ... --dns exec -d ... run, and "renew" to renew)
#
# Options (environment):
#  JARL_SERVER  Jarl server URL, e.g. https://ns1.example.com:8053 (optional if the jarl CLI is configured)
#  JARL_TOKEN   API token, or @FILE (optional if the jarl CLI is configured)
#  JARL_VIEW    Only write into this view (optional; default every view that has the zone)
#               On a host inside a split DNS, lego's own propagation check then can't
#               see the record: leave it unset, or run lego with
#               --dns.propagation.disable-ans (lego 5; --dns.propagation-disable-ans in lego 4)
#               (docs/acme.md, "Split DNS and lego's propagation check").
#  JARL_BIN     Path of the jarl binary (optional; default "jarl")

JARL_BIN="${JARL_BIN:-jarl}"

if [ "$2" = "--" ]; then
  echo "jarl-lego: EXEC_MODE=RAW is not supported; unset EXEC_MODE" >&2
  exit 2
fi

case "$1" in
  present) action="set" ;;
  cleanup) action="unset" ;;
  *)
    echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
    exit 2
    ;;
esac

if [ $# -ne 3 ]; then
  echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
  exit 2
fi

# lego passes the full record name, so --exact keeps jarl from adding
# _acme-challenge. again.
if [ -n "$JARL_VIEW" ]; then
  exec "$JARL_BIN" -q acme "$action" --exact --view "$JARL_VIEW" "$2" "$3"
fi
exec "$JARL_BIN" -q acme "$action" --exact "$2" "$3"