adamandClaude Opus 5.5
c10ebe0d38
docs/acme.md and jarl-lego show lego 5's commands (lego run, which also renews; lego migrate when upgrading) beside lego 4's. A new section explains why lego on a host inside a split DNS fails its own propagation check when the challenge goes into the external view only (JARL_VIEW, a one-view token, httpreq's /view/...), and the ways round it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.9 KiB
Bash
Executable File
50 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Jarl (BIND manager): a program for lego's "exec" DNS provider.
|
|
#
|
|
# lego runs it as "jarl-lego present FQDN VALUE" and "jarl-lego cleanup
|
|
# FQDN VALUE", where FQDN is the challenge name after lego has followed
|
|
# any CNAME. It publishes and removes the TXT record through the jarl CLI.
|
|
#
|
|
# Install it, then:
|
|
# EXEC_PATH=/usr/local/bin/jarl-lego JARL_TOKEN=@/etc/jarl/lego.token \
|
|
# lego run --accept-tos --email you@example.com --dns exec -d example.com -d '*.example.com'
|
|
# (lego 4: lego --accept-tos --email ... --dns exec -d ... run, and "renew" to renew)
|
|
#
|
|
# Options (environment):
|
|
# JARL_SERVER Jarl server URL, e.g. https://ns1.example.com:8053 (optional if the jarl CLI is configured)
|
|
# JARL_TOKEN API token, or @FILE (optional if the jarl CLI is configured)
|
|
# JARL_VIEW Only write into this view (optional; default every view that has the zone)
|
|
# On a host inside a split DNS, lego's own propagation check then can't
|
|
# see the record: leave it unset, or run lego with
|
|
# --dns.propagation.disable-ans (lego 5; --dns.propagation-disable-ans in lego 4)
|
|
# (docs/acme.md, "Split DNS and lego's propagation check").
|
|
# JARL_BIN Path of the jarl binary (optional; default "jarl")
|
|
|
|
JARL_BIN="${JARL_BIN:-jarl}"
|
|
|
|
if [ "$2" = "--" ]; then
|
|
echo "jarl-lego: EXEC_MODE=RAW is not supported; unset EXEC_MODE" >&2
|
|
exit 2
|
|
fi
|
|
|
|
case "$1" in
|
|
present) action="set" ;;
|
|
cleanup) action="unset" ;;
|
|
*)
|
|
echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
if [ $# -ne 3 ]; then
|
|
echo "usage: jarl-lego present|cleanup FQDN VALUE" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# lego passes the full record name, so --exact keeps jarl from adding
|
|
# _acme-challenge. again.
|
|
if [ -n "$JARL_VIEW" ]; then
|
|
exec "$JARL_BIN" -q acme "$action" --exact --view "$JARL_VIEW" "$2" "$3"
|
|
fi
|
|
exec "$JARL_BIN" -q acme "$action" --exact "$2" "$3"
|