updated readme with info about running with certbot

1 files changed, 59 insertions, 0 deletions

diff --git a/README.md b/README.md
index 528d1d1..0504fe5 100644
--- a/README.md
+++ b/README.md
@@ -73,3 +73,62 @@ source nccli.env
 ```bash
 ./nccli -h
 ```
+
+## How to use it to automate Certbot DNS verification
+Certbot does not have a DNS plugin for Namecheap, so we rely on its
+`--manual-auth-hook` flag to run a script to place DNS records
+it generates into our Namecheap domain so that it can complete DNS verification.
+[Docs](https://eff-certbot.readthedocs.io/en/stable/using.html#pre-and-post-validation-hooks).
+
+Eg. `certbot` cmd:
+```bash
+certbot \
+    certonly -n --agree-tos --email [your email] \
+    --config-dir [default: /etc/letsencrypt] \
+    --work-dir [default: /etc/letsencrypt] \
+    --logs-dir /tmp/letsencrypt \
+    --server https://acme-v02.api.letsencrypt.org/directory \
+    --manual --preferred-challenges=dns \
+    --manual-auth-hook /path/to/auth.sh \
+    -d '*.wildcard.domain'
+```
+where `auth.sh` is:
+```bash
+#!/bin/bash
+
+API_USER="[ your namecheap user ]"
+API_KEY="[ your namecheap api access key ]"
+API_ACCESS_IP="[ your namecheap api whitelisted IP ]"
+DOMAIN_MAIN="[ your namecheap managed domain ]"
+DOMAIN_END="[ your namecheap managed domain's ending (net, or com, or xyz etc.) ]"
+
+echo "CERTBOT DOMAIN: ${CERTBOT_DOMAIN}"
+echo "CERTBOT VALUE: ${CERTBOT_VALIDATION}"
+
+# Create TXT record
+docker run --rm -it \
+        --name nctest \
+        -e API_USER="${API_USER}" \
+        -e API_KEY="${API_KEY}" \
+        -e ACCESS_IP="${API_ACCESS_IP}" \
+        -e DOMAIN_MAIN="${DOMAIN_MAIN}" \
+        -e DOMAIN_END="${DOMAIN_END}" \
+        registry.gitlab.com/kdam0/nccli \
+        /bin/nccli \
+            add \
+            -name "_acme-challenge" \
+            -value "${CERTBOT_VALIDATION}" \
+            -type "TXT" \
+            -priority 11 \
+            -ttl 60
+
+# Save info for cleanup
+if [ ! -d /tmp/CERTBOT_$CERTBOT_DOMAIN ];then
+        mkdir -m 0700 /tmp/CERTBOT_$CERTBOT_DOMAIN
+fi
+
+# Sleep to make sure the change has time to propagate over to DNS
+sleep 45
+```
+After the `certbot` cmd, we can run `nccli delete` command to remove the
+temporary entries added.