diff options
| -rw-r--r-- | README.md | 59 |
1 files changed, 59 insertions, 0 deletions
@@ -73,3 +73,62 @@ source nccli.env ```bash ./nccli -h ``` + +## How to use it to automate Certbot DNS verification +Certbot does not have a DNS plugin for Namecheap, so we rely on its +`--manual-auth-hook` flag to run a script to place DNS records +it generates into our Namecheap domain so that it can complete DNS verification. +[Docs](https://eff-certbot.readthedocs.io/en/stable/using.html#pre-and-post-validation-hooks). + +Eg. `certbot` cmd: +```bash +certbot \ + certonly -n --agree-tos --email [your email] \ + --config-dir [default: /etc/letsencrypt] \ + --work-dir [default: /etc/letsencrypt] \ + --logs-dir /tmp/letsencrypt \ + --server https://acme-v02.api.letsencrypt.org/directory \ + --manual --preferred-challenges=dns \ + --manual-auth-hook /path/to/auth.sh \ + -d '*.wildcard.domain' +``` +where `auth.sh` is: +```bash +#!/bin/bash + +API_USER="[ your namecheap user ]" +API_KEY="[ your namecheap api access key ]" +API_ACCESS_IP="[ your namecheap api whitelisted IP ]" +DOMAIN_MAIN="[ your namecheap managed domain ]" +DOMAIN_END="[ your namecheap managed domain's ending (net, or com, or xyz etc.) ]" + +echo "CERTBOT DOMAIN: ${CERTBOT_DOMAIN}" +echo "CERTBOT VALUE: ${CERTBOT_VALIDATION}" + +# Create TXT record +docker run --rm -it \ + --name nctest \ + -e API_USER="${API_USER}" \ + -e API_KEY="${API_KEY}" \ + -e ACCESS_IP="${API_ACCESS_IP}" \ + -e DOMAIN_MAIN="${DOMAIN_MAIN}" \ + -e DOMAIN_END="${DOMAIN_END}" \ + registry.gitlab.com/kdam0/nccli \ + /bin/nccli \ + add \ + -name "_acme-challenge" \ + -value "${CERTBOT_VALIDATION}" \ + -type "TXT" \ + -priority 11 \ + -ttl 60 + +# Save info for cleanup +if [ ! -d /tmp/CERTBOT_$CERTBOT_DOMAIN ];then + mkdir -m 0700 /tmp/CERTBOT_$CERTBOT_DOMAIN +fi + +# Sleep to make sure the change has time to propagate over to DNS +sleep 45 +``` +After the `certbot` cmd, we can run `nccli delete` command to remove the +temporary entries added. |