tld.patch

   1 diff -ur dehydrated-0.7.0.orig/dehydrated dehydrated-0.7.0/dehydrated
   2 --- dehydrated-0.7.0.orig/dehydrated    2020-12-10 16:54:26.000000000 +0100
   3 +++ dehydrated-0.7.0/dehydrated 2021-01-01 18:41:50.608417166 +0100
   4 @@ -1,4 +1,4 @@
   5 -#!/usr/bin/env bash
   6 +#!/bin/bash
   7
   8  # dehydrated by lukas2511
   9  # Source: https://dehydrated.io
  10 @@ -11,7 +11,7 @@
  11  [[ -n "${ZSH_VERSION:-}" ]] && set -o SH_WORD_SPLIT && set +o FUNCTION_ARGZERO && set -o NULL_GLOB && set -o noglob
  12  [[ -z "${ZSH_VERSION:-}" ]] && shopt -s nullglob && set -f
  13
  14 -umask 077 # paranoid umask, we're creating private keys
  15 +umask 027 # allow root and dehydrated group only to protect private keys
  16
  17  # Close weird external file descriptors
  18  exec 3>&-
  19 @@ -28,7 +28,7 @@
  20  done
  21  SCRIPTDIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
  22
  23 -BASEDIR="${SCRIPTDIR}"
  24 +BASEDIR="/var/lib/dehydrated"
  25  ORIGARGS=("${@}")
  26
  27  # Generate json.sh path matching string
  28 @@ -340,7 +340,7 @@
  29    HOOK=
  30    PREFERRED_CHAIN=
  31    HOOK_CHAIN="no"
  32 -  RENEW_DAYS="30"
  33 +  RENEW_DAYS="10"
  34    KEYSIZE="4096"
  35    WELLKNOWN=
  36    PRIVATE_KEY_RENEW="yes"
  37 @@ -356,8 +356,8 @@
  38    IP_VERSION=
  39    CHAINCACHE=
  40    AUTO_CLEANUP="no"
  41 -  DEHYDRATED_USER=
  42 -  DEHYDRATED_GROUP=
  43 +  DEHYDRATED_USER="root"
  44 +  DEHYDRATED_GROUP="dehydrated"
  45    API="auto"
  46
  47    if [[ -z "${CONFIG:-}" ]]; then
  48 @@ -495,8 +495,8 @@
  49    [[ -z "${CERTDIR}" ]] && CERTDIR="${BASEDIR}/certs"
  50    [[ -z "${ALPNCERTDIR}" ]] && ALPNCERTDIR="${BASEDIR}/alpn-certs"
  51    [[ -z "${CHAINCACHE}" ]] && CHAINCACHE="${BASEDIR}/chains"
  52 -  [[ -z "${DOMAINS_TXT}" ]] && DOMAINS_TXT="${BASEDIR}/domains.txt"
  53 -  [[ -z "${WELLKNOWN}" ]] && WELLKNOWN="/var/www/dehydrated"
  54 +  [[ -z "${DOMAINS_TXT}" ]] && DOMAINS_TXT="/etc/dehydrated/domains.txt"
  55 +  [[ -z "${WELLKNOWN}" ]] && WELLKNOWN="${BASEDIR}/acme-challenges"
  56    [[ -z "${LOCKFILE}" ]] && LOCKFILE="${BASEDIR}/lock"
  57    [[ -z "${OPENSSL_CNF}" ]] && OPENSSL_CNF="$("${OPENSSL}" version -d | cut -d\" -f2)/openssl.cnf"
  58    [[ -n "${PARAM_LOCKFILE_SUFFIX:-}" ]] && LOCKFILE="${LOCKFILE}-${PARAM_LOCKFILE_SUFFIX}"
  59 diff -ur dehydrated-0.7.0.orig/docs/examples/config dehydrated-0.7.0/docs/examples/config
  60 --- dehydrated-0.7.0.orig/docs/examples/config  2020-12-10 16:54:26.000000000 +0100
  61 +++ dehydrated-0.7.0/docs/examples/config       2021-01-01 18:41:13.934417166 +0100
  62 @@ -47,11 +47,11 @@
  63  # default: <unset>
  64  #DOMAINS_D=
  65
  66 -# Base directory for account key, generated certificates and list of domains (default: $SCRIPTDIR -- uses config directory if undefined)
  67 -#BASEDIR=$SCRIPTDIR
  68 +# Base directory for account key, generated certificates and list of domains (default: /var/lib/dehydrated)
  69 +#BASEDIR="/var/lib/dehydrated"
  70
  71  # File containing the list of domains to request certificates for (default: $BASEDIR/domains.txt)
  72 -#DOMAINS_TXT="${BASEDIR}/domains.txt"
  73 +#DOMAINS_TXT="/etc/dehydrated/domains.txt"
  74
  75  # Output directory for generated certificates
  76  #CERTDIR="${BASEDIR}/certs"
  77 @@ -63,7 +63,7 @@
  78  #ACCOUNTDIR="${BASEDIR}/accounts"
  79
  80  # Output directory for challenge-tokens to be served by webserver or deployed in HOOK (default: /var/www/dehydrated)
  81 -#WELLKNOWN="/var/www/dehydrated"
  82 +#WELLKNOWN="${BASEDIR}/acme-challenges"
  83
  84  # Default keysize for private keys (default: 4096)
  85  #KEYSIZE="4096"
  86 @@ -87,13 +87,13 @@
  87  #
  88  # BASEDIR and WELLKNOWN variables are exported and can be used in an external program
  89  # default: <unset>
  90 -#HOOK=
  91 +#HOOK="/etc/dehydrated/hooks/hook.sh"
  92
  93  # Chain clean_challenge|deploy_challenge arguments together into one hook call per certificate (default: no)
  94  #HOOK_CHAIN="no"
  95
  96 -# Minimum days before expiration to automatically renew certificate (default: 30)
  97 -#RENEW_DAYS="30"
  98 +# Minimum days before expiration to automatically renew certificate (default: 10)
  99 +#RENEW_DAYS="10"
 100
 101  # Regenerate private keys instead of just signing new certificates on renewal (default: yes)
 102  #PRIVATE_KEY_RENEW="yes"