-diff -ur dehydrated-0.6.2.orig/dehydrated dehydrated-0.6.2/dehydrated
---- dehydrated-0.6.2.orig/dehydrated 2018-04-25 21:22:40.000000000 +0000
-+++ dehydrated-0.6.2/dehydrated 2018-05-27 19:22:45.065763589 +0000
+diff -ur dehydrated-0.7.1.orig/dehydrated dehydrated-0.7.1/dehydrated
+--- dehydrated-0.7.1.orig/dehydrated 2022-10-31 15:12:38.000000000 +0100
++++ dehydrated-0.7.1/dehydrated 2023-05-15 16:41:50.839664597 +0200
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
# dehydrated by lukas2511
# Source: https://dehydrated.io
+@@ -11,7 +11,7 @@
+ [[ -n "${ZSH_VERSION:-}" ]] && set -o SH_WORD_SPLIT && set +o FUNCTION_ARGZERO && set -o NULL_GLOB && set -o noglob
+ [[ -z "${ZSH_VERSION:-}" ]] && shopt -s nullglob && set -f
+
+-umask 077 # paranoid umask, we're creating private keys
++umask 027 # allow root and dehydrated group only to protect private keys
+
+ # Close weird external file descriptors
+ exec 3>&-
@@ -28,7 +28,7 @@
done
SCRIPTDIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
-BASEDIR="${SCRIPTDIR}"
+BASEDIR="/var/lib/dehydrated"
- ORIGARGS="$@"
+ ORIGARGS=("${@}")
- # Create (identifiable) temporary files
-@@ -133,7 +133,7 @@
- DOMAINS_TXT=
+ noglob_set() {
+@@ -372,7 +372,7 @@
HOOK=
+ PREFERRED_CHAIN=
HOOK_CHAIN="no"
- RENEW_DAYS="30"
+ RENEW_DAYS="10"
KEYSIZE="4096"
WELLKNOWN=
PRIVATE_KEY_RENEW="yes"
-@@ -255,8 +255,8 @@
+@@ -388,8 +388,8 @@
+ IP_VERSION=
+ CHAINCACHE=
+ AUTO_CLEANUP="no"
+- DEHYDRATED_USER=
+- DEHYDRATED_GROUP=
++ DEHYDRATED_USER="root"
++ DEHYDRATED_GROUP="dehydrated"
+ API="auto"
+ if [[ -z "${CONFIG:-}" ]]; then
+@@ -528,8 +528,8 @@
[[ -z "${CERTDIR}" ]] && CERTDIR="${BASEDIR}/certs"
+ [[ -z "${ALPNCERTDIR}" ]] && ALPNCERTDIR="${BASEDIR}/alpn-certs"
[[ -z "${CHAINCACHE}" ]] && CHAINCACHE="${BASEDIR}/chains"
- [[ -z "${DOMAINS_TXT}" ]] && DOMAINS_TXT="${BASEDIR}/domains.txt"
- [[ -z "${WELLKNOWN}" ]] && WELLKNOWN="/var/www/dehydrated"
[[ -z "${LOCKFILE}" ]] && LOCKFILE="${BASEDIR}/lock"
[[ -z "${OPENSSL_CNF}" ]] && OPENSSL_CNF="$("${OPENSSL}" version -d | cut -d\" -f2)/openssl.cnf"
[[ -n "${PARAM_LOCKFILE_SUFFIX:-}" ]] && LOCKFILE="${LOCKFILE}-${PARAM_LOCKFILE_SUFFIX}"
-diff -ur dehydrated-0.6.2.orig/docs/examples/config dehydrated-0.6.2/docs/examples/config
---- dehydrated-0.6.2.orig/docs/examples/config 2018-04-25 21:22:40.000000000 +0000
-+++ dehydrated-0.6.2/docs/examples/config 2018-05-27 19:12:46.943770323 +0000
-@@ -40,11 +40,11 @@
+diff -ur dehydrated-0.7.1.orig/docs/examples/config dehydrated-0.7.1/docs/examples/config
+--- dehydrated-0.7.1.orig/docs/examples/config 2022-10-31 15:12:38.000000000 +0100
++++ dehydrated-0.7.1/docs/examples/config 2023-05-15 16:41:50.839664597 +0200
+@@ -47,11 +47,11 @@
# default: <unset>
- #CONFIG_D=
+ #DOMAINS_D=
-# Base directory for account key, generated certificates and list of domains (default: $SCRIPTDIR -- uses config directory if undefined)
-#BASEDIR=$SCRIPTDIR
# Output directory for generated certificates
#CERTDIR="${BASEDIR}/certs"
-@@ -53,7 +53,7 @@
+@@ -63,7 +63,7 @@
#ACCOUNTDIR="${BASEDIR}/accounts"
# Output directory for challenge-tokens to be served by webserver or deployed in HOOK (default: /var/www/dehydrated)
# Default keysize for private keys (default: 4096)
#KEYSIZE="4096"
-@@ -77,13 +77,13 @@
+@@ -87,13 +87,13 @@
#
# BASEDIR and WELLKNOWN variables are exported and can be used in an external program
# default: <unset>