← Retour
#!/bin/bash
# ===========================================
# Certbot DNS-01 Auth Hook pour o2switch
# Crée l'enregistrement TXT _acme-challenge
# ===========================================
# Variables fournies par certbot:
# CERTBOT_DOMAIN - Le domaine à valider
# CERTBOT_VALIDATION - La valeur du challenge
set -e
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# Config peut être dans lib/ (local) ou au même niveau (sur nginx)
if [ -f "$SCRIPT_DIR/lib/config.sh" ]; then
source "$SCRIPT_DIR/lib/config.sh"
elif [ -f "$SCRIPT_DIR/../../lib/config.sh" ]; then
source "$SCRIPT_DIR/../../lib/config.sh"
else
echo "ERROR: config.sh not found" >&2
exit 1
fi
LOG_FILE="/tmp/certbot-dns-hook.log"
log() {
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE"
}
log "=== AUTH HOOK START ==="
log "Domain: $CERTBOT_DOMAIN"
log "Validation: $CERTBOT_VALIDATION"
# Extraire le sous-domaine pour le TXT record
if [[ "$CERTBOT_DOMAIN" == *".$O2SWITCH_DOMAIN" ]]; then
SUBDOMAIN="${CERTBOT_DOMAIN%.$O2SWITCH_DOMAIN}"
SUBDOMAIN="${SUBDOMAIN#\*.}"
TXT_NAME="_acme-challenge.$SUBDOMAIN"
elif [[ "$CERTBOT_DOMAIN" == "$O2SWITCH_DOMAIN" ]]; then
TXT_NAME="_acme-challenge"
else
log "ERROR: Domain $CERTBOT_DOMAIN not part of $O2SWITCH_DOMAIN"
exit 1
fi
log "TXT Record: $TXT_NAME.$O2SWITCH_DOMAIN"
log "TXT Value: $CERTBOT_VALIDATION"
# Récupérer le serial actuel depuis le SOA
log "Fetching current zone serial..."
ZONE_DATA=$(curl -4 --connect-timeout 30 -m 60 -s \
-H "Authorization: cpanel $O2SWITCH_USERNAME:$O2SWITCH_API_TOKEN" \
"$O2SWITCH_API_URL/execute/DNS/parse_zone?zone=$O2SWITCH_DOMAIN")
SERIAL_B64=$(echo "$ZONE_DATA" | jq -r '.data[] | select(.record_type == "SOA") | .data_b64[2]' 2>/dev/null)
SERIAL=$(echo "$SERIAL_B64" | base64 -d 2>/dev/null)
log "Zone serial: $SERIAL"
# Créer l'enregistrement TXT via UAPI avec token
RESULT=$(curl -4 --connect-timeout 30 -m 60 -s \
-H "Authorization: cpanel $O2SWITCH_USERNAME:$O2SWITCH_API_TOKEN" \
"$O2SWITCH_API_URL/execute/DNS/mass_edit_zone?zone=$O2SWITCH_DOMAIN&serial=$SERIAL&add=%7B%22dname%22%3A%22$TXT_NAME%22%2C%22ttl%22%3A60%2C%22record_type%22%3A%22TXT%22%2C%22data%22%3A%5B%22$CERTBOT_VALIDATION%22%5D%7D")
if echo "$RESULT" | grep -q '"status":1'; then
log "SUCCESS: TXT record created"
else
log "ERROR: Failed to create TXT record"
log "Response: $RESULT"
exit 1
fi
# Attendre la propagation DNS
log "Waiting 30s for DNS propagation..."
sleep 30
# Vérifier que le TXT est visible
for i in {1..6}; do
log "DNS check attempt $i/6..."
TXT_CHECK=$(dig +short TXT "$TXT_NAME.$O2SWITCH_DOMAIN" @8.8.8.8 2>/dev/null | tr -d '"')
if [[ "$TXT_CHECK" == *"$CERTBOT_VALIDATION"* ]]; then
log "SUCCESS: TXT record visible in DNS"
log "=== AUTH HOOK END ==="
exit 0
fi
log "TXT not yet visible, waiting 10s..."
sleep 10
done
log "WARNING: TXT record may not be fully propagated, continuing anyway"
log "=== AUTH HOOK END ==="
exit 0