dehydrated-zonefiles-hook

#!/bin/sh
# -*- coding: utf-8; mode: sh; tab-width: 3; indent-tabs-mode: nil -*-
#
# Copyright 2017, 2021, 2023
# Raffaello D. Di Napoli

[ -n "${ZONES_DIR}" ] || ZONES_DIR=/etc/nsd
[ -n "${DNS_SERVER_PIDFILE}" ] || DNS_SERVER_PIDFILE=/run/nsd/nsd.pid
[ -n "${HTTP_SERVER_PIDFILE}" ] || HTTP_SERVER_PIDFILE=/run/apache2.pid
[ -n "${IMAP_SERVER_PIDFILE}" ] || IMAP_SERVER_PIDFILE=/run/dovecot/master.pid


awk_zone_parsing='
   function strip_final_dot(s) {
      sub(/\.$/, "", s)
      return s
   }

   function make_fully_qualified(s) {
      if (s == "@") {
         return zone_origin
      } else if (s ~ /\.$/) {
         # Absolute name.
         return s
      } else {
         # The name is relative to $ORIGIN; prepend that.
         return s "." zone_origin
      }
   }

   # This big block parses each line, making available to other blocks:
   # •  rr_name: fully-qualified name of the resource record (e.g. “example.com.”,
   #       “www.example.com”); vaues such as “@”, “www”, or “”, all of which valid in a zone file,
   #       are turned into fully qualified;
   # •  rr_type: type of the resource record (e.g. “SOA”, “A”, “CNAME”);
   # •  rr_value: value of the resource record (string for TXT, IP address for A/AAAA,
   #       fully-qualified name for CNAME, MX and other hostname-like types);
   # •  zone_origin: the string declared by “$ORIGIN”;
   # •  stripped_comment: comment that was removed from $0, if any.
   #
   # If $0 does not define a resource record, the values above will all be set to "".
   {
      rr_name = ""
      rr_type = ""
      if (match($0, /[\t ]*;.*$/)) {
         stripped_comment = substr($0, RSTART)
         $0 = substr($0, 1, length($0) - RLENGTH)
      } else {
         stripped_comment = ""
      }
      if (/^\$/) {
         # Not a resource record, but we want to capture $ORIGIN for later use.
         if ($1 == "$ORIGIN") {
            zone_origin = $2
         }
      } else if (NF >= 2) {
         if (/^[\t ]/) {
            # Missing first field.
            rr_next_field = 1
         } else {
            last_rr_name = make_fully_qualified($1)
            rr_next_field = 2
         }
         rr_name = last_rr_name
         if ($rr_next_field ~ /^[0-9]+$/) {
            # Skip the TTL field.
            ++rr_next_field
         }
         if ($rr_next_field == "IN") {
            # Consume the Class field.
            ++rr_next_field
         }
         if ($rr_next_field ~ /^(CNAME|NS)$/) {
            rr_type = $rr_next_field
            ++rr_next_field
            rr_value = make_fully_qualified($rr_next_field)
         } else if ($rr_next_field == "MX") {
            rr_type = $rr_next_field
            # Skip type and priority.
            rr_next_field += 2
            rr_value = make_fully_qualified($rr_next_field)
            ++rr_next_field
         } else if ($rr_next_field ~ /^(A|AAAA)$/) {
            rr_type = $rr_next_field
            ++rr_next_field
            rr_value = $rr_next_field
            ++rr_next_field
         } else if ($rr_next_field == "TXT") {
            rr_type = $rr_next_field
            ++rr_next_field
            rr_value = $rr_next_field
            # TXT may be quoted.
            if (match(rr_value, /^".*"$/)) {
               rr_value = substr(rr_value, 2, length(rr_value) - 2)
            }
            ++rr_next_field
         } else if ($rr_next_field == "SOA") {
            rr_type = $rr_next_field
            ++rr_next_field
         }
      }
   }
'

prepare_zonefile_for_update() {
   local file="${1}" domain line new_version
   awk <"${file}" -vwanted_domain="${2}" -vtoday=$(date -u +%Y%m%d) "${awk_zone_parsing}"'
      function replace_version_and_print(version) {
         # Find where the value of version occurs in $0, and cut $0 up so that we can replace just
         # the version (see end of function).
         if (NR == soa_NR) {
            # Still on the same line as the SOA record, so we need to first find the parenthesis.
            find_start = index($0, ")") + 1
         } else {
            find_start = 1
         }
         # The left-most number must be the version.
         match($0, /[0-9]+/)
         if (substr($0, RSTART, RLENGTH) != version) {
            return 1
         }
         line_before = substr($0, 1, RSTART - 1)
         line_after = substr($0, RSTART + RLENGTH)

         # Update the version.
         if (length(version) > 8) {
            # Assume that such a large number is a timestamp + revision.
            updated_day = 0 + substr(version, 1, 8)
            revision = 0 + substr(version, 9)
            revision_digits = length(version) - 8
            if (updated_day < today) {
               updated_day = today
               revision = 1
            } else {
               # Date is today or in the future; keep the date and move to the next revision.
               ++revision;
            }
            version = sprintf("%d%." revision_digits "d", today, revision)
         } else {
            # Looks like it’s just a number, so increment it.
            version = 1 + version
         }

         print strip_final_dot(zone_origin) " " NR
         print line_before version line_after stripped_comment
         return 0
      }

      zone_origin && strip_final_dot(zone_origin) != wanted_domain {
         exit(5)
      }

      rr_type == "SOA" {
         # Find the open parenthesis and the version field (which may be on a separate line).
         for (; rr_next_field <= NF; ++rr_next_field) {
            if (soa_NR) {
               if ($rr_next_field !~ /^[0-9]+$/) {
                  exit(1)
               }
               replace_version_and_print($rr_next_field)
               exit(0)
            }
            if ($rr_next_field == "(") {
               soa_NR = NR
            }
         }
         next
      }

      soa_NR && NF >= 1 {
         if ($1 !~ /^[0-9]+$/) {
            exit(1)
         }
         replace_version_and_print($1)
         exit(0)
      }
   ' |
   {
      read -r domain line && IFS= read -r new_version || return 1
      sed -e "
         # Replace the line containing the version.
         ${line} s/^.*$/${new_version}/
         # Clean up any challenges.
         /^_acme-challenge/ d
      " <"${file}" >"${file}.newver"
      mv -f "${file}.newver" "${file}"
      return 0
   }
}

print_domains_txt() {
   local file domain
   for file in "${ZONES_DIR}"/*.zone; do
      [ -r "${file}" ] || continue
      awk <"${file}" "${awk_zone_parsing}"'
         $1 == "$ORIGIN" {
            print strip_final_dot($2)
            next
         }
         rr_type ~ /^(A|AAAA|CNAME)$/ {
            length_diff = length(rr_name) - length(zone_origin)
            # Only print this host name if it’s in this domain.
            if (length_diff > 0 && substr(rr_name, length_diff + 1) == zone_origin) {
               print strip_final_dot(rr_name)
            }
         }
      ' | {
         read -r domain
         echo "${domain}"
         LC_ALL=C sort -u
      } |
      tr '\n' ' ' |
      sed -e 's/ $/\n/'
   done
   exit 0
}

reload_server_config() {
   if [ ! -r "${2}" ]; then
      echo "  No PIDfile, can't reload ${1} server" >&2
      exit 1
   fi
   local pid=$(cat <"${2}")
   if [ -z "${pid}" ]; then
      echo "  No PID, can't reload ${1} server" >&2
      exit 1
   fi
   echo "  Reloading configuration for ${1} server with PID ${pid}" >&2
   kill -HUP "${pid}"
}

domain_includes_mx_servers() {
   local domain="${1}" file
   for file in "${ZONES_DIR}"/*.zone; do
      [ -r "${file}" ] || continue
      awk <"${file}" -vdomain="${domain}" "${awk_zone_parsing}"'
         rr_type == "MX" {
            if (match(rr_value, /[^.]+.[^.]+.$/)) {
               # -1 to skip the trailing dot.
               if (domain == substr(rr_value, RSTART, RLENGTH - 1)) {
                  exit 1
               }
            }
         }
      ' || return 0
   done
   return 1
}

# ${alias} is exported by dehydrated, and equals ${domain} in absence of other aliases.
deploy_challenge() {
   local domain="${alias}" file hostname
   for file in "${ZONES_DIR}"/*.zone; do
      [ -r "${file}" ] || continue
      prepare_zonefile_for_update "${file}" "${domain}" || continue

      echo "  Deploying challenges to zone file ${file}" >&2
      while [ ${#} -ge 3 ]; do
         hostname=
         echo "    Deploying challenge for ${1}" >&2
         [ "${1}" != "${domain}" ] && hostname=".${1%.${domain}}"
         echo "_acme-challenge${hostname} TXT \"${3}\""
         shift 3
      done >>"${file}"
      break
   done
   reload_server_config DNS "${DNS_SERVER_PIDFILE}"
   exit 0
}

clean_challenge() {
   local file
   for file in "${ZONES_DIR}"/*.zone; do
      [ -r "${file}" ] || continue
      prepare_zonefile_for_update "${file}" "${1}" || continue

      echo "  Cleaned up challenges from zone file ${file}" >&2
   done
   reload_server_config DNS "${DNS_SERVER_PIDFILE}"
   exit 0
}

deploy_cert_to_dir() {
   local dst="${1}"
   local   privkey_dst="${dst}/${domain}.key"
   local      cert_dst="${dst}/${domain}.crt"
   local fullchain_dst="${dst}/${domain}.fullchain.crt"
   cp -a "${privkey_src}"   "${privkey_dst}"
   cp -a "${cert_src}"      "${cert_dst}"
   cp -a "${fullchain_src}" "${fullchain_dst}"
   chmod 400 "${privkey_dst}"
   chmod 444 "${cert_dst}" "${fullchain_dst}"
   chown root:root "${privkey_dst}" "${cert_dst}" "${fullchain_dst}"
}

deploy_cert() {
   domain="${1}"
   timestamp="${6}"
     privkey_src="$(readlink -f "${2}")"
        cert_src="$(readlink -f "${3}")"
   fullchain_src="$(readlink -f "${4}")"
       chain_src="$(readlink -f "${5}")"
   if [ -d /etc/ssl/apache2 ]; then
      deploy_cert_to_dir /etc/ssl/apache2
      reload_server_config HTTP "${HTTP_SERVER_PIDFILE}"
   fi
   if domain_includes_mx_servers "${domain}"; then
      if [ -d /etc/ssl/postfix ]; then
         deploy_cert_to_dir /etc/ssl/postfix
         echo "  Reloading configuration for SMTP server" >&2
         /usr/sbin/postfix reload
      fi
      if [ -d /etc/ssl/dovecot ]; then
         deploy_cert_to_dir /etc/ssl/dovecot
         reload_server_config IMAP "${IMAP_SERVER_PIDFILE}"
      fi
   fi
   unset domain timestamp privkey_src cert_src fullchain_src chain_src
}

case "${1}" in
(print_domains_txt|deploy_challenge|clean_challenge|deploy_cert)
   "${@}" ;;
(unchanged_cert)
   ;;
(test_domain_includes_mx_servers)
   # Allow test to access these non-hook functions.
   "${1##test_}" "${2}"
   exit ${?}
   ;;
(*)
   exit 0
   ;;
esac