65 lines
1.9 KiB
Bash
65 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
source ./lib.sh
|
||
|
||
install -d /etc/letsencrypt/renewal-hooks/deploy
|
||
|
||
# --- 50: Symlink-Hook (setzt stabile /etc/ssl/{ui,webmail,mail}) ---
|
||
cat >/etc/letsencrypt/renewal-hooks/deploy/50-mailwolt-symlinks.sh <<HOOK
|
||
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
UI_SSL_DIR="/etc/ssl/ui"
|
||
WEBMAIL_SSL_DIR="/etc/ssl/webmail"
|
||
MAIL_SSL_DIR="/etc/ssl/mail"
|
||
|
||
UI_HOST="${UI_HOST}"
|
||
WEBMAIL_HOST="${WEBMAIL_HOST}"
|
||
MX_HOST="${MAIL_HOSTNAME}"
|
||
|
||
link_if() {
|
||
local host="\$1" target_dir="\$2"
|
||
[[ -z "\$host" ]] && return 0
|
||
local le="/etc/letsencrypt/live/\${host}"
|
||
local cert="\${le}/fullchain.pem"
|
||
local key="\${le}/privkey.pem"
|
||
[[ -f "\$cert" && -f "\$key" ]] || return 0
|
||
install -d -m 0755 "\$target_dir"
|
||
ln -sf "\$cert" "\${target_dir}/fullchain.pem"
|
||
ln -sf "\$key" "\${target_dir}/privkey.pem"
|
||
echo "[+] Linked \${target_dir} -> \${le}"
|
||
}
|
||
|
||
link_if "${UI_HOST}" "\${UI_SSL_DIR}"
|
||
link_if "${WEBMAIL_HOST}" "\${WEBMAIL_SSL_DIR}"
|
||
link_if "${MX_HOST}" "\${MAIL_SSL_DIR}"
|
||
|
||
systemctl reload nginx || true
|
||
systemctl reload postfix dovecot || true
|
||
HOOK
|
||
chmod +x /etc/letsencrypt/renewal-hooks/deploy/50-mailwolt-symlinks.sh
|
||
|
||
# --- 60: TLSA-Hook (bei jedem Renew für MX neu berechnen – falls Key doch rotiert) ---
|
||
cat >/etc/letsencrypt/renewal-hooks/deploy/60-mailwolt-tlsa.sh <<HOOK
|
||
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
MX_HOST="${MAIL_HOSTNAME}"
|
||
|
||
# Nur reagieren, wenn das MX-Zert erneuert wurde
|
||
case " \${RENEWED_DOMAINS:-} " in
|
||
*" \${MX_HOST} "*) ;;
|
||
*) exit 0 ;;
|
||
esac
|
||
|
||
CERT="\${RENEWED_LINEAGE}/fullchain.pem"
|
||
if [[ -s "\$CERT" ]]; then
|
||
HASH="\$(openssl x509 -in "\$CERT" -noout -pubkey \
|
||
| openssl pkey -pubin -outform DER \
|
||
| openssl dgst -sha256 | sed 's/^.*= //')"
|
||
TLSA_LINE="_25._tcp.\${MX_HOST}. IN TLSA 3 1 1 \${HASH}"
|
||
install -d -m 0755 /etc/mailwolt/dns
|
||
echo "\${TLSA_LINE}" > "/etc/mailwolt/dns/\${MX_HOST}.tlsa.txt"
|
||
echo "[TLSA] \${TLSA_LINE}"
|
||
fi
|
||
HOOK
|
||
chmod +x /etc/letsencrypt/renewal-hooks/deploy/60-mailwolt-tlsa.sh |