danbao

danbao

V2EX 第 15318 号会员,加入于 2011-12-26 19:57:44 +08:00
5 G 70 S
根据 danbao 的设置,主题列表被隐藏
二手交易 相关的信息,包括已关闭的交易,不会被隐藏
danbao 最近回复了
@GoRoad 按 github action 的方式获取证书还苦恼啥
@lblblong 参考 acme.sh 的文档改一下密钥就行了

```yaml
name: DnsPod SSL Certificates

on:
schedule: # execute every 24 hours
- cron: "35 7 * * *"
workflow_dispatch:

env:
ACME: /home/runner/.acme.sh/acme.sh
DP_ID: ${{ secrets.DP_ID }}
DP_KEY: ${{ secrets.DP_KEY }}
EMAIL: ${{ secrets.EMAIL }}

jobs:
build:
runs-on: ubuntu-latest
if: github.event_name == 'schedule' || github.event.repository.owner.id == github.event.sender.id
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install & Configure acme.sh
run: |
curl https://get.acme.sh | sh -s email=$EMAIL
- name: Issue & Deploy Certificates
run: |
export DP_Id=$DP_ID
export DP_Key=$DP_KEY

git config --global user.email $EMAIL
git config --global user.name acme

# 如果想要其他证书发行机构,可以把 acme.sh 的 ca 目录拷贝到 repo 的 ca 目录
# mkdir -p /home/runner/.acme.sh/ca/
# cp -r ca/* /home/runner/.acme.sh/ca/

check_certificate_validity() {
cert_path=$1
if [ -f "$cert_path" ]; then
if openssl x509 -checkend $(( 30 * 86400 )) -noout -in "$cert_path"; then
echo "Certificate at $cert_path is valid for more than 30 days, skipping..."
return 0
else
return 1
fi
else
return 1
fi
}

issue_and_install_certificate() {
domain=$1
cert_type=$2 # "EC" or "RSA"
acme_server=$3 # default choose "letsencrypt" 其他 CA 请参考 https://github.com/acmesh-official/acme.sh/wiki/CA
keylength=$4 # empty for EC, "3072" for RSA

cert_path="./ssl/$domain"
[ "$cert_type" = "RSA" ] && cert_path="$cert_path/rsa"
cert_file="$cert_path/$domain.cer"
key_file="$cert_path/$domain.key"

# Issue certificate
issue_status=0
$ACME --issue --server $acme_server --debug --dns dns_dp -d "$domain" -d "*.$domain" ${keylength:+--keylength $keylength} || issue_status=$?
if [ $issue_status -ne 0 ]; then
echo "Failed to issue $cert_type certificate for $domain, skipping..."
return
fi

# Install certificate
install_status=0
$ACME --installcert -d "$domain" --key-file "$key_file" --fullchain-file "$cert_file" || install_status=$?
if [ $install_status -ne 0 ]; then
echo "Failed to install $cert_type certificate for $domain, skipping..."
return
fi

TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")
git add $cert_path/
git commit -m "Update $cert_type certificate files for $domain at $TIMESTAMP"
}

while IFS= read -r domain || [ -n "$domain" ]; do
mkdir -p "./ssl/$domain/rsa"

# Check and issue/install EC certificate
if ! check_certificate_validity "./ssl/$domain/$domain.cer"; then
issue_and_install_certificate "$domain" "EC" "letsencrypt" ""
fi

# Check and issue/install RSA certificate
if ! check_certificate_validity "./ssl/$domain/rsa/$domain.cer"; then
issue_and_install_certificate "$domain" "RSA" "letsencrypt" "3072"
fi

done < dnspod_domains_list.txt
- name: Push changes
uses: ad-m/github-push-action@master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
```
@br_wang 我的使用场景是内网有 ssl 的需求,比如 esxi ,adguard 的 DoH,但又不想专门搞个 vps 跑 cronjob
@Jinnrry 注意看这句话
记得不要直接 fork 这个 repo , 用 clone 然后 push 到你自己的 private github repo
@keyfunc @knva 哈哈,私钥在提交的时候已打码了~不过这个域名本来就是学费米,无所谓
@w292614191 这个 repo 就是用来解决这个问题的
@totoro625
我这个 repo 应该会避免这个问题,因为每天都会检查 SSL,检查完后会更新时间戳并提交 commit
写个 github action 用 acme.sh 定时获取证书
支持 rtsp 不
lz 威武,支持一个
关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   实用小工具   ·   2406 人在线   最高记录 6679   ·     Select Language
创意工作者们的社区
World is powered by solitude
VERSION: 3.9.8.5 · 11ms · UTC 11:06 · PVG 19:06 · LAX 04:06 · JFK 07:06
Developed with CodeLauncher
♥ Do have faith in what you're doing.