# $FreeBSD$

PORTNAME=	lego

DISTVERSIONPREFIX=	v

DISTVERSION=	2.7.1

CATEGORIES=	security

MAINTAINER=	matt@matthoran.com

COMMENT=	Let's Encrypt client and ACME library written in Go

LICENSE=	MIT

LICENSE_FILE=	${WRKSRC}/LICENSE

RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss

USES=		go

GO_PKGNAME=	github.com/go-acme/lego

GO_TARGET=	${GO_PKGNAME}/cmd/lego

GO_BUILDFLAGS=	-ldflags '-X "main.version=${GH_TAGNAME}"'

USE_GITHUB=	yes

GH_ACCOUNT=	go-acme

SAMPLE_FILES=	lego.sh.sample deploy.sh.sample

SUB_FILES=	604.lego pkg-message ${SAMPLE_FILES}

SUB_LIST=	PORTNAME=${PORTNAME} LEGO_USER=${LEGO_USER}

PERIODIC_DIRS=	etc/periodic/weekly

PERIODIC_FILES=	604.lego

LEGO_USER?=	_lego

USERS=		${LEGO_USER}

GROUPS=		${LEGO_USER}

post-install:

	${MKDIR} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS}

	${INSTALL_SCRIPT} ${WRKDIR}/${PERIODIC_FILES} ${STAGEDIR}${PREFIX}/${PERIODIC_DIRS}/${PERIODIC_FILES}

	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl/lego \

		${STAGEDIR}${ETCDIR} ${STAGEDIR}${WWWDIR}

.	for d in ${SAMPLE_FILES}

		${INSTALL_SCRIPT} ${WRKDIR}/${d} ${STAGEDIR}${ETCDIR}/${d}

.	endfor

.include <bsd.port.mk>

TIMESTAMP = 1563919890

SHA256 (go-acme-lego-v2.7.1_GH0.tar.gz) = 835fef2148e586ca81cd6116861baaada94f7c0b5bda37dcf14ca666544cb0f9

SIZE (go-acme-lego-v2.7.1_GH0.tar.gz) = 5298835

#!/bin/sh

if [ -r /etc/defaults/periodic.conf ]

then

    . /etc/defaults/periodic.conf

    source_periodic_confs

fi

PATH=$PATH:%%LOCALBASE%%/bin:%%LOCALBASE%%/sbin

export PATH

case "$weekly_lego_enable" in

    [Yy][Ee][Ss])

	echo

	echo "Checking Let's Encrypt certificate status:"

	if [ -x "$weekly_lego_renewscript" ] ; then

		echo "$weekly_lego_renewscript" | su -fm _lego || exit 3

	fi

	if [ -n "$weekly_lego_deployscript" ] ; then

		if [ -x "$weekly_lego_deployscript" ] ; then

			echo "Deploying Let's Encrypt certificates:"

			$weekly_lego_deployscript || exit 3

		else

			echo 'Skipped, deploy script does not exist or is not executable'

		fi

	fi

	;;

    *)

        ;;

esac

#!/bin/sh -e

SSLDIR="%%PREFIX%%/etc/ssl"

copy_certs () {

  local certdir certfile domain keyfile rc

  rc=1

  certdir="${SSLDIR}/lego/certificates"

  certfiles="$(find "${certdir}" -name "*.crt" -not -name "*.issuer.crt")"

  for certfile in $certfiles

  do

    domain="$(basename "$certfile" .crt)"

    keyfile="$(dirname "$certfile")/${domain}.key"

    if ! cmp -s "${certfile}" "${SSLDIR}/certs/${domain}.crt"

    then

      cp "${certfile}" "${SSLDIR}/certs/${domain}.crt"

      cp "${keyfile}" "${SSLDIR}/private/${domain}.key"

      rc=0

    fi

  done

  return $rc

}

if copy_certs

then

  output=$(service nginx reload 2>&1) || (echo "$output" && exit 1)

fi

#!/bin/sh -e

# Email used for registration and recovery contact.

EMAIL=""

BASEDIR="%%ETCDIR%%"

SSLDIR="%%PREFIX%%/etc/ssl/lego"

DOMAINSFILE="${BASEDIR}/domains.txt"

if [ -z "${EMAIL}" ]; then

	echo "Please set EMAIL to a valid address in ${BASEDIR}/lego.sh"

	exit 1

fi

if [ ! -e "${DOMAINSFILE}" ]; then

	echo "Please create ${DOMAINSFILE} as specified in ${BASEDIR}/lego.sh"

	exit 1

fi

if [ "$1" = "run" ]; then

	command="run"

else

	command="renew --days 30"

fi

run_or_renew() {

	%%PREFIX%%/bin/lego --path "${SSLDIR}" \

		--email="${EMAIL}" \

		$(printf -- "--domains=%s " $line) \

		--http --http.webroot="%%WWWDIR%%" \

		$1

}

while read line <&3; do

	if [ "$command" = "run" ]; then

		run_or_renew "$command"

	else

		output=$(run_or_renew "$command") || (echo "$output" && exit 1)

	fi

done 3<"${DOMAINSFILE}"

There are example scripts in

    %%ETCDIR%%

that you can use for renewing and deploying certificates.

In order to run the script regularly to update the certificates add this line

to /etc/periodic.conf:

    weekly_lego_enable="YES"

Additionally the following parameters may be added to /etc/periodic.conf:

Script to run to renew certificates, will be run as %%LEGO_USER%% (required)

    weekly_lego_renewscript="%%ETCDIR%%/lego.sh"

To run a script after the renewal to deploy certificates

    weekly_lego_deployscript="%%ETCDIR%%/deploy.sh"

If using the example renew script, add the domains for which lego will manage

certificates to

    %%ETCDIR%%/domains.txt, one domain on each line.

To add a Subject Alternate Name to the certificate, append the domain(s) to the

line:

    example.com www.example.com

To run lego for the first time, edit

    %%ETCDIR%%/lego.sh

and set the EMAIL variable.

Then run lego.sh with the run argument as the %%LEGO_USER%% user:

    $ %%ETCDIR%%/lego.sh run

Subsequent periodic runs will run with the renew argument by default, with a

renewal interval of 30 days.

lego is a client for Let's Encrypt users, written in Go. It has support for a

number of ACME challenges, and no external dependencies.

WWW: https://github.com/go-acme/lego

bin/lego

etc/periodic/weekly/604.lego

@dir(_lego,_lego,0700) etc/lego

@dir(,,0755) etc/ssl

@dir(_lego,_lego,0755) etc/ssl/lego

@dir(_lego,www,) %%WWWDIR%%

@sample(_lego,_lego,0700) etc/lego/lego.sh.sample

@sample etc/lego/deploy.sh.sample