amarillo 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a94e70709b0f4147b7c04711d1e1f58a54eeea7a743364ee4e8dc2d25984b83a
+  data.tar.gz: 1f179ac5eea2d4919e22d09a44b491cbed3e2704128d9da71a9c00a10c177275
+SHA512:
+  metadata.gz: 3acd69905f4138ab59a2de3a1cb8493a6e1ea9363ccaaa622c8d565112850e78ce11ea6fad940052c7a4795a3e19980bb2f24f392775ac4aeab463f19ef6d013
+  data.tar.gz: 0025b7ca2705e934750ca1bf267644ddc9fd610072ab64a2d5fc7c762b1c16d200b6ea1c6f74b87723c2a75fe6251982478ee72cfc9bc7c5b11581211b2d1a9d

data/bin/amarillo

@@ -0,0 +1,111 @@
+#!/usr/bin/env ruby
+# 
+# Copyright 2021 iAchieved.it LLC
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'optparse' 
+require 'fileutils'
+require 'amarillo'
+
+options = {}
+OptionParser.new do |opts|
+  opts.on("-z", "--zone ZONE", "Hosted zone") do |z|
+    options[:zone] = z
+  end
+
+  opts.on("-e", "--email EMAIL", "E-mail address") do |e|
+    options[:email] = e
+  end
+
+  opts.on("-n", "--name COMMONNAME", "Certificate Common Name") do |n|
+    options[:name] = n
+  end
+
+  opts.on("-o", "--output-directory OUTPUT_PATH", "Output directory of certificates and keys") do |o|
+    options[:certificate_path] = o
+  end
+
+  opts.on("-h", "--help") do |h|
+    options[:help] = h
+  end
+end.parse!
+
+if options[:help] then
+   manpage = <<-"HEREDOC"
+Usage:  amarillo --zone ZONE --name COMMONNAME --email EMAIL [--output-path OUTPUT_PATH]
+   HEREDOC
+   puts manpage
+  exit 0
+end 
+
+if options[:zone].nil? or
+   options[:email].nil? or
+   options[:name].nil? then
+
+   puts "Usage:  amarillo --zone ZONE --name COMMONNAME --email EMAIL [--output-directory OUTPUT_PATH]"
+
+   exit -1
+end
+
+if options[:output_path].nil?
+  certificate_path = "/etc/ssl/amarillo"
+  key_path         = "/etc/ssl/amarillo/private"
+else
+  certificate_path = options[:output_path]
+  key_path         = "#{certificate_path}/private"
+end
+
+# Try to create the certificate_path and key_path
+keypath_dirname = File.dirname(key_path)
+unless File.directory?(keypath_dirname)
+	begin
+	  FileUtils.mkdir_p(keypath_dirname)
+	rescue
+		writableMessage = <<-"HEREDOC"
+Error:  #{certificate_path} and #{key_path} are not writable directories to store keys and certificates.
+HEREDOC
+		print writableMessage
+		exit -1
+	end
+end
+
+# Check for existense of aws.env
+awsEnvPath = Pathname.new("/etc/amarillo/aws.env")
+if not awsEnvPath.exist? then
+	awsEnvMessage = <<-"HEREDOC"
+Error:  /etc/amarillo/aws.env AWS credentials file not found.
+
+/etc/amarillo/aws.env must exist and set both aws_access_key_id and aws_secret_access_key for an IAM user with AmazonRoute53FullAccess permissions. 
+
+Example:
+
+[default]
+aws_access_key_id = your_access_key_id
+aws_secret_access_key = your_secret_access_key
+	HEREDOC
+
+	print awsEnvMessage
+
+  exit -1
+end
+
+
+y = Amarillo.new(certificate_path, key_path, awsEnvPath)
+y.requestCertificate(options[:zone], options[:name], options[:email])

data/lib/amarillo.rb

@@ -0,0 +1,203 @@
+#!/usr/bin/env ruby
+#
+# Inspired by Pete Keen's (pete@petekeen.net) post
+# https://www.petekeen.net/lets-encrypt-without-certbot
+# 
+# Copyright 2021 iAchieved.it LLC
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'logger'          # Logging
+require 'acme-client'     # Let's Encrypt
+require 'openssl'         # Key Generation
+require 'aws-sdk-core'    # Credentials
+require 'aws-sdk-route53' # Route 53
+require 'resolv'          # DNS Resolvers
+
+class Amarillo
+
+  def initialize(certificatePath, keyPath, awsEnvPath)
+
+    @certificatePath = certificatePath
+    @keyPath         = keyPath
+    @awsEnvPath      = awsEnvPath
+
+    @logger = Logger.new(STDOUT)
+    @logger.level = Logger::INFO
+
+  end
+
+  def check_dns(domainName, nameservers, value)
+    valid = true
+
+    nameservers.each do |nameserver|
+      begin
+        records = Resolv::DNS.open(nameserver: nameserver) do |dns|
+          dns.getresources(
+            "_acme-challenge.#{domainName}", 
+            Resolv::DNS::Resource::IN::TXT
+            )
+        end
+        records = records.map(&:strings).flatten
+        valid = value == records.first
+      rescue Resolv::ResolvError
+        return false
+      end
+      return false if !valid
+    end
+
+    valid
+  end
+
+  def requestCertificate(zone, commonName, email)
+
+    @logger.info "Generating 4096-bit RSA private key"
+    key = OpenSSL::PKey::RSA.new(4096)
+    client = Acme::Client.new(
+      private_key: key, 
+      directory: 'https://acme-v02.api.letsencrypt.org/directory'
+      )
+
+    account = client.new_account(
+      contact: "mailto:#{email}", 
+      terms_of_service_agreed: true
+      )
+
+    # Generate a certificate order
+    @logger.info "Creating certificate order request for #{commonName}"
+
+    order          = client.new_order(identifiers: [commonName])
+    authorization  = order.authorizations.first
+    label          = "_acme-challenge.#{commonName}"
+    record_type    = authorization.dns.record_type
+    challengeValue = authorization.dns.record_content
+
+    @logger.info "Challenge value for #{commonName} in #{zone} zone is #{challengeValue}"
+
+    # Update Route 53
+
+    shared_creds = Aws::SharedCredentials.new(path: "#{@awsEnvPath}")
+    Aws.config.update(credentials: shared_creds)
+
+    # TODO:  Allow the user to set the region
+    route53 = Aws::Route53::Client.new(region: 'us-east-2')
+    hzone   = route53.list_hosted_zones(max_items: 100)
+    .hosted_zones
+    .detect { |z| z.name == "#{zone}." }
+
+    change = {
+      action: 'UPSERT',
+      resource_record_set: {
+        name: label,
+        type: record_type,
+        ttl: 1,
+        resource_records: [
+          { value: "\"#{challengeValue}\"" }
+        ]
+      }
+    }
+
+    options = {
+      hosted_zone_id: hzone.id,
+      change_batch: {
+        changes: [change]
+      }
+    }
+
+    route53.change_resource_record_sets(options)
+
+    nameservers = []
+
+    @logger.info "Looking up nameservers for #{zone}"
+
+    Resolv::DNS.open(nameserver: '9.9.9.9') do |dns|
+      while nameservers.length == 0
+        nameservers = dns.getresources(
+          zone,
+          Resolv::DNS::Resource::IN::NS
+          ).map(&:name).map(&:to_s)
+      end
+    end
+
+    @logger.info "Waiting for DNS record to propogate"
+    while !check_dns(commonName, nameservers, challengeValue)
+      sleep 1
+    end
+
+    authorization.dns.request_validation
+
+    @logger.info "Requesting validation..."
+    authorization.dns.reload
+    while authorization.dns.status == 'pending'
+    	sleep 2
+    	@logger.info "DNS status:  #{authorization.dns.status}"
+    	authorization.dns.reload
+    end
+
+    @logger.info "Requesting certificate..."
+
+    cert_key = OpenSSL::PKey::RSA.new(4096)
+    csr = Acme::Client::CertificateRequest.new(
+      private_key: cert_key, 
+      names: [commonName]
+      )
+
+    order.finalize(csr: csr)
+
+    sleep(1) while order.status == 'processing'
+
+    keyOutputPath =  "#{@keyPath}/#{commonName}.key"
+    certOutputPath = "#{@certificatePath}/#{commonName}.crt"
+
+    @logger.info "Saving private key to #{keyOutputPath}"
+
+    File.open(keyOutputPath, "w") do |f|
+    	f.puts cert_key.to_pem.to_s
+    end
+
+    @logger.info "Saving certificate to #{certOutputPath}"
+
+    File.open(certOutputPath, "w") do |f|
+    	f.puts order.certificate
+    end
+
+    @logger.info "Cleaning up..."
+
+    change = {
+      action: 'DELETE',
+      resource_record_set: {
+        name: label,
+        type: record_type,
+        ttl: 1,
+        resource_records: [
+          { value: "\"#{challengeValue}\"" }
+        ]
+      }
+    }
+
+    options = {
+      hosted_zone_id: hzone.id,
+      change_batch: {
+        changes: [change]
+      }
+    }
+
+    route53.change_resource_record_sets(options)
+  end
+end

metadata

@@ -0,0 +1,101 @@
+--- !ruby/object:Gem::Specification
+name: amarillo
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- iAchieved.it LLC
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2021-04-28 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: acme-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: openssl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-route53
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.48'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.48'
+description: A tool for managing Let's Encrypt dns-01 certificates
+email: joe@iachieved.it
+executables:
+- amarillo
+extensions: []
+extra_rdoc_files: []
+files:
+- bin/amarillo
+- lib/amarillo.rb
+homepage: https://github.com/iachievedit/amarillo
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3
+signing_key: 
+specification_version: 4
+summary: Amarillo
+test_files: []