surtr 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6347d467f10a9aa0d07d119f77d9608bb633c684f61e05ed55bf3747ff56dae0
-  data.tar.gz: 717b3f089df4fb666fa2459fa31dd2e45ac6487a5b7882bc7049f99fbaecad4b
+  metadata.gz: fca9124754acf3bf04d33a71a06648c8c0c1d947fb9484cd8f9ff8edcd90eb7f
+  data.tar.gz: e6d981c356da1eacccbe8f104af4c31d2b9a79497ca3753590dde0af5606a03d
 SHA512:
-  metadata.gz: '0885c832971d73ba1769c86e4b905c801f67c0ffe806d2fdb1215b5dc91d7925e52c072d235b32443e028a99efd49b5d94027fb08fe50405b7a5df811ee4b088'
-  data.tar.gz: 66bd2612418a162992e6911be922186697c8a274db2e74147954ba95afca588f6592c84c8872690eafce09906d8f4ecb8ec8466eb078a19125699a36e27a7b61
+  metadata.gz: 5e2025e6f7267723ae027d0c991267aade795b4f423d4ed8d1e89c35b32eb0bed36ca9679bc7d268b3116099fb517431d145a686e980161d9651b54a14d66c6b
+  data.tar.gz: 2bbcd17b0a21d85a5caee4cdfd2d7208ec5ec6074cb07fb718490069b33b9670c5ed298a8f8ad5da1d071e4f397e2aee20231db3ec47ef42dd3ebcbc127e8f21

data/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
   remote: .
   specs:
-    surtr (0.1.0)
-      acme-client
-      clamp
-      google-cloud-dns
+    surtr (0.2.0)
+      acme-client (~> 0.6)
+      clamp (~> 1.2)
+      google-cloud-dns (~> 0.28)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -8,6 +8,10 @@ A tool for managing Let's Encrypt certificates.
 
 ## Commands
 
+### surtr wizard DESTINATION DOMAINS...
+
+Authorize DOMAINS, get a certificate for them, and store the files in DESTINATION.
+
 ### surtr acme genkey
 
 Generate a signing key for ACME requests.
@@ -28,6 +32,10 @@ For when the DNS has updated: verify the authorization.
 
 Obtain a certificate for DOMAINS and store the files in DESTINATION.
 
-### surtr dns gcp NAME TYPE VALUE
+### surtr dns NAME TYPE VALUE gcp
 
 Add a DNS record to GCP.
+
+### surtr dns NAME TYPE VALUE wait
+
+Wait until the record propagates.

data/exe/surtr

@@ -3,6 +3,7 @@
 require "surtr"
 require "clamp"
 require "abbrev"
+require "logger"
 
 module Clamp::Subcommand::Declaration
   def find_subcommand (name)
@@ -13,17 +14,62 @@ module Clamp::Subcommand::Declaration
   end
 end
 
+$logger = Logger.new(STDERR)
+
 Clamp do
 
-  subcommand %w(dns), "Manage DNS" do
+  option "--keyfile", "FILE", "where to store the ACME key", default: ENV["HOME"] + "/.acme.pem", environment_variable: "SURTR_ACME_KEYFILE"
+
+  option "--endpoint", "STRING", "which ACME endpoint to use [staging, v01]", default: "v01", environment_variable: "SURTR_ACME_ENDPOINT" do |val|
+    fail ArgumentError, "endpoint must be either `staging' or `v01'" unless %w(staging v01).member?(val)
+  end
+
+  option "--project", "PROJECT", "google cloud project name", required: true, environment_variable: "SURTR_GCP_PROJECT"
+
+  subcommand %w(wizard), "Generate a certificate for some domains all automatic like" do
+
+    parameter "DESTINATION", "directory the certificate files will be put in"
+    parameter "DOMAIN ...", "domains to generate a certificate for"
+
+    def execute
+      $logger.info "verifying domains..."
+      domain_list.each do |domain|
+        $logger.info "#{domain}: verifying..."
+        ok, name, type, value = Surtr::ACME.challenge(keyfile, endpoint, domain)
+        if ok
+          $logger.info "#{domain}: verified"
+        else
+          $logger.info "#{domain}: not verified: adding challenge to DNS"
+          $logger.info "#{domain}: challenge: #{value}"
+          Surtr::DNS.gcp(project, name, type, value)
+          $logger.info "#{domain}: waiting for propagation"
+          Surtr::DNS.wait(name, type, value)
+          $logger.info "#{domain}: checking verification..."
+          Surtr::ACME.verify(keyfile, endpoint, domain)
+        end
+      end
+      $logger.info "requesting certificate..."
+      Surtr::ACME.certificate(keyfile, endpoint, destination, domain_list)
+      $logger.info "done"
+    end
+
+  end
 
-    option "--project", "PROJECT", "google cloud project name", required: true, environment_variable: "SURTR_GCP_PROJECT"
+  subcommand %w(dns), "Manage DNS records" do
 
-    subcommand %w(gcp), "Add a DNS record" do
+    parameter "NAME", "record name"
+    parameter "TYPE", "record type"
+    parameter "VALUE", "record value"
 
-      parameter "NAME", "record name"
-      parameter "TYPE", "record type"
-      parameter "VALUE", "record value"
+    subcommand %w(wait), "Wait until the DNS record propagates" do
+
+      def execute
+        Surtr::DNS.wait name, type, value
+      end
+
+    end
+
+    subcommand %w(gcp), "Add the DNS record to Google's Cloud DNS" do
 
       def execute
         Surtr::DNS.gcp project, name, type, value
@@ -35,11 +81,6 @@ Clamp do
 
   subcommand %w(acme), "Manage ACME" do
 
-    option "--keyfile", "FILE", "where to store the ACME key", default: ENV["HOME"] + "/.acme.pem", environment_variable: "SURTR_ACME_KEYFILE"
-    option "--endpoint", "STRING", "which ACME endpoint to use [staging, v01]", default: "v01", environment_variable: "SURTR_ACME_ENDPOINT" do |val|
-      fail ArgumentError, "endpoint must be either `staging' or `v01'" unless %w(staging v01).member?(val)
-    end
-
     subcommand %w(key), "Generate ACME key" do
       
       def execute
@@ -73,15 +114,26 @@ Clamp do
 
       parameter "DOMAIN", "domain name", environment_variable: "SURTR_ACME_AUTH_DOMAIN"
 
-      subcommand %w(c challenge), "Begin authorization challenge" do
+      subcommand %w(challenge), "Begin authorization challenge" do
         def execute
-          Surtr::ACME.challenge keyfile, endpoint, domain
+          ok, name, type, value = Surtr::ACME.challenge keyfile, endpoint, domain
+          if ok
+            puts "#{domain}: verified"
+          else
+            puts "#{domain}: not verified. DNS record required:"
+            puts "  " + [[challenge.record_name, domain].join("."), challenge.record_type, challenge.record_content.inspect].join(" ")
+          end
         end
       end
 
       subcommand %w(verify validate), "Verify authorization" do
         def execute
-          Surtr::ACME.verify keyfile, endpoint, domain
+          ok = Surtr::ACME.verify keyfile, endpoint, domain
+          if ok
+            puts "#{domain}: verified"
+          else
+            puts "#{domain}: not verified"
+          end
         end
       end
 

data/lib/surtr/acme.rb

@@ -23,10 +23,9 @@ module Surtr
       case auth.status
       when "pending"
         challenge = auth.dns01
-        puts "#{domain}: not verified. DNS record required:"
-        puts "  " + [[challenge.record_name, domain].join("."), challenge.record_type, challenge.record_content.inspect].join(" ")
+        return [false, [challenge.record_name, domain].join("."), challenge.record_type, challenge.record_content]
       when "valid"
-        puts "#{domain}: verified"
+        return true
       else
         fail "#{domain}: unexpected authorization status: #{auth.status}"
       end
@@ -43,8 +42,9 @@ module Surtr
         while auth.verify_status == "pending"
           sleep 0.1
         end
+        return true
       when "valid"
-        puts "#{domain}: verified"
+        return true
       else
         fail "#{domain}: unexpected authorization status: #{auth.status}"
       end

data/lib/surtr/dns.rb

@@ -1,15 +1,28 @@
 require "google/cloud/dns"
+require "resolv"
 
 module Surtr
 
   module DNS
 
+    def self.wait (name, type, value)
+      loop do
+        ok = %w(8.8.8.8 8.8.4.4).all? do |ns|
+          r = Resolv::DNS.new(nameserver: ns)
+          s = r.getresource(name, Resolv::DNS::Resource::IN::TXT).strings
+          s.member?(value)
+        end
+        break if ok
+        sleep 0.5
+      end
+    end
+
     def self.gcp (project, name, type, value)
 
       dns = Google::Cloud::Dns.new project: project
       dns.zones.each do |zone|
         if name.end_with?(zone.dns[0..-2])
-          zone.replace name, type, 60, value
+          zone.replace name, type, 1, value
           break
         end
       end

data/lib/surtr/version.rb

@@ -1,3 +1,3 @@
 module Surtr
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: surtr
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Nathan Baum