YANG JIANKUAN
5326c572a2
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。 完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。 验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
28 lines
1.3 KiB
Bash
Executable File
28 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Issue a wildcard cert for *.<DOMAIN_ROOT> via acme.sh DNS-01 and install it into
|
|
# a STANDALONE nginx cert dir (/etc/nginx/ssl/<DOMAIN_ROOT>/), with a renew reloadcmd
|
|
# that reloads the system (apt) nginx. No aaPanel.
|
|
. "$(dirname "$0")/_lib.sh"
|
|
|
|
PLUGIN="${ACME_DNS_PLUGIN:-dns_cf}"
|
|
CERTDIR="/etc/nginx/ssl/$DOMAIN_ROOT"
|
|
|
|
CRED_EXPORTS=""
|
|
for v in CF_API_TOKEN DP_Id DP_Key Ali_Key Ali_Secret AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY GD_Key GD_Secret; do
|
|
[ -n "${!v:-}" ] && CRED_EXPORTS+="export $v='${!v}'; "
|
|
done
|
|
# acme.sh's Cloudflare plugin expects CF_Token; alias it from CF_API_TOKEN.
|
|
[ -n "${CF_API_TOKEN:-}" ] && CRED_EXPORTS+="export CF_Token='${CF_API_TOKEN}'; "
|
|
|
|
run "$CRED_EXPORTS
|
|
mkdir -p '$CERTDIR'
|
|
curl -s https://get.acme.sh | sh -s email=admin@$PARENT_ZONE >/dev/null 2>&1 || true
|
|
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt >/dev/null 2>&1 || true
|
|
~/.acme.sh/acme.sh --issue --dns $PLUGIN -d '$DOMAIN_ROOT' -d '*.$DOMAIN_ROOT' --keylength ec-256 --server letsencrypt 2>&1 | tail -5
|
|
~/.acme.sh/acme.sh --install-cert -d '$DOMAIN_ROOT' --ecc \
|
|
--key-file '$CERTDIR/privkey.pem' \
|
|
--fullchain-file '$CERTDIR/fullchain.pem' \
|
|
--reloadcmd 'systemctl reload nginx' 2>&1 | tail -3
|
|
ls -l '$CERTDIR'
|
|
echo cert-done"
|