Name:		dehydrated
Version:	0.7.0
Release:	2%{?dist}
Summary:	ACME client in bash

Group:		Application/System
License:	MIT
URL:		https://github.com/lukas2511/dehydrated
Source0:	%{name}-%{version}.tar.gz
Source1:	dehydrated_hooks
SOurce2:	dehydrated_revoke
Source3:	httpd.sh.sample

BuildArch:	noarch
BuildRoot:	/var/tmp/%{name}-%{version}-%{release}-buildroot

BuildRequires: 	httpd
Requires:	openssl
Requires:	sed
Requires:	/bin/awk
Requires:	curl
Requires:	/bin/mktemp

Conflicts:	letsencrypt.sh
Obsoletes:	letsencrypt.sh

%if 0%{?fedora} >= 11 || 0%{?rhel} >= 5
%global useselinux 1
%else
%global useselinux 0
%endif

%description
This is a client for signing certificates with an ACME server
(currently only provided by Let's Encrypt) implemented as a
relatively simple bash-script.

%prep
%setup -q -n %{name}-%{version}

%build
sed -i -e "s|#BASEDIR=.*|BASEDIR=%{_localstatedir}/lib/%{name}/certificates|" \
       -e "s|#WELLKNOWN=.*|WELLKNOWN=%{_localstatedir}/lib/%{name}/challenges|" \
       -e "s|#HOOK=.*|HOOK=%{_bindir}/dehydrated_hooks|" \
       -e "s|#DOMAINS_TXT=.*|DOMAINS_TXT=%{_sysconfdir}/%{name}/domains.txt|" \
        docs/examples/config

%install
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/challenges
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/certificates
install -D dehydrated $RPM_BUILD_ROOT/%{_bindir}/%{name}
install %{SOURCE1} $RPM_BUILD_ROOT/%{_bindir}/dehydrated_hooks
install %{SOURCE2} $RPM_BUILD_ROOT/%{_bindir}/dehydrated_revoke
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_clean_challenge.d
install -D -m 0644 %{SOURCE3} $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d/10httpd.sh.sample
install -D -m 0644 docs/examples/config $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/config
install -D -m 0644 docs/examples/domains.txt $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/domains.txt
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/%{name}
#!/bin/sh
# Uncomment to enable auto-renewal
# %{_bindir}/%{name} -c 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log

# Uncomment this to auto revoke old certs
# %{_bindir}/dehydrated_revoke 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log

_EOF
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d/dehydrated.conf

Alias /.well-known/acme-challenge/ %{_localstatedir}/lib/%{name}/challenges/

<Directory %{_localstatedir}/lib/%{name}/challenges>
  Options None
  AllowOverride None
  Header set Content-Type "application/jose+json"
  <IfModule mod_authz_core.c>
    # Apache 2.4
    Require all granted
  </IfModule>
  <IfModule !mod_authz_core.c>
    # Apache 2.2
    Order deny,allow
    Allow from all
  </IfModule>
</Directory>
_EOF
install -d -m 750 $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d/%{name}
/var/log/%{name}.log {
  missingok
  copytruncate
  rotate 12
  compress
  weekly
  create 0660 root root
}
_EOF

%post
%if %{useselinux}
(
# New File context
semanage fcontext -a -t cert_t "%{_localstatedir}/lib/dehydrated(/.*)?"
# files created by app
restorecon -R %{_localstatedir}/lib/dehydrated
) &>/dev/null || :
%endif

# Migrate from letsencrypt.sh
if [ -e %{_sysconfdir}/letsencrypt.sh/config ]; then
  sed -e 's/letsencrypt.sh/dehydrated/g' \
      -e 's/le_hooks.sh/dehydrated_hooks/g' \
      %{_sysconfdir}/letsencrypt.sh/config > %{_sysconfdir}/%{name}/config
fi
if [ -e %{_sysconfdir}/letsencrypt.sh/domains.txt ]; then
  cat %{_sysconfdir}/letsencrypt.sh/domains.txt > %{_sysconfdir}/%{name}/domains.txt
fi
if [ -d %{_localstatedir}/lib/letsencrypt.sh/certificates/certs ]; then
  mv %{_localstatedir}/lib/letsencrypt.sh/certificates/* %{_localstatedir}/lib/%{name}/certificates/
fi
if [ -e %{_sysconfdir}/httpd/conf.d/ssl.conf ]; then
  sed -i -e 's|%{_localstatedir}/lib/letsencrypt.sh|%{_localstatedir}/lib/%{name}|g' %{_sysconfdir}/httpd/conf.d/ssl.conf
fi
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ ]; then
  find %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_deploy_cert.d/ \;
fi
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ ]; then
  find %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_clean_challenge.d/ \;
fi

%postun
%if %{useselinux}
if [ "$1" -eq "0" ]; then
    # Remove the File Context
    (
    semanage fcontext -d "%{_localstatedir}/lib/dehydrated(/.*)?"
    ) &>/dev/null || :
fi
%endif

%files
%doc LICENSE README.md docs/examples/hook.sh
%config(noreplace) %{_sysconfdir}/%{name}/*
%config(noreplace) %attr(0755,root,root) %{_sysconfdir}/cron.daily/%{name}
%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
%attr(0644, root,root) %{_sysconfdir}/%{name}/hooks_deploy_cert.d/*
%dir %attr(0755,root,root) %{_sysconfdir}/%{name}/hooks_clean_challenge.d/
%attr(0755,root,root) %{_bindir}/%{name}
%attr(0755,root,root) %{_bindir}/dehydrated_hooks
%attr(0755,root,root) %{_bindir}/dehydrated_revoke
%dir %attr(0755,root,root) %{_localstatedir}/lib/%{name}/challenges
%dir %attr(0750,root,root) %{_localstatedir}/lib/%{name}/certificates

%changelog
* Wed May 26 2021 Daniel Berteaud <daniel@firewall-services.com> 0.7.0-2
- Update to 0.7.0 (daniel@firewall-services.com)

* Thu Apr 09 2020 Daniel Berteaud <daniel@firewall-services.com> 0.6.5-13
- Don't call hook scripts with exec (daniel@firewall-services.com)

* Wed Jul 24 2019 Daniel Berteaud <daniel@firewall-services.com> 0.6.5-12
- Update to 0.6.5 (daniel@firewall-services.com)
- Switch to LFS to track tarballs (daniel@firewall-services.com)

* Tue Nov 06 2018 Daniel Berteaud <daniel@firewall-services.com> 0.6.2-11
- No reason to restrict read access to the challenge dir And now it can work
  with nginx too (daniel@firewall-services.com)

* Thu May 17 2018 Daniel Berteaud <daniel@firewall-services.com> 0.6.2-10
- Update to 0.6.2
* Thu Mar 15 2018 Daniel Berteaud <daniel@firewall-services.com> 0.6.1-10
- Update to 0.6.1
* Tue Mar 13 2018 Daniel Berteaud <daniel@firewall-services.com> 0.6.0-0.beta1
- Update to 0.6.0
* Mon Feb 26 2018 Daniel Berteaud <daniel@firewall-services.com> 0.5.0-11
- Only update ssl.conf if it exists (daniel@firewall-services.com)

* Thu Feb 01 2018 Daniel Berteaud <daniel@firewall-services.com> 0.5.0-10
- Configure correct tito builder (daniel@firewall-services.com)

* Thu Feb 01 2018 Daniel Berteaud <daniel@firewall-services.com> 0.5.0-10.beta1
- new package built with tito

* Thu Feb 1 2018 Daniel Berteaud <daniel@firewall-services.com> - 0.5.0-1
- Update to 0.5.0

* Wed May 31 2017 Daniel Berteaud <daniel@firewall-services.com> - 0.4.0-10
- Bump release (priority vs EPEL)

* Tue Mar 14 2017 Daniel Berteaud <daniel@firewall-services.com> - 0.4.0-1
- Update to 0.4.0

* Thu Jan 19 2017 Daniel Berteaud <daniel@firewall-services.com> - 0.3.1.20170119.gitb36d638-1
- Set context to cert_t so it isn't changed to cron_var_lib_t when exec via cron
- Update to git b36d638

* Mon Oct 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-3
- Fix warning when installing dehydrated without upgrading from letsencrypt.sh
- Update the default hook to use dehydrated_hooks

* Mon Sep 19 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-2
- Fix find command to work with older find versions (on el5), replace -executable with -perm /111

* Wed Sep 14 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-1
- Renamed to dehydrated

* Wed Aug 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-2
- Set var_lib_t context to files

* Wed Aug 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-1
- Update to git afabfff

* Mon Jun 6 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-4
- Default to enable HOOK in config

* Fri Jun 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-3
- Add missing exec permission on daily cronjob script

* Wed Jun 1 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-2
- Fix le_revoke.sh script to use config instead of config.sh

* Tue May 31 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-1
- Update to git ec48906

* Fri May 13 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160513.gita286741-1
- Update to git a286741

* Wed Mar 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160330.gitdca25e8-1
- Update to git dca25e8
- Fix arg shifting in le_hooks script

* Tue Feb 23 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160223.git2099c77-1
- Update to GIT git2099c77

* Sat Jan 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-2
- Rename httpd.sh hook to 10httpd.sh
- Provide le_revoke.sh script to revoke old certificates
- Add timestamp to logs using awk

* Fri Jan 29 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-1
- Use date based version number

* Wed Jan 27 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.3.git79ff846-1
- Update to git 79ff846

* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.2.git3432f60-1
- Add hooks directory

* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.1.git3432f60-1
- First package