34 lines
1.7 KiB
Bash
Executable File
34 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# TP31 — Caddyfile + DNS-Token in LXC 130 ausrollen.
|
|
#
|
|
# Das Token wird aus ~/.secrets/credentials.env gelesen und direkt in die
|
|
# Container-Env-Datei geschrieben. Es erscheint dabei NIE auf stdout und nie in
|
|
# einer Kommandozeile — dieselbe Regel wie bei `sshpass -e` (s. CLAUDE.md).
|
|
set -euo pipefail
|
|
|
|
PVE=${PVE:-root@10.40.20.100}
|
|
CTID=${CTID:-130}
|
|
HERE=$(cd "$(dirname "$0")" && pwd)
|
|
|
|
TOKEN=$(grep -m1 '^CF_DNS_API_TOKEN=' ~/.secrets/credentials.env 2>/dev/null | cut -d= -f2- || true)
|
|
if [ -z "${TOKEN}" ]; then
|
|
echo "FEHLER: CF_DNS_API_TOKEN fehlt in ~/.secrets/credentials.env" >&2
|
|
echo " Anlegen in Cloudflare: My Profile -> API Tokens -> Create Token," >&2
|
|
echo " Permission 'Zone : DNS : Edit', Zone Resources auf emsenhuber.net begrenzen." >&2
|
|
echo " NICHT das account-weite CF_API_TOKEN wiederverwenden." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "-> Caddyfile"
|
|
scp -q "${HERE}/Caddyfile" "${PVE}:/tmp/.caddyfile.$$"
|
|
ssh "${PVE}" "pct push ${CTID} /tmp/.caddyfile.\$\$ /etc/caddy/Caddyfile --perms 644 2>/dev/null || pct push ${CTID} /tmp/.caddyfile.$$ /etc/caddy/Caddyfile --perms 644; rm -f /tmp/.caddyfile.$$"
|
|
|
|
echo "-> Token (maskiert: Laenge ${#TOKEN})"
|
|
printf 'CF_DNS_API_TOKEN=%s\n' "${TOKEN}" | ssh "${PVE}" "cat > /tmp/.cenv.$$ && chmod 600 /tmp/.cenv.$$ && pct push ${CTID} /tmp/.cenv.$$ /etc/caddy/caddy.env --perms 600 && rm -f /tmp/.cenv.$$"
|
|
|
|
echo "-> validate"
|
|
ssh "${PVE}" "pct exec ${CTID} -- sh -c 'set -a; . /etc/caddy/caddy.env; set +a; /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile' 2>&1 | tail -3"
|
|
|
|
echo "-> reload/start"
|
|
ssh "${PVE}" "pct exec ${CTID} -- systemctl reload-or-restart caddy && sleep 3 && pct exec ${CTID} -- systemctl is-active caddy"
|