diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index d943ce1d0..2a5039e66 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -14,6 +14,10 @@ NOTE: This is a new major release with backwards-incompatible changes. Downgrade to older releases is not supported. Be sure to create a full backup and include /var/etc/acme-client. +NOTE: Lexicon is deprecated and most configurations are converted +to native acme.sh DNS APIs. However, in some case manual reconfiguration +may be necessary. + Added: * add nic.ru DNS API (#3684) * add Aurora DNS API @@ -27,12 +31,62 @@ Added: Changed: * use a dedicated acme.sh runtime directory for every cert (#3127) +* migrate lexicon provider aliyun to acme.sh DNS API (#2920) +* migrate lexicon provider aurora to acme.sh DNS API (#2920) +* migrate lexicon provider azure to acme.sh DNS API (#2920) +* migrate lexicon provider cloudflare to acme.sh DNS API (#2920) +* migrate lexicon provider cloudns to acme.sh DNS API (#2920) +* migrate lexicon provider cloudxns to acme.sh DNS API (#2920) +* migrate lexicon provider conoha to acme.sh DNS API (#2920) +* migrate lexicon provider constellix to acme.sh DNS API (#2920) +* migrate lexicon provider digitalocean to acme.sh DNS API (#2920) +* migrate lexicon provider directadmin to acme.sh DNS API (#2920) +* migrate lexicon provider dnsimple to acme.sh DNS API (#2920) +* migrate lexicon provider dnsmadeeasy to acme.sh DNS API (#2920) +* migrate lexicon provider dnspod to acme.sh DNS API (#2920) +* migrate lexicon provider dreamhost to acme.sh DNS API (#2920) +* migrate lexicon provider easydns to acme.sh DNS API (#2920) +* migrate lexicon provider exoscale to acme.sh DNS API (#2920) +* migrate lexicon provider gandi to acme.sh DNS API (#2920) +* migrate lexicon provider godaddy to acme.sh DNS API (#2920) +* migrate lexicon provider googleclouddns to acme.sh DNS API (#2920) +* migrate lexicon provider gratisdns to acme.sh DNS API (#2920) +* migrate lexicon provider henet to acme.sh DNS API (#2920) +* migrate lexicon provider hetzner to acme.sh DNS API (#2920) +* migrate lexicon provider infoblox to acme.sh DNS API (#2920) +* migrate lexicon provider internetbs to acme.sh DNS API (#2920) +* migrate lexicon provider inwx to acme.sh DNS API (#2920) +* migrate lexicon provider linode to acme.sh DNS API (#2920) +* migrate lexicon provider linode4 to acme.sh DNS API (#2920) +* migrate lexicon provider luadns to acme.sh DNS API (#2920) +* migrate lexicon provider namecheap to acme.sh DNS API (#2920) +* migrate lexicon provider namesilo to acme.sh DNS API (#2920) +* migrate lexicon provider netcup to acme.sh DNS API (#2920) +* migrate lexicon provider nfsn to acme.sh DNS API (#2920) +* migrate lexicon provider nsone to acme.sh DNS API (#2920) +* migrate lexicon provider online to acme.sh DNS API (#2920) +* migrate lexicon provider ovh to acme.sh DNS API (#2920) +* migrate lexicon provider plesk to acme.sh DNS API (#2920) +* migrate lexicon provider pointhq to acme.sh DNS API (#2920) +* migrate lexicon provider powerdns to acme.sh DNS API (#2920) +* migrate lexicon provider rackspace to acme.sh DNS API (#2920) +* migrate lexicon provider rage4 to acme.sh DNS API (#2920) +* migrate lexicon provider route53 to acme.sh DNS API (#2920) +* migrate lexicon provider transip to acme.sh DNS API (#2920) +* migrate lexicon provider vultr to acme.sh DNS API (#2920) +* migrate lexicon provider yandex to acme.sh DNS API (#2920) +* migrate lexicon provider zeit to acme.sh DNS API (#2920) +* migrate lexicon provider zilore to acme.sh DNS API (#2920) +* migrate lexicon provider zonomi to acme.sh DNS API (#2920) Fixed: * fix sporadic command failure with gcloud DNS API (#3745) * fix errors when the same Common Name is used multiple times (#3127) * fix crash on invalid automations (#3752) +Deprecated: +* deprecate support for lexicon DNS APIs (no removal date yet) + 3.20 Added: diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml index 4fd1fd5d4..98fdc7e56 100644 --- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml +++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml @@ -788,12 +788,7 @@ Specify the location of the generated TSIG Key inside the TSIG file using grep and cut, example: grep \# /etc/knot/acme.key | cut -d' ' -f2 - - header - - - - + header diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml index bc0a32b0a..a583d068b 100644 --- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml @@ -1,6 +1,6 @@ //OPNsense/AcmeClient - 4.0.0 + 4.1.0 A secure ACME Client plugin @@ -481,7 +481,7 @@ KingHost Knot (knsupdate) LeaseWeb - lexicon + lexicon (DEPRECATED) Linode (v3 / Deprecated) Linode (v4) Loopia @@ -787,67 +787,67 @@ N cloudflare - Aliyun.com - AuroraDNS + Aliyun.com (UNSUPPORTED) + AuroraDNS (UNSUPPORTED) Auto API - Azure - CloudFlare - ClouDNS - CloudXNS - ConoHa - Constellix - DigitalOcean - Dinahosting - DirectAdmin - DNSimple - DnsMadeEasy + Azure (UNSUPPORTED) + CloudFlare (UNSUPPORTED) + ClouDNS (UNSUPPORTED) + CloudXNS (UNSUPPORTED) + ConoHa (UNSUPPORTED) + Constellix (UNSUPPORTED) + DigitalOcean (UNSUPPORTED) + Dinahosting (UNSUPPORTED) + DirectAdmin (UNSUPPORTED) + DNSimple (UNSUPPORTED) + DnsMadeEasy (UNSUPPORTED) DNSPark - DNSPod - Dreamhost - EasyDNS + DNSPod (UNSUPPORTED) + Dreamhost (UNSUPPORTED) + EasyDNS (UNSUPPORTED) Easyname - ExoScale - Gandi + ExoScale (UNSUPPORTED) + Gandi (UNSUPPORTED) Gehirn Glesys - GoDaddy - Google Cloud - GratisDNS - Hurricane Electric - Hetzner + GoDaddy (UNSUPPORTED) + Google Cloud (UNSUPPORTED) + GratisDNS (UNSUPPORTED) + Hurricane Electric (UNSUPPORTED) + Hetzner (UNSUPPORTED) Hover - Infoblox - Internet.bs - INWX - Linode (v3 / Deprecated) - Linode (v4) + Infoblox (UNSUPPORTED) + Internet.bs (UNSUPPORTED) + INWX (UNSUPPORTED) + Linode v3 (UNSUPPORTED) + Linode v4 (UNSUPPORTED) Localzone - LuaDNS + LuaDNS (UNSUPPORTED) Memset - Namecheap - Namesilo - Netcup - NFSN - NS1 + Namecheap (UNSUPPORTED) + Namesilo (UNSUPPORTED) + Netcup (UNSUPPORTED) + NFSN (UNSUPPORTED) + NS1 (UNSUPPORTED) OnApp - Online - OVH - Plesk - PointHQ - PowerDNS - Rackspace - Rage4 - Route 53 + Online (UNSUPPORTED) + OVH (UNSUPPORTED) + Plesk (UNSUPPORTED) + PointHQ (UNSUPPORTED) + PowerDNS (UNSUPPORTED) + Rackspace (UNSUPPORTED) + Rage4 (UNSUPPORTED) + Route 53 (UNSUPPORTED) SafeDNS SakuraCloud Softlayer Subreg - Transip - Vultr - Yandex - Zeit - Zilore - Zonomi + Transip (UNSUPPORTED) + Vultr (UNSUPPORTED) + Yandex (UNSUPPORTED) + Zeit (UNSUPPORTED) + Zilore (UNSUPPORTED) + Zonomi (UNSUPPORTED) diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php new file mode 100644 index 000000000..a28ae71f4 --- /dev/null +++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php @@ -0,0 +1,266 @@ +getNodeByReference('validations.validation')->iterateItems() as $validation) { + $dns_service = (string)$validation->dns_service; + $dns_lexicon_provider = (string)$validation->dns_lexicon_provider; + + if (!empty($dns_lexicon_provider) && ($dns_service === 'dns_lexicon')) { + // Migrate old lexicon values to DNS API values. + switch ($dns_lexicon_provider) { + case 'aliyun': + $validation->dns_service = 'dns_ali'; + $validation->dns_ali_key = (string)$validation->dns_lexicon_user; + $validation->dns_ali_secret = (string)$validation->dns_lexicon_token; + break; + case 'aurora': + $validation->dns_service = 'dns_aurora'; + $validation->dns_aurora_key = (string)$validation->dns_lexicon_user; + $validation->dns_aurora_secret = (string)$validation->dns_lexicon_token; + break; + case 'cloudflare': + $validation->dns_service = 'dns_cf'; + $validation->dns_cf_key = (string)$validation->dns_lexicon_user; + $validation->dns_cf_token = (string)$validation->dns_lexicon_token; + break; + case 'cloudns': + $validation->dns_service = 'dns_cloudns'; + $validation->dns_cloudns_auth_id = (string)$validation->dns_lexicon_user; + $validation->dns_cloudns_auth_password = (string)$validation->dns_lexicon_token; + break; + case 'cloudxns': + $validation->dns_service = 'dns_cx'; + $validation->dns_cx_key = (string)$validation->dns_lexicon_user; + $validation->dns_cx_secret = (string)$validation->dns_lexicon_token; + break; + case 'conoha': + $validation->dns_service = 'dns_conoha'; + $validation->dns_conoha_user = (string)$validation->dns_lexicon_user; + $validation->dns_conoha_password = (string)$validation->dns_lexicon_token; + break; + case 'constellix': + $validation->dns_service = 'dns_constellix'; + $validation->dns_constellix_key = (string)$validation->dns_lexicon_user; + $validation->dns_constellix_secret = (string)$validation->dns_lexicon_token; + break; + case 'digitalocean': + $validation->dns_service = 'dns_dgon'; + $validation->dns_dgon_key = (string)$validation->dns_lexicon_token; + break; + case 'directadmin': + $validation->dns_service = 'dns_da'; + $validation->dns_da_key = (string)$validation->dns_lexicon_token; + break; + case 'dnsimple': + $validation->dns_service = 'dns_dnsimple'; + $validation->dns_dnsimple_token = (string)$validation->dns_lexicon_token; + break; + case 'dnsmadeeasy': + $validation->dns_service = 'dns_me'; + $validation->dns_me_key = (string)$validation->dns_lexicon_user; + $validation->dns_me_secret = (string)$validation->dns_lexicon_token; + break; + case 'dnspod': + $validation->dns_service = 'dns_dp'; + $validation->dns_dp_id = (string)$validation->dns_lexicon_user; + $validation->dns_dp_key = (string)$validation->dns_lexicon_token; + break; + case 'dreamhost': + $validation->dns_service = 'dns_dreamhost'; + // FIXME: parameter prefix should match $dns_service + $validation->dns_dh_key = (string)$validation->dns_lexicon_token; + break; + case 'easydns': + $validation->dns_service = 'dns_easydns'; + $validation->dns_easydns_apikey = (string)$validation->dns_lexicon_user; + $validation->dns_easydns_apitoken = (string)$validation->dns_lexicon_token; + break; + case 'exoscale': + $validation->dns_service = 'dns_exoscale'; + $validation->dns_exoscale_key = (string)$validation->dns_lexicon_user; + $validation->dns_exoscale_secret = (string)$validation->dns_lexicon_token; + break; + case 'gandi': + $validation->dns_service = 'dns_gandi_livedns'; + $validation->dns_gandi_livedns_key = (string)$validation->dns_lexicon_user; + $validation->dns_gandi_livedns_token = (string)$validation->dns_lexicon_token; + break; + case 'godaddy': + $validation->dns_service = 'dns_gd'; + $validation->dns_gd_key = (string)$validation->dns_lexicon_user; + $validation->dns_gd_secret = (string)$validation->dns_lexicon_token; + break; + case 'googleclouddns': + $validation->dns_service = 'dns_gcloud'; + $validation->dns_gcloud_key = (string)$validation->dns_lexicon_token; + break; + case 'gratisdns': + $validation->dns_service = 'dns_gdnsdk'; + $validation->dns_gdnsdk_user = (string)$validation->dns_lexicon_user; + $validation->dns_gdnsdk_password = (string)$validation->dns_lexicon_token; + break; + case 'henet': + $validation->dns_service = 'dns_he'; + $validation->dns_he_user = (string)$validation->dns_lexicon_user; + $validation->dns_he_password = (string)$validation->dns_lexicon_token; + break; + case 'hetzner': + $validation->dns_service = 'dns_hetzner'; + $validation->dns_hetzner_token = (string)$validation->dns_lexicon_token; + break; + case 'infoblox': + $validation->dns_service = 'dns_infoblox'; + $validation->dns_infoblox_credentials = (string)$validation->dns_lexicon_token; + break; + case 'internetbs': + $validation->dns_service = 'dns_internetbs'; + $validation->dns_internetbs_key = (string)$validation->dns_lexicon_user; + $validation->dns_internetbs_password = (string)$validation->dns_lexicon_token; + break; + case 'inwx': + $validation->dns_service = 'dns_inwx'; + $validation->dns_inwx_user = (string)$validation->dns_lexicon_user; + $validation->dns_inwx_password = (string)$validation->dns_lexicon_token; + break; + case 'linode': + $validation->dns_service = 'dns_linode'; + $validation->dns_linode_key = (string)$validation->dns_lexicon_token; + break; + case 'linode4': + $validation->dns_service = 'dns_linode_v4'; + $validation->dns_linode_v4_key = (string)$validation->dns_lexicon_token; + break; + case 'luadns': + $validation->dns_service = 'dns_lua'; + $validation->dns_lua_email = (string)$validation->dns_lexicon_user; + $validation->dns_lua_key = (string)$validation->dns_lexicon_token; + break; + case 'namecheap': + $validation->dns_service = 'dns_namecheap'; + $validation->dns_namecheap_user = (string)$validation->dns_lexicon_user; + $validation->dns_namecheap_api = (string)$validation->dns_lexicon_token; + break; + case 'namesilo': + $validation->dns_service = 'dns_namesilo'; + $validation->dns_namesilo_key = (string)$validation->dns_lexicon_token; + break; + case 'netcup': + $validation->dns_service = 'dns_netcup'; + $validation->dns_netcup_key = (string)$validation->dns_lexicon_user; + $validation->dns_netcup_pw = (string)$validation->dns_lexicon_token; + break; + case 'nfsn': + $validation->dns_service = 'dns_njalla'; + $validation->dns_njalla_token = (string)$validation->dns_lexicon_token; + break; + case 'nsone': + $validation->dns_service = 'dns_nsone'; + $validation->dns_nsone_key = (string)$validation->dns_lexicon_token; + break; + case 'online': + $validation->dns_service = 'dns_online'; + $validation->dns_online_key = (string)$validation->dns_lexicon_token; + break; + case 'ovh': + $validation->dns_service = 'dns_ovh'; + $validation->dns_ovh_app_key = (string)$validation->dns_lexicon_user; + $validation->dns_ovh_app_secret = (string)$validation->dns_lexicon_token; + break; + case 'plesk': + $validation->dns_service = 'dns_pleskxml'; + $validation->dns_pleskxml_user = (string)$validation->dns_lexicon_user; + $validation->dns_pleskxml_pass = (string)$validation->dns_lexicon_token; + break; + case 'pointhq': + $validation->dns_service = 'dns_pointhq'; + $validation->dns_pointhq_email = (string)$validation->dns_lexicon_user; + $validation->dns_pointhq_key = (string)$validation->dns_lexicon_token; + break; + case 'powerdns': + $validation->dns_service = 'dns_pdns'; + $validation->dns_pdns_serverid = (string)$validation->dns_lexicon_user; + $validation->dns_pdns_token = (string)$validation->dns_lexicon_token; + break; + case 'rackspace': + $validation->dns_service = 'dns_rackspace'; + $validation->dns_rackspace_user = (string)$validation->dns_lexicon_user; + $validation->dns_rackspace_key = (string)$validation->dns_lexicon_token; + break; + case 'rage4': + $validation->dns_service = 'dns_rage4'; + $validation->dns_rage4_user = (string)$validation->dns_lexicon_user; + $validation->dns_rage4_token = (string)$validation->dns_lexicon_token; + break; + case 'route53': + $validation->dns_service = 'dns_aws'; + $validation->dns_aws_id = (string)$validation->dns_lexicon_user; + $validation->dns_aws_secret = (string)$validation->dns_lexicon_token; + break; + case 'transip': + $validation->dns_service = 'dns_transip'; + $validation->dns_transip_username = (string)$validation->dns_lexicon_user; + $validation->dns_transip_key = (string)$validation->dns_lexicon_token; + break; + case 'vultr': + $validation->dns_service = 'dns_vultr'; + $validation->dns_vultr_key = (string)$validation->dns_lexicon_token; + break; + case 'yandex': + $validation->dns_service = 'dns_yandex'; + $validation->dns_yandex_token = (string)$validation->dns_lexicon_token; + break; + case 'zeit': + // URL points to zilore, so we'll use this DNS API as a replacement. + $validation->dns_service = 'dns_zilore'; + $validation->dns_zilore_key = (string)$validation->dns_lexicon_token; + break; + case 'zilore': + $validation->dns_service = 'dns_zilore'; + $validation->dns_zilore_key = (string)$validation->dns_lexicon_token; + break; + case 'zonomi': + $validation->dns_service = 'dns_zonomi'; + // FIXME: parameter prefix should match $dns_service + $validation->dns_zm_key = (string)$validation->dns_lexicon_token; + break; + } + } + } + } +}