From b94aefde74334951abead644de49fb2fffaf246f Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 21 Oct 2022 15:21:47 +0200
Subject: [PATCH] security/acme-client: migrate to NAME_setup use, closes #3113

refs https://github.com/opnsense/core/issues/5917
---
 .../OPNsense/AcmeClient/Api/ServiceController.php |  7 -------
 .../opnsense/scripts/OPNsense/AcmeClient/setup.sh |  4 ++--
 .../conf/actions.d/actions_acmeclient.conf        | 15 +++++----------
 3 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
index de54eeeea..0e1a34a23 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ServiceController.php
@@ -149,9 +149,6 @@ class ServiceController extends ApiControllerBase
             // generate template
             $backend->configdRun('template reload OPNsense/AcmeClient');
 
-            // now setup the environment
-            $backend->configdRun("acmeclient setup");
-
             // (res)start daemon
             if ($mdlAcme->settings->enabled->__toString() == 1) {
                 if ($runStatus['status'] == "running" && !$force_restart) {
@@ -177,8 +174,6 @@ class ServiceController extends ApiControllerBase
         $backend = new Backend();
         // first generate template based on current configuration
         $backend->configdRun('template reload OPNsense/AcmeClient');
-        // now setup the environment
-        $backend->configdRun("acmeclient setup");
         // finally run the syntax check
         $response = $backend->configdRun("acmeclient configtest");
         return array("result" => $response);
@@ -192,8 +187,6 @@ class ServiceController extends ApiControllerBase
     public function signallcertsAction()
     {
         $backend = new Backend();
-        // first setup the environment
-        $backend->configdRun("acmeclient setup");
         // run the command
         $response = $backend->configdRun("acmeclient sign-all-certs");
         return array("result" => $response);
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
index 43140eea7..fd9b73425 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
@@ -3,7 +3,7 @@
 ACME_BASE="/var/etc/acme-client"
 ACME_DIRS="/var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/configs /var/etc/acme-client/challenges /var/etc/acme-client/home"
 
-# Generating dirs if missing and setting owner and mode (recursively)
+# Generate required directories and set owner/mode recursively.
 for directory in ${ACME_DIRS}; do
     mkdir -p ${directory}
     chown -R root:wheel ${directory}
@@ -16,7 +16,7 @@ if [ -L /var/etc/acme-client/home/dns_opnsense.sh ]; then
     unlink /var/etc/acme-client/home/dns_opnsense.sh
 fi
 
-# Setting owner and mode for base and immediate children (non recursive)
+# Set owner/mode for base and immediate children (non recursive).
 chown root:wheel ${ACME_BASE} ${ACME_BASE}/*
 chmod 750 ${ACME_BASE} ${ACME_BASE}/*
 
diff --git a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
index 4faf4b687..7c47bdf85 100644
--- a/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
+++ b/security/acme-client/src/opnsense/service/conf/actions.d/actions_acmeclient.conf
@@ -1,8 +1,3 @@
-[setup]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh
-parameters:
-type:script_output
-
 ##########################################
 ## lighttpd actions
 ##########################################
@@ -42,7 +37,7 @@ message:testing acme_http_challenge configuration
 ##########################################
 
 [sign-cert]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --force --cert
 parameters:%s
 type:script
 message:signing or renewing a certificate
@@ -66,25 +61,25 @@ type:script
 message:removing a certificate private key
 
 [sign-all-certs]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all
 parameters:
 type:script
 message:signing or renewing all certificates
 
 [run-automation]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode automation --cert
 parameters:%s
 type:script
 message:running automations for a certificate
 
 [import]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode import --cert
 parameters:%s
 type:script
 message:running import for a certificate
 
 [cron-auto-renew]
-command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
+command:/usr/sbin/daemon -f /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode issue --all --cron
 parameters:
 type:script
 message:cronjob running to sign or renew certificates