#!/bin/bash
######系統配合
#下載ISO檔
#https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝
######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw
##設定Let’s encrypt Wildcard 萬用字元憑證安裝
ETH0=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')
IP=$(ifconfig $ETH0 |grep 'inet ' |awk '{print $2}')
DOMAINNAME=$(/bin/hostname -d)
DATE=$(date "+%Y%m%d%H")
sync
apt -y install certbot python3-certbot-apache
sync
systemctl disable certbot.timer
#apt -y install python3-certbot-nginx
#systemctl disable nginx.service
#cp -arf /etc/bind/$DOMAINNAME /etc/bind/$DOMAINNAME-$DATE
#cat >> /etc/bind/$DOMAINNAME << EOF
#_acme-challenge.$DOMAINNAME.     IN      TXT     "prAFv32S1laeMVqE4rwZJ_OZpQzAOwtSZyct6uMeDpw"
#EOF

service apache2 stop
certbot certonly --standalone --agree-tos --manual-public-ip-logging-ok --register-unsafely-without-email --preferred-challenges http -d $DOMAINNAME -d dns.$DOMAINNAME -d www.$DOMAINNAME -d ftp.$DOMAINNAME -d mrtg.$DOMAINNAME -d postfix.$DOMAINNAME -d bandwidthd.$DOMAINNAME -d webmail.$DOMAINNAME

#certbot certonly --manual --agree-tos --manual-public-ip-logging-ok --register-unsafely-without-email --preferred-challenges dns -d *.$DOMAINNAME
#service apache2 stop
#certbot certonly --apache --agree-tos --manual-public-ip-logging-ok --register-unsafely-without-email --manual-auth-hook http -d $DOMAINNAME
#certbot certonly --manual --agree-tos --manual-public-ip-logging-ok --register-unsafely-without-email --preferred-challenges dns -d *.$DOMAINNAME

cp -arf /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf-$DATE
cat >> /etc/apache2/sites-available/default-ssl.conf << EOF
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4
SSLHonorCipherOrder on
SSLProtocol all -SSLv3
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
SSLCertificateFile /etc/letsencrypt/live/$DOMAINNAME/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAINNAME/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/$DOMAINNAME/chain.pem
EOF

a2enmod headers
systemctl restart named.service

####Cockpit SSL
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/cockpit/ws-certs.d/1-letsencrypt.cert
install -m 640 -g cockpit-ws /etc/letsencrypt/live/$DOMAINNAME/privkey.pem /etc/cockpit/ws-certs.d/1-letsencrypt.key
#cat /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/letsencrypt/live/$DOMAINNAME/privkey.pem > /etc/cockpit/ws-certs.d/$DOMAINNAME.cert
#chown root:cockpit-ws /etc/cockpit/ws-certs.d/$DOMAINNAME.cert

####Webmin SSL
cat /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/letsencrypt/live/$DOMAINNAME/privkey.pem > /etc/webmin/miniserv.pem

####OXOOL SSL
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/cert.pem /etc/oxool/cert.pem
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/privkey.pem /etc/oxool/key.pem
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/chain.pem /etc/oxool/ca-chain.cert.pem

cat > /etc/cron.daily/UpdateSSL << EOF
#!/bin/bash
/usr/bin/systemctl stop apache2.service
/usr/bin/certbot renew --quiet >> /var/log/letsencrypt/letsencrypt.log
/usr/bin/systemctl reload apache2.service  >> /var/log/letsencrypt-auto.log

####Cockpit SSL
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/cockpit/ws-certs.d/1-letsencrypt.cert
install -m 640 -g cockpit-ws /etc/letsencrypt/live/$DOMAINNAME/privkey.pem /etc/cockpit/ws-certs.d/1-letsencrypt.key
#cat /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/letsencrypt/live/$DOMAINNAME/privkey.pem > /etc/cockpit/ws-certs.d/$DOMAINNAME.cert
#chown root:cockpit-ws /etc/cockpit/ws-certs.d/$DOMAINNAME.cert

####Webmin SSL
cat /etc/letsencrypt/live/$DOMAINNAME/fullchain.pem /etc/letsencrypt/live/$DOMAINNAME/privkey.pem > /etc/webmin/miniserv.pem

####OXOOL SSL
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/cert.pem /etc/oxool/cert.pem
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/privkey.pem /etc/oxool/key.pem
install -m 644 /etc/letsencrypt/live/$DOMAINNAME/chain.pem /etc/oxool/ca-chain.cert.pem

/usr/bin/systemctl restart apache2.service
/usr/bin/systemctl restart cockpit.service 
/usr/bin/systemctl restart webmin.service
EOF
chmod +x /etc/cron.daily/UpdateSSL
sync;sync;reboot