├── .coveragerc ├── .flake8 ├── .github └── workflows │ └── test.yml ├── .gitignore ├── .isort.cfg ├── Dockerfile ├── LICENSE ├── Pipfile ├── Pipfile.lock ├── README.md ├── acmeproxy ├── __init__.py ├── acmeproxy │ ├── __init__.py │ ├── settings.py │ ├── urls.py │ └── wsgi.py ├── manage.py └── proxy │ ├── __init__.py │ ├── admin.py │ ├── management │ ├── __init__.py │ └── commands │ │ ├── __init__.py │ │ ├── deleteauthorisation.py │ │ ├── listauthorisations.py │ │ ├── listresponses.py │ │ └── pipeapi.py │ ├── migrations │ ├── 0001_initial.py │ ├── 0002_auto_20160930_1457.py │ ├── 0003_auto_20161004_1402.py │ ├── 0004_auto_20161004_1514.py │ ├── 0005_auto_20161005_1215.py │ ├── 0006_auto_20161005_1339.py │ ├── 0007_response_expired_at.py │ ├── 0008_auto_20161010_1645.py │ ├── 0009_auto_20200611_0403.py │ └── __init__.py │ ├── models.py │ ├── tests │ ├── __init__.py │ ├── test_commands.py │ ├── test_views.py │ └── util.py │ ├── urls.py │ └── views.py ├── docker-compose.yml ├── docker-support ├── dev-init.sh ├── dev_settings.py └── pipfile-to-requirements.py ├── example_settings.py ├── plugins ├── acmeproxy-certbot.py ├── acmeproxy-dehydrated-multiple-domains.sh └── acmeproxy-dehydrated.sh ├── pyproject.toml ├── pytest.ini └── setup.py /.coveragerc: -------------------------------------------------------------------------------- 1 | [run] 2 | branch = True 3 | context = ${CI_JOB_NAME-local} 4 | data_file = .coverage/.coverage.${CI_JOB_NAME-local}.${CI_JOB_ID-run} 5 | parallel = True 6 | 7 | plugins = 8 | django_coverage_plugin 9 | 10 | omit = 11 | # omit anything in a .local directory anywhere 12 | */.local/* 13 | # omit everything in /usr 14 | /usr/* 15 | 16 | [report] 17 | precision = 2 18 | -------------------------------------------------------------------------------- /.flake8: -------------------------------------------------------------------------------- 1 | [flake8] 2 | max-complexity = 18 3 | 4 | ignore = E203, E266, E501, W503, E722 5 | # select = B,C,E,F,W,T4,B9 6 | 7 | exclude = 8 | migrations 9 | -------------------------------------------------------------------------------- /.github/workflows/test.yml: -------------------------------------------------------------------------------- 1 | name: Lint & Test 2 | 3 | on: 4 | - push 5 | - pull_request 6 | 7 | jobs: 8 | test: 9 | 10 | runs-on: ubuntu-18.04 11 | 12 | steps: 13 | - uses: actions/checkout@v2 14 | - name: Set up Python 3.6 15 | uses: actions/setup-python@v1 16 | with: 17 | python-version: 3.6 18 | - name: Install dependencies 19 | run: | 20 | pip install pipenv 21 | pipenv sync --dev 22 | - name: Test with pytest 23 | env: 24 | DJANGO_SETTINGS_MODULE: acmeproxy_settings 25 | run: | 26 | cp docker-support/dev_settings.py acmeproxy_settings.py 27 | pipenv run pytest -v 28 | lint: 29 | 30 | runs-on: ubuntu-18.04 31 | 32 | steps: 33 | - uses: actions/checkout@v2 34 | - name: Install linters 35 | run: | 36 | pip3 install setuptools 37 | pip3 install flake8 black isort 38 | - name: Lint with flake8 39 | run: | 40 | python3 -m flake8 . 41 | - name: Lint with isort 42 | run: | 43 | python3 -m isort --check-only -rc . 44 | - name: Lint with black 45 | run: | 46 | python3 -m black --check --diff . 47 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Django 2 | db.sqlite3 3 | 4 | # Byte-compiled / optimized / DLL files 5 | __pycache__/ 6 | *.py[cod] 7 | *$py.class 8 | 9 | # C extensions 10 | *.so 11 | 12 | # Distribution / packaging 13 | .Python 14 | env/ 15 | build/ 16 | develop-eggs/ 17 | dist/ 18 | downloads/ 19 | eggs/ 20 | .eggs/ 21 | lib/ 22 | lib64/ 23 | parts/ 24 | sdist/ 25 | var/ 26 | *.egg-info/ 27 | .installed.cfg 28 | *.egg 29 | 30 | # PyInstaller 31 | # Usually these files are written by a python script from a template 32 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 33 | *.manifest 34 | *.spec 35 | 36 | # Installer logs 37 | pip-log.txt 38 | pip-delete-this-directory.txt 39 | 40 | # Unit test / coverage reports 41 | htmlcov/ 42 | .tox/ 43 | .coverage 44 | .coverage.* 45 | .cache 46 | nosetests.xml 47 | coverage.xml 48 | *,cover 49 | .hypothesis/ 50 | 51 | # Translations 52 | *.mo 53 | *.pot 54 | 55 | # Django stuff: 56 | *.log 57 | local_settings.py 58 | 59 | # Flask stuff: 60 | instance/ 61 | .webassets-cache 62 | 63 | # Scrapy stuff: 64 | .scrapy 65 | 66 | # Sphinx documentation 67 | docs/_build/ 68 | 69 | # PyBuilder 70 | target/ 71 | 72 | # IPython Notebook 73 | .ipynb_checkpoints 74 | 75 | # pyenv 76 | .python-version 77 | 78 | # celery beat schedule file 79 | celerybeat-schedule 80 | 81 | # dotenv 82 | .env 83 | 84 | # virtualenv 85 | venv/ 86 | ENV/ 87 | 88 | # Spyder project settings 89 | .spyderproject 90 | 91 | # Rope project settings 92 | .ropeproject 93 | 94 | .vscode/ 95 | -------------------------------------------------------------------------------- /.isort.cfg: -------------------------------------------------------------------------------- 1 | 2 | [settings] 3 | multi_line_output=3 4 | include_trailing_comma=true 5 | force_grid_wrap=0 6 | use_parentheses=true 7 | line_length=88 8 | skip=migrations 9 | default_section=THIRDPARTY 10 | known_first_party=acmeproxy 11 | no_lines_before=LOCALFOLDER 12 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM buildpack-deps:bionic 2 | 3 | # Install the build dependencies and prime the cache 4 | RUN set -ex \ 5 | && apt-get update \ 6 | && apt-get install --no-install-recommends --no-install-suggests --quiet --yes --verbose-versions \ 7 | build-essential \ 8 | gettext \ 9 | python3 \ 10 | python3-dev \ 11 | python3-pip \ 12 | python3-setuptools \ 13 | python3-venv \ 14 | python3-wheel \ 15 | && rm -rf /var/lib/apt/lists/ \ 16 | && apt-get autoremove --purge --quiet --yes \ 17 | && apt-get purge --quiet --yes \ 18 | && apt-get clean \ 19 | && pip3 install --upgrade \ 20 | pip \ 21 | setuptools \ 22 | dumb-init \ 23 | wheel \ 24 | && rm -rf /root/.cache/pip 25 | 26 | RUN set -ex \ 27 | && python3 -m venv /venv \ 28 | && /venv/bin/pip install --upgrade \ 29 | pip \ 30 | pipenv \ 31 | setuptools \ 32 | wheel 33 | 34 | COPY Pipfile.lock ./docker-support/pipfile-to-requirements.py / 35 | RUN set -ex \ 36 | && python3 /pipfile-to-requirements.py /Pipfile.lock > /tmp/requirements.txt \ 37 | && pip3 download --dest=/tmp --requirement /tmp/requirements.txt \ 38 | && rm -rf /tmp /pipfile-to-requirements.py /Pipfile.lock 39 | 40 | COPY ./ /code/ 41 | 42 | WORKDIR /code 43 | 44 | ENV VIRTUAL_ENV=/venv \ 45 | PATH=/venv/bin:$PATH \ 46 | PYTHONUNBUFFERED=1 \ 47 | PYTHONWARNINGS=always \ 48 | LC_ALL=C.UTF-8 \ 49 | LANG=C.UTF-8 50 | 51 | RUN set -ex \ 52 | && cd /code \ 53 | && PYTHONWARNINGS= pip install --exists-action=w \ 54 | -e . \ 55 | && PYTHONWARNINGS= pipenv sync --dev \ 56 | && ln -s /acmeproxy_settings.py "$(python -c 'from distutils.sysconfig import get_python_lib; print(get_python_lib())')/acmeproxy_settings.py" 57 | 58 | ENTRYPOINT ["/usr/local/bin/dumb-init"] 59 | 60 | ENV DJANGO_SETTINGS_MODULE acmeproxy_settings 61 | EXPOSE 8080 62 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | {one line to give the program's name and a brief idea of what it does.} 635 | Copyright (C) {year} {name of author} 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | {project} Copyright (C) {year} {fullname} 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | name = "pypi" 3 | url = "https://pypi.org/simple" 4 | verify_ssl = true 5 | 6 | [packages] 7 | acmeproxy = {editable = true,path = "."} 8 | 9 | [dev-packages] 10 | black = "==19.10b0" 11 | flake8 = "~=3.8.2" 12 | isort = "~=4.3.21" 13 | pytest = "~=5.4.3" 14 | pytest-cov = "~=2.10.0" 15 | pytest-django = "~=3.9.0" 16 | django-coverage-plugin = "~=1.8.0" 17 | 18 | [requires] 19 | python_version = "3.6" 20 | -------------------------------------------------------------------------------- /Pipfile.lock: -------------------------------------------------------------------------------- 1 | { 2 | "_meta": { 3 | "hash": { 4 | "sha256": "41e209662c9124c730f1b71404db3f98943c72d25199a6f222d29659ffbaa155" 5 | }, 6 | "pipfile-spec": 6, 7 | "requires": { 8 | "python_version": "3.6" 9 | }, 10 | "sources": [ 11 | { 12 | "name": "pypi", 13 | "url": "https://pypi.org/simple", 14 | "verify_ssl": true 15 | } 16 | ] 17 | }, 18 | "default": { 19 | "acmeproxy": { 20 | "editable": true, 21 | "path": "." 22 | }, 23 | "django": { 24 | "hashes": [ 25 | "sha256:30c235dec87e05667597e339f194c9fed6c855bda637266ceee891bf9093da43", 26 | "sha256:e319a7164d6d30cb177b3fd74d02c52f1185c37304057bb76d74047889c605d9" 27 | ], 28 | "markers": "python_version >= '3.5'", 29 | "version": "==2.2.19" 30 | }, 31 | "djangorestframework": { 32 | "hashes": [ 33 | "sha256:5cc724dc4b076463497837269107e1995b1fbc917468d1b92d188fd1af9ea789", 34 | "sha256:a5967b68a04e0d97d10f4df228e30f5a2d82ba63b9d03e1759f84993b7bf1b53" 35 | ], 36 | "markers": "python_version >= '3.5'", 37 | "version": "==3.11.2" 38 | }, 39 | "pytz": { 40 | "hashes": [ 41 | "sha256:83a4a90894bf38e243cf052c8b58f381bfe9a7a483f6a9cab140bc7f702ac4da", 42 | "sha256:eb10ce3e7736052ed3623d49975ce333bcd712c7bb19a58b9e2089d4057d0798" 43 | ], 44 | "version": "==2021.1" 45 | }, 46 | "sqlparse": { 47 | "hashes": [ 48 | "sha256:017cde379adbd6a1f15a61873f43e8274179378e95ef3fede90b5aa64d304ed0", 49 | "sha256:0f91fd2e829c44362cbcfab3e9ae12e22badaa8a29ad5ff599f9ec109f0454e8" 50 | ], 51 | "markers": "python_version >= '3.5'", 52 | "version": "==0.4.1" 53 | }, 54 | "tabulate": { 55 | "hashes": [ 56 | "sha256:d7c013fe7abbc5e491394e10fa845f8f32fe54f8dc60c6622c6cf482d25d47e4", 57 | "sha256:eb1d13f25760052e8931f2ef80aaf6045a6cceb47514db8beab24cded16f13a7" 58 | ], 59 | "version": "==0.8.9" 60 | } 61 | }, 62 | "develop": { 63 | "appdirs": { 64 | "hashes": [ 65 | "sha256:7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41", 66 | "sha256:a841dacd6b99318a741b166adb07e19ee71a274450e68237b4650ca1055ab128" 67 | ], 68 | "version": "==1.4.4" 69 | }, 70 | "attrs": { 71 | "hashes": [ 72 | "sha256:31b2eced602aa8423c2aea9c76a724617ed67cf9513173fd3a4f03e3a929c7e6", 73 | "sha256:832aa3cde19744e49938b91fea06d69ecb9e649c93ba974535d08ad92164f700" 74 | ], 75 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 76 | "version": "==20.3.0" 77 | }, 78 | "black": { 79 | "hashes": [ 80 | "sha256:1b30e59be925fafc1ee4565e5e08abef6b03fe455102883820fe5ee2e4734e0b", 81 | "sha256:c2edb73a08e9e0e6f65a0e6af18b059b8b1cdd5bef997d7a0b181df93dc81539" 82 | ], 83 | "index": "pypi", 84 | "version": "==19.10b0" 85 | }, 86 | "click": { 87 | "hashes": [ 88 | "sha256:d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a", 89 | "sha256:dacca89f4bfadd5de3d7489b7c8a566eee0d3676333fbb50030263894c38c0dc" 90 | ], 91 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'", 92 | "version": "==7.1.2" 93 | }, 94 | "coverage": { 95 | "hashes": [ 96 | "sha256:004d1880bed2d97151facef49f08e255a20ceb6f9432df75f4eef018fdd5a78c", 97 | "sha256:01d84219b5cdbfc8122223b39a954820929497a1cb1422824bb86b07b74594b6", 98 | "sha256:040af6c32813fa3eae5305d53f18875bedd079960822ef8ec067a66dd8afcd45", 99 | "sha256:06191eb60f8d8a5bc046f3799f8a07a2d7aefb9504b0209aff0b47298333302a", 100 | "sha256:13034c4409db851670bc9acd836243aeee299949bd5673e11844befcb0149f03", 101 | "sha256:13c4ee887eca0f4c5a247b75398d4114c37882658300e153113dafb1d76de529", 102 | "sha256:184a47bbe0aa6400ed2d41d8e9ed868b8205046518c52464fde713ea06e3a74a", 103 | "sha256:18ba8bbede96a2c3dde7b868de9dcbd55670690af0988713f0603f037848418a", 104 | "sha256:1aa846f56c3d49205c952d8318e76ccc2ae23303351d9270ab220004c580cfe2", 105 | "sha256:217658ec7187497e3f3ebd901afdca1af062b42cfe3e0dafea4cced3983739f6", 106 | "sha256:24d4a7de75446be83244eabbff746d66b9240ae020ced65d060815fac3423759", 107 | "sha256:2910f4d36a6a9b4214bb7038d537f015346f413a975d57ca6b43bf23d6563b53", 108 | "sha256:2949cad1c5208b8298d5686d5a85b66aae46d73eec2c3e08c817dd3513e5848a", 109 | "sha256:2a3859cb82dcbda1cfd3e6f71c27081d18aa251d20a17d87d26d4cd216fb0af4", 110 | "sha256:2cafbbb3af0733db200c9b5f798d18953b1a304d3f86a938367de1567f4b5bff", 111 | "sha256:2e0d881ad471768bf6e6c2bf905d183543f10098e3b3640fc029509530091502", 112 | "sha256:30c77c1dc9f253283e34c27935fded5015f7d1abe83bc7821680ac444eaf7793", 113 | "sha256:3487286bc29a5aa4b93a072e9592f22254291ce96a9fbc5251f566b6b7343cdb", 114 | "sha256:372da284cfd642d8e08ef606917846fa2ee350f64994bebfbd3afb0040436905", 115 | "sha256:41179b8a845742d1eb60449bdb2992196e211341818565abded11cfa90efb821", 116 | "sha256:44d654437b8ddd9eee7d1eaee28b7219bec228520ff809af170488fd2fed3e2b", 117 | "sha256:4a7697d8cb0f27399b0e393c0b90f0f1e40c82023ea4d45d22bce7032a5d7b81", 118 | "sha256:51cb9476a3987c8967ebab3f0fe144819781fca264f57f89760037a2ea191cb0", 119 | "sha256:52596d3d0e8bdf3af43db3e9ba8dcdaac724ba7b5ca3f6358529d56f7a166f8b", 120 | "sha256:53194af30d5bad77fcba80e23a1441c71abfb3e01192034f8246e0d8f99528f3", 121 | "sha256:5fec2d43a2cc6965edc0bb9e83e1e4b557f76f843a77a2496cbe719583ce8184", 122 | "sha256:6c90e11318f0d3c436a42409f2749ee1a115cd8b067d7f14c148f1ce5574d701", 123 | "sha256:74d881fc777ebb11c63736622b60cb9e4aee5cace591ce274fb69e582a12a61a", 124 | "sha256:7501140f755b725495941b43347ba8a2777407fc7f250d4f5a7d2a1050ba8e82", 125 | "sha256:796c9c3c79747146ebd278dbe1e5c5c05dd6b10cc3bcb8389dfdf844f3ead638", 126 | "sha256:869a64f53488f40fa5b5b9dcb9e9b2962a66a87dab37790f3fcfb5144b996ef5", 127 | "sha256:8963a499849a1fc54b35b1c9f162f4108017b2e6db2c46c1bed93a72262ed083", 128 | "sha256:8d0a0725ad7c1a0bcd8d1b437e191107d457e2ec1084b9f190630a4fb1af78e6", 129 | "sha256:900fbf7759501bc7807fd6638c947d7a831fc9fdf742dc10f02956ff7220fa90", 130 | "sha256:92b017ce34b68a7d67bd6d117e6d443a9bf63a2ecf8567bb3d8c6c7bc5014465", 131 | "sha256:970284a88b99673ccb2e4e334cfb38a10aab7cd44f7457564d11898a74b62d0a", 132 | "sha256:972c85d205b51e30e59525694670de6a8a89691186012535f9d7dbaa230e42c3", 133 | "sha256:9a1ef3b66e38ef8618ce5fdc7bea3d9f45f3624e2a66295eea5e57966c85909e", 134 | "sha256:af0e781009aaf59e25c5a678122391cb0f345ac0ec272c7961dc5455e1c40066", 135 | "sha256:b6d534e4b2ab35c9f93f46229363e17f63c53ad01330df9f2d6bd1187e5eaacf", 136 | "sha256:b7895207b4c843c76a25ab8c1e866261bcfe27bfaa20c192de5190121770672b", 137 | "sha256:c0891a6a97b09c1f3e073a890514d5012eb256845c451bd48f7968ef939bf4ae", 138 | "sha256:c2723d347ab06e7ddad1a58b2a821218239249a9e4365eaff6649d31180c1669", 139 | "sha256:d1f8bf7b90ba55699b3a5e44930e93ff0189aa27186e96071fac7dd0d06a1873", 140 | "sha256:d1f9ce122f83b2305592c11d64f181b87153fc2c2bbd3bb4a3dde8303cfb1a6b", 141 | "sha256:d314ed732c25d29775e84a960c3c60808b682c08d86602ec2c3008e1202e3bb6", 142 | "sha256:d636598c8305e1f90b439dbf4f66437de4a5e3c31fdf47ad29542478c8508bbb", 143 | "sha256:deee1077aae10d8fa88cb02c845cfba9b62c55e1183f52f6ae6a2df6a2187160", 144 | "sha256:ebe78fe9a0e874362175b02371bdfbee64d8edc42a044253ddf4ee7d3c15212c", 145 | "sha256:f030f8873312a16414c0d8e1a1ddff2d3235655a2174e3648b4fa66b3f2f1079", 146 | "sha256:f0b278ce10936db1a37e6954e15a3730bea96a0997c26d7fee88e6c396c2086d", 147 | "sha256:f11642dddbb0253cc8853254301b51390ba0081750a8ac03f20ea8103f0c56b6" 148 | ], 149 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4' and python_version < '4'", 150 | "version": "==5.5" 151 | }, 152 | "django-coverage-plugin": { 153 | "hashes": [ 154 | "sha256:d53cbf3828fd83d6b89ff7292c6805de5274e36411711692043e67bcde25ae0c" 155 | ], 156 | "index": "pypi", 157 | "version": "==1.8.0" 158 | }, 159 | "flake8": { 160 | "hashes": [ 161 | "sha256:749dbbd6bfd0cf1318af27bf97a14e28e5ff548ef8e5b1566ccfb25a11e7c839", 162 | "sha256:aadae8761ec651813c24be05c6f7b4680857ef6afaae4651a4eccaef97ce6c3b" 163 | ], 164 | "index": "pypi", 165 | "version": "==3.8.4" 166 | }, 167 | "importlib-metadata": { 168 | "hashes": [ 169 | "sha256:742add720a20d0467df2f444ae41704000f50e1234f46174b51f9c6031a1bd71", 170 | "sha256:b74159469b464a99cb8cc3e21973e4d96e05d3024d337313fedb618a6e86e6f4" 171 | ], 172 | "markers": "python_version < '3.8'", 173 | "version": "==3.7.3" 174 | }, 175 | "isort": { 176 | "hashes": [ 177 | "sha256:54da7e92468955c4fceacd0c86bd0ec997b0e1ee80d97f67c35a78b719dccab1", 178 | "sha256:6e811fcb295968434526407adb8796944f1988c5b65e8139058f2014cbe100fd" 179 | ], 180 | "index": "pypi", 181 | "version": "==4.3.21" 182 | }, 183 | "mccabe": { 184 | "hashes": [ 185 | "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42", 186 | "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f" 187 | ], 188 | "version": "==0.6.1" 189 | }, 190 | "more-itertools": { 191 | "hashes": [ 192 | "sha256:5652a9ac72209ed7df8d9c15daf4e1aa0e3d2ccd3c87f8265a0673cd9cbc9ced", 193 | "sha256:c5d6da9ca3ff65220c3bfd2a8db06d698f05d4d2b9be57e1deb2be5a45019713" 194 | ], 195 | "markers": "python_version >= '3.5'", 196 | "version": "==8.7.0" 197 | }, 198 | "packaging": { 199 | "hashes": [ 200 | "sha256:5b327ac1320dc863dca72f4514ecc086f31186744b84a230374cc1fd776feae5", 201 | "sha256:67714da7f7bc052e064859c05c595155bd1ee9f69f76557e21f051443c20947a" 202 | ], 203 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 204 | "version": "==20.9" 205 | }, 206 | "pathspec": { 207 | "hashes": [ 208 | "sha256:86379d6b86d75816baba717e64b1a3a3469deb93bb76d613c9ce79edc5cb68fd", 209 | "sha256:aa0cb481c4041bf52ffa7b0d8fa6cd3e88a2ca4879c533c9153882ee2556790d" 210 | ], 211 | "version": "==0.8.1" 212 | }, 213 | "pluggy": { 214 | "hashes": [ 215 | "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0", 216 | "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d" 217 | ], 218 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 219 | "version": "==0.13.1" 220 | }, 221 | "py": { 222 | "hashes": [ 223 | "sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3", 224 | "sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a" 225 | ], 226 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 227 | "version": "==1.10.0" 228 | }, 229 | "pycodestyle": { 230 | "hashes": [ 231 | "sha256:2295e7b2f6b5bd100585ebcb1f616591b652db8a741695b3d8f5d28bdc934367", 232 | "sha256:c58a7d2815e0e8d7972bf1803331fb0152f867bd89adf8a01dfd55085434192e" 233 | ], 234 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 235 | "version": "==2.6.0" 236 | }, 237 | "pyflakes": { 238 | "hashes": [ 239 | "sha256:0d94e0e05a19e57a99444b6ddcf9a6eb2e5c68d3ca1e98e90707af8152c90a92", 240 | "sha256:35b2d75ee967ea93b55750aa9edbbf72813e06a66ba54438df2cfac9e3c27fc8" 241 | ], 242 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 243 | "version": "==2.2.0" 244 | }, 245 | "pyparsing": { 246 | "hashes": [ 247 | "sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1", 248 | "sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b" 249 | ], 250 | "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'", 251 | "version": "==2.4.7" 252 | }, 253 | "pytest": { 254 | "hashes": [ 255 | "sha256:5c0db86b698e8f170ba4582a492248919255fcd4c79b1ee64ace34301fb589a1", 256 | "sha256:7979331bfcba207414f5e1263b5a0f8f521d0f457318836a7355531ed1a4c7d8" 257 | ], 258 | "index": "pypi", 259 | "version": "==5.4.3" 260 | }, 261 | "pytest-cov": { 262 | "hashes": [ 263 | "sha256:45ec2d5182f89a81fc3eb29e3d1ed3113b9e9a873bcddb2a71faaab066110191", 264 | "sha256:47bd0ce14056fdd79f93e1713f88fad7bdcc583dcd7783da86ef2f085a0bb88e" 265 | ], 266 | "index": "pypi", 267 | "version": "==2.10.1" 268 | }, 269 | "pytest-django": { 270 | "hashes": [ 271 | "sha256:64f99d565dd9497af412fcab2989fe40982c1282d4118ff422b407f3f7275ca5", 272 | "sha256:664e5f42242e5e182519388f01b9f25d824a9feb7cd17d8f863c8d776f38baf9" 273 | ], 274 | "index": "pypi", 275 | "version": "==3.9.0" 276 | }, 277 | "regex": { 278 | "hashes": [ 279 | "sha256:07ef35301b4484bce843831e7039a84e19d8d33b3f8b2f9aab86c376813d0139", 280 | "sha256:13f50969028e81765ed2a1c5fcfdc246c245cf8d47986d5172e82ab1a0c42ee5", 281 | "sha256:14de88eda0976020528efc92d0a1f8830e2fb0de2ae6005a6fc4e062553031fa", 282 | "sha256:159fac1a4731409c830d32913f13f68346d6b8e39650ed5d704a9ce2f9ef9cb3", 283 | "sha256:18e25e0afe1cf0f62781a150c1454b2113785401ba285c745acf10c8ca8917df", 284 | "sha256:201e2619a77b21a7780580ab7b5ce43835e242d3e20fef50f66a8df0542e437f", 285 | "sha256:360a01b5fa2ad35b3113ae0c07fb544ad180603fa3b1f074f52d98c1096fa15e", 286 | "sha256:39c44532d0e4f1639a89e52355b949573e1e2c5116106a395642cbbae0ff9bcd", 287 | "sha256:3d9356add82cff75413bec360c1eca3e58db4a9f5dafa1f19650958a81e3249d", 288 | "sha256:3d9a7e215e02bd7646a91fb8bcba30bc55fd42a719d6b35cf80e5bae31d9134e", 289 | "sha256:4651f839dbde0816798e698626af6a2469eee6d9964824bb5386091255a1694f", 290 | "sha256:486a5f8e11e1f5bbfcad87f7c7745eb14796642323e7e1829a331f87a713daaa", 291 | "sha256:4b8a1fb724904139149a43e172850f35aa6ea97fb0545244dc0b805e0154ed68", 292 | "sha256:4c0788010a93ace8a174d73e7c6c9d3e6e3b7ad99a453c8ee8c975ddd9965643", 293 | "sha256:4c2e364491406b7888c2ad4428245fc56c327e34a5dfe58fd40df272b3c3dab3", 294 | "sha256:575a832e09d237ae5fedb825a7a5bc6a116090dd57d6417d4f3b75121c73e3be", 295 | "sha256:5770a51180d85ea468234bc7987f5597803a4c3d7463e7323322fe4a1b181578", 296 | "sha256:633497504e2a485a70a3268d4fc403fe3063a50a50eed1039083e9471ad0101c", 297 | "sha256:63f3ca8451e5ff7133ffbec9eda641aeab2001be1a01878990f6c87e3c44b9d5", 298 | "sha256:709f65bb2fa9825f09892617d01246002097f8f9b6dde8d1bb4083cf554701ba", 299 | "sha256:808404898e9a765e4058bf3d7607d0629000e0a14a6782ccbb089296b76fa8fe", 300 | "sha256:882f53afe31ef0425b405a3f601c0009b44206ea7f55ee1c606aad3cc213a52c", 301 | "sha256:8bd4f91f3fb1c9b1380d6894bd5b4a519409135bec14c0c80151e58394a4e88a", 302 | "sha256:8e65e3e4c6feadf6770e2ad89ad3deb524bcb03d8dc679f381d0568c024e0deb", 303 | "sha256:976a54d44fd043d958a69b18705a910a8376196c6b6ee5f2596ffc11bff4420d", 304 | "sha256:a0d04128e005142260de3733591ddf476e4902c0c23c1af237d9acf3c96e1b38", 305 | "sha256:a0df9a0ad2aad49ea3c7f65edd2ffb3d5c59589b85992a6006354f6fb109bb18", 306 | "sha256:a2ee026f4156789df8644d23ef423e6194fad0bc53575534101bb1de5d67e8ce", 307 | "sha256:a59a2ee329b3de764b21495d78c92ab00b4ea79acef0f7ae8c1067f773570afa", 308 | "sha256:b97ec5d299c10d96617cc851b2e0f81ba5d9d6248413cd374ef7f3a8871ee4a6", 309 | "sha256:b98bc9db003f1079caf07b610377ed1ac2e2c11acc2bea4892e28cc5b509d8d5", 310 | "sha256:b9d8d286c53fe0cbc6d20bf3d583cabcd1499d89034524e3b94c93a5ab85ca90", 311 | "sha256:bcd945175c29a672f13fce13a11893556cd440e37c1b643d6eeab1988c8b209c", 312 | "sha256:c66221e947d7207457f8b6f42b12f613b09efa9669f65a587a2a71f6a0e4d106", 313 | "sha256:c782da0e45aff131f0bed6e66fbcfa589ff2862fc719b83a88640daa01a5aff7", 314 | "sha256:cb4ee827857a5ad9b8ae34d3c8cc51151cb4a3fe082c12ec20ec73e63cc7c6f0", 315 | "sha256:d47d359545b0ccad29d572ecd52c9da945de7cd6cf9c0cfcb0269f76d3555689", 316 | "sha256:dc9963aacb7da5177e40874585d7407c0f93fb9d7518ec58b86e562f633f36cd", 317 | "sha256:ea2f41445852c660ba7c3ebf7d70b3779b20d9ca8ba54485a17740db49f46932", 318 | "sha256:f5d0c921c99297354cecc5a416ee4280bd3f20fd81b9fb671ca6be71499c3fdf", 319 | "sha256:f85d6f41e34f6a2d1607e312820971872944f1661a73d33e1e82d35ea3305e14" 320 | ], 321 | "version": "==2021.3.17" 322 | }, 323 | "six": { 324 | "hashes": [ 325 | "sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259", 326 | "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced" 327 | ], 328 | "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'", 329 | "version": "==1.15.0" 330 | }, 331 | "toml": { 332 | "hashes": [ 333 | "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b", 334 | "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f" 335 | ], 336 | "markers": "python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'", 337 | "version": "==0.10.2" 338 | }, 339 | "typed-ast": { 340 | "hashes": [ 341 | "sha256:07d49388d5bf7e863f7fa2f124b1b1d89d8aa0e2f7812faff0a5658c01c59aa1", 342 | "sha256:14bf1522cdee369e8f5581238edac09150c765ec1cb33615855889cf33dcb92d", 343 | "sha256:240296b27397e4e37874abb1df2a608a92df85cf3e2a04d0d4d61055c8305ba6", 344 | "sha256:36d829b31ab67d6fcb30e185ec996e1f72b892255a745d3a82138c97d21ed1cd", 345 | "sha256:37f48d46d733d57cc70fd5f30572d11ab8ed92da6e6b28e024e4a3edfb456e37", 346 | "sha256:4c790331247081ea7c632a76d5b2a265e6d325ecd3179d06e9cf8d46d90dd151", 347 | "sha256:5dcfc2e264bd8a1db8b11a892bd1647154ce03eeba94b461effe68790d8b8e07", 348 | "sha256:7147e2a76c75f0f64c4319886e7639e490fee87c9d25cb1d4faef1d8cf83a440", 349 | "sha256:7703620125e4fb79b64aa52427ec192822e9f45d37d4b6625ab37ef403e1df70", 350 | "sha256:8368f83e93c7156ccd40e49a783a6a6850ca25b556c0fa0240ed0f659d2fe496", 351 | "sha256:84aa6223d71012c68d577c83f4e7db50d11d6b1399a9c779046d75e24bed74ea", 352 | "sha256:85f95aa97a35bdb2f2f7d10ec5bbdac0aeb9dafdaf88e17492da0504de2e6400", 353 | "sha256:8db0e856712f79c45956da0c9a40ca4246abc3485ae0d7ecc86a20f5e4c09abc", 354 | "sha256:9044ef2df88d7f33692ae3f18d3be63dec69c4fb1b5a4a9ac950f9b4ba571606", 355 | "sha256:963c80b583b0661918718b095e02303d8078950b26cc00b5e5ea9ababe0de1fc", 356 | "sha256:987f15737aba2ab5f3928c617ccf1ce412e2e321c77ab16ca5a293e7bbffd581", 357 | "sha256:9ec45db0c766f196ae629e509f059ff05fc3148f9ffd28f3cfe75d4afb485412", 358 | "sha256:9fc0b3cb5d1720e7141d103cf4819aea239f7d136acf9ee4a69b047b7986175a", 359 | "sha256:a2c927c49f2029291fbabd673d51a2180038f8cd5a5b2f290f78c4516be48be2", 360 | "sha256:a38878a223bdd37c9709d07cd357bb79f4c760b29210e14ad0fb395294583787", 361 | "sha256:b4fcdcfa302538f70929eb7b392f536a237cbe2ed9cba88e3bf5027b39f5f77f", 362 | "sha256:c0c74e5579af4b977c8b932f40a5464764b2f86681327410aa028a22d2f54937", 363 | "sha256:c1c876fd795b36126f773db9cbb393f19808edd2637e00fd6caba0e25f2c7b64", 364 | "sha256:c9aadc4924d4b5799112837b226160428524a9a45f830e0d0f184b19e4090487", 365 | "sha256:cc7b98bf58167b7f2db91a4327da24fb93368838eb84a44c472283778fc2446b", 366 | "sha256:cf54cfa843f297991b7388c281cb3855d911137223c6b6d2dd82a47ae5125a41", 367 | "sha256:d003156bb6a59cda9050e983441b7fa2487f7800d76bdc065566b7d728b4581a", 368 | "sha256:d175297e9533d8d37437abc14e8a83cbc68af93cc9c1c59c2c292ec59a0697a3", 369 | "sha256:d746a437cdbca200622385305aedd9aef68e8a645e385cc483bdc5e488f07166", 370 | "sha256:e683e409e5c45d5c9082dc1daf13f6374300806240719f95dc783d1fc942af10" 371 | ], 372 | "version": "==1.4.2" 373 | }, 374 | "typing-extensions": { 375 | "hashes": [ 376 | "sha256:7cb407020f00f7bfc3cb3e7881628838e69d8f3fcab2f64742a5e76b2f841918", 377 | "sha256:99d4073b617d30288f569d3f13d2bd7548c3a7e4c8de87db09a9d29bb3a4a60c", 378 | "sha256:dafc7639cde7f1b6e1acc0f457842a83e722ccca8eef5270af2d74792619a89f" 379 | ], 380 | "markers": "python_version < '3.8'", 381 | "version": "==3.7.4.3" 382 | }, 383 | "wcwidth": { 384 | "hashes": [ 385 | "sha256:beb4802a9cebb9144e99086eff703a642a13d6a0052920003a230f3294bbe784", 386 | "sha256:c4d647b99872929fdb7bdcaa4fbe7f01413ed3d98077df798530e5b04f116c83" 387 | ], 388 | "version": "==0.2.5" 389 | }, 390 | "zipp": { 391 | "hashes": [ 392 | "sha256:3607921face881ba3e026887d8150cca609d517579abe052ac81fc5aeffdbd76", 393 | "sha256:51cb66cc54621609dd593d1787f286ee42a5c0adbb4b29abea5a63edc3e03098" 394 | ], 395 | "markers": "python_version >= '3.6'", 396 | "version": "==3.4.1" 397 | } 398 | } 399 | } 400 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # acmeproxy 2 | 3 | This PowerDNS backend only serves [ACME dns-01 challenge responses](https://letsencrypt.org/docs/acme-protocol-updates/), and exposes an HTTPS API to permit those challenge responses to be published by automated certificate renewal tools. 4 | 5 | ## Dev environment 6 | 7 | You can start a dev environemnt with 8 | 9 | docker-compose up 10 | 11 | The app will now be available at http://localhost:8080 12 | 13 | ## Use with dehydrated or certbot 14 | 15 | Example plugins for [dehydrated](http://dehydrated.de/) and [certbot](https://certbot.eff.org/) are supplied in the `plugins` directory. Edit these plugin to specify the location of your acmeproxy installation and authorisation key registered with the API, then call them as a dns-01 hook. 16 | 17 | For instance, with dehydrated: 18 | 19 | dehydrated -c -t dns-01 -k ./acmeproxy-dehydrated.sh -d secure.example.com 20 | 21 | ## Deployment 22 | 23 | Install the app in a virtual environemnt with 24 | 25 | pip install . 26 | 27 | In a new directory make a copy of `example_settings.py` called `acmeproxy_settings.py`. Then fill in all the values. 28 | 29 | With your working directory set as the newly created directory you can now run the app as a wsgi app. With the environment variable `DJANGO_SETTINGS_MODULE` set to `acmeproxy_settings`. and the wsgi app at `acmeproxy.acmeproxy.wsgi:application`. 30 | 31 | ### Example Apache configuration when certbot is used for the API certificate 32 | 33 | 34 | ServerName acme-proxy-ns1.example.com 35 | DocumentRoot /var/www/html 36 | 37 | ErrorLog ${APACHE_LOG_DIR}/error.log 38 | CustomLog ${APACHE_LOG_DIR}/access.log combined 39 | 40 | ProxyPass / http://127.0.0.1:8000/ 41 | ProxyPassReverse / http://127.0.0.1:8000/ 42 | 43 | 44 | Require ip 127.0.0.1 45 | 46 | 47 | SSLCertificateFile /etc/letsencrypt/live/acme-proxy-ns1.example.com/fullchain.pem 48 | SSLCertificateKeyFile /etc/letsencrypt/live/acme-proxy-ns1.example.com/privkey.pem 49 | Include /etc/letsencrypt/options-ssl-apache.conf 50 | 51 | 52 | ### Example PowerDNS configuration 53 | 54 | In the directory with your settings file make a new file called `backend`. 55 | 56 | In it put 57 | 58 | #!/bin/sh 59 | export DJANGO_SETTINGS_MODULE=acmeproxy_settings 60 | /path/to/venv/django-admin pipeapi 61 | 62 | #### /etc/powerdns/pdns.conf 63 | 64 | config-dir=/etc/powerdns 65 | include-dir=/etc/powerdns/pdns.d 66 | setgid=pdns 67 | setuid=pdns 68 | 69 | #### /etc/powerdns/pdns.d/acmeproxy.conf 70 | 71 | launch=pipe 72 | pipe-command=/opt/acmeproxy/backend 73 | pipe-timeout=4000 74 | 75 | ## API documentation 76 | 77 | ### HTTPS API usage 78 | 79 | All API endpoints will return JSON containing a `result` key describing the result of the operation. If an operation fails this will be `false`, and the HTTP response code will indicate the nature of the failure. 80 | 81 | #### Authorisations 82 | 83 | Before delegating any names an **authorisation** should be requested using the `create_authorisation` endpoint. 84 | 85 | $ curl --data "name=secure.example.com" https://acme-proxy-ns1.example.com/create_authorisation 86 | {"result": {"secret": "52f562aedc99383c6af848bc7016380a", "authorisation": "secure.example.com", "suffix_match": false}} 87 | 88 | If authentication is enabled in your installation (with the `ACMEPROXY_AUTHORISATION_CREATION_SECRETS` setting configured to something other than `None`) you will also need to supply a `secret` field corresponding to the account being used. 89 | 90 | The randomly generated `secret` returned by this call is then used to identify this authorisation in further calls to the API. 91 | 92 | To re-generate the authentication secret for a given authorisation the `expire_authorisation` endpoint may be used. 93 | 94 | $ curl --data "name=secure.example.com&secret=52f562aedc99383c6af848bc7016380a" https://acme-proxy-ns1.example.com/expire_authorisation 95 | {"result": {"secret": "e04541b1d63bc68d296137bc2ee86923", "authorisation": "secure.example.com", "suffix_match": false}} 96 | 97 | #### Challenge responses 98 | 99 | During an ACME dns-01 challenge it is necessary to publish a **challenge response** string supplied by the ACME client. The `publish_response` endpoint allows a response to be published for a name that has been registered with an authorisation. 100 | 101 | $ curl --data "name=secure.example.com&response=evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA&secret=52f562aedc99383c6af848bc7016380a" https://acme-proxy-ns1.example.com/publish_response 102 | {"result": {"authorisation": "secure.example.com", "suffix_match": false, "published": true}} 103 | 104 | Optionally a client may request that all challenge responses for a name be expired once they are no longer required, however the backend will expire them regardless after five minutes. 105 | 106 | $ curl --data "name=secure.example.com&secret=52f562aedc99383c6af848bc7016380a" https://acme-proxy-ns1.example.com/expire_response 107 | {"result": {"authorisation": "secure.example.com", "suffix_match": false, "expired": true}} 108 | 109 | ### DNS usage 110 | 111 | Suppose you have a domain `example.com` and wish to issue certificates for `secure.example.com` without having an HTTP server running and without giving full control of the `example.com` zone to an ACME client. 112 | 113 | By registering an authorisation through the HTTPS API then adding a delegation for the expected challenge, `_acme-challenge.secure.example.com` it is possible to response to those challenges with data supplied using an HTTPS POST to the server. 114 | 115 | _acme-challenge.secure.example.com. IN NS acme-proxy-ns1.example.com 116 | 117 | It should also be possible to load this backend along side your existing backends, though that functionality is not yet fully tested. 118 | 119 | Once the delegation is made a response can be published using the `publish_response` endpoint of the HTTPS API during ACME certification issuance. 120 | 121 | ### Command line tools 122 | 123 | There are several Django management commands available in the `proxy` app. 124 | 125 | #### listauthorisations 126 | 127 | Lists all authorisations present in the database. 128 | 129 | $ python manage.py listauthorisations 130 | name created_by_ip created_at account 131 | --------------------- --------------- -------------------------------- --------- 132 | secure.example.com 192.0.2.1 2016-10-10 03:11:18.525111+00:00 operations 133 | test.example.org 192.0.2.1 2016-10-10 03:50:35.827334+00:00 test 134 | host1.example.com 192.0.2.1 2016-10-10 03:51:38.185688+00:00 operations 135 | 136 | #### deleteauthorisation 137 | 138 | Permanently remove an authorisation from the database. 139 | 140 | $ python manage.py deleteauthorisation test.example.org 141 | Successfully deleted authorisation "test.example.org" 142 | 143 | #### listresponses 144 | 145 | List the audit log of challenge responses that have been published, optionally between any two dates. 146 | 147 | $ python manage.py listresponses --start=2016-09-01 --end=2016-12-30 148 | name expired_at created_by_ip created_at 149 | ------------------- -------------------------------- --------------- -------------------------------- 150 | secure.example.com 2016-10-10 03:12:05.984890+00:00 192.0.2.1 2016-10-09 21:47:24.236299+00:00 151 | test.example.org 2016-10-10 03:12:05.984890+00:00 192.0.2.1 2016-10-10 03:12:04.833764+00:00 152 | 153 | A response will have an `expired_at` value if the ACME client explicitly marked all challenges for a name as complete. 154 | 155 | -------------------------------------------------------------------------------- /acmeproxy/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/__init__.py -------------------------------------------------------------------------------- /acmeproxy/acmeproxy/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/acmeproxy/__init__.py -------------------------------------------------------------------------------- /acmeproxy/acmeproxy/settings.py: -------------------------------------------------------------------------------- 1 | import os 2 | 3 | DEBUG = False 4 | 5 | LANGUAGE_CODE = "en-nz" 6 | TIME_ZONE = "Pacific/Auckland" 7 | 8 | ## Django settings 9 | 10 | BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) 11 | 12 | # Application definition 13 | 14 | INSTALLED_APPS = ( 15 | "django.contrib.admin", 16 | "django.contrib.auth", 17 | "django.contrib.contenttypes", 18 | "django.contrib.sessions", 19 | "django.contrib.messages", 20 | "django.contrib.staticfiles", 21 | "rest_framework", 22 | "acmeproxy.proxy", 23 | ) 24 | 25 | MIDDLEWARE = ( 26 | "django.middleware.security.SecurityMiddleware", 27 | "django.contrib.sessions.middleware.SessionMiddleware", 28 | "django.middleware.common.CommonMiddleware", 29 | "django.middleware.csrf.CsrfViewMiddleware", 30 | "django.contrib.auth.middleware.AuthenticationMiddleware", 31 | "django.contrib.messages.middleware.MessageMiddleware", 32 | "django.middleware.clickjacking.XFrameOptionsMiddleware", 33 | ) 34 | 35 | ROOT_URLCONF = "acmeproxy.acmeproxy.urls" 36 | 37 | TEMPLATES = [ 38 | { 39 | "BACKEND": "django.template.backends.django.DjangoTemplates", 40 | "DIRS": [], 41 | "APP_DIRS": True, 42 | "OPTIONS": { 43 | "context_processors": [ 44 | "django.template.context_processors.debug", 45 | "django.template.context_processors.request", 46 | "django.contrib.auth.context_processors.auth", 47 | "django.contrib.messages.context_processors.messages", 48 | ], 49 | }, 50 | }, 51 | ] 52 | 53 | WSGI_APPLICATION = "acmeproxy.acmeproxy.wsgi.application" 54 | 55 | 56 | # Database 57 | # https://docs.djangoproject.com/en/1.8/ref/settings/#databases 58 | 59 | DATABASES = { 60 | "default": { 61 | "ENGINE": "django.db.backends.sqlite3", 62 | "NAME": os.path.join(BASE_DIR, "db.sqlite3"), 63 | } 64 | } 65 | 66 | 67 | # Internationalization 68 | # https://docs.djangoproject.com/en/1.8/topics/i18n/ 69 | 70 | 71 | USE_I18N = True 72 | 73 | USE_L10N = True 74 | 75 | USE_TZ = True 76 | 77 | 78 | # Static files (CSS, JavaScript, Images) 79 | # https://docs.djangoproject.com/en/1.8/howto/static-files/ 80 | 81 | STATIC_URL = "/static/" 82 | -------------------------------------------------------------------------------- /acmeproxy/acmeproxy/urls.py: -------------------------------------------------------------------------------- 1 | from django.contrib import admin 2 | from django.urls import include, path 3 | 4 | urlpatterns = [ 5 | path("admin/", admin.site.urls), 6 | path("", include("acmeproxy.proxy.urls")), 7 | ] 8 | -------------------------------------------------------------------------------- /acmeproxy/acmeproxy/wsgi.py: -------------------------------------------------------------------------------- 1 | """ 2 | WSGI config for acmeproxy project. 3 | 4 | It exposes the WSGI callable as a module-level variable named ``application``. 5 | 6 | For more information on this file, see 7 | https://docs.djangoproject.com/en/1.8/howto/deployment/wsgi/ 8 | """ 9 | 10 | import os 11 | 12 | from django.core.wsgi import get_wsgi_application 13 | 14 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "acmeproxy.settings") 15 | 16 | application = get_wsgi_application() 17 | -------------------------------------------------------------------------------- /acmeproxy/manage.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | import os 3 | import sys 4 | 5 | if __name__ == "__main__": 6 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "acmeproxy.acmeproxy.settings") 7 | 8 | from django.core.management import execute_from_command_line 9 | 10 | execute_from_command_line(sys.argv) 11 | -------------------------------------------------------------------------------- /acmeproxy/proxy/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/proxy/__init__.py -------------------------------------------------------------------------------- /acmeproxy/proxy/admin.py: -------------------------------------------------------------------------------- 1 | from django.contrib import admin 2 | 3 | from .models import Authorisation, Response 4 | 5 | 6 | class AuthorisationAdmin(admin.ModelAdmin): 7 | list_display = ("name", "created_at", "created_by_ip") 8 | fields = ("name", "secret") 9 | 10 | 11 | class ResponseAdmin(admin.ModelAdmin): 12 | list_display = ( 13 | "name", 14 | "response", 15 | "created_at", 16 | "expired_at", 17 | "live", 18 | "created_by_ip", 19 | ) 20 | 21 | 22 | admin.site.register(Authorisation, AuthorisationAdmin) 23 | admin.site.register(Response, ResponseAdmin) 24 | -------------------------------------------------------------------------------- /acmeproxy/proxy/management/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/proxy/management/__init__.py -------------------------------------------------------------------------------- /acmeproxy/proxy/management/commands/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/proxy/management/commands/__init__.py -------------------------------------------------------------------------------- /acmeproxy/proxy/management/commands/deleteauthorisation.py: -------------------------------------------------------------------------------- 1 | from django.core.management.base import BaseCommand, CommandError 2 | 3 | from acmeproxy.proxy.models import Authorisation 4 | 5 | 6 | class Command(BaseCommand): 7 | help = "Delete an authorisation" 8 | 9 | def add_arguments(self, parser): 10 | parser.add_argument("name", type=str) 11 | 12 | def handle(self, *args, **options): 13 | name = options["name"] 14 | 15 | try: 16 | authorisation = Authorisation.objects.get(name__iexact=name) 17 | except Authorisation.DoesNotExist: 18 | raise CommandError('Authorisation "%s" does not exist' % name) 19 | 20 | try: 21 | authorisation.delete() 22 | except: 23 | raise CommandError('Could not delete authorisation "%s"' % name) 24 | else: 25 | self.stdout.write('Successfully deleted authorisation "%s"' % name) 26 | -------------------------------------------------------------------------------- /acmeproxy/proxy/management/commands/listauthorisations.py: -------------------------------------------------------------------------------- 1 | from collections import OrderedDict 2 | 3 | from django.core.management.base import BaseCommand, CommandError 4 | from tabulate import tabulate 5 | 6 | from acmeproxy.proxy.models import Authorisation 7 | 8 | 9 | class Command(BaseCommand): 10 | help = "List all of the granted authorisations" 11 | 12 | def handle(self, *args, **options): 13 | authorisations = Authorisation.objects.all() 14 | if len(authorisations) < 1: 15 | raise CommandError("No authorisations found") 16 | 17 | # this is pretty inefficient but the table is likely to be small 18 | table = [ 19 | { 20 | k: v 21 | for (k, v) in authorisation.__dict__.items() 22 | if k in ("account", "created_at", "created_by_ip", "name") 23 | } 24 | for authorisation in authorisations 25 | ] 26 | table = [ 27 | OrderedDict(sorted(entry.items(), key=lambda x: x[0], reverse=True)) 28 | for entry in table 29 | ] 30 | 31 | self.stdout.write(tabulate(table, headers="keys")) 32 | -------------------------------------------------------------------------------- /acmeproxy/proxy/management/commands/listresponses.py: -------------------------------------------------------------------------------- 1 | from collections import OrderedDict 2 | 3 | from django.core.management.base import BaseCommand, CommandError 4 | from django.utils import dateparse 5 | from tabulate import tabulate 6 | 7 | from acmeproxy.proxy.models import Response 8 | 9 | 10 | class Command(BaseCommand): 11 | help = "List all published responses for a given date range" 12 | 13 | def add_arguments(self, parser): 14 | parser.add_argument( 15 | "--start", 16 | default=None, 17 | help="if specified, return only records created after this time", 18 | ) 19 | parser.add_argument( 20 | "--end", 21 | default=None, 22 | help="if specified, return only records created before this time", 23 | ) 24 | parser.add_argument( 25 | "--name", 26 | default=None, 27 | help="if specified, return only records for this name", 28 | ) 29 | 30 | def handle(self, *args, **options): 31 | query = {} 32 | 33 | if options["start"] is not None: 34 | query["created_at__gt"] = dateparse.parse_date(options["start"]) 35 | if query["created_at__gt"] is None: 36 | raise CommandError("Invalid start date") 37 | 38 | if options["end"] is not None: 39 | query["created_at__lt"] = dateparse.parse_date(options["end"]) 40 | if query["created_at__lt"] is None: 41 | raise CommandError("Invalid end date") 42 | 43 | if options["name"] is not None: 44 | query["name__iexact"] = options["name"] 45 | 46 | responses = Response.objects.filter(**query) 47 | if len(responses) < 1: 48 | raise CommandError("No responses found") 49 | 50 | # this is pretty inefficient but the table is likely to be small 51 | table = [ 52 | { 53 | k: v 54 | for (k, v) in response.__dict__.items() 55 | if k in ("expired_at", "created_at", "created_by_ip", "name") 56 | } 57 | for response in responses 58 | ] 59 | table = [ 60 | OrderedDict(sorted(entry.items(), key=lambda x: x[0], reverse=True)) 61 | for entry in table 62 | ] 63 | self.stdout.write(tabulate(table, headers="keys")) 64 | -------------------------------------------------------------------------------- /acmeproxy/proxy/management/commands/pipeapi.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import time 3 | 4 | from django.conf import settings 5 | from django.core.management.base import BaseCommand 6 | from django.db.models import Q 7 | from django.utils import timezone 8 | 9 | from acmeproxy.proxy.models import Response 10 | 11 | 12 | class Command(BaseCommand): 13 | help = "Called by PowerDNS to exchange DNS data" 14 | 15 | @staticmethod 16 | def format_data(qname, qtype, answer, ttl=60): 17 | return "\t".join([qname, "IN", qtype, str(ttl), "1", answer]) 18 | 19 | def send(self, answer_tag, answer_data=None): 20 | if answer_data: 21 | answer_data = "\t{}".format(answer_data) 22 | else: 23 | answer_data = "" 24 | line = "{}{}\n".format(answer_tag, answer_data) 25 | self.stdout.write(line) 26 | self.stdout.flush() 27 | 28 | @staticmethod 29 | def strip_labels(name, count): 30 | return ".".join(name.split(".")[count:]) 31 | 32 | def generate_records(self): 33 | responses = Response.objects.filter( 34 | Q(expired_at__gt=timezone.now()) | Q(expired_at__isnull=True) 35 | ) 36 | records = [] 37 | 38 | for response in responses: 39 | # Serve the challenge TXT record for the requested zone 40 | records.append( 41 | { 42 | "name": "_acme-challenge.%s" % response.name, 43 | "type": "TXT", 44 | "ttl": 5, 45 | "content": response.response, 46 | } 47 | ) 48 | 49 | # In case just the _acme-challenge.foo name was delegated, ensure authority at that level 50 | records.append( 51 | { 52 | "name": "_acme-challenge.%s" % response.name, 53 | "type": "SOA", 54 | "ttl": 5, 55 | "content": "%s. %s. %s 0 0 0 0" 56 | % ( 57 | settings.ACMEPROXY_SOA_HOSTNAME, 58 | settings.ACMEPROXY_SOA_CONTACT, 59 | str(int(time.time())), 60 | ), 61 | } 62 | ) 63 | records.append( # Serve NS for _acme-challenge.foo.example.com 64 | { 65 | "name": "_acme-challenge.%s" % response.name, 66 | "type": "NS", 67 | "ttl": 5, 68 | "content": settings.ACMEPROXY_SOA_HOSTNAME, 69 | } 70 | ) 71 | records.append( # Serve CAA for _acme-challenge.foo.example.com 72 | { 73 | "name": "_acme-challenge.%s" % response.name, 74 | "type": "CAA", 75 | "ttl": 5, 76 | "content": '0 issue "letsencrypt.org"', 77 | } 78 | ) 79 | 80 | # Also claim to be authoritative for foo.example.com and example.com to handle CAA for the various ways in which the challenge 81 | # might have been delegated (e.g. at the foo.example.com or example.com levels) 82 | 83 | for depth in (0, 1): 84 | extra_zone_name = self.strip_labels(response.name, depth) 85 | 86 | records.append( 87 | { 88 | "name": extra_zone_name, 89 | "type": "SOA", 90 | "ttl": 5, 91 | "content": "%s. %s. %s 0 0 0 0" 92 | % ( 93 | settings.ACMEPROXY_SOA_HOSTNAME, 94 | settings.ACMEPROXY_SOA_CONTACT, 95 | str(int(time.time())), 96 | ), 97 | } 98 | ) 99 | records.append( 100 | { 101 | "name": extra_zone_name, 102 | "type": "NS", 103 | "ttl": 5, 104 | "content": settings.ACMEPROXY_SOA_HOSTNAME, 105 | } 106 | ) 107 | records.append( 108 | { 109 | "name": extra_zone_name, 110 | "type": "CAA", 111 | "ttl": 5, 112 | "content": '0 issue "letsencrypt.org"', 113 | } 114 | ) 115 | 116 | return records 117 | 118 | def handle(self, *args, **options): 119 | # handshake and accept version 1 of the ABI 120 | line = sys.stdin.readline() 121 | try: 122 | query, version = line.strip().split() 123 | except ValueError: 124 | self.send("FAIL") 125 | sys.exit(1) 126 | 127 | if query != "HELO" and version != "1": 128 | self.send("FAIL") 129 | sys.exit(1) 130 | 131 | self.send("OK", "ACME Proxy API") 132 | 133 | # loop forever answering questions 134 | while True: 135 | line = sys.stdin.readline() 136 | 137 | try: 138 | ( 139 | question_type, 140 | qname, 141 | qclass, 142 | qtype, 143 | id, 144 | remote_ip, 145 | ) = line.strip().split() 146 | except ValueError: 147 | if line.startswith("DEBUGQUIT"): 148 | sys.exit(0) 149 | else: 150 | continue 151 | 152 | records = self.generate_records() 153 | found = 0 154 | if question_type == "Q": 155 | for record in records: 156 | if ( 157 | qtype in ("ANY", record["type"]) 158 | and qname.lower() == record["name"] 159 | ): 160 | found = found + 1 161 | self.send( 162 | "DATA", 163 | self.format_data( 164 | qname, record["type"], record["content"], record["ttl"] 165 | ), 166 | ) 167 | 168 | self.send("END") 169 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0001_initial.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [] 10 | 11 | operations = [ 12 | migrations.CreateModel( 13 | name="Authorization", 14 | fields=[ 15 | ( 16 | "id", 17 | models.AutoField( 18 | verbose_name="ID", 19 | primary_key=True, 20 | auto_created=True, 21 | serialize=False, 22 | ), 23 | ), 24 | ("name", models.CharField(max_length=255)), 25 | ("prefix_match", models.BooleanField()), 26 | ("secret", models.CharField(max_length=128)), 27 | ], 28 | ), 29 | migrations.CreateModel( 30 | name="Response", 31 | fields=[ 32 | ( 33 | "id", 34 | models.AutoField( 35 | verbose_name="ID", 36 | primary_key=True, 37 | auto_created=True, 38 | serialize=False, 39 | ), 40 | ), 41 | ("name", models.CharField(max_length=255)), 42 | ("response", models.CharField(max_length=255)), 43 | ("created", models.DateTimeField(auto_now_add=True)), 44 | ("created_by_ip", models.GenericIPAddressField()), 45 | ], 46 | ), 47 | ] 48 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0002_auto_20160930_1457.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0001_initial"), 11 | ] 12 | 13 | operations = [ 14 | migrations.RenameModel( 15 | old_name="Authorization", 16 | new_name="Authorisation", 17 | ), 18 | ] 19 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0003_auto_20161004_1402.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0002_auto_20160930_1457"), 11 | ] 12 | 13 | operations = [ 14 | migrations.RenameField( 15 | model_name="authorisation", 16 | old_name="prefix_match", 17 | new_name="suffix_match", 18 | ), 19 | ] 20 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0004_auto_20161004_1514.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0003_auto_20161004_1402"), 11 | ] 12 | 13 | operations = [ 14 | migrations.RenameField( 15 | model_name="response", 16 | old_name="created", 17 | new_name="created_at", 18 | ), 19 | migrations.AlterField( 20 | model_name="response", 21 | name="created_by_ip", 22 | field=models.GenericIPAddressField(verbose_name="Created by IP address"), 23 | ), 24 | ] 25 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0005_auto_20161005_1215.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0004_auto_20161004_1514"), 11 | ] 12 | 13 | operations = [ 14 | migrations.AlterUniqueTogether( 15 | name="authorisation", 16 | unique_together=set([("name", "suffix_match")]), 17 | ), 18 | ] 19 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0006_auto_20161005_1339.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | import datetime 5 | 6 | from django.db import migrations, models 7 | from django.utils.timezone import utc 8 | 9 | 10 | class Migration(migrations.Migration): 11 | 12 | dependencies = [ 13 | ("proxy", "0005_auto_20161005_1215"), 14 | ] 15 | 16 | operations = [ 17 | migrations.AddField( 18 | model_name="authorisation", 19 | name="created_at", 20 | field=models.DateTimeField( 21 | default=datetime.datetime(2016, 10, 5, 0, 39, 2, 173677, tzinfo=utc), 22 | auto_now_add=True, 23 | ), 24 | preserve_default=False, 25 | ), 26 | migrations.AddField( 27 | model_name="authorisation", 28 | name="created_by_ip", 29 | field=models.GenericIPAddressField( 30 | default="192.0.2.1", verbose_name="Created by IP address" 31 | ), 32 | preserve_default=False, 33 | ), 34 | ] 35 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0007_response_expired_at.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0006_auto_20161005_1339"), 11 | ] 12 | 13 | operations = [ 14 | migrations.AddField( 15 | model_name="response", 16 | name="expired_at", 17 | field=models.DateTimeField(null=True), 18 | ), 19 | ] 20 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0008_auto_20161010_1645.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | from __future__ import unicode_literals 3 | 4 | from django.db import migrations, models 5 | 6 | 7 | class Migration(migrations.Migration): 8 | 9 | dependencies = [ 10 | ("proxy", "0007_response_expired_at"), 11 | ] 12 | 13 | operations = [ 14 | migrations.AddField( 15 | model_name="authorisation", 16 | name="account", 17 | field=models.CharField(max_length=255, default=""), 18 | preserve_default=False, 19 | ), 20 | migrations.AlterField( 21 | model_name="response", 22 | name="expired_at", 23 | field=models.DateTimeField(null=True, blank=True), 24 | ), 25 | ] 26 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/0009_auto_20200611_0403.py: -------------------------------------------------------------------------------- 1 | # Generated by Django 2.2.13 on 2020-06-11 04:03 2 | 3 | from django.db import migrations 4 | 5 | 6 | class Migration(migrations.Migration): 7 | 8 | dependencies = [ 9 | ("proxy", "0008_auto_20161010_1645"), 10 | ] 11 | 12 | operations = [ 13 | migrations.AlterUniqueTogether( 14 | name="authorisation", 15 | unique_together=set(), 16 | ), 17 | migrations.RemoveField( 18 | model_name="authorisation", 19 | name="suffix_match", 20 | ), 21 | ] 22 | -------------------------------------------------------------------------------- /acmeproxy/proxy/migrations/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/proxy/migrations/__init__.py -------------------------------------------------------------------------------- /acmeproxy/proxy/models.py: -------------------------------------------------------------------------------- 1 | import binascii 2 | import os 3 | from datetime import timedelta 4 | 5 | from django.db import models 6 | from django.utils import timezone 7 | 8 | 9 | class Authorisation(models.Model): 10 | name = models.CharField(max_length=255) 11 | secret = models.CharField(max_length=128) 12 | created_at = models.DateTimeField(auto_now_add=True, editable=False) 13 | created_by_ip = models.GenericIPAddressField(verbose_name="Created by IP address") 14 | account = models.CharField(max_length=255) 15 | 16 | def __str__(self): 17 | return self.name 18 | 19 | def reset_secret(self): 20 | self.secret = binascii.hexlify(os.urandom(16)).decode( 21 | "cp437" 22 | ) # generate a random 128 bit secret 23 | 24 | 25 | class Response(models.Model): 26 | name = models.CharField(max_length=255) 27 | response = models.CharField(max_length=255) 28 | created_at = models.DateTimeField(auto_now_add=True, editable=False) 29 | created_by_ip = models.GenericIPAddressField(verbose_name="Created by IP address") 30 | expired_at = models.DateTimeField(null=True, blank=True) 31 | 32 | def __str__(self): 33 | return "_acme-challenge.%s IN TXT %s" % (self.name, self.response) 34 | 35 | def live(self): 36 | threshold = timezone.now() - timedelta(minutes=5) 37 | return self.created_at > threshold and ( 38 | self.expired_at is None or self.expired_at > timezone.now() 39 | ) 40 | 41 | live.boolean = True 42 | -------------------------------------------------------------------------------- /acmeproxy/proxy/tests/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/catalyst/acmeproxy/beac45e13aecc0d120f6771c1e05a48f01978bb3/acmeproxy/proxy/tests/__init__.py -------------------------------------------------------------------------------- /acmeproxy/proxy/tests/test_commands.py: -------------------------------------------------------------------------------- 1 | from io import StringIO 2 | 3 | import pytest 4 | from django.core.management import call_command 5 | from django.core.management.base import CommandError 6 | 7 | from acmeproxy.proxy.models import Authorisation 8 | from acmeproxy.proxy.tests.util import create_authorisation, create_response 9 | 10 | 11 | @pytest.mark.django_db 12 | class TestDeleteAuthorisation: 13 | def test_successful_delete(self): 14 | create_authorisation(name="example.com") 15 | out = StringIO() 16 | call_command("deleteauthorisation", "example.com", stdout=out) 17 | assert Authorisation.objects.count() == 0 18 | 19 | def test_no_domain_matched_name(self): 20 | create_authorisation(name="example.com") 21 | out = StringIO() 22 | with pytest.raises(CommandError): 23 | call_command("deleteauthorisation", "example.org", stdout=out) 24 | 25 | def test_mixed_case(self): 26 | create_authorisation(name="example.com") 27 | out = StringIO() 28 | call_command("deleteauthorisation", "eXAmple.cOm", stdout=out) 29 | assert Authorisation.objects.count() == 0 30 | 31 | 32 | @pytest.mark.django_db 33 | class TestListAuthorisations: 34 | def test_successful_list(self): 35 | create_authorisation(name="example.com") 36 | out = StringIO() 37 | call_command("listauthorisations", stdout=out) 38 | assert "example.com" in out.getvalue() 39 | 40 | def test_nothing(self): 41 | out = StringIO() 42 | with pytest.raises(CommandError): 43 | call_command("listauthorisations", stdout=out) 44 | 45 | 46 | @pytest.mark.django_db 47 | class TestListResponses: 48 | def test_successful_list(self): 49 | create_authorisation(name="example.com") 50 | create_response(name="example.com") 51 | out = StringIO() 52 | call_command("listresponses", stdout=out) 53 | assert "example.com" in out.getvalue() 54 | 55 | def test_nothing(self): 56 | out = StringIO() 57 | with pytest.raises(CommandError): 58 | call_command("listresponses", stdout=out) 59 | 60 | 61 | @pytest.mark.django_db 62 | class TestPipeAPI: 63 | @pytest.mark.parametrize( 64 | "test_input, output", 65 | [ 66 | ("HELO\t1\nDEBUGQUIT", "OK\tACME Proxy API\n"), 67 | ( 68 | "HELO\t1\nQ\texample.com\th\tANY\th\t127.0.0.1\nDEBUGQUIT", 69 | 'OK\tACME Proxy API\nDATA\texample.com\tIN\tSOA\t5\t1\tacme-proxy-ns1.example.com. hostmaster.example.com. 1592267735 0 0 0 0\nDATA\texample.com\tIN\tNS\t5\t1\tacme-proxy-ns1.example.com\nDATA\texample.com\tIN\tCAA 5\t1\t0 issue "letsencrypt.org"\nEND\n', 70 | ), 71 | ( 72 | "HELO\t1\nQ\texample.com\th\tCAA\th\t127.0.0.1\nDEBUGQUIT", 73 | 'OK\tACME Proxy API\nDATA\texample.com\tIN\tCAA 5\t1\t0 issue "letsencrypt.org"\nEND\n', 74 | ), 75 | ( 76 | "HELO\t1\nQ\t_acme-challenge.example.com\th\tANY\th\t127.0.0.1\nDEBUGQUIT", 77 | 'OK\tACME Proxy API\nDATA\t_acme-challenge.example.com IN\tTXT 5\t1\ttest_response\nDATA\t_acme-challenge.example.com\tIN\tSOA\t5\t1\tacme-proxy-ns1.example.com. hostmaster.example.com. 1592267735 0 0 0 0\nDATA\t_acme-challenge.example.com\tIN\tNS\t5\t1\tacme-proxy-ns1.example.com\nDATA\t_acme-challenge.example.com\tIN\tCAA 5\t1\t0 issue "letsencrypt.org"\nEND\n', 78 | ), 79 | ( 80 | "HELO\t1\nQ\t_acme-challenge.example.com\th\tTXT\th\t127.0.0.1\nDEBUGQUIT", 81 | "OK\tACME Proxy API\nDATA\t_acme-challenge.example.com IN\tTXT 5\t1\ttest_response\nEND\n", 82 | ), 83 | ( 84 | "RANDOM GARBAGE", 85 | "FAIL\n", 86 | ), 87 | ( 88 | "RANDOMGARBAGE", 89 | "FAIL\n", 90 | ), 91 | ( 92 | "HELO\t1\nRANDOMGARBAGE\nDEBUGQUIT", 93 | "OK\tACME Proxy API\n", 94 | ), 95 | ( 96 | "HELO\t1\nR random correct number of things\nDEBUGQUIT", 97 | "OK\tACME Proxy API\nEND\n", 98 | ), 99 | ( 100 | "HELO\t1\nRANDOMGARBAGE\nQ\texample.com\th\tCAA\th\t127.0.0.1\nDEBUGQUIT", 101 | 'OK\tACME Proxy API\nDATA\texample.com\tIN\tCAA 5\t1\t0 issue "letsencrypt.org"\nEND\n', 102 | ), 103 | ( 104 | "HELO\t1\nR random correct number of things\nQ\texample.com\th\tCAA\th\t127.0.0.1\nDEBUGQUIT", 105 | 'OK\tACME Proxy API\nEND\nDATA\texample.com\tIN\tCAA 5\t1\t0 issue "letsencrypt.org"\nEND\n', 106 | ), 107 | ], 108 | ) 109 | def test_query(self, monkeypatch, test_input, output): 110 | create_authorisation(name="example.com") 111 | create_response(name="example.com") 112 | out = StringIO() 113 | monkeypatch.setattr( 114 | "sys.stdin", 115 | StringIO(test_input), 116 | ) 117 | monkeypatch.setattr("time.time", lambda: 1592267735) 118 | with pytest.raises(SystemExit): 119 | call_command("pipeapi", stdout=out) 120 | assert out.getvalue() == output 121 | -------------------------------------------------------------------------------- /acmeproxy/proxy/tests/test_views.py: -------------------------------------------------------------------------------- 1 | import pytest 2 | 3 | from acmeproxy.proxy.tests.util import create_authorisation, create_response 4 | 5 | 6 | @pytest.mark.django_db 7 | class TestAuthroisation: 8 | def test_create_authorisation(self, client): 9 | resp = client.post("/create_authorisation", data={"name": "example.com"}) 10 | assert resp.status_code == 200 11 | assert resp.json()["result"]["authorisation"] == "example.com" 12 | 13 | def test_create_authorisation_mixed_case(self, client): 14 | resp = client.post("/create_authorisation", data={"name": "exAMplE.cOm"}) 15 | assert resp.status_code == 200 16 | assert resp.json()["result"]["authorisation"] == "example.com" 17 | 18 | def test_create_authorisation_missing_name(self, client): 19 | resp = client.post("/create_authorisation", data={}) 20 | assert resp.status_code == 400 21 | 22 | @pytest.mark.parametrize( 23 | "auth_settings,domain,secret,status_code", 24 | [ 25 | ( 26 | {"18084e750a1cff6f2d627e7a568ab81a": {"name": "developers"}}, 27 | "example.com", 28 | "18084e750a1cff6f2d627e7a568ab81a", 29 | 200, 30 | ), 31 | ( 32 | {"18084e750a1cff6f2d627e7a568ab81a": {"name": "developers"}}, 33 | "example.com", 34 | "wrong_secret", 35 | 403, 36 | ), 37 | ( 38 | { 39 | "18084e750a1cff6f2d627e7a568ab81a": { 40 | "name": "developers", 41 | "permit": ["example.com"], 42 | } 43 | }, 44 | "example.com", 45 | "18084e750a1cff6f2d627e7a568ab81a", 46 | 200, 47 | ), 48 | ( 49 | { 50 | "18084e750a1cff6f2d627e7a568ab81a": { 51 | "name": "developers", 52 | "permit": ["example.org"], 53 | } 54 | }, 55 | "example.com", 56 | "18084e750a1cff6f2d627e7a568ab81a", 57 | 403, 58 | ), 59 | ( 60 | { 61 | "18084e750a1cff6f2d627e7a568ab81a": { 62 | "name": "developers", 63 | "permit": [".example.com"], 64 | } 65 | }, 66 | "example.com", 67 | "18084e750a1cff6f2d627e7a568ab81a", 68 | 403, 69 | ), 70 | ( 71 | { 72 | "18084e750a1cff6f2d627e7a568ab81a": { 73 | "name": "developers", 74 | "permit": [".example.com"], 75 | } 76 | }, 77 | "test.example.com", 78 | "18084e750a1cff6f2d627e7a568ab81a", 79 | 200, 80 | ), 81 | ( 82 | { 83 | "18084e750a1cff6f2d627e7a568ab81a": { 84 | "name": "developers", 85 | "permit": ["example.com"], 86 | } 87 | }, 88 | "test.example.com", 89 | "18084e750a1cff6f2d627e7a568ab81a", 90 | 403, 91 | ), 92 | ], 93 | ) 94 | def test_create_auth_permissions( 95 | self, client, settings, auth_settings, domain, secret, status_code 96 | ): 97 | settings.ACMEPROXY_AUTHORISATION_CREATION_SECRETS = auth_settings 98 | resp = client.post( 99 | "/create_authorisation", 100 | data={"name": domain, "secret": secret}, 101 | ) 102 | assert resp.status_code == status_code 103 | 104 | def test_expire_authorisation(self, client): 105 | create_authorisation(name="example.com") 106 | resp = client.post( 107 | "/expire_authorisation", 108 | data={"name": "example.com", "secret": "test_secret"}, 109 | ) 110 | assert resp.status_code == 200 111 | assert resp.json()["result"]["authorisation"] == "example.com" 112 | 113 | def test_expire_mixed_case(self, client): 114 | create_authorisation(name="example.com") 115 | resp = client.post( 116 | "/expire_authorisation", 117 | data={"name": "exAMplE.cOm", "secret": "test_secret"}, 118 | ) 119 | assert resp.status_code == 200 120 | assert resp.json()["result"]["authorisation"] == "example.com" 121 | 122 | def test_expire_wrong_secret(self, client): 123 | create_authorisation(name="example.com") 124 | resp = client.post( 125 | "/expire_authorisation", 126 | data={"name": "example.com", "secret": "wrong_secret"}, 127 | ) 128 | assert resp.status_code == 403 129 | assert resp.json()["result"] is False 130 | 131 | def test_expire_missing_name(self, client): 132 | create_authorisation(name="example.com") 133 | resp = client.post( 134 | "/expire_authorisation", 135 | data={"secret": "test_secret"}, 136 | ) 137 | assert resp.status_code == 400 138 | 139 | def test_expire_missing_secret(self, client): 140 | create_authorisation(name="example.com") 141 | resp = client.post( 142 | "/expire_authorisation", 143 | data={"name": "example.com"}, 144 | ) 145 | assert resp.status_code == 400 146 | 147 | def test_create_wrong_method(self, client): 148 | resp = client.get("/create_authorisation", data={"name": "example.com"}) 149 | assert resp.status_code == 405 150 | 151 | def test_expire_wrong_method(self, client): 152 | resp = client.get("/expire_authorisation", data={"name": "example.com"}) 153 | assert resp.status_code == 405 154 | 155 | 156 | @pytest.mark.django_db 157 | class TestResponse: 158 | def test_publish_response(self, client): 159 | create_authorisation(name="example.com") 160 | resp = client.post( 161 | "/publish_response", 162 | data={ 163 | "name": "example.com", 164 | "response": "random_secret", 165 | "secret": "test_secret", 166 | }, 167 | ) 168 | assert resp.status_code == 200 169 | assert resp.json()["result"]["authorisation"] == "example.com" 170 | assert resp.json()["result"]["published"] is True 171 | 172 | def test_publish_response_mixed_case(self, client): 173 | create_authorisation(name="example.com") 174 | resp = client.post( 175 | "/publish_response", 176 | data={ 177 | "name": "exAMple.coM", 178 | "response": "random_secret", 179 | "secret": "test_secret", 180 | }, 181 | ) 182 | assert resp.status_code == 200 183 | assert resp.json()["result"]["authorisation"] == "example.com" 184 | assert resp.json()["result"]["published"] is True 185 | 186 | def test_publish_wrong_secret(self, client): 187 | create_authorisation(name="example.com") 188 | resp = client.post( 189 | "/publish_response", 190 | data={ 191 | "name": "example.com", 192 | "response": "random_secret", 193 | "secret": "wrong_secret", 194 | }, 195 | ) 196 | assert resp.status_code == 403 197 | assert resp.json()["result"] is False 198 | 199 | def test_publish_missing_name(self, client): 200 | create_authorisation(name="example.com") 201 | resp = client.post( 202 | "/publish_response", 203 | data={"response": "random_secret", "secret": "test_secret"}, 204 | ) 205 | assert resp.status_code == 400 206 | 207 | def test_publish_missing_response(self, client): 208 | create_authorisation(name="example.com") 209 | resp = client.post( 210 | "/publish_response", 211 | data={"name": "example.com", "secret": "test_secret"}, 212 | ) 213 | assert resp.status_code == 400 214 | 215 | def test_publish_missing_secret(self, client): 216 | create_authorisation(name="example.com") 217 | resp = client.post( 218 | "/publish_response", 219 | data={"name": "example.com", "response": "random_secret"}, 220 | ) 221 | assert resp.status_code == 400 222 | 223 | def test_expire_response(self, client): 224 | create_authorisation(name="example.com") 225 | create_response(name="example.com") 226 | resp = client.post( 227 | "/expire_response", 228 | data={"name": "example.com", "secret": "test_secret"}, 229 | ) 230 | assert resp.status_code == 200 231 | assert resp.json()["result"]["authorisation"] == "example.com" 232 | 233 | def test_expire_response_mixed_case(self, client): 234 | create_authorisation(name="example.com") 235 | create_response(name="example.com") 236 | resp = client.post( 237 | "/expire_response", 238 | data={"name": "exAMple.Com", "secret": "test_secret"}, 239 | ) 240 | assert resp.status_code == 200 241 | assert resp.json()["result"]["authorisation"] == "example.com" 242 | 243 | def test_expire_missing_name(self, client): 244 | create_authorisation(name="example.com") 245 | create_response(name="example.com") 246 | resp = client.post( 247 | "/expire_response", 248 | data={"secret": "test_secret"}, 249 | ) 250 | assert resp.status_code == 400 251 | 252 | def test_expire_missing_secret(self, client): 253 | create_authorisation(name="example.com") 254 | create_response(name="example.com") 255 | resp = client.post( 256 | "/expire_response", 257 | data={"name": "example.com"}, 258 | ) 259 | assert resp.status_code == 400 260 | 261 | def test_expire_wrong_secret(self, client): 262 | create_authorisation(name="example.com") 263 | create_response(name="example.com") 264 | resp = client.post( 265 | "/expire_response", 266 | data={"name": "example.com", "secret": "wrong_secret"}, 267 | ) 268 | assert resp.status_code == 403 269 | assert resp.json()["result"] is False 270 | 271 | def test_publish_wrong_method(self, client): 272 | resp = client.get("/publish_response", data={"name": "example.com"}) 273 | assert resp.status_code == 405 274 | 275 | def test_expire_wrong_method(self, client): 276 | resp = client.get("/expire_response", data={"name": "example.com"}) 277 | assert resp.status_code == 405 278 | -------------------------------------------------------------------------------- /acmeproxy/proxy/tests/util.py: -------------------------------------------------------------------------------- 1 | from acmeproxy.proxy.models import Authorisation, Response 2 | 3 | 4 | def create_authorisation(name): 5 | Authorisation.objects.create( 6 | name=name, secret="test_secret", created_by_ip="127.0.0.1" 7 | ) 8 | 9 | 10 | def create_response(name): 11 | Response.objects.create( 12 | name=name, response="test_response", created_by_ip="127.0.0.1" 13 | ) 14 | -------------------------------------------------------------------------------- /acmeproxy/proxy/urls.py: -------------------------------------------------------------------------------- 1 | from django.urls import path 2 | 3 | from . import views 4 | 5 | urlpatterns = [ 6 | path("publish_response", views.PublishResponse.as_view(), name="publish_response"), 7 | path("expire_response", views.ExpireResponse.as_view(), name="expire_response"), 8 | path( 9 | "create_authorisation", 10 | views.CreateAuthorisation.as_view(), 11 | name="create_authorisation", 12 | ), 13 | path( 14 | "expire_authorisation", 15 | views.ExpireAuthorisation.as_view(), 16 | name="expire_authorisation", 17 | ), 18 | ] 19 | -------------------------------------------------------------------------------- /acmeproxy/proxy/views.py: -------------------------------------------------------------------------------- 1 | import hmac 2 | 3 | from django.conf import settings 4 | from django.core.exceptions import ObjectDoesNotExist 5 | from django.utils import timezone 6 | from rest_framework import serializers 7 | from rest_framework.response import Response as APIResponse 8 | from rest_framework.views import APIView 9 | 10 | from .models import Authorisation, Response 11 | 12 | 13 | # stolen from https://stackoverflow.com/a/4581997 14 | def client_ip(request): 15 | x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR") 16 | if x_forwarded_for: 17 | ip = x_forwarded_for.split(",")[0] 18 | else: 19 | ip = request.META.get("REMOTE_ADDR") 20 | return ip 21 | 22 | 23 | def get_authorisation(name, secret): 24 | """ 25 | Attempts to find a valid authorisation for the given name and secret combination. 26 | """ 27 | 28 | try: # try and find an explicit authorisation 29 | authorisation = Authorisation.objects.get(name__iexact=name) 30 | if not hmac.compare_digest(authorisation.secret, secret): 31 | raise ObjectDoesNotExist 32 | except ObjectDoesNotExist: 33 | return False 34 | 35 | return authorisation 36 | 37 | 38 | class PublishResponseSerializer(serializers.Serializer): 39 | name = serializers.CharField() 40 | response = serializers.CharField() 41 | secret = serializers.CharField() 42 | 43 | 44 | class PublishResponse(APIView): 45 | def post(self, request, format=None): 46 | serializer = PublishResponseSerializer(data=request.data) 47 | if not serializer.is_valid(): 48 | return APIResponse(serializer.errors, status=400) 49 | 50 | name = serializer.data["name"].lower() 51 | response = serializer.data["response"] 52 | secret = serializer.data["secret"] 53 | 54 | authorisation = get_authorisation(name, secret) 55 | 56 | if authorisation: 57 | try: 58 | db_response = Response( 59 | name=name, response=response, created_by_ip=client_ip(request) 60 | ) 61 | db_response.save() 62 | except: 63 | return APIResponse( 64 | {"result": False, "error": "Could not save response in database"}, 65 | status=500, 66 | ) 67 | else: 68 | return APIResponse( 69 | {"result": {"authorisation": authorisation.name, "published": True}} 70 | ) 71 | 72 | return APIResponse( 73 | {"result": False, "error": "Invalid authorisation token"}, status=403 74 | ) 75 | 76 | 77 | class NameSecretSerializer(serializers.Serializer): 78 | name = serializers.CharField() 79 | secret = serializers.CharField() 80 | 81 | 82 | class ExpireResponse(APIView): 83 | def post(self, request, format=None): 84 | serializer = NameSecretSerializer(data=request.data) 85 | if not serializer.is_valid(): 86 | return APIResponse(serializer.errors, status=400) 87 | 88 | name = serializer.data["name"].lower() 89 | secret = serializer.data["secret"] 90 | 91 | authorisation = get_authorisation(name, secret) 92 | 93 | if authorisation: 94 | expired = ( 95 | Response.objects.filter(name__iexact=name).update( 96 | expired_at=timezone.now() 97 | ) 98 | > 0 99 | ) 100 | return APIResponse( 101 | {"result": {"authorisation": authorisation.name, "expired": expired}} 102 | ) 103 | 104 | return APIResponse( 105 | {"result": False, "error": "Invalid authorisation token"}, status=403 106 | ) 107 | 108 | 109 | class NameSecretOptionalSerializer(serializers.Serializer): 110 | name = serializers.CharField() 111 | secret = serializers.CharField(required=False) 112 | 113 | 114 | class CreateAuthorisation(APIView): 115 | def post(self, request, format=None): 116 | serializer = NameSecretOptionalSerializer(data=request.data) 117 | if not serializer.is_valid(): 118 | return APIResponse(serializer.errors, status=400) 119 | 120 | name = serializer.data["name"].lower() 121 | secret = serializer.data.get("secret", "") 122 | 123 | if settings.ACMEPROXY_AUTHORISATION_CREATION_SECRETS is not None: 124 | user = settings.ACMEPROXY_AUTHORISATION_CREATION_SECRETS.get(secret, None) 125 | if user is None: 126 | return APIResponse( 127 | {"result": False, "error": "Invalid account token"}, status=403 128 | ) 129 | else: 130 | allowed = True 131 | if "permit" in user: 132 | allowed = False 133 | for permit_name in user["permit"]: 134 | if ( 135 | permit_name.startswith(".") and name.endswith(permit_name) 136 | ) or (not permit_name.startswith(".") and permit_name == name): 137 | allowed = True 138 | break 139 | if not allowed: 140 | return APIResponse( 141 | { 142 | "result": False, 143 | "error": "Changes to this domain are not permitted with this account token", 144 | }, 145 | status=403, 146 | ) 147 | 148 | account = user["name"] 149 | else: 150 | account = "" 151 | 152 | db_authorisation = Authorisation( 153 | name=name, created_by_ip=client_ip(request), account=account 154 | ) 155 | db_authorisation.reset_secret() 156 | 157 | try: 158 | db_authorisation.save() 159 | except: 160 | return APIResponse( 161 | {"result": False, "error": "Could not save authorisation in database"}, 162 | status=500, 163 | ) 164 | 165 | return APIResponse( 166 | { 167 | "result": { 168 | "authorisation": db_authorisation.name, 169 | "secret": db_authorisation.secret, 170 | } 171 | } 172 | ) 173 | 174 | 175 | class ExpireAuthorisation(APIView): 176 | def post(self, request, format=None): 177 | serializer = NameSecretSerializer(data=request.data) 178 | if not serializer.is_valid(): 179 | return APIResponse(serializer.errors, status=400) 180 | 181 | name = serializer.data["name"].lower() 182 | secret = serializer.data["secret"] 183 | 184 | authorisation = get_authorisation(name, secret) 185 | 186 | if authorisation: 187 | try: 188 | authorisation.reset_secret() 189 | authorisation.save() 190 | except: 191 | return APIResponse( 192 | { 193 | "result": False, 194 | "error": "Could not save authorisation in database", 195 | }, 196 | status=500, 197 | ) 198 | else: 199 | return APIResponse( 200 | { 201 | "result": { 202 | "authorisation": authorisation.name, 203 | "secret": authorisation.secret, 204 | } 205 | } 206 | ) 207 | 208 | return APIResponse( 209 | {"result": False, "error": "Invalid authorisation token"}, status=403 210 | ) 211 | -------------------------------------------------------------------------------- /docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3.4' 2 | services: 3 | webapp: 4 | build: 5 | context: ./ 6 | command: /code/docker-support/dev-init.sh 7 | ports: 8 | - "8080:8080" 9 | volumes: 10 | - type: bind 11 | source: ./ 12 | target: /code 13 | - type: bind 14 | source: ./docker-support/dev_settings.py 15 | target: /acmeproxy_settings.py 16 | read_only: true 17 | - type: tmpfs 18 | target: /tmp 19 | restart: always 20 | -------------------------------------------------------------------------------- /docker-support/dev-init.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | set -ex 3 | 4 | DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" 5 | 6 | django-admin --version 7 | 8 | django-admin migrate 9 | 10 | django-admin runserver 0.0.0.0:8080 11 | -------------------------------------------------------------------------------- /docker-support/dev_settings.py: -------------------------------------------------------------------------------- 1 | from acmeproxy.acmeproxy import settings # noqa: F401 2 | from acmeproxy.acmeproxy.settings import * # noqa: F401, F403 3 | 4 | SECRET_KEY = "this key is very hush hush!" 5 | DEBUG = True 6 | 7 | ACMEPROXY_SOA_HOSTNAME = "acme-proxy-ns1.example.com" 8 | ACMEPROXY_SOA_CONTACT = "hostmaster.example.com" 9 | 10 | ACMEPROXY_AUTHORISATION_CREATION_SECRETS = None 11 | -------------------------------------------------------------------------------- /docker-support/pipfile-to-requirements.py: -------------------------------------------------------------------------------- 1 | import json 2 | import sys 3 | 4 | 5 | def parse_pipenv_lock_section(section_data): 6 | for req_name, req_data in section_data.items(): 7 | if req_data.get("version") and req_data.get("hashes"): 8 | hashes = " ".join(f"--hash={hash}" for hash in req_data.get("hashes")) 9 | yield f"{req_name}{req_data['version']} {hashes}" 10 | 11 | 12 | def main(): 13 | for name in sys.argv[1:]: 14 | with open(name, "r") as f: 15 | data = json.load(f) 16 | for section in ["default", "develop"]: 17 | for version_spec in parse_pipenv_lock_section(data.get(section, {})): 18 | print(version_spec) # noqa: T001 19 | 20 | 21 | if __name__ == "__main__": 22 | main() 23 | -------------------------------------------------------------------------------- /example_settings.py: -------------------------------------------------------------------------------- 1 | from acmeproxy.acmeproxy import settings # noqa: F401 2 | from acmeproxy.acmeproxy.settings import * # noqa: F401, F403 3 | 4 | ## Configuration to change when deploying acmeproxy 5 | 6 | LANGUAGE_CODE = "en-nz" 7 | TIME_ZONE = "Pacific/Auckland" 8 | SECRET_KEY = ( 9 | "set this to something random (e.g. dd if=/dev/urandom bs=1 count=16 | xxd -ps)" 10 | ) 11 | ALLOWED_HOSTS = [] 12 | 13 | ACMEPROXY_SOA_HOSTNAME = "acme-proxy-ns1.example.com" 14 | ACMEPROXY_SOA_CONTACT = "hostmaster.example.com" 15 | 16 | # if this is None then no authentication is required to request an authorisation for a name 17 | ACMEPROXY_AUTHORISATION_CREATION_SECRETS = None 18 | 19 | # otherwise you can set up API keys like so... 20 | # 21 | # ACMEPROXY_AUTHORISATION_CREATION_SECRETS = { 22 | # 'dbb62ae39642b9d2e81ee7a5e5e8d175': { 23 | # 'name': 'operations-team', 24 | # 'permit': ['example.com', '.example.org'], <--- optional list of valid names 25 | # } 26 | # '18084e750a1cff6f2d627e7a568ab81a': { 27 | # 'name': 'developers', 28 | # } 29 | # } 30 | -------------------------------------------------------------------------------- /plugins/acmeproxy-certbot.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | 3 | """ 4 | acmeproxy dns-01 hook for 5 | Michael Fincham 6 | 7 | Usage 8 | ----- 9 | 10 | Create a cli.ini for certbot in /etc/letsencrypt/cli.ini: 11 | 12 | rsa-key-size = 4096 13 | preferred-challenges = dns 14 | manual-auth-hook = /opt/acmeproxy/acmeproxy-certbot.py auth 15 | manual-cleanup-hook = /opt/acmeproxy/acmeproxy-certbot.py cleanup 16 | manual-public-ip-logging-ok = True 17 | 18 | And create a configuration file in /etc/acmeproxy.ini: 19 | 20 | [defaults] 21 | endpoint=https://acme-proxy-ns1.example.com 22 | 23 | [domain:example.org] 24 | secret=786575b19e29abcad093c8af793a4e2b 25 | 26 | [domain:example.net] 27 | secret=f3073e829c8b4dc40e906f084069d75c 28 | 29 | Make sure the acmeproxy.ini file isn't world readable, then run certbot 30 | with the options necessary in your environment, e.g. 31 | 32 | certbot --manual --installer=apache 33 | """ 34 | 35 | import argparse 36 | import configparser 37 | import os 38 | import stat 39 | import sys 40 | 41 | import requests 42 | 43 | 44 | class AcmeproxyClient(object): 45 | def __init__(self, endpoint, secret, domain, challenge): 46 | self.endpoint = endpoint 47 | self.secret = secret 48 | self.domain = domain 49 | self.challenge = challenge 50 | 51 | def publish_record(self, challenge): 52 | print( 53 | requests.post( 54 | "%s/publish_response" % (self.endpoint,), 55 | data={ 56 | "name": self.domain, 57 | "secret": self.secret, 58 | "response": self.challenge, 59 | }, 60 | ).text 61 | ) 62 | 63 | def delete_record(self): 64 | print( 65 | requests.post( 66 | "%s/expire_response" % (self.endpoint,), 67 | data={"name": self.domain, "secret": self.secret}, 68 | ).text 69 | ) 70 | 71 | 72 | if __name__ == "__main__": 73 | parser = argparse.ArgumentParser( 74 | description=__doc__, formatter_class=argparse.RawTextHelpFormatter 75 | ) 76 | parser.add_argument( 77 | "--configuration-path", 78 | metavar="PATH", 79 | type=str, 80 | default="/etc/acmeproxy.ini", 81 | help="path to the configuration file, defaults to /etc/acmeproxy.ini", 82 | ) 83 | parser.add_argument( 84 | "hook", metavar="HOOK", type=str, help="hook to execute, either auth or cleanup" 85 | ) 86 | args = parser.parse_args() 87 | config = configparser.ConfigParser() 88 | 89 | try: 90 | try: 91 | if os.stat(args.configuration_path).st_mode & stat.S_IROTH: 92 | sys.stderr.write( 93 | "error: configuration is world readable, fix the file permissions and re-create exposed keys" 94 | ) 95 | sys.exit(1) 96 | except FileNotFoundError: 97 | sys.stderr.write( 98 | "error: configuration file '%s' does not exist\n" 99 | % args.configuration_path 100 | ) 101 | sys.exit(1) 102 | else: 103 | if not os.access(args.configuration_path, os.R_OK): 104 | raise 105 | config.read(args.configuration_path) 106 | except: 107 | sys.stderr.write( 108 | "error: unable to read the configuration file from '%s'\n" 109 | % args.configuration_path 110 | ) 111 | sys.exit(1) 112 | 113 | try: 114 | domain = os.environ["CERTBOT_DOMAIN"].lower() 115 | challenge = os.environ["CERTBOT_VALIDATION"] 116 | except: 117 | sys.stderr.write( 118 | "error: CERTBOT_DOMAIN and CERTBOT_VALIDATION must be set in the environment\n" 119 | ) 120 | sys.exit(1) 121 | 122 | section_pattern = "domain:" 123 | all_domain_metadata = {} 124 | for section in config.sections(): 125 | if not section.lower().startswith(section_pattern): 126 | continue 127 | section_domain = section[len(section_pattern) :].lower() 128 | all_domain_metadata[section_domain] = { 129 | "endpoint": config[section].get( 130 | "endpoint", config.get("defaults", "endpoint", fallback=None) 131 | ), 132 | "secret": config[section].get( 133 | "secret", config.get("defaults", "secret", fallback=None) 134 | ), 135 | } 136 | 137 | if domain not in all_domain_metadata: 138 | sys.stderr.write( 139 | "error: domain '%s' not found in configuration file\n" % domain 140 | ) 141 | sys.exit(1) 142 | 143 | domain_metadata = all_domain_metadata[domain] 144 | if domain_metadata["secret"] is None or domain_metadata["endpoint"] is None: 145 | sys.stderr.write( 146 | "error: domain '%s' is missing required configuration, 'endpoint' and 'secret' must be configured\n" 147 | % domain 148 | ) 149 | sys.exit(1) 150 | 151 | client = AcmeproxyClient( 152 | domain_metadata["endpoint"], domain_metadata["secret"], domain, challenge 153 | ) 154 | 155 | if args.hook == "auth": 156 | client.publish_record(challenge) 157 | elif args.hook == "cleanup": 158 | client.delete_record() 159 | else: 160 | sys.stderr.write("error: unhandled hook '%s'\n" % args.hook) 161 | sys.exit(2) 162 | -------------------------------------------------------------------------------- /plugins/acmeproxy-dehydrated-multiple-domains.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # acmeproxy dns-01 hook for 4 | # Michael Fincham 5 | # Grant McLean 6 | # 7 | # This example hook looks up mappings between domain names and their respective authorisation keys in 8 | # a file (for instance, /etc/acmeproxy-keys). The file should have a line format like: 9 | # 10 | # example.com 0ceefa693a2e8ca6fa4fa33570d9cda3 11 | # 12 | # Where each domain is followed by whitespace and then the domain's authorisation key. 13 | # 14 | # Usage: 15 | # dehydrated -c -t dns-01 -k ./acmeproxy-dehydrated-multiple-domains.sh -d example.com 16 | 17 | endpoint=https://acme-proxy-ns1.example.com 18 | secret=$(awk "\$1 == \"${2}\" {print \$2}" /etc/acmeproxy-keys) 19 | if [ -n "${2}" -a -z "${secret}" ]; then 20 | echo "No secret key for host '$2'" 21 | exit 1 22 | fi 23 | 24 | case ${1} in 25 | deploy_challenge) 26 | echo " + Publishing challenge for ${2} to ${endpoint}..." 27 | if curl --silent --data "secret=${secret}&name=${2}&response=${4}" ${endpoint}/publish_response | grep 'published' >/dev/null 2>&1; then 28 | echo " + Published successfully!" 29 | else 30 | echo "ERROR: Could not publish challenge." 31 | exit 1 32 | fi 33 | ;; 34 | clean_challenge) 35 | echo " + Expiring challenges for ${2} at ${endpoint}..." 36 | if curl --silent --data "secret=${secret}&name=${2}" ${endpoint}/expire_response | grep 'expired' >/dev/null 2>&1; then 37 | echo " + Expired successfully!" 38 | else 39 | echo "ERROR: Could not expire challenges." 40 | exit 1 41 | fi 42 | ;; 43 | deploy_cert) 44 | echo " + This DNS hook cannot deploy certificates. Certificate will need to be manually deployed!" 45 | ;; 46 | startup_hook) 47 | ;; 48 | exit_hook) 49 | ;; 50 | *_cert) 51 | ;; 52 | *) 53 | echo "dehydrated requested an unknown hook action: ${1}" 54 | ;; 55 | esac 56 | -------------------------------------------------------------------------------- /plugins/acmeproxy-dehydrated.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # acmeproxy dns-01 hook for 4 | # Michael Fincham 5 | # 6 | # Usage: 7 | # dehydrated -c -t dns-01 -k ./acmeproxy-dehydrated.sh -d example.com 8 | 9 | endpoint=https://acme-proxy-ns1.example.com 10 | secret=52f562aedc99383c6af848bc7016380a 11 | 12 | case ${1} in 13 | deploy_challenge) 14 | echo " + Publishing challenge for ${2} to ${endpoint}..." 15 | if curl --silent --data "secret=${secret}&name=${2}&response=${4}" ${endpoint}/publish_response | grep 'published' >/dev/null 2>&1; then 16 | echo " + Published successfully!" 17 | else 18 | echo "ERROR: Could not publish challenge." 19 | exit 1 20 | fi 21 | ;; 22 | clean_challenge) 23 | echo " + Expiring challenges for ${2} at ${endpoint}..." 24 | if curl --silent --data "secret=${secret}&name=${2}" ${endpoint}/expire_response | grep 'expired' >/dev/null 2>&1; then 25 | echo " + Expired successfully!" 26 | else 27 | echo "ERROR: Could not expire challenges." 28 | exit 1 29 | fi 30 | ;; 31 | deploy_cert) 32 | echo " + This DNS hook cannot deploy certificates. Certificate will need to be manually deployed!" 33 | ;; 34 | startup_hook) 35 | ;; 36 | exit_hook) 37 | ;; 38 | *_cert) 39 | ;; 40 | *) 41 | echo "letsencrypt.sh requested an unknown hook action: ${1}" 42 | ;; 43 | esac 44 | -------------------------------------------------------------------------------- /pyproject.toml: -------------------------------------------------------------------------------- 1 | [build-system] 2 | requires = ["setuptools", "wheel"] 3 | build-backend = "setuptools.build_meta:__legacy__" -------------------------------------------------------------------------------- /pytest.ini: -------------------------------------------------------------------------------- 1 | [pytest] 2 | #DJANGO_SETTINGS_MODULE = tiaki.accounts.test_settings 3 | python_files = tests.py test_*.py *_tests.py 4 | testpaths = acmeproxy 5 | django_find_project = false 6 | 7 | xfail_strict=true 8 | 9 | addopts = --cov-config .coveragerc 10 | --cov acmeproxy 11 | --fail-on-template-vars 12 | --strict 13 | --strict-markers 14 | 15 | markers = 16 | django_db 17 | -------------------------------------------------------------------------------- /setup.py: -------------------------------------------------------------------------------- 1 | from setuptools import find_packages, setup 2 | 3 | requirements = ["django~=2.2.0", "djangorestframework~=3.11.0", "tabulate"] 4 | 5 | 6 | packages = find_packages( 7 | where="./", 8 | include=["acmeproxy", "acmeproxy.*"], 9 | ) 10 | if not packages: 11 | raise ValueError("No packages detected.") 12 | 13 | setup( 14 | name="acmeproxy", 15 | version="0.1", 16 | description="PowerDNS backend for serving ACME dns-01 challenge responses", 17 | url="https://github.com/catalyst/acmeproxy/", 18 | author="Catalyst.net.nz Ltd.", 19 | author_email="opsdev@catalyst.net.nz", 20 | python_requires=">=3.6", 21 | license="GPLv3", 22 | package_dir={"acmeproxy": "acmeproxy"}, 23 | packages=packages, 24 | install_requires=requirements, 25 | zip_safe=False, 26 | include_package_data=True, 27 | classifiers=[ 28 | "Development Status :: 3 - Alpha", 29 | "Natural Language :: English", 30 | "Operating System :: OS Independent", 31 | "Programming Language :: Python", 32 | "Programming Language :: Python :: 3", 33 | "Programming Language :: Python :: 3 :: Only", 34 | "Programming Language :: Python :: 3.6", 35 | "Programming Language :: Python :: 3.7", 36 | ], 37 | ) 38 | --------------------------------------------------------------------------------