mirror of
https://github.com/acmesh-official/acme.sh.git
synced 2026-08-13 12:33:30 +02:00
698f6c7329
* feat: add Shelly Gen3+ deploy hook with RFC 7616 HTTP Digest auth
Adds deploy/shelly.sh for deploying Let's Encrypt HTTPS server certificates
to Shelly Gen3+ devices (Gen4 tested) via JSON-RPC over HTTP.
- RFC 7616 SHA-256 HTTP Digest authentication (Authorization header)
- Uploads fullchain.pem and private key via Shelly.PutHTTPServerCert / PutHTTPServerKey
- Auto-reboot support (SHELLY_REBOOT to disable)
- Auth auto-detection: no password = no auth, password = Digest
- Nonce counter (nc) increments per request per RFC 7616
- Tested against Shelly 2PM Gen4 (firmware 2.0.0)
Also adds deploy/test_shelly.sh for self-testing the hook logic without
a real device (mocked _post).
* fix: address review feedback on shelly deploy hook
- Fix _secure_debug calls to use two arguments (label + value)
- Remove bash-only $RANDOM cnonce fallback; openssl always available
- Parse $HTTP_HEADER directly instead of raw curl re-request
- Detect auth via HTTP 401 status line, not empty response body
- Route reboot through _shelly_rpc to rebuild auth header with correct nc
- Remove export HTTPS_INSECURE=1 (no-op for http://, leaks to other hooks)
- Clear _H1 before returning from shelly_deploy
- Prefix all helper variables with _shelly_ to avoid namespace collisions
- Delete deploy/test_shelly.sh (deploy/ files become hook names)
- Fix missing trailing newline
* fix: validate shelly JSON-RPC responses are valid JSON
Non-JSON responses like HTTP 429 'Too Many Requests' would pass
the empty-response and '"error"' checks and be reported as success.
Now reject any response that doesn't start with '{' and contain '"id"'.
* fix: add 1s delay between shelly cert/key clear and upload calls
The Shelly device has a race condition where uploading data immediately
after clearing the existing cert/key returns -103 'Missing required
argument data!'. A 1-second delay fixes this.
* fix: remove clear-before-upload in shelly deploy hook
Shelly auto-removes all three TLS files (cert, key, CA bundle) when any
single one is cleared. The old sequence clear-cert → upload-cert →
clear-key → upload-key resulted in the key clear wiping the newly
uploaded cert, leaving only the key at boot time. The mbedtls
pk_check_pair then silently skipped the HTTPS listener.
Fix: just upload directly (overwrite in place). No clearing needed.
* Fix ShellCheck SC2090 and shfmt in shelly deploy hook
SC2090: false positive on export _H1 (used quoted in _post)
shfmt: no space after "<" in _json_encode redirects
* moved two lines to cover the whole if block
---------
Co-authored-by: neil <github@neilpang.com>
Co-authored-by: cysimons <cysimons@cisco.com>
|
||
|---|---|---|
| .. | ||
| ali_cdn.sh | ||
| ali_dcdn.sh | ||
| apache.sh | ||
| baidu_cdn.sh | ||
| byteplus_alb.sh | ||
| cachefly.sh | ||
| cleverreach.sh | ||
| consul.sh | ||
| cpanel_uapi.sh | ||
| directadmin.sh | ||
| docker.sh | ||
| dovecot.sh | ||
| edgio.sh | ||
| exim4.sh | ||
| fortigate.sh | ||
| fritzbox.sh | ||
| gcore_cdn.sh | ||
| gitlab.sh | ||
| haproxy.sh | ||
| kemplm.sh | ||
| keychain.sh | ||
| keyhelp.sh | ||
| keyhelp_api.sh | ||
| kong.sh | ||
| lighttpd.sh | ||
| localcopy.sh | ||
| mailcow.sh | ||
| multideploy.sh | ||
| myapi.sh | ||
| mydevil.sh | ||
| mysqld.sh | ||
| netlify.sh | ||
| nginx.sh | ||
| openmediavault.sh | ||
| opensshd.sh | ||
| openstack.sh | ||
| panos.sh | ||
| peplink.sh | ||
| proxmoxbs.sh | ||
| proxmoxve.sh | ||
| pureftpd.sh | ||
| qiniu.sh | ||
| README.md | ||
| routeros.sh | ||
| ruckus.sh | ||
| shelly.sh | ||
| ssh.sh | ||
| strongswan.sh | ||
| synology_dsm.sh | ||
| truenas.sh | ||
| truenas_ws.sh | ||
| unifi.sh | ||
| vault.sh | ||
| vault_cli.sh | ||
| vsftpd.sh | ||
| windows_rdp.sh | ||
| zyxel_gs1900.sh | ||