totoro: remove cloudflare credentials from raritan-sslrenew

ops/nixos/totoro/default.nix

@@ -481,8 +481,7 @@ in {
       ExecStart = "${depot.ops.raritan.ssl-renew}/lego.sh";
       EnvironmentFile = pkgs.writeText "sslrenew-secret" ''
         CERTIFICATE_DOMAIN=kvm.lukegb.xyz
-        LETSENCRYPT_EMAIL=letsencrypt@lukegb.com
+        CERTIFICATE_ROLE=letsencrypt-cloudflare
-        CF_DNS_API_TOKEN=${secrets.cloudflareCredentials.token}
         RARITAN_IP=192.168.1.50
         RARITAN_USERNAME=${secrets.raritan.sslrenew.username}
         RARITAN_PASSWORD=${secrets.raritan.sslrenew.password}

ops/raritan/ssl-renew/default.nix

@@ -5,7 +5,7 @@
 { depot, pkgs, ... }:
 
 pkgs.runCommandNoCC "raritan-update" {
-  inherit (pkgs) lego curl;
+  inherit (pkgs) curl jq;
 } ''
   mkdir $out
   substituteAll ${./deploy.sh} $out/deploy.sh

ops/raritan/ssl-renew/lego.sh

@@ -2,23 +2,30 @@
 
 set -euo pipefail
 
-export LEGO_FLAGS="\
+CERTIFICATE_JSON="$(@curl@/bin/curl \
-  	--accept-tos \
+	-H "X-Vault-Request: true" \
-  	--dns cloudflare \
+	-X PUT \
-  	--dns.resolvers 1.1.1.1 \
+	-d "{\"common_name\": \"${CERTIFICATE_DOMAIN}\"}" \
-  	--domains "${CERTIFICATE_DOMAIN}" \
+	"http://localhost:8200/v1/acme/certs/${CERTIFICATE_ROLE}")"
-  	--key-type rsa4096 \
-  	--email "${LETSENCRYPT_EMAIL}" \
-	"
 
-if ! [[ -f .lego/certificates/${CERTIFICATE_DOMAIN}.crt ]]; then
+if [[ "$(@jq@/bin/jq .errors <(echo "$CERTIFICATE_JSON") 2>/dev/null)" != "null" ]]; then
-  exec @lego@/bin/lego \
+	@jq@/bin/jq .errors <(echo "$CERTIFICATE_JSON") >&2
-	$LEGO_FLAGS \
+	exit 1
-  	run \
-  	--run-hook="@out@/deploy.sh"
 fi
 
-exec @lego@/bin/lego \
+temp_dir=$(mktemp -d)
-	$LEGO_FLAGS \
+trap "rm -rf $temp_dir" INT TERM HUP EXIT
-	renew \
+
-	--renew-hook="@out@/deploy.sh"
+@jq@/bin/jq -r .data.cert <(echo "$CERTIFICATE_JSON") > "$temp_dir/cert.pem"
+@jq@/bin/jq -r .data.private_key <(echo "$CERTIFICATE_JSON") > "$temp_dir/pkey.pem"
+
+@curl@/bin/curl -k \
+	--user "${RARITAN_USERNAME}:${RARITAN_PASSWORD}" \
+	-F cert_file=@"$temp_dir/cert.pem" \
+	-F key_file=@"$temp_dir/pkey.pem" \
+	"https://${RARITAN_IP}/cgi-bin/server_ssl_cert_upload.cgi"
+@curl@/bin/curl -k \
+	--user "${RARITAN_USERNAME}:${RARITAN_PASSWORD}" \
+	"https://${RARITAN_IP}/bulk" \
+	-H 'Content-Type: application/json; charset=UTF-8' \
+	--data-binary '{"jsonrpc":"2.0","method":"performBulk","params":{"requests":[{"rid":"/server_ssl_cert","json":{"jsonrpc":"2.0","method":"installPendingKeyPair","params":null,"id":1}}]},"id":2}'