letsencrypt-tools/install.sh

#!/bin/bash
#
# letsencrypt-tools
# https://git.stack-source.com/msb/letsencrypt-tools
# Copyright (c) 2022 Matthew Saunders Brown <matthewsaundersbrown@gmail.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
#
# must be root
if [ "${EUID}" -ne 0 ]; then
  echo "You must be root to run this installer."
  exit
fi

# check for existing Let's Encrypt install
if [ -d "/etc/letsencrypt/" ]; then
  echo "WARNING: Let's Encrypt is already installed."
  echo "This installer will overwrite existing configurations."
  echo -e "You have five seconds to execute ctrl-c to cancel this install.\a"
  sleep 5
fi

apt-get update
DEBIAN_FRONTEND=noninteractive apt-get -y install python3-certbot-apache

mkdir /etc/ssl/letsencrypt
chmod 750 /etc/ssl/letsencrypt
chgrp ssl-cert /etc/ssl/letsencrypt

# Let's Encrypt configurations
cp etc/letsencrypt/cli.ini /etc/letsencrypt/cli.ini
chmod 644 /etc/letsencrypt/cli.ini
chown root:root /etc/letsencrypt/cli.ini
mkdir -p /etc/letsencrypt/renewal-hooks/deploy/
cp etc/letsencrypt/renewal-hooks/deploy/cp-to-etc-ssl.sh /etc/letsencrypt/renewal-hooks/deploy/cp-to-etc-ssl.sh
chmod 750 /etc/letsencrypt/renewal-hooks/deploy/cp-to-etc-ssl.sh
chown root:root /etc/letsencrypt/renewal-hooks/deploy/cp-to-etc-ssl.sh
mkdir -p /etc/letsencrypt/renewal-hooks/post/
cp etc/letsencrypt/renewal-hooks/post/reload-services.sh /etc/letsencrypt/renewal-hooks/post/reload-services.sh
chmod 750 /etc/letsencrypt/renewal-hooks/post/reload-services.sh
chown root:root /etc/letsencrypt/renewal-hooks/post/reload-services.sh

cp etc/apache2/conf-available/certbot.conf /etc/apache2/conf-available/certbot.conf
a2enmod --quiet proxy proxy_http
a2enconf --quiet certbot
systemctl restart apache2

# install Let's Encrypt user scripts
cp bin/letsencrypt-* /usr/local/bin
chmod 755 /usr/local/bin/letsencrypt-*

# install Deploy tools used by vpanel-stack
cp sbin/letsencrypt-deploy.sh /usr/local/sbin/
chmod 750 /usr/local/sbin/letsencrypt-deploy.sh
cp systemd/letsencrypt-* /usr/local/lib/systemd/system/
chmod 644 /usr/local/lib/systemd/system/letsencrypt-*
systemctl daemon-reload
systemctl enable --now letsencrypt-deploy.path

echo
fqdn=`hostname -f`
if [ -n "$fqdn" ]; then
  echo "email = webmaster@$fqdn" >> /etc/letsencrypt/cli.ini
  echo "Let's Encrypt email set to webmaster@$fqdn"
  echo "This can be changed by editing /etc/letsencrypt/cli.ini."
else
  echo "Server DNS domain name not set, Let's Encrypt email setting left unconfigured."
fi