|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 |
# install ZNC apt install znc useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc sudo -u znc /usr/bin/znc --datadir=/var/lib/znc --makeconf # Note: you need to finish interactive config wizard here # set up dehydrated with CloudFlare DNS support apt install curl python3 python3-pip cd /usr/local/src git clone https://github.com/lukas2511/dehydrated git clone https://github.com/kappataumu/letsencrypt-cloudflare-hook addgroup letsencrypt adduser root letsencrypt adduser znc letsencrypt chgrp letsencrypt dehydrated/dehydrated chmod 2755 dehydrated/dehydrated sed -i "s/python/python3/g" letsencrypt-cloudflare-hook/hook.py pip3 install -r letsencrypt-cloudflare-hook/requirements.py mkdir -p /etc/dehyderated/accounts chgrp letsencrypt -R /etc/dehyderated chmod g+rwx -R /etc/dehyderated # config dehydrated cat > /etc/dehydrated/config <<EOF export CF_KEY='your_cloudflare_api_key' EOF chmod 640 /etc/dehydrated/config # set up initial certificate mkdir -p /etc/znc/cert chown znc:znc -R /etc/znc chgrp letsencrypt /etc/znc/cert /usr/local/src/dehydrated/dehydrated --cron --domain example.com --challenge dns-01 -k '/usr/local/src/letsencrypt-cloudflare-hook/hook.py' --out /etc/znc/cert --accept-terms rm /var/lib/znc/znc.pem touch /var/lib/znc/znc.pem chown znc:znc /var/lib/znc/znc.pem # set up systemd service cat > /etc/systemd/system/znc.service <<EOF [Unit] Description=ZNC, an advanced IRC bouncer After=network-online.target znc-update-cert.service [Service] ExecStart=/usr/bin/znc -f --datadir=/var/lib/znc User=znc [Install] WantedBy=multi-user.target EOF cat > /etc/systemd/system/znc-update-cert.service <<EOF [Unit] Description=Update SSL certificate for ZNC After=network-online.target [Service] ExecStart=/bin/bash -c "(/usr/local/src/dehydrated/dehydrated --cron --domain irc.swineson.me --challenge dns-01 -k '/usr/local/src/letsencrypt-cloudflare-hook/hook.py' --out /etc/znc/cert --accept-terms || /bin/true) && cat /etc/znc/cert/irc.swineson.me/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem" User=znc Type=oneshot [Install] WantedBy=multi-user.target EOF cat > /etc/systemd/system/znc-update-cert.timer <<EOF [Unit] Description=Update ZNC SSL certificate automatically [Timer] OnBootSec=5min OnUnitInactiveSec=1d Unit=znc-update-cert.service [Install] WantedBy=timers.target EOF # start everything systemctl daemon-reload systemctl start znc.service znc-update-cert.service znc-update-cert.timer systemctl enable znc.service znc-update-cert.service znc-update-cert.timer |