#!/bin/sh
# MDChallengeDns01 hook for Apache mod_md — publishes the DNS-01 challenge TXT via acme-dns.
#
# CRITICAL (learned the hard way, see POSTMORTEM §3): mod_md runs this hook as the
# Apache run-user (www-data) with an EMPTY $PATH. Therefore:
# - this file must be executable by www-data -> chmod 755
# - the creds file must be readable by www-data -> chown root:www-data, chmod 640
# - set an explicit PATH and use ABSOLUTE binaries (bare curl/sed won't resolve)
# Verify as the real user: sudo -u www-data /etc/apache2/acme-dns-hook.sh setup 7rnx.net <43charToken>
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export PATH
CREDS=/etc/acme-dns/7rnx.json # {"username":..,"password":..,"subdomain":..}
ACTION="$1"; shift; for VALUE in "$@"; do :; done # last arg = challenge token
[ "$ACTION" = "setup" ] || exit 0 # teardown: acme-dns keeps last 2, no-op
U=$(/usr/bin/sed -n 's/.*"username":"\([^"]*\)".*/\1/p' "$CREDS")
P=$(/usr/bin/sed -n 's/.*"password":"\([^"]*\)".*/\1/p' "$CREDS")
S=$(/usr/bin/sed -n 's/.*"subdomain":"\([^"]*\)".*/\1/p' "$CREDS")
/usr/bin/curl -fsS -X POST https://auth.acme-dns.io/update \
-H "X-Api-User: $U" -H "X-Api-Key: $P" \
--data "{\"subdomain\":\"$S\",\"txt\":\"$VALUE\"}" >/dev/null