From c127903127077ac4ed515a0ed28cfac6384e88f4 Mon Sep 17 00:00:00 2001
From: Benoit Garret <benoit.garret@gadz.org>
Date: Tue, 27 Apr 2021 16:03:40 +0200
Subject: [PATCH 01/15] Add Consul deploy hook

---
 deploy/consul.sh | 98 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 98 insertions(+)
 create mode 100644 deploy/consul.sh

diff --git a/deploy/consul.sh b/deploy/consul.sh
new file mode 100644
index 00000000..97aad380
--- /dev/null
+++ b/deploy/consul.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env sh
+
+# Here is a script to deploy cert to hashicorp consul using curl
+# (https://www.consul.io/)
+#
+# it requires following environment variables:
+#
+# CONSUL_PREFIX - this contains the prefix path in consul
+# CONSUL_HTTP_ADDR - consul requires this to find your consul server
+#
+# additionally, you need to ensure that CONSUL_HTTP_TOKEN is available
+# to access the consul server
+
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+consul_deploy() {
+
+	_cdomain="$1"
+	_ckey="$2"
+	_ccert="$3"
+	_cca="$4"
+	_cfullchain="$5"
+
+	_debug _cdomain "$_cdomain"
+	_debug _ckey "$_ckey"
+	_debug _ccert "$_ccert"
+	_debug _cca "$_cca"
+	_debug _cfullchain "$_cfullchain"
+
+	# validate required env vars
+	_getdeployconf CONSUL_PREFIX
+	if [ -z "$CONSUL_PREFIX" ]; then
+		_err "CONSUL_PREFIX needs to be defined (contains prefix path in vault)"
+		return 1
+	fi
+	_savedeployconf CONSUL_PREFIX "$CONSUL_PREFIX"
+
+	_getdeployconf CONSUL_HTTP_ADDR
+	if [ -z "$CONSUL_HTTP_ADDR" ]; then
+		_err "CONSUL_HTTP_ADDR needs to be defined (contains consul connection address)"
+		return 1
+	fi
+	_savedeployconf CONSUL_HTTP_ADDR "$CONSUL_HTTP_ADDR"
+
+	CONSUL_CMD=$(command -v consul)
+
+	# force CLI, but the binary does not exist => error
+	if [ -n "$USE_CLI" ] && [ -z "$CONSUL_CMD" ]; then
+		_err "Cannot find the consul binary!"
+		return 1
+	fi
+
+	# use the CLI first
+	if [ -n "$USE_CLI" ] || [ -n "$CONSUL_CMD" ]; then
+		_info "Found consul binary, deploying with CLI"
+		consul_deploy_cli "$CONSUL_CMD" "$CONSUL_PREFIX"
+	else
+		_info "Did not find consul binary, deploying with API"
+		consul_deploy_api "$CONSUL_HTTP_ADDR" "$CONSUL_PREFIX" "$CONSUL_HTTP_TOKEN"
+	fi
+}
+
+consul_deploy_api() {
+	CONSUL_HTTP_ADDR="$1"
+	CONSUL_PREFIX="$2"
+	CONSUL_HTTP_TOKEN="$3"
+
+	URL="$CONSUL_HTTP_ADDR/v1/kv/$CONSUL_PREFIX"
+	export _H1="X-Consul-Token: $CONSUL_HTTP_TOKEN"
+
+	if [ -n "$FABIO" ]; then
+		_post "$(cat "$_cfullchain")" "$URL/${_cdomain}-cert.pem" '' "PUT" || return 1
+		_post "$(cat "$_ckey")" "$URL/${_cdomain}-key.pem" '' "PUT" || return 1
+	else
+		_post "$(cat "$_ccert")" "$URL/${_cdomain}/cert.pem" '' "PUT" || return 1
+		_post "$(cat "$_ckey")" "$URL/${_cdomain}/cert.key" '' "PUT" || return 1
+		_post "$(cat "$_cca")" "$URL/${_cdomain}/chain.pem" '' "PUT" || return 1
+		_post "$(cat "$_cfullchain")" "$URL/${_cdomain}/fullchain.pem" '' "PUT" || return 1
+	fi
+}
+
+consul_deploy_cli() {
+	CONSUL_CMD="$1"
+	CONSUL_PREFIX="$2"
+
+	if [ -n "$FABIO" ]; then
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-cert.pem" @"$_cfullchain" || return 1
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-key.pem" @"$_ckey" || return 1
+	else
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.pem" value=@"$_ccert" || return 1
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.key" value=@"$_ckey" || return 1
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/chain.pem" value=@"$_cca" || return 1
+		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/fullchain.pem" value=@"$_cfullchain" || return 1
+	fi
+}

From 07afc4953ada485b51d514fc65b80c00669f751b Mon Sep 17 00:00:00 2001
From: Benoit Garret <benoit.garret@gadz.org>
Date: Fri, 7 May 2021 12:12:30 +0200
Subject: [PATCH 02/15] Fix the shfmt check

---
 deploy/consul.sh | 124 +++++++++++++++++++++++------------------------
 1 file changed, 62 insertions(+), 62 deletions(-)

diff --git a/deploy/consul.sh b/deploy/consul.sh
index 97aad380..f93fb452 100644
--- a/deploy/consul.sh
+++ b/deploy/consul.sh
@@ -18,81 +18,81 @@
 #domain keyfile certfile cafile fullchain
 consul_deploy() {
 
-	_cdomain="$1"
-	_ckey="$2"
-	_ccert="$3"
-	_cca="$4"
-	_cfullchain="$5"
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
 
-	_debug _cdomain "$_cdomain"
-	_debug _ckey "$_ckey"
-	_debug _ccert "$_ccert"
-	_debug _cca "$_cca"
-	_debug _cfullchain "$_cfullchain"
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
 
-	# validate required env vars
-	_getdeployconf CONSUL_PREFIX
-	if [ -z "$CONSUL_PREFIX" ]; then
-		_err "CONSUL_PREFIX needs to be defined (contains prefix path in vault)"
-		return 1
-	fi
-	_savedeployconf CONSUL_PREFIX "$CONSUL_PREFIX"
+  # validate required env vars
+  _getdeployconf CONSUL_PREFIX
+  if [ -z "$CONSUL_PREFIX" ]; then
+    _err "CONSUL_PREFIX needs to be defined (contains prefix path in vault)"
+    return 1
+  fi
+  _savedeployconf CONSUL_PREFIX "$CONSUL_PREFIX"
 
-	_getdeployconf CONSUL_HTTP_ADDR
-	if [ -z "$CONSUL_HTTP_ADDR" ]; then
-		_err "CONSUL_HTTP_ADDR needs to be defined (contains consul connection address)"
-		return 1
-	fi
-	_savedeployconf CONSUL_HTTP_ADDR "$CONSUL_HTTP_ADDR"
+  _getdeployconf CONSUL_HTTP_ADDR
+  if [ -z "$CONSUL_HTTP_ADDR" ]; then
+    _err "CONSUL_HTTP_ADDR needs to be defined (contains consul connection address)"
+    return 1
+  fi
+  _savedeployconf CONSUL_HTTP_ADDR "$CONSUL_HTTP_ADDR"
 
-	CONSUL_CMD=$(command -v consul)
+  CONSUL_CMD=$(command -v consul)
 
-	# force CLI, but the binary does not exist => error
-	if [ -n "$USE_CLI" ] && [ -z "$CONSUL_CMD" ]; then
-		_err "Cannot find the consul binary!"
-		return 1
-	fi
+  # force CLI, but the binary does not exist => error
+  if [ -n "$USE_CLI" ] && [ -z "$CONSUL_CMD" ]; then
+    _err "Cannot find the consul binary!"
+    return 1
+  fi
 
-	# use the CLI first
-	if [ -n "$USE_CLI" ] || [ -n "$CONSUL_CMD" ]; then
-		_info "Found consul binary, deploying with CLI"
-		consul_deploy_cli "$CONSUL_CMD" "$CONSUL_PREFIX"
-	else
-		_info "Did not find consul binary, deploying with API"
-		consul_deploy_api "$CONSUL_HTTP_ADDR" "$CONSUL_PREFIX" "$CONSUL_HTTP_TOKEN"
-	fi
+  # use the CLI first
+  if [ -n "$USE_CLI" ] || [ -n "$CONSUL_CMD" ]; then
+    _info "Found consul binary, deploying with CLI"
+    consul_deploy_cli "$CONSUL_CMD" "$CONSUL_PREFIX"
+  else
+    _info "Did not find consul binary, deploying with API"
+    consul_deploy_api "$CONSUL_HTTP_ADDR" "$CONSUL_PREFIX" "$CONSUL_HTTP_TOKEN"
+  fi
 }
 
 consul_deploy_api() {
-	CONSUL_HTTP_ADDR="$1"
-	CONSUL_PREFIX="$2"
-	CONSUL_HTTP_TOKEN="$3"
+  CONSUL_HTTP_ADDR="$1"
+  CONSUL_PREFIX="$2"
+  CONSUL_HTTP_TOKEN="$3"
 
-	URL="$CONSUL_HTTP_ADDR/v1/kv/$CONSUL_PREFIX"
-	export _H1="X-Consul-Token: $CONSUL_HTTP_TOKEN"
+  URL="$CONSUL_HTTP_ADDR/v1/kv/$CONSUL_PREFIX"
+  export _H1="X-Consul-Token: $CONSUL_HTTP_TOKEN"
 
-	if [ -n "$FABIO" ]; then
-		_post "$(cat "$_cfullchain")" "$URL/${_cdomain}-cert.pem" '' "PUT" || return 1
-		_post "$(cat "$_ckey")" "$URL/${_cdomain}-key.pem" '' "PUT" || return 1
-	else
-		_post "$(cat "$_ccert")" "$URL/${_cdomain}/cert.pem" '' "PUT" || return 1
-		_post "$(cat "$_ckey")" "$URL/${_cdomain}/cert.key" '' "PUT" || return 1
-		_post "$(cat "$_cca")" "$URL/${_cdomain}/chain.pem" '' "PUT" || return 1
-		_post "$(cat "$_cfullchain")" "$URL/${_cdomain}/fullchain.pem" '' "PUT" || return 1
-	fi
+  if [ -n "$FABIO" ]; then
+    _post "$(cat "$_cfullchain")" "$URL/${_cdomain}-cert.pem" '' "PUT" || return 1
+    _post "$(cat "$_ckey")" "$URL/${_cdomain}-key.pem" '' "PUT" || return 1
+  else
+    _post "$(cat "$_ccert")" "$URL/${_cdomain}/cert.pem" '' "PUT" || return 1
+    _post "$(cat "$_ckey")" "$URL/${_cdomain}/cert.key" '' "PUT" || return 1
+    _post "$(cat "$_cca")" "$URL/${_cdomain}/chain.pem" '' "PUT" || return 1
+    _post "$(cat "$_cfullchain")" "$URL/${_cdomain}/fullchain.pem" '' "PUT" || return 1
+  fi
 }
 
 consul_deploy_cli() {
-	CONSUL_CMD="$1"
-	CONSUL_PREFIX="$2"
+  CONSUL_CMD="$1"
+  CONSUL_PREFIX="$2"
 
-	if [ -n "$FABIO" ]; then
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-cert.pem" @"$_cfullchain" || return 1
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-key.pem" @"$_ckey" || return 1
-	else
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.pem" value=@"$_ccert" || return 1
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.key" value=@"$_ckey" || return 1
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/chain.pem" value=@"$_cca" || return 1
-		$CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/fullchain.pem" value=@"$_cfullchain" || return 1
-	fi
+  if [ -n "$FABIO" ]; then
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-cert.pem" @"$_cfullchain" || return 1
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}-key.pem" @"$_ckey" || return 1
+  else
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.pem" value=@"$_ccert" || return 1
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/cert.key" value=@"$_ckey" || return 1
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/chain.pem" value=@"$_cca" || return 1
+    $CONSUL_CMD kv put "${CONSUL_PREFIX}/${_cdomain}/fullchain.pem" value=@"$_cfullchain" || return 1
+  fi
 }

From c0285fbc15e729096b59833395e70c2708af9322 Mon Sep 17 00:00:00 2001
From: Marcus Grando <marcus@sbh.eng.br>
Date: Thu, 10 Jun 2021 11:45:53 -0300
Subject: [PATCH 03/15] Added Azion DNS API

---
 dnsapi/dns_azion.sh | 258 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 258 insertions(+)
 create mode 100644 dnsapi/dns_azion.sh

diff --git a/dnsapi/dns_azion.sh b/dnsapi/dns_azion.sh
new file mode 100644
index 00000000..2c5e8fda
--- /dev/null
+++ b/dnsapi/dns_azion.sh
@@ -0,0 +1,258 @@
+#!/usr/bin/env sh
+
+#
+#AZION_Username=""
+#AZION_Password=""
+#AZION_Token=""
+#AZION_ZoneID=""
+#
+
+AZION_Api="https://api.azionapi.net"
+
+########  Public functions ########
+
+# Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+dns_azion_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  AZION_Username="${AZION_Username:-$(_readaccountconf_mutable AZION_Username)}"
+  AZION_Password="${AZION_Password:-$(_readaccountconf_mutable AZION_Password)}"
+  AZION_Token="${AZION_Token:-$(_readaccountconf_mutable AZION_Token)}"
+  AZION_ZoneID="${AZION_ZoneID:-$(_readaccountconf_mutable AZION_ZoneID)}"
+
+  if ! _contains "$AZION_Username" "@"; then
+    _err "It seems that the AZION_Username is not a valid email address. Revalidate your environments."
+    return 1
+  fi
+
+  if [ -z "$AZION_Token" ]; then
+    if [ -z "$AZION_Username" ] || [ -z "$AZION_Password" ]; then
+      _err "You didn't specified a AZION_Username/AZION_Password to generate Azion token."
+      return 1
+    fi
+    _get_token
+    AZION_Token="${AZION_Token:-$(_readaccountconf_mutable AZION_Token)}"
+  fi
+
+  _saveaccountconf_mutable AZION_Username "$AZION_Username"
+  _saveaccountconf_mutable AZION_Password "$AZION_Password"
+  _saveaccountconf_mutable AZION_Token "$AZION_Token"
+  _saveaccountconf_mutable AZION_ZoneID "$AZION_ZoneID"
+
+  _debug "Detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Domain not found"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+  _debug _domain_id "$_domain_id"
+
+  _info "Add or update record"
+  _get_record "$_sub_domain"
+  if [ "$record_id" ]; then
+    _payload="{\"record_type\": \"TXT\", \"entry\": \"$_sub_domain\", \"answers_list\": [$answers_list, \"$txtvalue\"], \"ttl\": 20}"
+    if _azion_rest PUT "intelligent_dns/$_domain_id/records/$record_id" "$_payload"; then
+      if _contains "$response" "$txtvalue"; then
+        _info "Record updated."
+        return 0
+      fi
+    fi
+  else
+    _payload="{\"record_type\": \"TXT\", \"entry\": \"$_sub_domain\", \"answers_list\": [\"$txtvalue\"], \"ttl\": 20}"
+    if _azion_rest POST "intelligent_dns/$_domain_id/records" "$_payload"; then
+      if _contains "$response" "$txtvalue"; then
+        _info "Record added."
+        return 0
+      fi
+    fi
+  fi
+  _err "Failed to add or update record."
+  return 1
+}
+
+# Usage: fulldomain txtvalue
+# Used to remove the txt record after validation
+dns_azion_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  AZION_Username="${AZION_Username:-$(_readaccountconf_mutable AZION_Username)}"
+  AZION_Password="${AZION_Password:-$(_readaccountconf_mutable AZION_Password)}"
+  AZION_Token="${AZION_Token:-$(_readaccountconf_mutable AZION_Token)}"
+  AZION_ZoneID="${AZION_ZoneID:-$(_readaccountconf_mutable AZION_ZoneID)}"
+
+  if ! _contains "$AZION_Username" "@"; then
+    _err "It seems that the AZION_Username is not a valid email address. Revalidate your environments."
+    return 1
+  fi
+
+  if [ -z "$AZION_Token" ]; then
+    if [ -z "$AZION_Username" ] || [ -z "$AZION_Password" ]; then
+      _err "You didn't specified a AZION_Username/AZION_Password to generate Azion token."
+      return 1
+    fi
+    _get_token
+    AZION_Token="${AZION_Token:-$(_readaccountconf_mutable AZION_Token)}"
+  fi
+
+  _debug "Detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Domain not found"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+  _debug _domain_id "$_domain_id"
+
+  _info "Removing record"
+  _get_record "$_sub_domain"
+  if [ "$record_id" ]; then
+    if _azion_rest DELETE "intelligent_dns/$_domain_id/records/$record_id"; then
+      _info "Record removed."
+      return 0
+    else
+      _err "Failed to remove record."
+      return 1
+    fi
+  else
+    _info "Record not found or already removed."
+    return 0
+  fi
+}
+
+####################  Private functions below ##################################
+# Usage: _acme-challenge.www.domain.com
+# returns
+#  _sub_domain=_acme-challenge.www
+#  _domain=domain.com
+#  _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+
+  # Use Zone ID directly if provided
+  if [ "$AZION_ZoneID" ]; then
+    if ! _azion_rest GET "intelligent_dns/$AZION_ZoneID"; then
+      return 1
+    else
+      if _contains "$response" "\"domain\":\"" >/dev/null; then
+        _domain=$(echo "$response" | _egrep_o "\"domain\":\"[^\"]*\"" | cut -d : -f 2 | _head_n 1 | tr -d \")
+        if [ "$_domain" ]; then
+          _cutlength=$((${#domain} - ${#_domain} - 1))
+          _sub_domain=$(printf "%s" "$domain" | cut -c "1-$_cutlength")
+          _domain_id=$AZION_ZoneID
+          return 0
+        else
+          return 1
+        fi
+      else
+        return 1
+      fi
+    fi
+  fi
+
+  if ! _azion_rest GET "intelligent_dns"; then
+    return 1
+  fi
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      # not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"domain\":\"$h\""; then
+      _domain_id=$(echo "$response" | tr '{' "\n" | grep "\"domain\":\"$h\"" | _egrep_o "\"id\":[0-9]*" | _head_n 1 | cut -d : -f 2 | tr -d \")
+      _debug _domain_id "$_domain_id"
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+        _domain=$h
+        _saveaccountconf_mutable AZION_ZoneID "$_domain_id"
+        return 0
+      fi
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_get_record() {
+  _record=$1
+
+  AZION_ZoneID="${AZION_ZoneID:-$(_readaccountconf_mutable AZION_ZoneID)}"
+
+  if ! _azion_rest GET "intelligent_dns/$AZION_ZoneID/records"; then
+    return 1
+  fi
+
+  if _contains "$response" "\"entry\":\"$_record\""; then
+    _json_record=$(echo "$response" | tr '{}' "\n" | grep "\"entry\":\"$_record\"")
+    if [ "$_json_record" ]; then
+      record_id=$(echo "$_json_record" | _egrep_o "\"record_id\":[0-9]*" | _head_n 1 | cut -d : -f 2 | tr -d \")
+      answers_list=$(echo "$_json_record" | _egrep_o "\"answers_list\":\[.*\]" | _head_n 1 | cut -d : -f 2 | tr -d \[\])
+      return 0
+    fi
+    return 1
+  fi
+  return 1
+}
+
+_get_token() {
+  AZION_Username="${AZION_Username:-$(_readaccountconf_mutable AZION_Username)}"
+  AZION_Password="${AZION_Password:-$(_readaccountconf_mutable AZION_Password)}"
+
+  _basic_auth=$(printf "%s:%s" "$AZION_Username" "$AZION_Password" | _base64)
+  _debug _basic_auth "$_basic_auth"
+
+  export _H1="Accept: application/json; version=3"
+  export _H2="Content-Type: application/json"
+  export _H3="Authorization: Basic $_basic_auth"
+
+  response="$(_post "" "$AZION_Api/tokens" "" "POST")"
+  _debug2 response "$response"
+  if _contains "$response" "\"token\":\"" >/dev/null; then
+    _azion_token=$(echo "$response" | _egrep_o "\"token\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \")
+    _debug _azion_token "$_azion_token"
+    _saveaccountconf_mutable AZION_Token "$_azion_token"
+  else
+    _err "Failed to generate Azion token"
+    return 1
+  fi
+}
+
+_azion_rest() {
+  _method=$1
+  _uri="$2"
+  _data="$3"
+
+  AZION_Token="${AZION_Token:-$(_readaccountconf_mutable AZION_Token)}"
+
+  export _H1="Accept: application/json; version=3"
+  export _H2="Content-Type: application/json"
+  export _H3="Authorization: token $AZION_Token"
+
+  if [ "$_method" != "GET" ]; then
+    _debug _data "$_data"
+    response="$(_post "$_data" "$AZION_Api/$_uri" "" "$_method")"
+  else
+    response="$(_get "$AZION_Api/$_uri")"
+  fi
+
+  _debug2 response "$response"
+
+  if [ "$?" != "0" ]; then
+    _err "error $_method $_uri $_data"
+    return 1
+  fi
+  return 0
+}

From 7c7d61f61e634649482eff75e216df1da9e8e298 Mon Sep 17 00:00:00 2001
From: Habetdin <15926758+Habetdin@users.noreply.github.com>
Date: Wed, 23 Jun 2021 03:20:07 +0300
Subject: [PATCH 04/15] Fix special characters escaping

To escape characters '_', '*', '`', '[' outside of an entity, prepend the characters '\' before them.
---
 notify/telegram.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/notify/telegram.sh b/notify/telegram.sh
index d16f3a98..454b4146 100644
--- a/notify/telegram.sh
+++ b/notify/telegram.sh
@@ -27,7 +27,7 @@ telegram_send() {
   fi
   _saveaccountconf_mutable TELEGRAM_BOT_CHATID "$TELEGRAM_BOT_CHATID"
 
-  _content="$(printf "%s" "$_content" | sed -e 's/*/\\\\*/')"
+  _content="$(printf "%s" "$_content" | sed -e 's/\([_*`\[]\)/\\\\\1/g')"
   _content="$(printf "*%s*\n%s" "$_subject" "$_content" | _json_encode)"
   _data="{\"text\": \"$_content\", "
   _data="$_data\"chat_id\": \"$TELEGRAM_BOT_CHATID\", "

From 014e01605859d18a75d55db33f1ce2e886e50bbc Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 20:35:49 +0800
Subject: [PATCH 05/15] add retry for init api

---
 acme.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/acme.sh b/acme.sh
index 681632fa..efbbd042 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2540,12 +2540,18 @@ _initAPI() {
   _api_server="${1:-$ACME_DIRECTORY}"
   _debug "_init api for server: $_api_server"
 
-  if [ -z "$ACME_NEW_ACCOUNT" ]; then
+  MAX_API_RETRY_TIMES=10
+  _sleep_retry_sec=10
+  _request_retry_times=0
+  while [ -z "$ACME_NEW_ACCOUNT" ] && [ "${_request_retry_times}" -lt "$MAX_API_RETRY_TIMES" ]; do
+    _request_retry_times=$(_math "$_request_retry_times" + 1)
     response=$(_get "$_api_server")
     if [ "$?" != "0" ]; then
       _debug2 "response" "$response"
-      _err "Can not init api for: $_api_server."
-      return 1
+      _info "Can not init api for: $_api_server."
+      _info "Sleep $_sleep_retry_sec and retry."
+      _sleep "$_sleep_retry_sec"
+      continue
     fi
     response=$(echo "$response" | _json_decode)
     _debug2 "response" "$response"
@@ -2578,8 +2584,12 @@ _initAPI() {
     _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
     _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
     _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
-
-  fi
+    if [ "$ACME_KEY_CHANGE" ] && [ "$ACME_NEW_AUTHZ" ] && [ "$ACME_NEW_ORDEW_ACCOUNT" ] && [ "$ACME_REVOR" ] && [ "$ACME_NEKE_CERT" ]; then
+      return 0
+    fi
+  done
+  _err "Can not init api, for $_api_server"
+  return 1
 }
 
 #[domain]  [keylength or isEcc flag]

From 9daeae1695b19f13741b435d04381ed9fa84c815 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 20:45:15 +0800
Subject: [PATCH 06/15] remove unnecessary check

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index efbbd042..0f81419a 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2584,7 +2584,7 @@ _initAPI() {
     _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
     _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
     _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
-    if [ "$ACME_KEY_CHANGE" ] && [ "$ACME_NEW_AUTHZ" ] && [ "$ACME_NEW_ORDEW_ACCOUNT" ] && [ "$ACME_REVOR" ] && [ "$ACME_NEKE_CERT" ]; then
+    if [ "$ACME_NEW_ACCOUNT" ] && [ "$ACME_NEW_ORDER" ]; then
       return 0
     fi
   done

From 078a8b40e9cbcb42af679caf44ae19b2536a58a3 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 22:03:00 +0800
Subject: [PATCH 07/15] add buypass test

---
 .github/workflows/Ubuntu.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 1ec50189..c8ceffc7 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -28,6 +28,10 @@ jobs:
            CA_ECDSA: "ZeroSSL ECC Domain Secure Site CA"
            CA: "ZeroSSL RSA Domain Secure Site CA"
            CA_EMAIL: "githubtest@acme.sh"
+        - TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
+           CA_ECDSA: "Buypass Class 2 Test4 CA 5"
+           CA: "Buypass Class 2 Test4 CA 5"
+           CA_EMAIL: "githubtest@acme.sh"
     runs-on: ubuntu-latest
     env:
       TEST_LOCAL: 1

From 1ae9c4837042e5a53a2f3413ea88a263e86347e3 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 22:05:43 +0800
Subject: [PATCH 08/15] fix error

---
 .github/workflows/Ubuntu.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index c8ceffc7..4113738f 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -28,7 +28,7 @@ jobs:
            CA_ECDSA: "ZeroSSL ECC Domain Secure Site CA"
            CA: "ZeroSSL RSA Domain Secure Site CA"
            CA_EMAIL: "githubtest@acme.sh"
-        - TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
+        -  TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
            CA_ECDSA: "Buypass Class 2 Test4 CA 5"
            CA: "Buypass Class 2 Test4 CA 5"
            CA_EMAIL: "githubtest@acme.sh"

From 29fe1c86dae489458f64a660f3fe60d3d5a29bad Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 23:21:10 +0800
Subject: [PATCH 09/15] fix initapi

---
 acme.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/acme.sh b/acme.sh
index 0f81419a..0dd8b678 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2587,6 +2587,8 @@ _initAPI() {
     if [ "$ACME_NEW_ACCOUNT" ] && [ "$ACME_NEW_ORDER" ]; then
       return 0
     fi
+    _info "Sleep $_sleep_retry_sec and retry."
+    _sleep "$_sleep_retry_sec"
   done
   _err "Can not init api, for $_api_server"
   return 1

From 2c927277e25758233b6b33300877afecb0e8a4a2 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 23:23:46 +0800
Subject: [PATCH 10/15] fix error

---
 .github/workflows/Ubuntu.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 4113738f..cddf14b5 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -28,7 +28,7 @@ jobs:
            CA_ECDSA: "ZeroSSL ECC Domain Secure Site CA"
            CA: "ZeroSSL RSA Domain Secure Site CA"
            CA_EMAIL: "githubtest@acme.sh"
-        -  TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
+         - TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
            CA_ECDSA: "Buypass Class 2 Test4 CA 5"
            CA: "Buypass Class 2 Test4 CA 5"
            CA_EMAIL: "githubtest@acme.sh"

From c66e157a14cae435413f39ef15630ca5a67d8ffd Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 23:30:16 +0800
Subject: [PATCH 11/15] fix path filter

---
 .github/workflows/FreeBSD.yml      | 2 +-
 .github/workflows/Linux.yml        | 2 +-
 .github/workflows/MacOS.yml        | 2 +-
 .github/workflows/PebbleStrict.yml | 2 +-
 .github/workflows/Solaris.yml      | 2 +-
 .github/workflows/Ubuntu.yml       | 2 +-
 .github/workflows/Windows.yml      | 2 +-
 .github/workflows/dockerhub.yml    | 5 +++++
 .github/workflows/shellcheck.yml   | 2 +-
 9 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/FreeBSD.yml b/.github/workflows/FreeBSD.yml
index dd80a0b9..8b6d4aa5 100644
--- a/.github/workflows/FreeBSD.yml
+++ b/.github/workflows/FreeBSD.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/FreeBSD.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index 6d4dcf7c..a3cf1c59 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Linux.yml'
 
 
 
diff --git a/.github/workflows/MacOS.yml b/.github/workflows/MacOS.yml
index b03bec0c..e12ef8e2 100644
--- a/.github/workflows/MacOS.yml
+++ b/.github/workflows/MacOS.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/MacOS.yml'
 
 
 jobs:
diff --git a/.github/workflows/PebbleStrict.yml b/.github/workflows/PebbleStrict.yml
index fee41feb..15795367 100644
--- a/.github/workflows/PebbleStrict.yml
+++ b/.github/workflows/PebbleStrict.yml
@@ -11,7 +11,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/PebbleStrict.yml'
 
 jobs:
   PebbleStrict:
diff --git a/.github/workflows/Solaris.yml b/.github/workflows/Solaris.yml
index ad976f59..3f2adb6a 100644
--- a/.github/workflows/Solaris.yml
+++ b/.github/workflows/Solaris.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Solaris.yml'
 
 
 jobs:
diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index cddf14b5..dc704c04 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Ubuntu.yml'
 
 
 jobs:
diff --git a/.github/workflows/Windows.yml b/.github/workflows/Windows.yml
index 0219eaa5..ed73641f 100644
--- a/.github/workflows/Windows.yml
+++ b/.github/workflows/Windows.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Windows.yml'
 
 
 jobs:
diff --git a/.github/workflows/dockerhub.yml b/.github/workflows/dockerhub.yml
index 238fde3a..0c3aec0a 100644
--- a/.github/workflows/dockerhub.yml
+++ b/.github/workflows/dockerhub.yml
@@ -6,6 +6,11 @@ on:
       - '*'
     tags:
       - '*'
+    paths:
+      - '**.sh'
+      - "Dockerfile"
+      - '.github/workflows/dockerhub.yml'
+
     
 jobs:
   CheckToken:
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index b22a2fd8..006b5873 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -11,7 +11,7 @@ on:
       - dev
     paths:
       - '**.sh'
-      - '**.yml'
+      - '.github/workflows/shellcheck.yml'
 
 jobs:
   ShellCheck:

From 77f659c9b9cbb1685075d5fc5e9d7409c87a6eb7 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 24 Jun 2021 23:57:21 +0800
Subject: [PATCH 12/15] add NO_ECC_384

---
 .github/workflows/Ubuntu.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index dc704c04..88a9fd38 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -32,6 +32,7 @@ jobs:
            CA_ECDSA: "Buypass Class 2 Test4 CA 5"
            CA: "Buypass Class 2 Test4 CA 5"
            CA_EMAIL: "githubtest@acme.sh"
+           NO_ECC_384: "1"
     runs-on: ubuntu-latest
     env:
       TEST_LOCAL: 1
@@ -39,6 +40,7 @@ jobs:
       CA_ECDSA: ${{ matrix.CA_ECDSA }}
       CA: ${{ matrix.CA }}
       CA_EMAIL: ${{ matrix.CA_EMAIL }}
+      NO_ECC_384: ${{ matrix.NO_ECC_384 }}
     steps:
     - uses: actions/checkout@v2
     - name: Install tools

From e9bdf02cfc7f57263d6693a62e35568795f56c3e Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Fri, 25 Jun 2021 00:01:46 +0800
Subject: [PATCH 13/15] fix filter

---
 .github/workflows/FreeBSD.yml      | 2 +-
 .github/workflows/Linux.yml        | 2 +-
 .github/workflows/MacOS.yml        | 2 +-
 .github/workflows/PebbleStrict.yml | 2 +-
 .github/workflows/Solaris.yml      | 2 +-
 .github/workflows/Ubuntu.yml       | 2 +-
 .github/workflows/Windows.yml      | 2 +-
 .github/workflows/shellcheck.yml   | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/FreeBSD.yml b/.github/workflows/FreeBSD.yml
index 8b6d4aa5..407a9e6d 100644
--- a/.github/workflows/FreeBSD.yml
+++ b/.github/workflows/FreeBSD.yml
@@ -12,7 +12,7 @@ on:
       - dev
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/FreeBSD.yml'
 
 
 jobs:
diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index a3cf1c59..c4ec07c4 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Linux.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/MacOS.yml b/.github/workflows/MacOS.yml
index e12ef8e2..5ceeba7a 100644
--- a/.github/workflows/MacOS.yml
+++ b/.github/workflows/MacOS.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/MacOS.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/PebbleStrict.yml b/.github/workflows/PebbleStrict.yml
index 15795367..ea8e723d 100644
--- a/.github/workflows/PebbleStrict.yml
+++ b/.github/workflows/PebbleStrict.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/PebbleStrict.yml'
   pull_request:
     branches:
       - dev
diff --git a/.github/workflows/Solaris.yml b/.github/workflows/Solaris.yml
index 3f2adb6a..c3c756bb 100644
--- a/.github/workflows/Solaris.yml
+++ b/.github/workflows/Solaris.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Solaris.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 88a9fd38..e6102b97 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Ubuntu.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/Windows.yml b/.github/workflows/Windows.yml
index ed73641f..91605a52 100644
--- a/.github/workflows/Windows.yml
+++ b/.github/workflows/Windows.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '*.sh'
-      - '**.yml'
+      - '.github/workflows/Windows.yml'
 
   pull_request:
     branches:
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 006b5873..940a187d 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -5,7 +5,7 @@ on:
       - '*'
     paths:
       - '**.sh'
-      - '**.yml'
+      - '.github/workflows/shellcheck.yml'
   pull_request:
     branches:
       - dev

From bcce77508a222eb70615e040c8cd6cbaf069b944 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Fri, 25 Jun 2021 00:04:13 +0800
Subject: [PATCH 14/15] remove buypass test

---
 .github/workflows/Ubuntu.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index e6102b97..d3d66e19 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -28,11 +28,7 @@ jobs:
            CA_ECDSA: "ZeroSSL ECC Domain Secure Site CA"
            CA: "ZeroSSL RSA Domain Secure Site CA"
            CA_EMAIL: "githubtest@acme.sh"
-         - TEST_ACME_Server: "https://api.test4.buypass.no/acme/directory"
-           CA_ECDSA: "Buypass Class 2 Test4 CA 5"
-           CA: "Buypass Class 2 Test4 CA 5"
-           CA_EMAIL: "githubtest@acme.sh"
-           NO_ECC_384: "1"
+
     runs-on: ubuntu-latest
     env:
       TEST_LOCAL: 1

From eae490b5b153f1e7b43528a88e3156d18eb4f389 Mon Sep 17 00:00:00 2001
From: Arnoud Vermeer <avermeer@tucows.com>
Date: Fri, 25 Jun 2021 10:12:23 +0200
Subject: [PATCH 15/15] [dns_pdns] Fix: missing content type in PATCH requests
 #3454

---
 dnsapi/dns_pdns.sh | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_pdns.sh b/dnsapi/dns_pdns.sh
index 28b35492..6aa2e953 100755
--- a/dnsapi/dns_pdns.sh
+++ b/dnsapi/dns_pdns.sh
@@ -103,7 +103,7 @@ set_record() {
     _build_record_string "$oldchallenge"
   done
 
-  if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"REPLACE\", \"name\": \"$full.\", \"type\": \"TXT\", \"ttl\": $PDNS_Ttl, \"records\": [$_record_string]}]}"; then
+  if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"REPLACE\", \"name\": \"$full.\", \"type\": \"TXT\", \"ttl\": $PDNS_Ttl, \"records\": [$_record_string]}]}" "application/json"; then
     _err "Set txt record error."
     return 1
   fi
@@ -126,7 +126,7 @@ rm_record() {
 
   if _contains "$_existing_challenges" "$txtvalue"; then
     #Delete all challenges (PowerDNS API does not allow to delete content)
-    if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"DELETE\", \"name\": \"$full.\", \"type\": \"TXT\"}]}"; then
+    if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"DELETE\", \"name\": \"$full.\", \"type\": \"TXT\"}]}" "application/json"; then
       _err "Delete txt record error."
       return 1
     fi
@@ -140,7 +140,7 @@ rm_record() {
         fi
       done
       #Recreate the existing challenges
-      if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"REPLACE\", \"name\": \"$full.\", \"type\": \"TXT\", \"ttl\": $PDNS_Ttl, \"records\": [$_record_string]}]}"; then
+      if ! _pdns_rest "PATCH" "/api/v1/servers/$PDNS_ServerId/zones/$root" "{\"rrsets\": [{\"changetype\": \"REPLACE\", \"name\": \"$full.\", \"type\": \"TXT\", \"ttl\": $PDNS_Ttl, \"records\": [$_record_string]}]}" "application/json"; then
         _err "Set txt record error."
         return 1
       fi
@@ -203,12 +203,13 @@ _pdns_rest() {
   method=$1
   ep=$2
   data=$3
+  ct=$4
 
   export _H1="X-API-Key: $PDNS_Token"
 
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
-    response="$(_post "$data" "$PDNS_Url$ep" "" "$method")"
+    response="$(_post "$data" "$PDNS_Url$ep" "" "$method" "$ct")"
   else
     response="$(_get "$PDNS_Url$ep")"
   fi