Automate UnrealIRCd certificates renewal with Certbot

deploy_irc

#!/usr/bin/env bash

#		NOTE:
#		This script was made to work with certbot. I don't guarantee it will
#		work with other ACME clients.
#
#		This was tested in Ubuntu 20.04 and higher. This should work as it is on
#		any Debian/Ubuntu based distros. For other distros please check Certbot
#		documentation.
#
#
#		USAGE:
#		Create a folder named `scripts` inside `/etc/letsencrypt` with:
#			mkdir -p /etc/letsencrypt/scripts
#
#		Place this script inside `/etc/letsencrypt/scripts` and name it `deploy_irc.sh`
#
#		Make the script executable with:
#			chmod +x /etc/letsencrypt/scripts/deploy_irc.sh
#
#		Request the certificate with one of the following commands:
#		- Normal:
#			certbot -d irc.domain.tld --deploy-hook /etc/letsencrypt/scripts/deploy_irc.sh
#
#		- SAN certificate:
#			certbot -d irc.domain.tld -d servername.domain.tld --deploy-hook /etc/letsencrypt/scripts/deploy_irc.sh
#
#
#		ATTENTION:
#		The SAN certificate and private key will be saved on /etc/letsencrypt/live/irc.domain.tld and not /etc/letsencrypt/live/servername.domain.tld
#
#
#		Edit the domain/subdomain, user and paths to fit your installation
#		Enjoy!

# What's your IRC domain/subdomain?
ircDomain=irc.domain.tld

# What is the shell user running UnrealIRCd?
ircUser=ircd

# What is the shell group of the user running UnrealIRCd?
# Usually it's the same as the user specified above.
ircGroup=ircd

# Complete path to UnrealIRCd install directory
# Usually "/home/<user>/unrealircd" when installed normally
ircDir=/home/ircd/unrealircd

# Complete path to the UnrealIRCd tls folder
# Usually `/home/<user>/unrealircd/conf/tls' when installed normally
ircTLS=/home/ircd/unrealircd/conf/tls

# Don't edit anything below unless you know exactly what you're doing.
# If you touch the code below and then complain the script "suddenly stopped working" I'll touch you at night.

case $RENEWED_LINEAGE in
	*/"$ircDomain")
        cp -f -- "$RENEWED_LINEAGE"/fullchain.pem "$RENEWED_LINEAGE"/privkey.pem "$ircTLS" &&
        chown -- "$ircUser":"$ircGroup" "$ircTLS"/fullchain.pem "$ircTLS"/privkey.pem &&
        "$ircDir"/unrealircd reloadtls
esac

reload_cert.sh

#!/usr/bin/env bash

#		NOTE:
#		Script to be used with Certbot and the `Setting up certbot for use with UnrealIRCd' guide
#		located at https://www.unrealircd.org/docs/Setting_up_certbot_for_use_with_UnrealIRCd
#
#		I can't guarantee that this script will work with other ACME clients
#
#		This script was tested on Ubuntu 20.04 and higher. This should work as it is on
#		any Debian/Ubuntu based distros.
#		For other distros, please check the distro/certbot documentation
#
#
#		USAGE:
#		Create a folder named `scripts` inside `/etc/letsencrypt` with:
#			mkdir -p /etc/letsencrypt/scripts
#
#		Place this script inside `/etc/letsencrypt/scripts` and name it `reload_cert.sh`
#
#		Make the script executable with:
#			chmod +x /etc/letsencrypt/scripts/reload_cert.sh
#
#		Request the certificate with one of the following commands:
#		- Normal:
#			certbot -d irc.domain.tld --deploy-hook /etc/letsencrypt/scripts/reload_cert.sh
#
#		- SAN certificate:
#			certbot -d irc.domain.tld -d servername.domain.tld --deploy-hook /etc/letsencrypt/scripts/reload_cert.sh
#
#
#		ATTENTION:
#		The SAN certificate and private key will be saved on /etc/letsencrypt/live/irc.domain.tldd and not /etc/letsencrypt/live/servername.domain.tld
#
#
#		Edit the domain and paths to fit your installation
#		Enjoy!

# What's your IRC domain/subdomain?
ircDomain=irc.domain.tld

# Complete path to the UnrealIRCd install directory
# Usually "/home/<user>/unrealircd" when installed normally
ircDir=/home/ircd/unrealircd
		
# Don't edit anything below unless you know exactly what you're doing.
# If you touch the code below and then complain the script "suddenly stopped working" I'll touch you at night.

case $RENEWED_LINEAGE in
	*/"$ircDomain")
	"$ircDir"/unrealircd reloadtls
esac

Useful shell scripts to automate your certificate deployment with UnrealIRCd servers, ideal for one server only setups

You need to do some minor changes to your listen block, depending on how you plan to deploy the certs.
Using the deploy_irc script, your listen block must be something like this:

listen {
	ip <ip address>;
	port 6697;
	options {
		tls;
		clientsonly;
	}
	tls-options {
		certificate "tls/fullchain.pem";
		key "tls/privkey.pem";
	}
}

If you're using the reload_cert.sh instead, your listen block needs to be similar to this:

listen {
	ip <ip address>;
	port 6697;
	options {
		tls;
		clientsonly;
	}
	tls-options {
		certificate "/etc/letsencrypt/live/your.subdomain.tld/fullchain.pem";
		key "/etc/letsencrypt/live/your.subdomain.tld/privkey.pem";
	}
}

This is nice a neat. I might use this at a later date, instead of manually doing things. thx mate!

This is nice a neat. I might use this at a later date, instead of manually doing things. thx mate!

You should probably update the fork :D