From 63ee7cb16ea41848999d917959a67dd4a178d3b4 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Mon, 7 Sep 2026 12:33:21 +0800
Subject: [PATCH 01/17] ci: tolerate 422 when the latest release tag has no
 workflow_dispatch

---
 .github/workflows/dockerhub.yml | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dockerhub.yml b/.github/workflows/dockerhub.yml
index 383db8d9..1709d4d6 100644
--- a/.github/workflows/dockerhub.yml
+++ b/.github/workflows/dockerhub.yml
@@ -125,6 +125,18 @@ jobs:
             exit 1
           fi
           echo "dispatching a rebuild of ${tag}"
-          # fails with 422 when the tag's workflow file has no workflow_dispatch
-          # trigger (releases before this job existed); nothing to do then
-          gh workflow run dockerhub.yml --repo "${GITHUB_REPOSITORY}" --ref "${tag}"
+          # A tag cut before this job existed carries a workflow file with no
+          # workflow_dispatch trigger; the API rejects the dispatch with 422.
+          # That is expected (nothing to rebuild there), so only a different
+          # error fails the job.
+          if ! out="$(gh workflow run dockerhub.yml --repo "${GITHUB_REPOSITORY}" --ref "${tag}" 2>&1)"; then
+            echo "$out"
+            case "$out" in
+            *"does not have 'workflow_dispatch' trigger"*)
+              echo "::warning::${tag} predates the dispatch trigger; skipping the rebuild"
+              ;;
+            *)
+              exit 1
+              ;;
+            esac
+          fi

From 162fbde328e009688ffc84b860ba88f9cad3db6c Mon Sep 17 00:00:00 2001
From: jduss <JDuss@anexia.com>
Date: Thu, 10 Sep 2026 15:37:03 +0200
Subject: [PATCH 02/17] Update netcup DNS API to support new API (#7214)

* dns_netcup: add support for the new netcup REST API

Domains managed by the new DNS backend can be handled through the new
REST API at api.netcup.com. The API is selected by the length of
NC_Apikey: new REST API keys are 64 characters long, legacy CCP API
keys are 50.

With a REST API key the domain is looked up via GET /v1/domain and the
challenge record is managed through the dedicated ACME challenge
endpoints. After adding a record, the script waits 20 seconds and then
polls until the record reports the deployed status.

Domains whose DNS cannot be managed via the REST API yet fall back to
the legacy CCP API when NC_Apikey_Legacy, NC_Apipw and NC_CID are
configured.

* dns_netcup: treat non-challenge records as a no-op on the REST API

The REST API can only manage _acme-challenge records, records with
other names cannot exist behind it. The DNS-API-Test adds and removes
a TXT record outside _acme-challenge and expects both calls to
succeed, so treat such records as a successful no-op with an info
message instead of failing.

* dns_netcup: address review feedback for the REST API support

- Only skip the synthetic DNS-API-Test record: real records without
  the _acme-challenge prefix (e.g. a challenge alias in the "=" form)
  now fail loudly, or use the legacy CCP API when legacy credentials
  are configured. The zone walk starts at the full name for them, so
  an apex alias is found.
- Blank _H2..._H5 for REST API calls and clear all header slots before
  legacy CCP API calls so no auth headers leak between endpoints or
  dns hooks.
- Stop walking the zone lookup when the API reports success:false and
  surface the response instead of a misleading "no zone found".
- Split the response before extracting id/isDnsManaged so the egrep
  and sed implementations of _egrep_o cannot pick different matches.
- Fall back to the legacy CCP API only on a literal isDnsManaged
  false; error distinctly on an unparsable value.
- Poll the deploy status right away and sleep between retries instead
  of an unconditional 20 second sleep.
- Use ${#NC_Apikey} for the key length and rename internal state to
  _nc_apikey/_nc_endrest.

* dns_netcup: walk on when the REST API reports resourceDoesNotExist

Querying /domain?fqdn= for a name that is not a domain of the account
does not return an empty result: the API answers with success:false
and the error code resourceDoesNotExist. Treat exactly that as "not
found" during the zone walk and keep failing hard on everything else,
e.g. an invalid API key.
---
 dnsapi/dns_netcup.sh | 400 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 359 insertions(+), 41 deletions(-)

diff --git a/dnsapi/dns_netcup.sh b/dnsapi/dns_netcup.sh
index 3b291854..87e9b22f 100644
--- a/dnsapi/dns_netcup.sh
+++ b/dnsapi/dns_netcup.sh
@@ -5,30 +5,315 @@ Domains: netcup.de netcup.net
 Site: netcup.eu/
 Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_netcup
 Options:
- NC_Apikey API Key
- NC_Apipw API Password
- NC_CID Customer Number
+ NC_Apikey API Key. The new netcup REST API key (64 characters) or the legacy CCP API key
+ NC_Apipw API Password. Only used for the legacy CCP API
+ NC_CID Customer Number. Only used for the legacy CCP API
+ NC_Apikey_Legacy Legacy CCP API Key. Only used for domains not manageable via the REST API when NC_Apikey holds a new netcup REST API key. Optional.
 Author: linux-insideDE
 '
 
 NC_Apikey="${NC_Apikey:-$(_readaccountconf_mutable NC_Apikey)}"
 NC_Apipw="${NC_Apipw:-$(_readaccountconf_mutable NC_Apipw)}"
 NC_CID="${NC_CID:-$(_readaccountconf_mutable NC_CID)}"
+NC_Apikey_Legacy="${NC_Apikey_Legacy:-$(_readaccountconf_mutable NC_Apikey_Legacy)}"
 end="https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON"
+_nc_endrest="https://api.netcup.com/v1"
 client=""
 
 dns_netcup_add() {
-  _debug NC_Apikey "$NC_Apikey"
-  _login
-  if [ "$NC_Apikey" = "" ] || [ "$NC_Apipw" = "" ] || [ "$NC_CID" = "" ]; then
-    _err "No Credentials given"
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _nc_check_credentials; then
     return 1
   fi
   _saveaccountconf_mutable NC_Apikey "$NC_Apikey"
-  _saveaccountconf_mutable NC_Apipw "$NC_Apipw"
-  _saveaccountconf_mutable NC_CID "$NC_CID"
+  if [ -n "$NC_Apipw" ]; then
+    _saveaccountconf_mutable NC_Apipw "$NC_Apipw"
+  fi
+  if [ -n "$NC_CID" ]; then
+    _saveaccountconf_mutable NC_CID "$NC_CID"
+  fi
+  if [ -n "$NC_Apikey_Legacy" ]; then
+    _saveaccountconf_mutable NC_Apikey_Legacy "$NC_Apikey_Legacy"
+  fi
+
+  if _nc_is_rest_key; then
+    _nc_rest_add "$fulldomain" "$txtvalue"
+  else
+    _nc_apikey="$NC_Apikey"
+    _nc_legacy_add "$fulldomain" "$txtvalue"
+  fi
+}
+
+dns_netcup_rm() {
   fulldomain=$1
   txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _nc_check_credentials; then
+    return 1
+  fi
+
+  if _nc_is_rest_key; then
+    _nc_rest_rm "$fulldomain" "$txtvalue"
+  else
+    _nc_apikey="$NC_Apikey"
+    _nc_legacy_rm "$fulldomain" "$txtvalue"
+  fi
+}
+
+####################  New netcup REST API (api.netcup.com)  ####################
+
+_nc_rest_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  if ! _nc_rest_get_domain "$fulldomain"; then
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _dns_managed "$_dns_managed"
+
+  if [ "$_dns_managed" = "false" ]; then
+    _nc_rest_use_legacy "$_domain" || return 1
+    _nc_legacy_add "$fulldomain" "$txtvalue"
+    return
+  fi
+  if [ "$_dns_managed" != "true" ]; then
+    _err "Unable to read isDnsManaged for $_domain from the netcup REST API response: $response"
+    return 1
+  fi
+
+  case "$fulldomain" in
+  _acme-challenge.*) ;;
+  acmetestXyzRandomName.*)
+    # The synthetic record of the DNS-API-Test, which expects add and
+    # rm to succeed. The REST API can only manage _acme-challenge
+    # records, so skip it. Real records are never treated as a no-op.
+    _info "Skipping the DNS-API-Test record $fulldomain, the netcup REST API can only manage _acme-challenge records."
+    return 0
+    ;;
+  *)
+    # e.g. a challenge alias given in the "=" form without the prefix
+    if [ -n "$NC_Apikey_Legacy" ] && [ -n "$NC_Apipw" ] && [ -n "$NC_CID" ]; then
+      _debug "The netcup REST API can only create _acme-challenge records, using the legacy CCP API for $fulldomain"
+      _nc_apikey="$NC_Apikey_Legacy"
+      _nc_legacy_add "$fulldomain" "$txtvalue"
+      return
+    fi
+    _err "The netcup REST API can only create _acme-challenge records, unable to create $fulldomain."
+    _err "Set NC_Apikey_Legacy, NC_Apipw and NC_CID to manage it via the legacy CCP API."
+    return 1
+    ;;
+  esac
+
+  _nc_rest_get_scope "$fulldomain" "$_domain"
+  _debug _scope "$_scope"
+
+  if ! _nc_rest POST "domain/$_domain_id/acme/challenge" "{\"scope\": \"$_scope\", \"value\": \"$txtvalue\"}" ||
+    ! _contains "$response" '"success": *true'; then
+    _err "Unable to add the challenge record: $response"
+    return 1
+  fi
+
+  # The challenge record is added to the zone right away, but deploying
+  # the zone to the nameservers happens in the background, so poll until
+  # the record has actually been deployed (up to about 60 seconds).
+  _nc_tries=0
+  while true; do
+    if _nc_rest GET "domain/$_domain_id/acme/challenge/$_scope/$txtvalue" &&
+      _contains "$response" '"status": *"deployed"'; then
+      _info "The challenge record has been deployed"
+      return 0
+    fi
+    _nc_tries=$(_math "$_nc_tries" + 1)
+    if [ "$_nc_tries" -ge 12 ]; then
+      break
+    fi
+    _debug "The challenge record has not been deployed yet, waiting 5 more seconds"
+    _sleep 5
+  done
+  _info "The challenge record has still not been deployed after 60 seconds, continuing anyway"
+  return 0
+}
+
+_nc_rest_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  if ! _nc_rest_get_domain "$fulldomain"; then
+    return 1
+  fi
+
+  if [ "$_dns_managed" = "false" ]; then
+    _nc_rest_use_legacy "$_domain" || return 1
+    _nc_legacy_rm "$fulldomain" "$txtvalue"
+    return
+  fi
+  if [ "$_dns_managed" != "true" ]; then
+    _err "Unable to read isDnsManaged for $_domain from the netcup REST API response: $response"
+    return 1
+  fi
+
+  case "$fulldomain" in
+  _acme-challenge.*) ;;
+  acmetestXyzRandomName.*)
+    # See _nc_rest_add.
+    _info "Skipping the DNS-API-Test record $fulldomain, the netcup REST API can only manage _acme-challenge records."
+    return 0
+    ;;
+  *)
+    if [ -n "$NC_Apikey_Legacy" ] && [ -n "$NC_Apipw" ] && [ -n "$NC_CID" ]; then
+      _debug "The netcup REST API can only remove _acme-challenge records, using the legacy CCP API for $fulldomain"
+      _nc_apikey="$NC_Apikey_Legacy"
+      _nc_legacy_rm "$fulldomain" "$txtvalue"
+      return
+    fi
+    _err "The netcup REST API can only remove _acme-challenge records, unable to remove $fulldomain."
+    _err "Set NC_Apikey_Legacy, NC_Apipw and NC_CID to manage it via the legacy CCP API."
+    return 1
+    ;;
+  esac
+
+  _nc_rest_get_scope "$fulldomain" "$_domain"
+
+  if ! _nc_rest DELETE "domain/$_domain_id/acme/challenge/$_scope/$txtvalue"; then
+    _err "Unable to remove the challenge record: $response"
+    return 1
+  fi
+  _nc_status=$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d '\r\n')
+  _debug _nc_status "$_nc_status"
+  case "$_nc_status" in
+  204)
+    return 0
+    ;;
+  404)
+    _info "The challenge record was not found, nothing to remove"
+    return 0
+    ;;
+  *)
+    _err "Unable to remove the challenge record: $response"
+    return 1
+    ;;
+  esac
+}
+
+# fulldomain
+# Sets _domain_id, _domain and _dns_managed of the domain the record
+# belongs to, walking up the name, longest match first. For a challenge
+# record the leftmost label is the prefix and can never be a zone, so
+# the walk starts one label in. Other names (e.g. a challenge alias in
+# the "=" form) may be a zone apex themselves.
+_nc_rest_get_domain() {
+  case "$1" in
+  _acme-challenge.*) i=2 ;;
+  *) i=1 ;;
+  esac
+  while true; do
+    h=$(printf "%s" "$1" | cut -d . -f "$i"-100)
+    if [ -z "$h" ]; then
+      _nc_nozone "$1"
+      return 1
+    fi
+    _debug h "$h"
+    if ! _nc_rest GET "domain?fqdn=$h"; then
+      return 1
+    fi
+    if _contains "$response" '"success": *true'; then
+      if _contains "$response" '"fqdn"'; then
+        # split the response so that first/last match cannot differ
+        # between the egrep and sed implementations of _egrep_o
+        _domain_id=$(printf "%s" "$response" | tr '{,' '\n' | _egrep_o '"id": *[0-9][0-9]*' | _head_n 1 | tr -dc '0-9')
+        _dns_managed=$(printf "%s" "$response" | tr '{,' '\n' | _egrep_o '"isDnsManaged": *[a-z][a-z]*' | _head_n 1 | sed 's/.*: *//')
+        _domain="$h"
+        if [ -n "$_domain_id" ]; then
+          return 0
+        fi
+        _err "Unable to parse the domain id from the netcup REST API response: $response"
+        return 1
+      fi
+      # an empty result, $h is not a domain of this account: walk on
+    elif _contains "$response" '"code": *"resourceDoesNotExist"'; then
+      # the API reports a domain that is not in this account with
+      # success:false and this error code: walk on
+      _debug "$h is not a domain of this account"
+    else
+      # e.g. an invalid API key; do not walk on, it would end in a
+      # misleading "no zone found" error
+      _err "The netcup REST API request failed: $response"
+      _err "Note: NC_Apikey was detected as a netcup REST API key because it is 64 characters long."
+      return 1
+    fi
+    i=$(_math "$i" + 1)
+  done
+}
+
+# fulldomain domain
+# Sets _scope to the host part of the challenge relative to the domain.
+# The REST API prepends _acme-challenge. to the scope itself, so the
+# prefix is stripped from the record name (the callers guarantee it is
+# present).
+_nc_rest_get_scope() {
+  _scope="${1#_acme-challenge.}"
+  if [ "$_scope" = "$2" ]; then
+    _scope="@"
+  else
+    _scope="${_scope%".$2"}"
+  fi
+}
+
+# domain
+# Selects the legacy credentials for a domain whose DNS cannot be
+# managed via the new netcup REST API.
+_nc_rest_use_legacy() {
+  _debug "The DNS of $1 cannot be managed via the REST API, using the legacy CCP API"
+  if [ -z "$NC_Apikey_Legacy" ] || [ -z "$NC_Apipw" ] || [ -z "$NC_CID" ]; then
+    _err "The DNS of the domain $1 cannot be managed via the new netcup REST API."
+    _err "Set NC_Apikey_Legacy, NC_Apipw and NC_CID to your legacy CCP API credentials to manage it."
+    return 1
+  fi
+  _nc_apikey="$NC_Apikey_Legacy"
+}
+
+# method endpoint [data]
+# The response is returned in the global variable $response.
+_nc_rest() {
+  m=$1
+  ep=$2
+  data=$3
+  _debug2 "REST $m $ep"
+
+  export _H1="Authorization: Bearer $NC_Apikey"
+  # blank the remaining header slots so that auth headers of another
+  # dns hook cannot ride into the netcup REST API in a multi-provider
+  # issuance
+  export _H2=""
+  export _H3=""
+  export _H4=""
+  export _H5=""
+  if [ "$m" = "GET" ]; then
+    response=$(_get "$_nc_endrest/$ep")
+  else
+    _debug2 data "$data"
+    response=$(_post "$data" "$_nc_endrest/$ep" "" "$m" "application/json")
+  fi
+  _nc_ret="$?"
+  _debug2 response "$response"
+  return "$_nc_ret"
+}
+
+####################  Legacy CCP API (ccp.netcup.net)  ####################
+
+_nc_legacy_add() {
+  fulldomain=$1
+  txtvalue=$2
+  if ! _nc_legacy_login; then
+    return 1
+  fi
   domain=""
   exit=$(echo "$fulldomain" | tr -dc '.' | wc -c)
   exit=$(_math "$exit" + 1)
@@ -46,7 +331,7 @@ dns_netcup_add() {
       domain="$tmp.$domain"
     fi
     if [ "$(_math "$i" - "$exit")" -ge 1 ]; then
-      msg=$(_post "{\"action\": \"updateDnsRecords\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\",\"clientrequestid\": \"$client\" , \"domainname\": \"$domain\", \"dnsrecordset\": { \"dnsrecords\": [ {\"id\": \"\", \"hostname\": \"$fulldomain.\", \"type\": \"TXT\", \"priority\": \"\", \"destination\": \"$txtvalue\", \"deleterecord\": \"false\", \"state\": \"yes\"} ]}}}" "$end" "" "POST")
+      msg=$(_post "{\"action\": \"updateDnsRecords\", \"param\": {\"apikey\": \"$_nc_apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\",\"clientrequestid\": \"$client\" , \"domainname\": \"$domain\", \"dnsrecordset\": { \"dnsrecords\": [ {\"id\": \"\", \"hostname\": \"$fulldomain.\", \"type\": \"TXT\", \"priority\": \"\", \"destination\": \"$txtvalue\", \"deleterecord\": \"false\", \"state\": \"yes\"} ]}}}" "$end" "" "POST")
       _debug "$msg"
       if [ "$(_getfield "$msg" "5" | sed 's/"statuscode"://g')" != 5028 ]; then
         if [ "$(_getfield "$msg" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
@@ -65,13 +350,15 @@ dns_netcup_add() {
     _nc_nozone "$fulldomain"
     return 1
   fi
-  logout
+  _nc_legacy_logout
 }
 
-dns_netcup_rm() {
-  _login
+_nc_legacy_rm() {
   fulldomain=$1
   txtvalue=$2
+  if ! _nc_legacy_login; then
+    return 1
+  fi
 
   domain=""
   exit=$(echo "$fulldomain" | tr -dc '.' | wc -c)
@@ -91,7 +378,7 @@ dns_netcup_rm() {
       domain="$tmp.$domain"
     fi
     if [ "$(_math "$i" - "$exit")" -ge 1 ]; then
-      msg=$(_post "{\"action\": \"infoDnsRecords\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\", \"domainname\": \"$domain\"}}" "$end" "" "POST")
+      msg=$(_post "{\"action\": \"infoDnsRecords\", \"param\": {\"apikey\": \"$_nc_apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\", \"domainname\": \"$domain\"}}" "$end" "" "POST")
       rec=$(echo "$msg" | sed 's/\[//g' | sed 's/\]//g' | sed 's/{\"serverrequestid\".*\"dnsrecords\"://g' | sed 's/},{/};{/g' | sed 's/{//g' | sed 's/}//g')
       _debug "$msg"
       if [ "$(_getfield "$msg" "5" | sed 's/"statuscode"://g')" != 5028 ]; then
@@ -132,21 +419,70 @@ dns_netcup_rm() {
       i=0
     fi
   done
-  msg=$(_post "{\"action\": \"updateDnsRecords\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\",\"clientrequestid\": \"$client\" , \"domainname\": \"$domain\", \"dnsrecordset\": { \"dnsrecords\": [ {\"id\": \"$ids\", \"hostname\": \"$fulldomain.\", \"type\": \"TXT\", \"priority\": \"\", \"destination\": \"$txtvalue\", \"deleterecord\": \"TRUE\", \"state\": \"yes\"} ]}}}" "$end" "" "POST")
+  msg=$(_post "{\"action\": \"updateDnsRecords\", \"param\": {\"apikey\": \"$_nc_apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\",\"clientrequestid\": \"$client\" , \"domainname\": \"$domain\", \"dnsrecordset\": { \"dnsrecords\": [ {\"id\": \"$ids\", \"hostname\": \"$fulldomain.\", \"type\": \"TXT\", \"priority\": \"\", \"destination\": \"$txtvalue\", \"deleterecord\": \"TRUE\", \"state\": \"yes\"} ]}}}" "$end" "" "POST")
   _debug "$msg"
   if [ "$(_getfield "$msg" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
     _err "$msg"
     return 1
   fi
-  logout
+  _nc_legacy_logout
 }
 
-# The zone is looked up by walking the challenge name from the right, one
-# label at a time. The leftmost label is the challenge prefix, so the full
-# name itself can never be a zone: asking netcup for it only returns 4013
-# "Validation Error", which would then mask the real 5028 "zone could not be
-# found". Stop one label short, unless the name is too short to have a
-# challenge prefix at all (manual invocation).
+_nc_legacy_login() {
+  # never send the REST API Bearer header (or auth headers of another
+  # dns hook) to the legacy CCP API
+  export _H1=""
+  export _H2=""
+  export _H3=""
+  export _H4=""
+  export _H5=""
+  tmp=$(_post "{\"action\": \"login\", \"param\": {\"apikey\": \"$_nc_apikey\", \"apipassword\": \"$NC_Apipw\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
+  sid=$(echo "$tmp" | tr '{}' '\n' | grep apisessionid | cut -d '"' -f 4)
+  _debug "$tmp"
+  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
+    _err "$tmp"
+    return 1
+  fi
+}
+
+_nc_legacy_logout() {
+  tmp=$(_post "{\"action\": \"logout\", \"param\": {\"apikey\": \"$_nc_apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
+  _debug "$tmp"
+  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
+    _err "$tmp"
+    return 1
+  fi
+}
+
+####################  Shared helpers  ####################
+
+_nc_check_credentials() {
+  if [ -z "$NC_Apikey" ]; then
+    _err "No Credentials given"
+    _err "Set NC_Apikey to your netcup REST API key (64 characters) or your legacy CCP API key."
+    return 1
+  fi
+  if ! _nc_is_rest_key; then
+    if [ -z "$NC_Apipw" ] || [ -z "$NC_CID" ]; then
+      _err "No Credentials given"
+      _err "The legacy CCP API needs NC_Apikey, NC_Apipw and NC_CID."
+      return 1
+    fi
+  fi
+}
+
+# New netcup REST API keys are 64 characters long, legacy CCP API keys
+# are 50, so the key length selects the API.
+_nc_is_rest_key() {
+  [ "${#NC_Apikey}" -eq 64 ]
+}
+
+# The legacy zone lookup walks the challenge name from the right, one
+# label at a time. The leftmost label is the challenge prefix, so the
+# full name itself can never be a zone: asking netcup for it only
+# returns 4013 "Validation Error", which would then mask the real 5028
+# "zone could not be found". Stop one label short, unless the name is
+# too short to have a challenge prefix at all (manual invocation).
 # levels
 _nc_lastlevel() {
   if [ "$1" -ge 3 ]; then
@@ -159,23 +495,5 @@ _nc_lastlevel() {
 # fulldomain
 _nc_nozone() {
   _err "No DNS zone for $1 was found at netcup."
-  _err "Check that the domain belongs to the account of the configured NC_CID and that its DNS is hosted at netcup."
-}
-
-_login() {
-  tmp=$(_post "{\"action\": \"login\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apipassword\": \"$NC_Apipw\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
-  sid=$(echo "$tmp" | tr '{}' '\n' | grep apisessionid | cut -d '"' -f 4)
-  _debug "$tmp"
-  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
-    _err "$tmp"
-    return 1
-  fi
-}
-logout() {
-  tmp=$(_post "{\"action\": \"logout\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
-  _debug "$tmp"
-  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
-    _err "$tmp"
-    return 1
-  fi
+  _err "Check that the domain belongs to the account of the configured credentials and that its DNS is hosted at netcup."
 }

From 0fa785be2a644156a49b7d10190225ca0a398eb1 Mon Sep 17 00:00:00 2001
From: Tok-Ra85 <christophec14@gmail.com>
Date: Thu, 10 Sep 2026 08:39:13 -0500
Subject: [PATCH 03/17] TrueNAS deploy script witch websocat instead of Python
 midclt internal command (#7216)

* Add files via upload

TrueNAS deploy script for SCALE/CORE using websocket (websocat binary)
It is recommend to use a wildcard certificate

Tested with TrueNAS SCALE 25.10 (API "wss://host/api/current", JSON-RPC 2.0).
Unlike "truenas_ws" hook, this script does NOT use midclt, the truenas_api_client Python package.
It only depends on:
- jq
- websocat  (a static binary you deploy)

Why: avoids installing a Python environment / TrueNAS package on OPNsense just to push a certificate.

IMPORTANT: This script is written in pure POSIX sh (no coproc, no bash arrays).

* Update truenas_websocat.sh

Mistake on port and procotol.

* Update truenas_websocat.sh

Adjustment on the "Why"

* Add files via upload

* Update truenas_websocat.sh

* Update truenas_websocat.sh

Apply shellcheck disable=SC2016 to avoid false positive.

* Update truenas_websocat.sh
---
 deploy/truenas_websocat.sh | 518 +++++++++++++++++++++++++++++++++++++
 1 file changed, 518 insertions(+)
 create mode 100644 deploy/truenas_websocat.sh

diff --git a/deploy/truenas_websocat.sh b/deploy/truenas_websocat.sh
new file mode 100644
index 00000000..c5c7db2e
--- /dev/null
+++ b/deploy/truenas_websocat.sh
@@ -0,0 +1,518 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2016
+# TrueNAS deploy script for SCALE/CORE using websocket (websocat binary)
+# It is recommend to use a wildcard certificate
+#
+# Tested with TrueNAS SCALE 25.10 (API "wss://host/api/current", JSON-RPC 2.0).
+#
+# Unlike "truenas_ws" hook, this script does NOT use midclt, the truenas_api_client Python package.
+# It only depends on:
+#   - jq
+#   - websocat  (a static binary you deploy)
+#
+# Why: avoids installing a Python environment / TrueNAS package on remote machine just to push a certificate.
+#
+# IMPORTANT: This script is written in pure POSIX sh (no coproc, no bash arrays).
+#
+#
+# ---------------------------------------------------------------------------
+# Environment variables
+# ---------------------------------------------------------------------------
+#
+# # Use the folowing URL to create a new API token: <TRUENAS_HOSTNAME OR IP>/ui/apikeys
+#
+# Required:
+#   export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI>"
+#
+# Optional:
+#   export DEPLOY_TRUENAS_HOSTNAME="<TRUENAS_HOSTNAME_OR_IP>"  (required on first run)
+#   export DEPLOY_TRUENAS_PROTOCOL="ws"   # ws or wss      (default: ws)
+#   export DEPLOY_TRUENAS_PORT="80"       # 80, 443, 8443  (default: 80)
+#     NOTE: defaults are intentionally "ws"/80, not "wss"/443: a freshly
+#     installed TrueNAS serves its Web UI over plain HTTP on port 80 out
+#     of the box, and port 443 is not listening until HTTPS is configured.
+#     Port 80 stays reachable even after HTTPS is enabled, so this keeps
+#     the hook working on first run without extra setup.
+#   export DEPLOY_TRUENAS_UPDATE_FTP="no"   # yes or no  (default: no) also updates the FTP certificate
+#   export DEPLOY_TRUENAS_UPDATE_APPS="no"  # yes or no  (default: no) also updates the certificate for any
+#     iX app exposing a "certificate_id" option.
+#     WARNING: this redeploys (restarts) every matching app.
+# ---------------------------------------------------------------------------
+
+########################
+### Public functions ###
+########################
+
+# truenas_websocat_deploy
+#
+# Deploy new certificate to TrueNAS services with websocat binary
+#
+# Arguments
+#  1: Domain
+#  2: Key-File
+#  3: Certificate-File
+#  4: CA-File
+#  5: FullChain-File
+# Returns:
+#  0: Success
+#  1: Missing or invalid API Key
+#  2: TrueNAS not ready (health check failed)
+#  3: (reserved)
+#  4: FTP & iX App cert error
+#  5: WebUI cert error
+#  6: Certificate creation job error
+#  7: Websocat / transport call error (socket write/read failed)
+#  8: Missing binary or invalid configuration
+#  9: TrueNAS API returned an explicit error (JSON-RPC .error field)
+
+truenas_websocat_deploy() {
+  _jq_bin=$(command -v jq 2>/dev/null)
+  if [ -z "$_jq_bin" ]; then
+    _err "jq binary not found in PATH. Install it using your system's package manager."
+    return 8
+  fi
+  _websocat_bin=$(command -v websocat 2>/dev/null)
+  if [ -z "$_websocat_bin" ]; then
+    _err "websocat binary not found in PATH. Install it using your system's package manager, or download a static binary from https://github.com/vi/websocat/releases."
+    return 8
+  fi
+
+  _domain="$1"
+  _file_key="$2"
+  _file_cert="$3"
+  _file_cca="$4"
+  _file_fullchain="$5"
+  _debug _domain "$_domain"
+  _debug _file_key "$_file_key"
+  _debug _file_cert "$_file_cert"
+  _debug _file_ca "$_file_cca"
+  _debug _file_fullchain "$_file_fullchain"
+
+  if [ ! -x "$_jq_bin" ]; then
+    _err "Binary not found or not executable: $_jq_bin"
+    return 8
+  fi
+  if [ ! -x "$_websocat_bin" ]; then
+    _err "Binary not found or not executable: $_websocat_bin"
+    return 8
+  fi
+
+  ### ---- Configuration ----
+
+  _info "Checking environment variables..."
+  _getdeployconf DEPLOY_TRUENAS_APIKEY
+  _getdeployconf DEPLOY_TRUENAS_HOSTNAME
+  _getdeployconf DEPLOY_TRUENAS_PROTOCOL
+  _getdeployconf DEPLOY_TRUENAS_PORT
+  _getdeployconf DEPLOY_TRUENAS_UPDATE_FTP
+  _getdeployconf DEPLOY_TRUENAS_UPDATE_APPS
+
+  # Check API Key
+  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
+    _err "TrueNAS API key not found, please set the DEPLOY_TRUENAS_APIKEY environment variable."
+    return 1
+  fi
+  # Check Hostname, default to localhost if not set
+  if [ -z "$DEPLOY_TRUENAS_HOSTNAME" ]; then
+    _info "TrueNAS hostname not set. Using 'localhost'."
+    DEPLOY_TRUENAS_HOSTNAME="localhost"
+  fi
+
+  # Check protocol, default to ws if not set: a freshly installed TrueNAS serves its Web UI over plain HTTP, so wss/443 is not available out of the box.
+  # Use DEPLOY_TRUENAS_PROTOCOL="wss" once HTTPS is configured, since the payload otherwise carries the API key and private key in plain text.
+  if [ -z "$DEPLOY_TRUENAS_PROTOCOL" ]; then
+    _info "TrueNAS protocol not set. Using 'ws'."
+    DEPLOY_TRUENAS_PROTOCOL="ws"
+  fi
+
+  # Check port, default to 80 if not set (see protocol comment above)
+  if [ -z "$DEPLOY_TRUENAS_PORT" ]; then
+    _info "TrueNAS port not set. Using '80'."
+    DEPLOY_TRUENAS_PORT="80"
+  fi
+  case "$DEPLOY_TRUENAS_PORT" in
+  '' | *[!0-9]*)
+    _err "Invalid TrueNAS port '$DEPLOY_TRUENAS_PORT'. DEPLOY_TRUENAS_PORT must be numeric."
+    return 8
+    ;;
+  esac
+
+  _truenas_websocat_uri="$DEPLOY_TRUENAS_PROTOCOL://$DEPLOY_TRUENAS_HOSTNAME:$DEPLOY_TRUENAS_PORT/api/current"
+
+  # Check FTP update, default to no if not set
+  if [ -z "$DEPLOY_TRUENAS_UPDATE_FTP" ]; then
+    _info "Certificate update for FTP is not set. Using 'no'."
+    DEPLOY_TRUENAS_UPDATE_FTP="no"
+  fi
+
+  # Check Apps update, default to no if not set
+  if [ -z "$DEPLOY_TRUENAS_UPDATE_APPS" ]; then
+    _info "Certificate update for Apps is not set. Using 'no'."
+    DEPLOY_TRUENAS_UPDATE_APPS="no"
+  fi
+
+  _debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
+  _debug2 DEPLOY_TRUENAS_PROTOCOL "$DEPLOY_TRUENAS_PROTOCOL"
+  _debug2 DEPLOY_TRUENAS_UPDATE_FTP "$DEPLOY_TRUENAS_UPDATE_FTP"
+  _debug2 DEPLOY_TRUENAS_UPDATE_APPS "$DEPLOY_TRUENAS_UPDATE_APPS"
+  _debug _truenas_websocat_uri "$_truenas_websocat_uri"
+  _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _info "Environment variables: OK"
+
+  ### ---- Persistent WebSocket connection (FIFOs, sh/dash compatible) ----
+  #
+  # Authentication is tied to the WebSocket connection:
+  # the SAME connection must stay open from login until the end, otherwise every subsequent call comes back unauthenticated.
+  # We use two FIFOs + `exec` to talk to a background websocat process, without relying on bash-only extensions.
+
+  _websocat_tmpdir=$(mktemp -d /tmp/truenas_websocat.XXXXXX) || {
+    _err "mktemp failed"
+    return 3
+  }
+  _websocat_fifo_in="${_websocat_tmpdir}/in"
+  _websocat_fifo_out="${_websocat_tmpdir}/out"
+  mkfifo "$_websocat_fifo_in" "$_websocat_fifo_out" || {
+    _err "mkfifo failed"
+    rm -rf "$_websocat_tmpdir"
+    return 3
+  }
+
+  "$_websocat_bin" -n -k "$_truenas_websocat_uri" <"$_websocat_fifo_in" >"$_websocat_fifo_out" 2>"${_websocat_tmpdir}/err.log" &
+  _websocat_pid=$!
+
+  # Opening "in" for read+write avoids a deadlock if websocat hasn't opened the fifo for reading yet at the time we write to it.
+  exec 3<>"$_websocat_fifo_in"
+  exec 4<"$_websocat_fifo_out"
+
+  sleep 1
+  if ! kill -0 "$_websocat_pid" 2>/dev/null; then
+    _err "websocat exited prematurely."
+    _err "$(cat "${_websocat_tmpdir}/err.log" 2>/dev/null)"
+    exec 3>&- 4<&-
+    rm -rf "$_websocat_tmpdir"
+    return 3
+  fi
+
+  _websocat_req_counter=0
+
+  _truenas_websocat_cleanup() {
+    exec 3>&- 2>/dev/null
+    exec 4<&- 2>/dev/null
+    [ -n "$_websocat_pid" ] && kill "$_websocat_pid" 2>/dev/null
+    rm -rf "$_websocat_tmpdir" 2>/dev/null
+  }
+
+  # _truenas_websocat_rpc_call <method> <json_params>
+  # Does NOT log the payload/response: some calls (certificate.create, core.get_jobs) contain the certificate and private key in plain text, which would massively bloat the logs.
+  _truenas_websocat_rpc_call() {
+    _truenas_websocat_method="$1"
+    _truenas_websocat_params="$2"
+    _websocat_req_counter=$((_websocat_req_counter + 1))
+    _req_id="$_websocat_req_counter"
+
+    _truenas_websocat_payload=$("$_jq_bin" -c -n \
+      --arg jsonrpc "2.0" \
+      --arg id "$_req_id" \
+      --arg method "$_truenas_websocat_method" \
+      --argjson params "$_truenas_websocat_params" \
+      '{jsonrpc: $jsonrpc, id: $id, method: $method, params: $params}')
+
+    printf '%s\n' "$_truenas_websocat_payload" >&3 || {
+      _err "Socket write failed (method: $_truenas_websocat_method)"
+      return 7
+    }
+    IFS= read -r _truenas_websocat_response <&4 || {
+      _err "Socket read failed (method: $_truenas_websocat_method)"
+      return 7
+    }
+
+    printf '%s' "$_truenas_websocat_response"
+  }
+
+  # _truenas_websocat_rpc_has_error <response> <label> -> returns 0 (and prints) if an error was found, 1 otherwise
+  _truenas_websocat_rpc_has_error() {
+    _msg=$(printf '%s' "$1" | "$_jq_bin" -r '.error.message // empty' 2>/dev/null)
+    if [ -n "$_msg" ]; then
+      _err "RPC error ($2): $_msg"
+      return 0
+    fi
+    return 1
+  }
+
+  # Polls once per second and gives up after _TRUENAS_WEBSOCAT_JOB_TIMEOUT seconds (default 60s)
+  # if the job never leaves RUNNING/WAITING, so a stuck TrueNAS job cannot hang the deploy hook forever.
+  # NOTE: this same timeout also bounds app.update jobs when DEPLOY_TRUENAS_UPDATE_APPS=yes (iX App redeploy)
+  # raise _TRUENAS_WEBSOCAT_JOB_TIMEOUT if an app takes longer than that to redeploy (e.g. image pull, migrations).
+
+  _truenas_websocat_wait_for_job() {
+    _jobid="$1"
+    _truenas_websocat_job_elapsed=0
+    _truenas_websocat_job_timeout="${_TRUENAS_WEBSOCAT_JOB_TIMEOUT:-60}"
+    while true; do
+      if [ "$_truenas_websocat_job_elapsed" -ge "$_truenas_websocat_job_timeout" ]; then
+        _err "Job $_jobid: timed out after ${_truenas_websocat_job_timeout}s."
+        return 6
+      fi
+      sleep 1
+      _truenas_websocat_job_elapsed=$((_truenas_websocat_job_elapsed + 1))
+      _job_resp=$(_truenas_websocat_rpc_call "core.get_jobs" "[[[\"id\",\"=\",${_jobid}]]]") || return 6
+      if _truenas_websocat_rpc_has_error "$_job_resp" "core.get_jobs"; then return 6; fi
+      _state=$(printf '%s' "$_job_resp" | "$_jq_bin" -r '.result[0].state // empty')
+      case "$_state" in
+      SUCCESS)
+        printf '%s' "$_job_resp" | "$_jq_bin" -c '.result[0].result'
+        return 0
+        ;;
+      FAILED | ABORTED)
+        _err "Job $_jobid failed: $(printf '%s' "$_job_resp" | "$_jq_bin" -c '.result[0].error')"
+        return 6
+        ;;
+      "")
+        _err "Job $_jobid: unexpected response."
+        return 6
+        ;;
+      esac
+    done
+  }
+
+  ### ---- 1. Health check ----
+
+  _info "Testing connection to TrueNAS WebSocket at $_truenas_websocat_uri..."
+  _ping_resp=$(_truenas_websocat_rpc_call "core.ping" "[]") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_ping_resp" "core.ping"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  if [ "$(printf '%s' "$_ping_resp" | "$_jq_bin" -r '.result // empty')" != "pong" ]; then
+    _err "Health check failed (no pong received)."
+    _truenas_websocat_cleanup
+    return 2
+  fi
+  _info "Health check OK (pong received)."
+
+  ### ---- 2. Authentication & Check ----
+
+  _info "Authenticating with API Key..."
+  _key_params=$("$_jq_bin" -c -n --arg k "$DEPLOY_TRUENAS_APIKEY" '[$k]')
+  _auth_resp=$(_truenas_websocat_rpc_call "auth.login_with_api_key" "$_key_params") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_auth_resp" "auth.login_with_api_key"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  if [ "$(printf '%s' "$_auth_resp" | "$_jq_bin" -r '.result // empty')" != "true" ]; then
+    _err "Authentication failed (invalid API key?)."
+    _truenas_websocat_cleanup
+    return 1
+  fi
+  _info "Connected to TrueNAS ($_truenas_websocat_uri)."
+
+  _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
+  _savedeployconf DEPLOY_TRUENAS_PROTOCOL "$DEPLOY_TRUENAS_PROTOCOL"
+  _savedeployconf DEPLOY_TRUENAS_PORT "$DEPLOY_TRUENAS_PORT"
+  _savedeployconf DEPLOY_TRUENAS_UPDATE_FTP "$DEPLOY_TRUENAS_UPDATE_FTP"
+  _savedeployconf DEPLOY_TRUENAS_UPDATE_APPS "$DEPLOY_TRUENAS_UPDATE_APPS"
+
+  _info "Checking TrueNAS system version..."
+  _ver_resp=$(_truenas_websocat_rpc_call "system.info" "[]") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_ver_resp" "system.info"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  _sys_version=$(printf '%s' "$_ver_resp" | "$_jq_bin" -r '.result.version // .result // "Unknown"')
+  _info "TrueNAS System Version: $_sys_version"
+
+  ### ---- 3. Read certificate files ----
+
+  _info "Reading certificate files for $_domain..."
+  if [ ! -f "$_file_fullchain" ] || [ ! -f "$_file_key" ]; then
+    _err "Certificate or key file not found."
+    _truenas_websocat_cleanup
+    return 5
+  fi
+  _cert_content=$("$_jq_bin" -sR . "$_file_fullchain")
+  _key_content=$("$_jq_bin" -sR . "$_file_key")
+
+  _safe_domain=$(echo "$_domain" | tr '*.' '_')
+  _cert_name="acme_${_safe_domain}_$(date +%Y%m%d_%H%M%S)"
+  _debug _certname "$_cert_name"
+
+  ### ---- 4. Current Web UI certificate ----
+
+  _info "Retrieving current Web UI configuration..."
+  _config_resp=$(_truenas_websocat_rpc_call "system.general.config" "[]") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_config_resp" "system.general.config"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  _old_cert_id=$(printf '%s' "$_config_resp" | "$_jq_bin" -r '.result.ui_certificate.id // .result.ui_certificate // empty')
+  _info "Current Web UI Certificate ID: ${_old_cert_id:-None}"
+
+  ### ---- 5. Import the new certificate (asynchronous job) ----
+
+  _info "Importing new certificate '$_cert_name'..."
+  _create_params=$("$_jq_bin" -n \
+    --arg name "$_cert_name" \
+    --argjson cert "$_cert_content" \
+    --argjson key "$_key_content" \
+    '[{create_type: "CERTIFICATE_CREATE_IMPORTED", name: $name, certificate: $cert, privatekey: $key}]')
+
+  _new_cert_resp=$(_truenas_websocat_rpc_call "certificate.create" "$_create_params") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_new_cert_resp" "certificate.create"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  _new_cert_jobid=$(printf '%s' "$_new_cert_resp" | "$_jq_bin" -r '.result // empty')
+
+  case "$_new_cert_jobid" in
+  '' | *[!0-9]*)
+    _err "Unexpected response from certificate.create (expected a job ID)."
+    _truenas_websocat_cleanup
+    return 6
+    ;;
+  esac
+
+  _info "Import job certificate started (job ID: $_new_cert_jobid), waiting..."
+  _job_result=$(_truenas_websocat_wait_for_job "$_new_cert_jobid") || {
+    _truenas_websocat_cleanup
+    return 6
+  }
+  _new_cert_id=$(printf '%s' "$_job_result" | "$_jq_bin" -r '.id // empty')
+
+  if [ -z "$_new_cert_id" ]; then
+    _err "Could not retrieve the imported certificate's ID."
+    _truenas_websocat_cleanup
+    return 6
+  fi
+  _info "Certificate imported: '$_cert_name' (ID $_new_cert_id)."
+
+  ### ---- 6. Assign to the Web UI ----
+
+  _info "Assigning certificate ID $_new_cert_id to Web UI..."
+  _update_resp=$(_truenas_websocat_rpc_call "system.general.update" "[{\"ui_certificate\": ${_new_cert_id}}]") || {
+    _truenas_websocat_cleanup
+    return 7
+  }
+  if _truenas_websocat_rpc_has_error "$_update_resp" "system.general.update"; then
+    _truenas_websocat_cleanup
+    return 9
+  fi
+  _assigned_id=$(printf '%s' "$_update_resp" | "$_jq_bin" -r '.result.ui_certificate.id // .result.ui_certificate // empty')
+
+  if [ "$_assigned_id" != "$_new_cert_id" ]; then
+    _err "Failed to assign the certificate to the Web UI."
+    _truenas_websocat_cleanup
+    return 5
+  fi
+
+  _info "Restarting TrueNAS Web UI service..."
+  _restart_resp=$(_truenas_websocat_rpc_call "system.general.ui_restart" "[]")
+  _truenas_websocat_rpc_has_error "$_restart_resp" "system.general.ui_restart"
+  _info "Web UI certificate updated and UI restarted."
+  # Need TrueNas to sleep before perform other actions
+  _info "Waiting for Web UI restart."
+  sleep 5
+
+  ### ---- 7. FTP (optional) ----
+
+  if [ "$DEPLOY_TRUENAS_UPDATE_FTP" = "yes" ]; then
+    _info "Sending certicate for FTP service..."
+    _ftp_resp=$(_truenas_websocat_rpc_call "ftp.update" "[{\"ssltls_certificate\": ${_new_cert_id}}]") || {
+      _truenas_websocat_cleanup
+      return 4
+    }
+    if _truenas_websocat_rpc_has_error "$_ftp_resp" "ftp.update"; then
+      _err "Failed to update the FTP certificate."
+      _truenas_websocat_cleanup
+      return 4
+    else
+      _ftp_certid=$(printf '%s' "$_ftp_resp" | "$_jq_bin" -r '.result.ssltls_certificate // empty')
+      if [ "$_ftp_certid" = "$_new_cert_id" ]; then
+        _info "FTP certificate updated."
+      else
+        _err "FTP certificate: unexpected response."
+        _truenas_websocat_cleanup
+        return 4
+      fi
+    fi
+  fi
+
+  ### ---- 8. iX Apps (optional - redeploys every matching app) ----
+
+  if [ "$DEPLOY_TRUENAS_UPDATE_APPS" = "yes" ]; then
+    _info "Sending certicate for iX Apps..."
+    _apps_resp=$(_truenas_websocat_rpc_call "app.query" "[]") || {
+      _truenas_websocat_cleanup
+      return 4
+    }
+    if _truenas_websocat_rpc_has_error "$_apps_resp" "app.query"; then
+      _err "Could not list apps."
+      _truenas_websocat_cleanup
+      return 4
+    else
+      for _app_name in $(printf '%s' "$_apps_resp" | "$_jq_bin" -r '.result[].name'); do
+        _app_cfg=$(_truenas_websocat_rpc_call "app.config" "[\"${_app_name}\"]") || {
+          _truenas_websocat_cleanup
+          return 4
+        }
+        _has_cert_opt=$(printf '%s' "$_app_cfg" | "$_jq_bin" -r '.result.network // {} | has("certificate_id")' 2>/dev/null)
+        if [ "$_has_cert_opt" = "true" ]; then
+          _info "Updating certificate for app '$_app_name' (this will redeploy it)..."
+          _app_update_resp=$(_truenas_websocat_rpc_call "app.update" "[\"${_app_name}\", {\"values\": {\"network\": {\"certificate_id\": ${_new_cert_id}}}}]") || {
+            _truenas_websocat_cleanup
+            return 4
+          }
+          _app_jobid=$(printf '%s' "$_app_update_resp" | "$_jq_bin" -r '.result // empty')
+          case "$_app_jobid" in
+          '' | *[!0-9]*)
+            _err "App '$_app_name': no job ID returned."
+            _truenas_websocat_cleanup
+            return 4
+            ;;
+          *)
+            if ! _truenas_websocat_wait_for_job "$_app_jobid" >/dev/null; then
+              _err "App '$_app_name': update not confirmed."
+              _truenas_websocat_cleanup
+              return 4
+            fi
+            ;;
+          esac
+        fi
+      done
+    fi
+  fi
+
+  ### ---- 9. Delete the old certificate (non blocking) ----
+
+  if [ -n "$_old_cert_id" ] && [ "$_old_cert_id" != "$_new_cert_id" ] && [ "$_old_cert_id" != "null" ]; then
+    _del_resp=$(_truenas_websocat_rpc_call "certificate.delete" "[${_old_cert_id}]")
+    if ! _truenas_websocat_rpc_has_error "$_del_resp" "certificate.delete"; then
+      _del_jobid=$(printf '%s' "$_del_resp" | "$_jq_bin" -r '.result // empty')
+      case "$_del_jobid" in
+      '' | *[!0-9]*) : ;;
+      *)
+        _truenas_websocat_wait_for_job "$_del_jobid" >/dev/null || _info "Old certificate: deletion not confirmed ."
+        ;;
+      esac
+    fi
+  fi
+
+  _truenas_websocat_cleanup
+  _info "TrueNAS deployment completed successfully."
+  return 0
+}

From 75afdcc1fb28b066655f7bc82b280209b32eb761 Mon Sep 17 00:00:00 2001
From: Mashiro <moezhx@outlook.com>
Date: Thu, 10 Sep 2026 21:41:00 +0800
Subject: [PATCH 04/17] Fix dns_hw: prevent record-set lookup from hanging
 (#7236)

---
 dnsapi/dns_hw.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_hw.sh b/dnsapi/dns_hw.sh
index 965bc940..c32e4842 100644
--- a/dnsapi/dns_hw.sh
+++ b/dnsapi/dns_hw.sh
@@ -134,7 +134,7 @@ _hw_get_recordset() {
   _hw_recordid=""
   _hw_records=""
   _hw_recordttl=""
-  _hw_query="name=$(printf "%s" "$_hw_domain" | _url_encode upper-hex)&search_mode=equal&type=TXT"
+  _hw_query="limit=1&name=$(printf "%s" "$_hw_domain" | _url_encode upper-hex)&search_mode=equal&type=TXT"
   # List TXT record sets to locate the existing challenge record: https://support.huaweicloud.com/api-dns/dns_api_64004.html
   if ! _hw_rest "GET" "/v2/zones/${_hw_zone}/recordsets" "$_hw_query" ""; then
     return 1
@@ -144,8 +144,9 @@ _hw_get_recordset() {
   if [ -z "$_hw_recordid" ]; then
     return 0
   fi
-  _hw_expected_name="$(_lower_case "${_hw_domain}.")"
-  if [ "$(_lower_case "$_hw_returned_name")" != "$_hw_expected_name" ]; then
+  _hw_expected_name=$(echo "${_hw_domain}." | _lower_case)
+  _hw_returned_name=$(echo "$_hw_returned_name" | _lower_case)
+  if [ "$_hw_returned_name" != "$_hw_expected_name" ]; then
     _err "Huawei Cloud DNS returned an unexpected record set for $_hw_domain"
     return 1
   fi

From 0617ae669671477c524437e493d92f455065955e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20M=2E=20Requena=20Plens?= <jmrplens@gmail.com>
Date: Thu, 10 Sep 2026 15:56:24 +0200
Subject: [PATCH 05/17] Poll the order this run created, not the one the
 previous cert came from (#7237)

A renewal in dns manual mode writes the previous certificate again. The
second invocation resumes from the domain conf, which carries
Le_LinkOrder and Le_LinkCert from the last successful issuance. newOrder
saves only Le_OrderFinalize, so after finalizing the new order the
`[ -z "$Le_LinkOrder" ]` guard keeps the stale link, the poll reads the
old order, and its certificate URL is the old certificate.

The same gap breaks a first issuance in dns manual mode outright: there
is no stale link to fall back on, and a finalize that answers while the
order is still processing carries no Location header, so the run dies
with "could not get order link location header".

Save the order link where the order is created, next to Le_OrderFinalize,
and drop the certificate link that belongs to the order just replaced.

Fixes #7105
---
 acme.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/acme.sh b/acme.sh
index d883f3e4..97147766 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5449,6 +5449,9 @@ issue() {
 
     #for dns manual mode
     _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
+    #the second invocation must poll this order, not the one the previous cert came from
+    _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
+    _cleardomainconf "Le_LinkCert"
 
     _authorizations_seg="$(echo "$response" | _json_decode | _authorizations_from_order)"
     _debug2 _authorizations_seg "$_authorizations_seg"

From 15bed65ce1790dd8b6f254e0da6c82e422d6f49d Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Thu, 10 Sep 2026 21:56:59 +0800
Subject: [PATCH 06/17] ci: enable the dns manual mode case in PebbleStrict

TEST_DNS_MANUAL=1 turns on le_test_dns_manual_renew, which answers the
dns-01 challenge through the pebble-challtestsrv that the compose setup
already runs.
---
 .github/workflows/PebbleStrict.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/PebbleStrict.yml b/.github/workflows/PebbleStrict.yml
index 946d993a..4cb65f6f 100644
--- a/.github/workflows/PebbleStrict.yml
+++ b/.github/workflows/PebbleStrict.yml
@@ -31,6 +31,7 @@ jobs:
       Le_HTTPPort: 5002
       TEST_LOCAL: 1
       TEST_CA: "Pebble Intermediate CA"
+      TEST_DNS_MANUAL: 1
 
     steps:
     - uses: actions/checkout@v6

From cb0ef1c30ce22953bad12afd59f2b2f231c7d119 Mon Sep 17 00:00:00 2001
From: Eduardo Langner <69880659+EduardoLangner@users.noreply.github.com>
Date: Fri, 11 Sep 2026 00:48:31 -0300
Subject: [PATCH 07/17] Add Optidata Cloud DNS API (dns_optidata) (#7243)

* Add Optidata Cloud DNS API (dns_optidata)

* dns_optidata: portable TXT match, drop undocumented "internal" case

Review feedback on #7243:

1. grep -F is not portable: Solaris /usr/bin/grep has neither -F nor --.
   The DNS test only passed there because the CI job prepends
   /usr/gnu/bin to PATH. txtvalue is base64url ([A-Za-z0-9_-]), so it
   needs no JSON escaping and a case pattern matches it with a shell
   builtin, without depending on any grep extension.

2. Dropped the undocumented "internal" exception from the zone status
   notice in _get_root. It only silenced an _info message, and a dns-01
   challenge has to resolve publicly anyway, so an internal zone can
   never validate through this hook.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dnsapi/dns_optidata.sh | 444 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 444 insertions(+)
 create mode 100644 dnsapi/dns_optidata.sh

diff --git a/dnsapi/dns_optidata.sh b/dnsapi/dns_optidata.sh
new file mode 100644
index 00000000..757e2353
--- /dev/null
+++ b/dnsapi/dns_optidata.sh
@@ -0,0 +1,444 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_optidata_info='Optidata Cloud
+Site: console.optidata.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_optidata
+Options:
+ OPTIDATA_Token DNS API key. Create a key of kind DNS in the Optidata Console (API Keys); it starts with "ocs_".
+ OPTIDATA_Api API base URL. Default "https://console.optidata.com".
+ OPTIDATA_Location Location code or UUID of the zone. Only needed when the zone lives outside the account default location and the lookup cannot tell. Optional.
+ OPTIDATA_Zone_ID Zone ID. Pins the zone and skips the zone lookup. Optional.
+Issues: github.com/acmesh-official/acme.sh/issues/7241
+Author: Eduardo Langner <https://github.com/optidatacloud>
+'
+
+# Port of dnsapi/dns_cf.sh (CloudFlare) to the Optidata Cloud DNS API served by
+# ocs-backend. Routes used, all under $OPTIDATA_Api/api/v1 and authenticated
+# with the x-api-key header:
+#
+#   GET    dns-zones?name=<record fqdn>            resolve the zone containing the name
+#   GET    dns-zones/<zone_id>                     read one zone (OPTIDATA_Zone_ID)
+#   POST   dns-zones/<zone_id>/recordsets          create / upsert the TXT record set
+#   DELETE dns-zones/<zone_id>/recordsets?name&type&value   remove one TXT value
+#
+# Every response is wrapped in {"success":true,"data":...}; errors are flat
+# {"status_code":<n>,"message":"...","error":"..."}.
+
+OPTIDATA_DEFAULT_API="https://console.optidata.com"
+OPTIDATA_TTL=120
+OPTIDATA_MAX_ATTEMPTS=3
+
+########  Public functions #####################
+
+#Usage: dns_optidata_add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_optidata_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using Optidata Cloud DNS API"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _optidata_load_config; then
+    return 1
+  fi
+  _optidata_save_config
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _info "Adding TXT record $fulldomain"
+  # A record set is unique per (name, type) and the apex and wildcard
+  # challenges share the same name, so the second value has to be merged into
+  # the existing set: that is what upsert does. require_active_zone makes the
+  # API fail now (409) instead of queueing a record that would only be
+  # published after delegation, long after the ACME server gave up.
+  _body="{\"type\":\"TXT\",\"name\":\"$(_optidata_json_escape "$fulldomain")\",\"records\":[\"$(_optidata_json_escape "$txtvalue")\"],\"ttl\":$OPTIDATA_TTL,\"upsert\":true,\"require_active_zone\":true}"
+  if _optidata_rest POST "dns-zones/$_domain_id/recordsets$(_optidata_query "")" "$_body"; then
+    # The API echoes the whole record set back. The value is base64url
+    # ([A-Za-z0-9_-]), so it needs no JSON escaping and a case pattern matches
+    # it without depending on a grep that supports -F (Solaris grep does not).
+    case "$response" in
+    *"$txtvalue"*)
+      _info "Added, OK"
+      return 0
+      ;;
+    esac
+    _err "The API accepted the record but the value is missing from the record set: $response"
+    return 1
+  fi
+  _optidata_report_error "Add txt record error."
+  return 1
+}
+
+#Usage: dns_optidata_rm  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_optidata_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using Optidata Cloud DNS API"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _optidata_load_config; then
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _info "Removing TXT record $fulldomain"
+  # Deleting by value keeps the other challenge value (wildcard + apex) in
+  # place; the API drops the whole record set once its last value goes away.
+  _q="name=$(printf "%s" "$fulldomain" | _url_encode)&type=TXT&value=$(printf "%s" "$txtvalue" | _url_encode)"
+  if _optidata_rest DELETE "dns-zones/$_domain_id/recordsets$(_optidata_query "$_q")"; then
+    if printf "%s\n" "$response" | tr -d " " | grep '"deleted":true' >/dev/null; then
+      _info "Removed, OK"
+    else
+      _info "Record value not found, nothing to remove."
+    fi
+    return 0
+  fi
+  _optidata_report_error "Delete txt record error."
+  return 1
+}
+
+####################  Private functions below ##################################
+
+# Reads the settings from the environment or from the saved acme.sh config and
+# validates them. Shared by add and rm, which run in separate subshells.
+_optidata_load_config() {
+  OPTIDATA_Token="${OPTIDATA_Token:-$(_readdomainconf OPTIDATA_Token)}"
+  OPTIDATA_Token="${OPTIDATA_Token:-$(_readaccountconf_mutable OPTIDATA_Token)}"
+  OPTIDATA_Api="${OPTIDATA_Api:-$(_readaccountconf_mutable OPTIDATA_Api)}"
+  OPTIDATA_Location="${OPTIDATA_Location:-$(_readdomainconf OPTIDATA_Location)}"
+  OPTIDATA_Location="${OPTIDATA_Location:-$(_readaccountconf_mutable OPTIDATA_Location)}"
+  OPTIDATA_Zone_ID="${OPTIDATA_Zone_ID:-$(_readdomainconf OPTIDATA_Zone_ID)}"
+  OPTIDATA_Zone_ID="${OPTIDATA_Zone_ID:-$(_readaccountconf_mutable OPTIDATA_Zone_ID)}"
+
+  # Keys are pasted with quotes or blanks often enough to be worth cleaning.
+  OPTIDATA_Token="$(printf "%s" "$OPTIDATA_Token" | tr -d '" ')"
+  if [ -z "$OPTIDATA_Token" ]; then
+    OPTIDATA_Token=""
+    _err "You did not specify OPTIDATA_Token yet."
+    _err "Create a DNS API key in the Optidata Console (API Keys) and export it:"
+    _err "export OPTIDATA_Token=ocs_xxxxxxxxxxxxxxxx"
+    return 1
+  fi
+  if ! _startswith "$OPTIDATA_Token" "ocs_"; then
+    OPTIDATA_Token=""
+    _err 'OPTIDATA_Token must be an Optidata API key: it starts with "ocs_". Did you copy the entire key?'
+    return 1
+  fi
+
+  OPTIDATA_Api="${OPTIDATA_Api:-$OPTIDATA_DEFAULT_API}"
+  OPTIDATA_Api="$(printf "%s\n" "$OPTIDATA_Api" | sed 's:/*$::')"
+  case "$OPTIDATA_Api" in
+  http://* | https://*) ;;
+  *)
+    _err "OPTIDATA_Api must be an http(s) URL, e.g. $OPTIDATA_DEFAULT_API"
+    return 1
+    ;;
+  esac
+  _debug OPTIDATA_Api "$OPTIDATA_Api"
+  _debug OPTIDATA_Location "$OPTIDATA_Location"
+  _debug OPTIDATA_Zone_ID "$OPTIDATA_Zone_ID"
+  return 0
+}
+
+# Persists the settings so renewals work without the environment, following
+# dns_cf.sh: with a pinned zone the key lives in the domain config (so a
+# zone-restricted key can be used per certificate), otherwise in the account
+# config.
+_optidata_save_config() {
+  if [ "$OPTIDATA_Zone_ID" ]; then
+    _savedomainconf OPTIDATA_Token "$OPTIDATA_Token"
+    _savedomainconf OPTIDATA_Zone_ID "$OPTIDATA_Zone_ID"
+    if [ "$OPTIDATA_Location" ]; then
+      _savedomainconf OPTIDATA_Location "$OPTIDATA_Location"
+    else
+      _cleardomainconf OPTIDATA_Location
+    fi
+  else
+    _saveaccountconf_mutable OPTIDATA_Token "$OPTIDATA_Token"
+    if [ "$OPTIDATA_Location" ]; then
+      _saveaccountconf_mutable OPTIDATA_Location "$OPTIDATA_Location"
+    else
+      _clearaccountconf_mutable OPTIDATA_Location
+    fi
+    _clearaccountconf_mutable OPTIDATA_Zone_ID
+    _clearaccountconf OPTIDATA_Zone_ID
+  fi
+
+  if [ "$OPTIDATA_Api" != "$OPTIDATA_DEFAULT_API" ]; then
+    _saveaccountconf_mutable OPTIDATA_Api "$OPTIDATA_Api"
+  else
+    _clearaccountconf_mutable OPTIDATA_Api
+  fi
+}
+
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=a86dba58-0043-4cc6-a1bb-69d5e86f3ca3
+# _zone_location=3f2b46f2-4f14-44e2-8e21-1b6c17f2a9d1 (empty when the API does not report one)
+_get_root() {
+  domain=$1
+  _domain_lc="$(printf "%s\n" "$domain" | _lower_case | sed 's/\.$//')"
+  _domain=""
+  _domain_id=""
+  _sub_domain=""
+  _zone_location=""
+  _zone_status=""
+
+  if [ "$OPTIDATA_Zone_ID" ]; then
+    _debug "Using the pinned zone" "$OPTIDATA_Zone_ID"
+    if ! _optidata_rest GET "dns-zones/$OPTIDATA_Zone_ID$(_optidata_query "")"; then
+      _optidata_report_error "Can not read zone $OPTIDATA_Zone_ID."
+      return 1
+    fi
+    _zone_json="$response"
+  else
+    # The API returns every zone that contains the name, most specific first.
+    if ! _optidata_rest GET "dns-zones?name=$(printf "%s" "$_domain_lc" | _url_encode)"; then
+      _optidata_report_error "Zone lookup for $domain failed."
+      return 1
+    fi
+    if printf "%s\n" "$response" | tr -d " " | grep '"data":\[\]' >/dev/null; then
+      _err "No Optidata DNS zone contains $domain."
+      _err "Check that the zone exists in this account and that the API key is allowed to access it."
+      return 1
+    fi
+    # Pick the longest zone that is a suffix of the name ourselves as well, so
+    # an API that ignores the name filter still resolves the right zone.
+    _zone_json="$(_optidata_pick_zone "$response" "$_domain_lc")"
+    if [ -z "$_zone_json" ]; then
+      _err "No Optidata DNS zone contains $domain: $response"
+      return 1
+    fi
+  fi
+
+  _domain_id="$(_optidata_json_string "$_zone_json" id)"
+  _domain="$(_optidata_json_string "$_zone_json" zone_name)"
+  if [ -z "$_domain" ]; then
+    _domain="$(_optidata_json_string "$_zone_json" name)"
+  fi
+  _domain="$(printf "%s\n" "$_domain" | _lower_case | sed 's/\.$//')"
+  _zone_location="$(_optidata_json_string "$_zone_json" location)"
+  _zone_status="$(_optidata_json_string "$_zone_json" status)"
+  _debug _zone_location "$_zone_location"
+  _debug _zone_status "$_zone_status"
+
+  if [ -z "$_domain_id" ] || [ -z "$_domain" ]; then
+    _err "Could not read the zone id and name from the API response: $response"
+    return 1
+  fi
+
+  if [ "$_domain_lc" = "$_domain" ]; then
+    _sub_domain=""
+  else
+    case "$_domain_lc" in
+    *".$_domain")
+      _sub_domain="${_domain_lc%".$_domain"}"
+      ;;
+    *)
+      _err "Zone $_domain ($_domain_id) does not contain $domain."
+      return 1
+      ;;
+    esac
+  fi
+
+  if [ "$_zone_status" ] && [ "$_zone_status" != "ACTIVE" ]; then
+    _info "Zone $_domain has status $_zone_status; records are only published once the zone is ACTIVE (delegated to the Optidata name servers)."
+  fi
+  return 0
+}
+
+# Usage: _optidata_pick_zone '<list response>' '<lowercase fqdn>'
+# Prints the JSON of the zone with the longest name that is the fqdn itself or
+# one of its parents. Zones are flat objects, so splitting on "},{" is safe.
+_optidata_pick_zone() {
+  _pz_json="$1"
+  _pz_name="$2"
+  _pz_objects="$(printf "%s\n" "$_pz_json" | sed 's/}, *{/}\
+{/g')"
+  _pz_count="$(printf "%s\n" "$_pz_objects" | wc -l | tr -d " ")"
+  _pz_best=""
+  _pz_best_len=0
+  _pz_i=1
+  while [ "$_pz_i" -le "$_pz_count" ]; do
+    _pz_obj="$(printf "%s\n" "$_pz_objects" | sed -n "${_pz_i}p")"
+    _pz_zone="$(_optidata_json_string "$_pz_obj" zone_name)"
+    if [ -z "$_pz_zone" ]; then
+      _pz_zone="$(_optidata_json_string "$_pz_obj" name)"
+    fi
+    _pz_zone="$(printf "%s\n" "$_pz_zone" | _lower_case | sed 's/\.$//')"
+    if [ "$_pz_zone" ]; then
+      case "$_pz_name" in
+      "$_pz_zone" | *".$_pz_zone")
+        if [ "${#_pz_zone}" -gt "$_pz_best_len" ]; then
+          _pz_best="$_pz_obj"
+          _pz_best_len="${#_pz_zone}"
+        fi
+        ;;
+      esac
+    fi
+    _pz_i=$(_math "$_pz_i" + 1)
+  done
+  printf "%s" "$_pz_best"
+}
+
+# Usage: _optidata_json_string '<json>' key
+# Prints the string value of the first "key" in the JSON, nothing when the key
+# is absent or not a string (e.g. "location":null).
+_optidata_json_string() {
+  printf "%s\n" "$1" | _egrep_o "\"$2\": *\"[^\"]*\"" | _head_n 1 | sed 's/^"[^"]*": *"//; s/"$//'
+}
+
+# Escapes a value for use inside a JSON string literal.
+_optidata_json_escape() {
+  printf "%s\n" "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+}
+
+# Usage: _optidata_query '<query without the leading ?>'
+# Appends the location (explicit OPTIDATA_Location, else the one reported by
+# the zone lookup) and prints the query string with its leading "?", or
+# nothing when there is nothing to send.
+_optidata_query() {
+  _oq="$1"
+  _oq_loc="${OPTIDATA_Location:-$_zone_location}"
+  if [ "$_oq_loc" ]; then
+    if [ "$_oq" ]; then
+      _oq="$_oq&location=$(printf "%s" "$_oq_loc" | _url_encode)"
+    else
+      _oq="location=$(printf "%s" "$_oq_loc" | _url_encode)"
+    fi
+  fi
+  if [ "$_oq" ]; then
+    printf "?%s" "$_oq"
+  fi
+}
+
+# Usage: _optidata_rest METHOD 'endpoint under /api/v1' [json body]
+# Sets $response to the normalized JSON body. Returns 0 on a success envelope;
+# otherwise sets $_optidata_status / $_optidata_message and returns 1. Rate
+# limits and upstream hiccups (429, 502-504) are retried a few times.
+_optidata_rest() {
+  _m=$1
+  _ep=$2
+  _data=$3
+  _debug "$_m $_ep"
+
+  # Hooks share one shell and _get/_post always send _H1 to _H5, so the unused
+  # slots have to be cleared: otherwise a previous provider's header (an auth
+  # header, for instance) is sent to the Optidata endpoint.
+  export _H1="Accept: application/json"
+  export _H2="Content-Type: application/json"
+  export _H3="x-api-key: $OPTIDATA_Token"
+  export _H4=""
+  export _H5=""
+
+  _url="$OPTIDATA_Api/api/v1/$_ep"
+  _optidata_status=""
+  _optidata_message=""
+  _attempt=1
+  while true; do
+    # A failed request leaves the previous status line in the header file, which
+    # would then be read as this request's response code.
+    if [ -z "$HTTP_HEADER" ]; then
+      _err "HTTP header file is not initialized"
+      return 1
+    fi
+    : >"$HTTP_HEADER" || return 1
+    if [ "$_m" = "GET" ]; then
+      response="$(_get "$_url")"
+    else
+      _debug2 data "$_data"
+      response="$(_post "$_data" "$_url" "" "$_m")"
+    fi
+    _ret="$?"
+    if [ "$_ret" != "0" ]; then
+      _err "Request to $_url failed. Is OPTIDATA_Api correct and reachable?"
+      return 1
+    fi
+    _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d '\r\n')"
+    _debug "http response code" "$_code"
+    response="$(printf "%s\n" "$response" | _normalizeJson)"
+    _debug2 response "$response"
+
+    if printf "%s\n" "$response" | tr -d " " | grep '"success":true' >/dev/null; then
+      return 0
+    fi
+
+    _optidata_status="$(printf "%s\n" "$response" | _egrep_o '"status_code": *[0-9]*' | _head_n 1 | cut -d : -f 2 | tr -d " ")"
+    if [ -z "$_optidata_status" ]; then
+      _optidata_status="$_code"
+    fi
+    _optidata_message="$(_optidata_json_string "$response" message)"
+    if [ -z "$_optidata_message" ]; then
+      # Validation errors carry an array of messages.
+      _optidata_message="$(printf "%s\n" "$response" | _egrep_o '"message": *\[[^]]*\]' | _head_n 1 | sed 's/^"message": *\[//; s/\]$//' | tr -d '"')"
+    fi
+
+    case "$_optidata_status" in
+    429 | 502 | 503 | 504)
+      if [ "$_attempt" -lt "$OPTIDATA_MAX_ATTEMPTS" ]; then
+        _wait="$(grep -i "^Retry-After:" "$HTTP_HEADER" | _tail_n 1 | cut -d : -f 2 | tr -d ' \r\n')"
+        case "$_wait" in
+        '' | *[!0-9]*) _wait=5 ;;
+        esac
+        if [ "$_wait" -gt 60 ]; then
+          _wait=60
+        fi
+        _info "Optidata API answered HTTP $_optidata_status; retrying in ${_wait}s (attempt $_attempt of $OPTIDATA_MAX_ATTEMPTS)."
+        _sleep "$_wait"
+        _attempt=$(_math "$_attempt" + 1)
+        continue
+      fi
+      ;;
+    esac
+    return 1
+  done
+}
+
+# Usage: _optidata_report_error 'what failed'
+# Logs the API error captured by _optidata_rest plus a hint for the usual causes.
+_optidata_report_error() {
+  _err "$1"
+  if [ "$_optidata_message" ]; then
+    _err "Optidata API answered HTTP ${_optidata_status:-?}: $_optidata_message"
+  elif [ "$_optidata_status" ]; then
+    _err "Optidata API answered HTTP $_optidata_status: $response"
+  fi
+  case "$_optidata_status" in
+  401)
+    _err "Check OPTIDATA_Token: it must be a valid, enabled Optidata API key (it starts with ocs_). Did you copy the entire key?"
+    ;;
+  402)
+    _err "The account is blocked for billing reasons. Check the payment method in the Optidata Console."
+    ;;
+  403)
+    _err "The key must be a DNS API key with the dns_zones scope, the permissions zones_read, records_create, records_update and records_delete, and access to this zone."
+    ;;
+  404)
+    _err "The zone was not found. If it lives outside the account default location, set OPTIDATA_Location to its location code or UUID."
+    ;;
+  409)
+    _err "The zone is not delegated to the Optidata name servers yet. Point the domain NS records to them and retry once the zone status is ACTIVE."
+    ;;
+  429)
+    _err "The Optidata API rate limit was reached. Retry in a minute."
+    ;;
+  esac
+}

From 2074493c7c3e8d41c4bd9577ab839017decc4781 Mon Sep 17 00:00:00 2001
From: Jens Ott <jo@opteamax.de>
Date: Fri, 11 Sep 2026 05:49:47 +0200
Subject: [PATCH 08/17] Add Opteamax DNS API (#7244)

Adds dns_opteamax.sh, solving dns-01 challenges through the Opteamax
customer API (api.opteam.ax). Authentication is a Bearer token created in
the customer panel; the zone is detected by walking the name up against the
account's zone list, so subzones and DNS alias mode both work, and rm only
removes the value it was given so a wildcard's two TXT records survive each
other.
---
 dnsapi/dns_opteamax.sh | 229 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 229 insertions(+)
 create mode 100644 dnsapi/dns_opteamax.sh

diff --git a/dnsapi/dns_opteamax.sh b/dnsapi/dns_opteamax.sh
new file mode 100644
index 00000000..0d8dcf18
--- /dev/null
+++ b/dnsapi/dns_opteamax.sh
@@ -0,0 +1,229 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_opteamax_info='Opteamax.de
+Site: opteamax.de
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_opteamax
+Options:
+ OPTEAMAX_Token API token. Create it in the customer panel under "API-Tokens"; it starts with "oxt_".
+ OPTEAMAX_Api API endpoint. Default "https://api.opteam.ax/api/v2". Optional.
+Issues: github.com/acmesh-official/acme.sh/issues/7245
+Author: Jens Ott <jo@opteamax.de>
+'
+
+OPTEAMAX_Api_Default="https://api.opteam.ax/api/v2"
+
+######## Public functions #####################
+
+#Usage: dns_opteamax_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_opteamax_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _opteamax_init; then
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _domain "$_domain"
+  _debug _domain_id "$_domain_id"
+
+  _info "Adding the TXT record"
+  _opteamax_body="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"content\":\"$txtvalue\",\"ttl\":300}"
+  if ! _opteamax_rest POST "/dns/domains/$_domain_id/records/" "$_opteamax_body"; then
+    return 1
+  fi
+  if ! _contains "$response" "data_id"; then
+    _err "Could not add the TXT record: $response"
+    return 1
+  fi
+
+  _info "TXT record added"
+  return 0
+}
+
+#Usage: dns_opteamax_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_opteamax_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _opteamax_init; then
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _domain "$_domain"
+  _debug _domain_id "$_domain_id"
+
+  _debug "Getting the record id"
+  if ! _opteamax_rest GET "/dns/domains/$_domain_id/records/"; then
+    return 1
+  fi
+
+  # Only this challenge's record may go: a wildcard certificate puts two TXT
+  # values on the same name, and acme.sh removes them one call at a time.
+  # PowerDNS hands TXT content back in wire format, so the value arrives inside
+  # escaped quotes ("content": "\"<value>\""); matching from the field name up
+  # to the next field keeps the value pinned to the content field without
+  # spelling out those backslashes. _head_n 1 guarantees a single id even if an
+  # aborted earlier run left the same value behind twice.
+  _record_id=$(
+    echo "$response" | _opteamax_split |
+      grep '"type": *"TXT"' |
+      grep "\"name\": *\"$(_opteamax_re "$fulldomain")\.\"" |
+      grep "\"content\":[^,]*$txtvalue" |
+      _egrep_o '"data_id": *"[^"]*"' |
+      sed 's/.*"data_id": *"//;s/"$//' |
+      _head_n 1
+  )
+  _debug _record_id "$_record_id"
+
+  if [ -z "$_record_id" ]; then
+    _info "No such TXT record, nothing to remove."
+    return 0
+  fi
+
+  _info "Removing the TXT record"
+  if ! _opteamax_rest DELETE "/dns/domains/$_domain_id/records/$_record_id/"; then
+    return 1
+  fi
+
+  _info "TXT record removed"
+  return 0
+}
+
+#################### Private functions below ##################################
+
+# Read and check the credentials, and remember them for the renewal.
+_opteamax_init() {
+  OPTEAMAX_Token="${OPTEAMAX_Token:-$(_readaccountconf_mutable OPTEAMAX_Token)}"
+  OPTEAMAX_Api="${OPTEAMAX_Api:-$(_readaccountconf_mutable OPTEAMAX_Api)}"
+
+  if [ -z "$OPTEAMAX_Token" ]; then
+    _err "You have not set OPTEAMAX_Token yet."
+    _err "Create an API token in the customer panel under \"API-Tokens\" and export it:"
+    _err "export OPTEAMAX_Token=\"oxt_...\""
+    return 1
+  fi
+
+  if [ -z "$OPTEAMAX_Api" ]; then
+    OPTEAMAX_Api="$OPTEAMAX_Api_Default"
+  else
+    # A trailing slash would make every request path a double slash, which
+    # Django answers with a redirect that drops the request body.
+    OPTEAMAX_Api=$(echo "$OPTEAMAX_Api" | sed 's|/*$||')
+    _saveaccountconf_mutable OPTEAMAX_Api "$OPTEAMAX_Api"
+  fi
+  _saveaccountconf_mutable OPTEAMAX_Token "$OPTEAMAX_Token"
+  return 0
+}
+
+#_acme-challenge.www.domain.com
+#returns
+# _domain=domain.com
+# _domain_id=1234
+_get_root() {
+  domain=$1
+
+  # One request for the account's zones, then the name is walked up against
+  # them locally: the longest match wins, so a delegated subzone beats its
+  # parent.
+  if ! _opteamax_rest GET "/dns/domains/"; then
+    return 1
+  fi
+  _zones=$(echo "$response" | _opteamax_split)
+
+  i=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+    if [ -z "$h" ]; then
+      break
+    fi
+
+    _domain_id=$(
+      echo "$_zones" |
+        grep "\"domain\": *\"$(_opteamax_re "$h")\.\{0,1\}\"" |
+        _egrep_o '"domain_id": *[0-9]*' |
+        tr -d ' ' | cut -d : -f 2 | _head_n 1
+    )
+    if [ "$_domain_id" ]; then
+      _domain="$h"
+      return 0
+    fi
+
+    i=$(_math "$i" + 1)
+  done
+
+  # Only reached when the walk ran out of labels -- a failed request returns
+  # above, so this really does mean the account holds no zone for the name.
+  _err "Could not find a zone for $domain in your Opteamax account."
+  return 1
+}
+
+# Put one JSON object per line so a record's id can be read off the same line
+# as its name and content.
+_opteamax_split() {
+  sed 's/}, *{/}#{/g' | tr '#' '\n'
+}
+
+# Escape a domain name for use in a grep pattern: the dots are literal.
+_opteamax_re() {
+  echo "$1" | sed 's/\./\\./g'
+}
+
+# method endpoint [body]
+_opteamax_rest() {
+  m="$1"
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Authorization: Bearer $OPTEAMAX_Token"
+  export _H2="Content-Type: application/json"
+  export _H3="Accept: application/json"
+
+  if [ "$m" = "GET" ]; then
+    response="$(_get "$OPTEAMAX_Api$ep")"
+  else
+    _debug data "$data"
+    response="$(_post "$data" "$OPTEAMAX_Api$ep" "" "$m")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Error talking to $OPTEAMAX_Api$ep"
+    return 1
+  fi
+  _debug2 response "$response"
+
+  # A proxy or gateway error comes back as an HTML page with a 5xx status, and
+  # the http helpers only report transport failures -- so without this check the
+  # caller parses an error page as data and reports something misleading, such
+  # as the zone not existing.
+  case "$response" in
+  "{"* | "["*) ;;
+  *)
+    _err "Unexpected response from $OPTEAMAX_Api$ep (not JSON):"
+    _err "$(echo "$response" | _head_n 3)"
+    return 1
+    ;;
+  esac
+
+  # The API answers an authentication or permission problem with a JSON body
+  # and a 4xx status; the http helpers only report transport errors, so the
+  # body is what tells us the call was refused.
+  if _contains "$response" '"detail"'; then
+    _err "The API refused the request: $response"
+    return 1
+  fi
+
+  return 0
+}

From 9249c8922101f394e78c0d09332d0e604b71bc23 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 11 Sep 2026 11:50:56 +0800
Subject: [PATCH 09/17] Both confirmed and fixed in dev.

1. The four backup cp calls (KEYFILE/CERTFILE/CAFILE/FULLCHAIN) ran
   unguarded. With USE_SCP=yes MULTI_CALL is implicit, so each cp is its
   own ssh call and a missing source aborted the deploy. In batched mode
   it was masked because the exit code is that of the last command.
   Each cp is now wrapped in a remote [ -f ] test.
2. deploy/ssh.sh tested DEPLOY_SSH_FULLCHAIN = "yes" instead of
   DEPLOY_SSH_MULTI_CALL (since 2017). Effect was only that the
   fullchain backup got deferred to the next batch. Fixed as well.

Please upgrade with acme.sh --upgrade -b dev and retest.
---
 deploy/ssh.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 0bf3ee48..1c9b003d 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -247,7 +247,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
     if [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_KEYFILE ]; then cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -284,7 +284,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CERTFILE ]; then cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -325,7 +325,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CAFILE ]; then cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -370,8 +370,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null;"
-      if [ "$DEPLOY_SSH_FULLCHAIN" = "yes" ]; then
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_FULLCHAIN ]; then cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null; fi;"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi

From 98276668fd2acf29f073d971d31d17071c07f602 Mon Sep 17 00:00:00 2001
From: Bill Weiss <github@houdini.spum.us>
Date: Thu, 10 Sep 2026 21:55:38 -0600
Subject: [PATCH 10/17] Truenas 26 deploy fixes (#7205)

* Works with TrueNAS 26.0.0-BETA3 now

* Updated to work with new and old versions of TrueNAS

* shfmt fix for my changes

---------

Co-authored-by: Bill Weiss <github@e.billweiss.net>
---
 deploy/truenas_ws.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/deploy/truenas_ws.sh b/deploy/truenas_ws.sh
index 33e3dfa0..44eb0f8a 100644
--- a/deploy/truenas_ws.sh
+++ b/deploy/truenas_ws.sh
@@ -43,15 +43,15 @@ _ws_call() {
   _debug "_ws_call arg1" "$1"
   _debug "_ws_call arg2" "$2"
   _debug "_ws_call arg3" "$3"
-  if [ $# -eq 3 ]; then
-    _ws_response=$(midclt --uri "$_ws_uri" -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2" "$3")
-  fi
-  if [ $# -eq 2 ]; then
-    _ws_response=$(midclt --uri "$_ws_uri" -K "$DEPLOY_TRUENAS_APIKEY" call "$1" "$2")
-  fi
-  if [ $# -eq 1 ]; then
-    _ws_response=$(midclt --uri "$_ws_uri" -K "$DEPLOY_TRUENAS_APIKEY" call "$1")
-  fi
+
+  # TrueNAS 26.0.0-BETA3 and later need a --plain option for midclt call, detect if it is available
+  _midclt_plain=""
+  case "$(midclt --help 2>/dev/null)" in
+  *--plain*) _midclt_plain="--plain" ;;
+  esac
+
+  _ws_response=$(midclt --uri "$_ws_uri" -K "$DEPLOY_TRUENAS_APIKEY" $_midclt_plain call "$@")
+
   _debug "_ws_response" "$_ws_response"
   printf "%s" "$_ws_response"
   return 0
@@ -256,8 +256,8 @@ truenas_ws_deploy() {
 
   _info "Gather current WebUI certificate..."
   _ws_response="$(_ws_call "system.general.config")"
-  _ui_certificate_id=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
-  _ui_certificate_name=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."name"')
+  _ui_certificate_id=$(printf "%s" "$_ws_response" | jq -r '.ui_certificate | if type == "object" then .id else . end')
+  _ui_certificate_name=$(printf "%s" "$_ws_response" | jq -r 'if (.ui_certificate | type) == "object" then .ui_certificate.name else .ui_certificate_name end')
   _info "Current WebUI certificate ID: $_ui_certificate_id"
   _info "Current WebUI certificate name: $_ui_certificate_name"
 
@@ -332,7 +332,7 @@ truenas_ws_deploy() {
 
   _info "Replace WebUI certificate..."
   _ws_response=$(_ws_call "system.general.update" "{\"ui_certificate\": $_new_certid}")
-  _changed_certid=$(printf "%s" "$_ws_response" | jq -r '."ui_certificate"."id"')
+  _changed_certid=$(printf "%s" "$_ws_response" | jq -r '.ui_certificate | if type == "object" then .id else . end')
   if [ "$_changed_certid" != "$_new_certid" ]; then
     _err "WebUI certificate change error.."
     return 5

From cbd68ddc020ab54b3ebe12105b303fe4f36c3018 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 11 Sep 2026 12:42:34 +0800
Subject: [PATCH 11/17] Ignore an HTTP-date Retry-After when polling an order

Pebble answers a processing order with "Retry-After: <HTTP-date>". The
poll loop cut the value at the first colon and fed "Fri,11Sep202604" to
"[ -gt 0 ]", which errored with "integer expression expected" on every
round. Add _retryafter_seconds, which prints the header only in its
delay-seconds form, and use it at all four Retry-After sites. The two
sites that already filtered on digits used "[0-9]\+", which Solaris grep
does not support.
---
 acme.sh | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/acme.sh b/acme.sh
index 97147766..f87aba3e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2457,6 +2457,16 @@ _retry_backoff_sec() {
   esac
 }
 
+#Reads response headers from stdin and prints the Retry-After value, but only
+#when it is the delay-seconds form. The header may also carry an HTTP-date
+#(Pebble sends one on a processing order); that form prints nothing, so the
+#caller falls back to its own delay. Cutting a date at the first colon leaves
+#"Fri,11Sep202604" behind and every numeric test on it then errors with
+#"integer expression expected".
+_retryafter_seconds() {
+  tr -d '\r' | grep -i "^Retry-After *: *[0-9][0-9]* *$" | _head_n 1 | cut -d : -f 2 | tr -d ' '
+}
+
 # url  payload needbase64  keyfile
 _send_signed_request() {
   url=$1
@@ -2580,7 +2590,7 @@ _send_signed_request() {
         _debug3 _body "$_body"
       fi
 
-      _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *: *[0-9]\+ *" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
+      _retryafter=$(echo "$responseHeaders" | _retryafter_seconds)
       if _is_gateway_error "$code"; then
         _sleep_overload_retry_sec=$_retryafter
         if [ -z "$_sleep_overload_retry_sec" ]; then
@@ -5954,7 +5964,7 @@ $_authorizations_map"
         _on_issue_err "$_post_hook" "$vlist"
         return 1
       fi
-      _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *: *[0-9]\+ *" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
+      _retryafter=$(echo "$responseHeaders" | _retryafter_seconds)
       _sleep_overload_retry_sec=$_retryafter
       if [ "$_sleep_overload_retry_sec" ]; then
         if [ $_sleep_overload_retry_sec -le 600 ]; then
@@ -6024,7 +6034,7 @@ $_authorizations_map"
       break
     elif _contains "$response" "\"ready\""; then
       _info "Order status is 'ready', let's sleep and retry."
-      _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
+      _retryafter=$(echo "$responseHeaders" | _retryafter_seconds)
       _debug "_retryafter" "$_retryafter"
       if [ "$_retryafter" ] && [ $_retryafter -gt 0 ]; then
         _info "Sleeping for $_retryafter seconds then retrying"
@@ -6034,7 +6044,7 @@ $_authorizations_map"
       fi
     elif _contains "$response" "\"processing\""; then
       _info "Order status is 'processing', let's sleep and retry."
-      _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
+      _retryafter=$(echo "$responseHeaders" | _retryafter_seconds)
       _debug "_retryafter" "$_retryafter"
       if [ "$_retryafter" ] && [ $_retryafter -gt 0 ]; then
         _info "Sleeping for $_retryafter seconds then retrying"

From efecf2a308ef991032cd2aa08c1c5aff98d947d5 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 11 Sep 2026 14:23:38 +0800
Subject: [PATCH 12/17] ci: run Pebble with PEBBLE_AUTHZREUSE=0 in PebbleStrict

Pebble reuses a valid authorization in a new order 50% of the time by
default, so the dns manual mode case was a coin flip: a reused
authorization left nothing for the TXT record to answer.
---
 .github/workflows/PebbleStrict.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/PebbleStrict.yml b/.github/workflows/PebbleStrict.yml
index 4cb65f6f..09de7170 100644
--- a/.github/workflows/PebbleStrict.yml
+++ b/.github/workflows/PebbleStrict.yml
@@ -38,7 +38,14 @@ jobs:
     - name: Install tools
       run: sudo apt-get install -y socat
     - name: Run Pebble
-      run: cd .. && curl https://raw.githubusercontent.com/letsencrypt/pebble/master/docker-compose.yml >docker-compose.yml && docker compose up -d
+      run: |
+        cd ..
+        curl https://raw.githubusercontent.com/letsencrypt/pebble/master/docker-compose.yml >docker-compose.yml
+        # Pebble reuses a valid authorization in a new order 50% of the time
+        # by default, which makes the dns manual mode case a coin flip: a
+        # reused authorization leaves nothing for the TXT record to answer.
+        printf 'services:\n  pebble:\n    environment:\n      PEBBLE_AUTHZREUSE: "0"\n' >docker-compose.override.yml
+        docker compose up -d
     - name: Set up Pebble
       run: curl --request POST --data '{"ip":"10.30.50.1"}' http://localhost:8055/set-default-ipv4
     - name: Clone acmetest

From 666bf75589fc44cc4c609655a725f1303c229f44 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 11 Sep 2026 14:56:58 +0800
Subject: [PATCH 13/17] Honor an HTTP-date Retry-After when polling an order

HARICA answers a processing order with "Retry-After: <HTTP-date>" set
about two minutes after finalize (discussion 7190). Skipping the date
left the poll loop on its 2s fallback, and 30 rounds ran out 21 seconds
before the time the CA had named, so the issue failed although the
certificate was about to be signed.

Add _httpdate2time, which converts the IMF-fixdate form in shell
arithmetic: GNU, BSD and busybox date each want a different invocation
for it, and %a/%b are locale lookups. _retryafter_seconds prints
delay-seconds as before and turns a date into the seconds left until
then; a date in the past or an unparseable value still prints nothing.
---
 acme.sh | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 81 insertions(+), 7 deletions(-)

diff --git a/acme.sh b/acme.sh
index f87aba3e..f7ba06e7 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1982,6 +1982,63 @@ _ssldate2time() {
   return 1
 }
 
+#support the IMF-fixdate form of an HTTP-date, the one a Retry-After header
+#carries; it is always GMT:
+#     Sun, 06 Nov 1994 08:49:37 GMT   to   784111777
+#Computed in shell arithmetic rather than through date(1): GNU, BSD and
+#busybox date each want a different invocation for this form, and %a/%b are
+#locale lookups. The day count is the civil-to-days formula, exact for every
+#Gregorian date from 1970 on. Prints nothing and fails on any other input.
+_httpdate2time() {
+  _hdt="$1"
+  case "$_hdt" in
+  [A-Za-z][A-Za-z][A-Za-z]", "[0-9][0-9]" "[A-Za-z][A-Za-z][A-Za-z]" "[0-9][0-9][0-9][0-9]" "[0-9][0-9]:[0-9][0-9]:[0-9][0-9]" GMT") ;;
+  *)
+    return 1
+    ;;
+  esac
+  #the shell reads a leading zero as octal, so strip it before any arithmetic
+  _hdt_d="$(echo "$_hdt" | cut -d ' ' -f 2 | sed 's/^0*\([0-9]\)/\1/')"
+  _hdt_y="$(echo "$_hdt" | cut -d ' ' -f 4)"
+  _hdt_tm="$(echo "$_hdt" | cut -d ' ' -f 5)"
+  _hdt_H="$(echo "$_hdt_tm" | cut -d : -f 1 | sed 's/^0*\([0-9]\)/\1/')"
+  _hdt_M="$(echo "$_hdt_tm" | cut -d : -f 2 | sed 's/^0*\([0-9]\)/\1/')"
+  _hdt_S="$(echo "$_hdt_tm" | cut -d : -f 3 | sed 's/^0*\([0-9]\)/\1/')"
+  case "$(echo "$_hdt" | cut -d ' ' -f 3 | _lower_case)" in
+  jan) _hdt_m=1 ;;
+  feb) _hdt_m=2 ;;
+  mar) _hdt_m=3 ;;
+  apr) _hdt_m=4 ;;
+  may) _hdt_m=5 ;;
+  jun) _hdt_m=6 ;;
+  jul) _hdt_m=7 ;;
+  aug) _hdt_m=8 ;;
+  sep) _hdt_m=9 ;;
+  oct) _hdt_m=10 ;;
+  nov) _hdt_m=11 ;;
+  dec) _hdt_m=12 ;;
+  *)
+    return 1
+    ;;
+  esac
+  if [ "$_hdt_y" -lt 1970 ] || [ "$_hdt_d" -lt 1 ] || [ "$_hdt_d" -gt 31 ] || [ "$_hdt_H" -gt 23 ] || [ "$_hdt_M" -gt 59 ] || [ "$_hdt_S" -gt 60 ]; then
+    return 1
+  fi
+  #years start in March so the leap day is the last day of the year
+  if [ "$_hdt_m" -le 2 ]; then
+    _hdt_y="$((_hdt_y - 1))"
+    _hdt_mp="$((_hdt_m + 9))"
+  else
+    _hdt_mp="$((_hdt_m - 3))"
+  fi
+  _hdt_era="$((_hdt_y / 400))"
+  _hdt_yoe="$((_hdt_y - _hdt_era * 400))"
+  _hdt_doy="$(((153 * _hdt_mp + 2) / 5 + _hdt_d - 1))"
+  _hdt_doe="$((_hdt_yoe * 365 + _hdt_yoe / 4 - _hdt_yoe / 100 + _hdt_doy))"
+  _hdt_days="$((_hdt_era * 146097 + _hdt_doe - 719468))"
+  echo "$((_hdt_days * 86400 + _hdt_H * 3600 + _hdt_M * 60 + _hdt_S))"
+}
+
 _utc_date() {
   date -u "+%Y-%m-%d %H:%M:%S"
 }
@@ -2457,14 +2514,31 @@ _retry_backoff_sec() {
   esac
 }
 
-#Reads response headers from stdin and prints the Retry-After value, but only
-#when it is the delay-seconds form. The header may also carry an HTTP-date
-#(Pebble sends one on a processing order); that form prints nothing, so the
-#caller falls back to its own delay. Cutting a date at the first colon leaves
-#"Fri,11Sep202604" behind and every numeric test on it then errors with
-#"integer expression expected".
+#Reads response headers from stdin and prints the Retry-After value as a
+#number of seconds from now. The header carries either delay-seconds, printed
+#as is, or an HTTP-date (HARICA sends one on a processing order, Pebble too),
+#converted with _httpdate2time and turned into a delay against the local
+#clock. A date already in the past, or a value in neither form, prints
+#nothing, so the caller falls back to its own delay. Cutting a date at the
+#first colon used to leave "Thu,13Aug202612" behind, and every numeric test
+#on it then errored with "integer expression expected".
 _retryafter_seconds() {
-  tr -d '\r' | grep -i "^Retry-After *: *[0-9][0-9]* *$" | _head_n 1 | cut -d : -f 2 | tr -d ' '
+  _ras_v="$(tr -d '\r' | grep -i "^Retry-After *:" | _head_n 1 | cut -d : -f 2- | sed 's/^ *//; s/ *$//')"
+  if [ -z "$_ras_v" ]; then
+    return 0
+  fi
+  case "$_ras_v" in
+  *[!0-9]*)
+    _ras_t="$(_httpdate2time "$_ras_v")" || return 0
+    _ras_d="$((_ras_t - $(_time)))"
+    if [ "$_ras_d" -gt 0 ]; then
+      echo "$_ras_d"
+    fi
+    ;;
+  *)
+    echo "$_ras_v"
+    ;;
+  esac
 }
 
 # url  payload needbase64  keyfile

From 8e5ba60beea6f99a3270b10e6b9b4e9aa5e12314 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Sun, 13 Sep 2026 07:50:39 +0200
Subject: [PATCH 14/17] deploy/ssh: create the backup directory only when there
 is a file to back up

Follow-up to 9249c892 (#7249). The mkdir -p ran unconditionally before
the guarded cp calls, so a first deploy left an empty backup directory
behind. Move the mkdir into each guarded block.
---
 deploy/ssh.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 1c9b003d..a76d8097 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -232,8 +232,6 @@ _ssh_deploy() {
 do if [ -d \"\$fn\" ] && [ \"\$(expr \$now - \$(date -ur \$fn +%s) )\" -ge \"15552000\" ]; \
 then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; done; }; $_cmdstr"
     # Alternate version of above... _cmdstr="find $_backupprefix* -type d -mtime +180 2>/dev/null | xargs rm -rf; $_cmdstr"
-    # Create our backup directory for overwritten cert files.
-    _cmdstr="mkdir -p $_backupdir; $_cmdstr"
     _info "Backup of old certificate files will be placed in remote directory $_backupdir"
     _info "Backup directories erased after 180 days."
     if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
@@ -247,7 +245,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
     if [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_KEYFILE ]; then cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null; fi;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_KEYFILE ]; then mkdir -p $_backupdir; cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -284,7 +282,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CERTFILE ]; then cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null; fi;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CERTFILE ]; then mkdir -p $_backupdir; cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -325,7 +323,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CAFILE ]; then cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null; fi;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_CAFILE ]; then mkdir -p $_backupdir; cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
@@ -370,7 +368,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
     elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_FULLCHAIN ]; then cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null; fi;"
+      _cmdstr="$_cmdstr if [ -f $DEPLOY_SSH_FULLCHAIN ]; then mkdir -p $_backupdir; cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null; fi;"
       if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code

From a5e683546f98ed5be620dcdd29598a9a3b0bf3bc Mon Sep 17 00:00:00 2001
From: daemonhorn <daemonhorn@nullcore.com>
Date: Sat, 19 Sep 2026 09:43:23 -0400
Subject: [PATCH 15/17] Add JetKVM SSH deploy hook (#7254)

* Add JetKVM SSH deploy hook

Adds deploy/jetkvm.sh to deploy a certificate to a JetKVM
(https://jetkvm.com) KVM-over-IP device over plain SSH, writing the
cert/key via a small POSIX shell script piped to the remote "sh" (JetKVM
has no scp/SFTP server), staged under temp names and atomically renamed
into place so a dropped connection can't leave the device with a
mismatched cert/key pair for its own HTTPS listener. Defaults target
JetKVM's confirmed "Custom" TLS storage path/filenames and default the
post-upload command to "reboot", since JetKVM has no hot-reload for a new
certificate.

This factors out the SSH upload logic originally proposed in
opnsense/plugins#5621 (an OPNsense ACME Client plugin automation) per
maintainer feedback there, so it can be reused as a small config instead
of plugin-specific code: https://github.com/opnsense/plugins/pull/5621#issuecomment-5570647257

* Fix restart-command exit-code handling in jetkvm.sh

The default restart command ("reboot") tears down the very SSH
connection running it, which real hardware testing shows makes ssh's
own exit code unreliable: it can come back as either a clean 0 or a
connection-reset 255 for the exact same successful reboot depending on
timing. The hook previously trusted that single exit code directly, so
a fully successful, unattended cron renewal could be reported as a
failed deploy.

Split into two SSH calls: the first uploads and stages the cert/key and
its exit code is trusted as-is (no reboot risk there). The second runs
the restart command and is judged by whether a marker line printed
*before* that command shows up in the captured output -- if the marker
is missing, the call never really ran (real failure); if it's present,
only a clean exit or 255 (connection dropped, expected) counts as
success, while any other exit code is treated as the restart command's
own genuine failure (e.g. 127 = command not found).

Also: a blank DEPLOY_JETKVM_RESTART_CMD now falls back to "reboot"
rather than silently skipping the restart -- previously there was no
way to actually configure "no restart command", since the hook coerced
any blank value (including one the user deliberately set) back to
"reboot" on every run. Skipping it now requires the explicit sentinel
DEPLOY_JETKVM_RESTART_CMD="none".

* Verify JetKVM HTTPS Mode is "Custom" before uploading

Uploading a certificate that the device's active HTTPS Mode won't even
serve was previously a silent no-op -- the write would succeed but never
take effect until a human noticed and fixed the mode themselves.

JetKVM's own JSON-RPC getTLSState/setTLSState calls require an
authenticated WebRTC session (see jetkvm/kvm#1240 and the still-open
jetkvm/kvm#1515), so there's no documented/headless way to query this.
Its firmware (web_tls.go / config.go in jetkvm/kvm) does persist the
mode as a plain JSON field, "tls_mode" (values "", "self-signed", or
"custom"), in /userdata/kvm_config.json -- confirmed against a real
device, including that its busybox grep handles the -E/[[:space:]]
regex used here.

The check runs as the first step of the existing upload SSH call (no
extra round trip), exits a dedicated code (3) if "tls_mode" isn't
"custom", and the hook surfaces that as a specific, actionable error
pointing at the device's web UI setting, distinct from a generic upload
failure. Since the underlying config file/field is just as undocumented
as everything else this hook depends on, DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE=no
opts out entirely in case a future firmware version changes the format.

Also tightens two things noticed while adding this: the "Uploading
certificate..." info log no longer prints before a call that might
immediately fail the mode check, and the remote script's own error
echo (redundant with the local hook's more detailed _err message) is
dropped.

Confirmed end-to-end against a real JetKVM device: the regex correctly
matched the device's actual tls_mode=custom, and a full run of the
updated hook (mode check included) succeeded.

* Address maintainer review: hardcode firmware constants, drop local temp files, fix POSIX portability

Per @neilpang's review (acmesh-official/acme.sh#7254):

1. Drop [[:space:]]/-E from the tls_mode grep -- not portable (Solaris
   sed/grep read it as a literal bracket set); the compact and indented
   JSON forms are both covered by a plain space with '*'.
2. Use the core _time() wrapper instead of `date +%s || echo 0` -- the
   fallback was dead code (a date binary that doesn't understand %s
   still exits 0), and _time() is the idiom every other hook/dnsapi
   script already uses for this.
3. Drop the local temp files entirely for both the upload and restart
   SSH calls. The upload script is now built in a variable and piped
   directly into `ssh ... sh` (same pattern as deploy/windows_rdp.sh);
   $? after the pipeline is still ssh's own exit code. This keeps the
   private key off local disk and removes the _mktemp/chmod/rm dance.
4. Refuse to deploy when the key or fullchain file is empty (e.g. a
   --signcsr-only run) instead of uploading an empty key file and
   rebooting the device.
5. Use `printf '%s\n'`, not `echo`, for every generated script line --
   dash's echo interprets backslash escapes, so the remote script's
   content would otherwise depend on which /bin/sh happens to run
   acme.sh.
6. Save DEPLOY_JETKVM_SSH_CMD and DEPLOY_JETKVM_RESTART_CMD with
   _savedeployconf's "base64" flag (as deploy/docker.sh does for its
   own reload command), since a value containing a single quote would
   otherwise break the saved domain.conf line.
7. Distinguish "config file missing/unreadable" from "HTTPS Mode isn't
   Custom" with separate exit codes -- grep's own exit 2 for a missing
   file was previously funneled into the same "not custom" error,
   misdiagnosing the actual problem. Also stopped suggesting
   REQUIRE_CUSTOM_MODE=no in that error message: following it silently
   turns every future deploy into a no-op once persisted to domain.conf.
8. Hardcode the remote path, filenames, chmod values and config file
   path as constants instead of DEPLOY_JETKVM_* variables. They're
   firmware facts on a single-purpose, single-root appliance, not user
   configuration -- and since _savedeployconf pins whatever value is
   first used into domain.conf, a firmware-side correction to one of
   these later would never reach anyone who'd already deployed once.
   Only USER/HOST/PORT/SSH_CMD/RESTART_CMD/REQUIRE_CUSTOM_MODE remain.
9. Run the restart command detached (nohup sh -c 'sleep N; $CMD' &) so
   the ssh call returns as soon as it's launched, before the device
   actually reboots, instead of racing the connection teardown. This
   also removes the marker/case-based "0 or 255" exit-code logic
   entirely, along with the bug it had: a connection dropping after the
   marker printed but before the restart command actually ran was
   previously reported as a successful deploy. The tradeoff (also
   called out inline and in the PR description): a restart command that
   fails after being launched can no longer be detected, only a failure
   to launch it at all.
10. Use fixed temp filenames for the staged cert/key (not one new name
    per run) plus a `trap ... EXIT` in the generated script, so any
    abort (the mode check, a write failure under `set -e`) cleans up
    instead of leaving another stray key-bearing file on the device.
11. Trimmed the header: removed the marker/0|255 rationale (obsoleted by
    #9), corrected the "typically overnight" claim about when the
    restart actually runs, and added a wiki reference.

Not yet done: a deployhooks wiki entry (acmesh-official/acme.sh#7254's
point 12) -- flagged in the PR thread since only a repo collaborator can
edit that wiki.

Verified: shellcheck (no exclusions needed anymore) and shfmt -i 2
clean; a local smoke-test harness (stubbed acme.sh core, a fake ssh
that redirects the hardcoded device paths into a scratch directory)
covering a clean deploy with byte-exact content/permissions and no
leftover staged files, RESTART_CMD=none, HTTPS Mode not "custom",
the config file missing entirely (now a distinct error),
REQUIRE_CUSTOM_MODE=no, an empty key file (--signcsr case), and a
failed restart-command launch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M7rTpUF3btoBXSZ95Psjh7

* Fix restart-command quoting and correct the failure-detection comment

Per @neilpang's second review round:

1. DEPLOY_JETKVM_RESTART_CMD was interpolated unescaped inside the
   detached command's own single-quoted "sh -c '...'" wrapper. A value
   containing a single quote (e.g. "sh -c 'sync; reboot'") broke that
   quoting, splitting the string so only part of the intended command
   ran, un-detached. Escape embedded single quotes (the standard
   '\'' substitution) before nesting the value, matching how a value
   with no quotes at all still behaves identically. Verified against
   sh and dash directly, and with a new local smoke-test case that
   actually executes the generated detached command and confirms both
   halves of a quoted restart command run intact.

2. The comment claiming "only a failure to launch it at all is caught
   below" was wrong: since the restart command runs as an unwaited
   background job (nohup ... &), the remote sh returns 0 as soon as
   that job is launched, regardless of whether nohup, sh, or the
   restart command itself actually exist or succeed -- measured 0 in
   both cases. Reworded so the comment describes what's actually
   caught (an outright SSH connection failure) instead of implying a
   guarantee the code doesn't provide. No behavior change from this
   half of the fix, comment-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M7rTpUF3btoBXSZ95Psjh7

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 deploy/jetkvm.sh | 253 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 253 insertions(+)
 create mode 100644 deploy/jetkvm.sh

diff --git a/deploy/jetkvm.sh b/deploy/jetkvm.sh
new file mode 100644
index 00000000..a6129be7
--- /dev/null
+++ b/deploy/jetkvm.sh
@@ -0,0 +1,253 @@
+#!/usr/bin/env sh
+
+# Script to deploy a certificate to a JetKVM (https://jetkvm.com) KVM-over-IP
+# device over SSH. See also:
+# https://github.com/acmesh-official/acme.sh/wiki/deployhooks
+#
+# JetKVM only supports key-based SSH authentication (root@<device>, password
+# logins are disabled) once "Developer Mode" is enabled and a public key is
+# pasted into its web UI (Settings > Advanced). SSH keys must already be
+# exchanged and a passwordless login confirmed working (e.g. `ssh
+# root@jetkvm.example.com true`) before using this hook.
+#
+# JetKVM's minimal userspace does not ship an scp binary or SFTP server, so
+# unlike deploy/ssh.sh this hook has no "use scp" option: it always writes
+# the certificate and key by piping a small POSIX shell script to the
+# remote "sh" over stdin (only depends on "sh", "cat", "chmod", "mkdir",
+# "mv" and "rm" on the device side). The remote path, filenames and file
+# permissions are firmware constants on this single-purpose, single-root
+# appliance, so they are not configurable here.
+#
+# JetKVM's "Custom" TLS mode (device web UI: Settings > Network > HTTPS
+# Mode, must already be set to "Custom" before this hook's uploads take
+# effect) reads the certificate/key from that fixed location and does not
+# hot-reload: a device reboot is required to pick up a new certificate.
+# This hook's restart command therefore defaults to "reboot" -- a blank
+# DEPLOY_JETKVM_RESTART_CMD is treated the same as unset (falls back to
+# "reboot") rather than silently skipping it, since a renewed certificate
+# that's never actually applied defeats the point of automating this; set
+# it to the literal value "none" to opt out and apply/verify manually.
+# The restart command is run detached on the device (nohup ... &) so this
+# hook's ssh call can return before the reboot itself lands, rather than
+# racing the connection teardown.
+#
+# The certificate and key are staged under fixed temporary names on the
+# device and only renamed into their final names (an atomic "mv", on the
+# same filesystem) once both have been fully written and chmod'ed. This
+# keeps a dropped connection or a failed write from ever leaving the
+# device with a truncated or mismatched certificate/key pair for its own
+# HTTPS listener, and a "trap ... EXIT" in the generated script removes
+# any leftover staged file however that script exits.
+#
+# Before writing anything, this hook also checks that the device's HTTPS
+# Mode is already "Custom" -- uploading a certificate that mode won't
+# even serve would otherwise be a silent no-op. There is currently no
+# documented/headless way to read this back (JetKVM's own JSON-RPC
+# getTLSState/setTLSState calls require an authenticated WebRTC session,
+# see https://github.com/jetkvm/kvm/issues/1240 and the still-open
+# https://github.com/jetkvm/kvm/pull/1515), so this greps the device's
+# own config file instead: JetKVM's firmware (see web_tls.go / config.go
+# in https://github.com/jetkvm/kvm) persists the mode as the plain-JSON
+# field "tls_mode" (values "", "self-signed", or "custom") in
+# /userdata/kvm_config.json.
+#
+# None of the above (storage path, filenames, config file, reboot-to-apply
+# behavior) is part of JetKVM's stable/documented API; it was confirmed
+# against real JetKVM hardware, but is worth a spot-check after a JetKVM
+# firmware upgrade -- set DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE=no to skip the
+# HTTPS-mode check entirely if a future firmware version changes that
+# file's format out from under it.
+#
+# The following variables exported from environment will be used. If not
+# set then values previously saved in the domain.conf file are used. All
+# of them are optional.
+#
+# export DEPLOY_JETKVM_USER="root"                        # defaults to "root"
+# export DEPLOY_JETKVM_HOST="jetkvm.example.com"          # defaults to the cert's domain
+# export DEPLOY_JETKVM_PORT="22"                          # defaults to 22
+# export DEPLOY_JETKVM_SSH_CMD="ssh -T"                   # defaults to "ssh -T"
+# export DEPLOY_JETKVM_RESTART_CMD="reboot"               # defaults to "reboot"; set to "none" to skip it
+# export DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE="yes"          # defaults to "yes" (verify tls_mode=custom before upload); set to "no" to skip
+#
+# Example:
+# ```sh
+# export DEPLOY_JETKVM_HOST="192.168.1.50"
+# acme.sh --deploy -d jetkvm.example.com --deploy-hook jetkvm
+# ```
+#
+# returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+jetkvm_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  if [ ! -s "$_ckey" ] || [ ! -s "$_cfullchain" ]; then
+    _err "JetKVM deploy needs both a private key and a fullchain certificate (not available, e.g., after --signcsr)."
+    return 1
+  fi
+
+  _getdeployconf DEPLOY_JETKVM_USER
+  if [ -z "$DEPLOY_JETKVM_USER" ]; then
+    DEPLOY_JETKVM_USER="root"
+  fi
+  _savedeployconf DEPLOY_JETKVM_USER "$DEPLOY_JETKVM_USER"
+
+  _getdeployconf DEPLOY_JETKVM_HOST
+  if [ -z "$DEPLOY_JETKVM_HOST" ]; then
+    _debug "Using _cdomain as DEPLOY_JETKVM_HOST, please set if not correct."
+    DEPLOY_JETKVM_HOST="$_cdomain"
+  fi
+  _savedeployconf DEPLOY_JETKVM_HOST "$DEPLOY_JETKVM_HOST"
+
+  _getdeployconf DEPLOY_JETKVM_PORT
+  if [ -z "$DEPLOY_JETKVM_PORT" ]; then
+    DEPLOY_JETKVM_PORT="22"
+  fi
+  _savedeployconf DEPLOY_JETKVM_PORT "$DEPLOY_JETKVM_PORT"
+
+  _getdeployconf DEPLOY_JETKVM_SSH_CMD
+  if [ -z "$DEPLOY_JETKVM_SSH_CMD" ]; then
+    DEPLOY_JETKVM_SSH_CMD="ssh -T"
+  fi
+  _savedeployconf DEPLOY_JETKVM_SSH_CMD "$DEPLOY_JETKVM_SSH_CMD" "base64"
+
+  _getdeployconf DEPLOY_JETKVM_RESTART_CMD
+  if [ -z "$DEPLOY_JETKVM_RESTART_CMD" ]; then
+    DEPLOY_JETKVM_RESTART_CMD="reboot"
+  fi
+  _savedeployconf DEPLOY_JETKVM_RESTART_CMD "$DEPLOY_JETKVM_RESTART_CMD" "base64"
+
+  _getdeployconf DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE
+  if [ -z "$DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE" ]; then
+    DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE="yes"
+  fi
+  _savedeployconf DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE "$DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE"
+
+  _info "Deploying certificate to JetKVM device $DEPLOY_JETKVM_USER@$DEPLOY_JETKVM_HOST:$DEPLOY_JETKVM_PORT"
+
+  # Firmware constants on a single-purpose, single-root appliance -- not
+  # user configuration. If JetKVM ever moves these, that's a hook update,
+  # not a setting (a saved-per-domain override would just as easily hide
+  # the fix from anyone already using this hook).
+  _jetkvm_remote_path="/userdata/jetkvm/tls"
+  _jetkvm_cert_name="user-defined.crt"
+  _jetkvm_key_name="user-defined.key"
+  _jetkvm_config_file="/userdata/kvm_config.json"
+  _jetkvm_mode_exitcode=3
+  _jetkvm_config_missing_exitcode=4
+
+  _jetkvm_run_id="$$.$(_time)"
+  _jetkvm_cert_marker="ACME_JETKVM_CERT_$_jetkvm_run_id"
+  _jetkvm_key_marker="ACME_JETKVM_KEY_$_jetkvm_run_id"
+  _jetkvm_cert_tmp="$_jetkvm_remote_path/.$_jetkvm_cert_name.tmp"
+  _jetkvm_key_tmp="$_jetkvm_remote_path/.$_jetkvm_key_name.tmp"
+  _jetkvm_cert_target="$_jetkvm_remote_path/$_jetkvm_cert_name"
+  _jetkvm_key_target="$_jetkvm_remote_path/$_jetkvm_key_name"
+
+  # Command substitution strips all trailing newlines, so the printf below
+  # always emits the content with exactly one trailing newline before the
+  # heredoc terminator -- regardless of whether the source file already
+  # ended with one -- so the terminator is guaranteed to start its own line.
+  _jetkvm_cert_content="$(cat "$_cfullchain")"
+  _jetkvm_key_content="$(cat "$_ckey")"
+
+  _jetkvm_upload_script="$(
+    echo "#!/bin/sh"
+    echo "set -e"
+    echo "umask 077"
+    printf "trap \"rm -f '%s' '%s'\" EXIT\n" "$_jetkvm_cert_tmp" "$_jetkvm_key_tmp"
+    if [ "$DEPLOY_JETKVM_REQUIRE_CUSTOM_MODE" != "no" ]; then
+      # Uploading a certificate that HTTPS Mode won't even serve would
+      # otherwise fail silently -- see the header comment for why this
+      # greps the device's own config file rather than querying it
+      # through a documented API (there isn't one for reading this
+      # headlessly yet). The config file is checked for readability
+      # separately so a missing/renamed file isn't misreported as
+      # HTTPS Mode being wrong.
+      printf "if [ ! -r '%s' ]; then exit %s; fi\n" "$_jetkvm_config_file" "$_jetkvm_config_missing_exitcode"
+      printf 'if ! grep -q '\''"tls_mode" *: *"custom"'\'' '\''%s'\''; then exit %s; fi\n' "$_jetkvm_config_file" "$_jetkvm_mode_exitcode"
+    fi
+    printf "mkdir -p '%s'\n" "$_jetkvm_remote_path"
+    printf "cat > '%s' <<'%s'\n" "$_jetkvm_cert_tmp" "$_jetkvm_cert_marker"
+    printf '%s\n' "$_jetkvm_cert_content"
+    echo "$_jetkvm_cert_marker"
+    printf "chmod 0644 '%s'\n" "$_jetkvm_cert_tmp"
+    printf "cat > '%s' <<'%s'\n" "$_jetkvm_key_tmp" "$_jetkvm_key_marker"
+    printf '%s\n' "$_jetkvm_key_content"
+    echo "$_jetkvm_key_marker"
+    printf "chmod 0600 '%s'\n" "$_jetkvm_key_tmp"
+    printf "mv '%s' '%s'\n" "$_jetkvm_cert_tmp" "$_jetkvm_cert_target"
+    printf "mv '%s' '%s'\n" "$_jetkvm_key_tmp" "$_jetkvm_key_target"
+  )"
+
+  _secure_debug "Generated upload script" "$_jetkvm_upload_script"
+
+  _info "Connecting to JetKVM device $DEPLOY_JETKVM_USER@$DEPLOY_JETKVM_HOST:$DEPLOY_JETKVM_PORT to deploy certificate"
+  # shellcheck disable=SC2086
+  printf '%s\n' "$_jetkvm_upload_script" | $DEPLOY_JETKVM_SSH_CMD -p "$DEPLOY_JETKVM_PORT" "$DEPLOY_JETKVM_USER@$DEPLOY_JETKVM_HOST" sh
+  _ret=$?
+
+  if [ "$_ret" = "$_jetkvm_config_missing_exitcode" ]; then
+    _err "JetKVM config file ($_jetkvm_config_file) was not found or not readable on the device -- this hook's assumptions may be out of date after a firmware upgrade. Certificate was NOT uploaded."
+    return "$_ret"
+  fi
+
+  if [ "$_ret" = "$_jetkvm_mode_exitcode" ]; then
+    _err "JetKVM HTTPS Mode is not set to \"Custom\" (checked \"tls_mode\" in $_jetkvm_config_file on the device). Set it in the device's web UI (Settings > Network > HTTPS Mode) before this hook can take effect. Certificate was NOT uploaded."
+    return "$_ret"
+  fi
+
+  if [ "$_ret" != "0" ]; then
+    _err "Error code $_ret returned uploading certificate to JetKVM device"
+    return "$_ret"
+  fi
+
+  _info "Certificate and key uploaded to $_jetkvm_remote_path on the device"
+
+  if [ "$DEPLOY_JETKVM_RESTART_CMD" = "none" ]; then
+    _info "Certificate successfully deployed to JetKVM device. DEPLOY_JETKVM_RESTART_CMD=none, skipping restart command."
+    return 0
+  fi
+
+  # Run the restart command detached (nohup ... &) so this ssh call
+  # returns as soon as it's launched, before the device actually reboots,
+  # rather than racing the connection teardown -- observed, against real
+  # hardware, that a reboot racing the SSH session's own exit can make
+  # ssh itself exit anywhere from a clean 0 to a connection-reset 255.
+  # Since the restart command then runs as an unwaited background job on
+  # the device, this ssh call reports success as soon as that job is
+  # launched -- it does NOT confirm nohup, sh, or the restart command
+  # itself actually exist or succeed (measured: a nonexistent restart
+  # command, and even a missing nohup binary, both still return 0 here).
+  # Only an outright SSH connection failure (unreachable host, auth
+  # failure, etc.) is caught below. "sleep" runs on the device's own
+  # shell, not acme.sh's, so acme.sh's _sleep wrapper does not apply.
+  _info "Running post-upload command on JetKVM device: $DEPLOY_JETKVM_RESTART_CMD"
+  # Escape any single quotes in the (user-configurable, free-text)
+  # restart command before nesting it inside the outer 'sleep N; ...'
+  # single-quoted string -- otherwise a value like "sh -c 'sync; reboot'"
+  # breaks the quoting and only part of it ends up inside the detached
+  # background job.
+  _jetkvm_restart_cmd_escaped=$(printf '%s' "$DEPLOY_JETKVM_RESTART_CMD" | sed "s/'/'\\\\''/g")
+  _jetkvm_detached_cmd="nohup sh -c 'sleep 2; $_jetkvm_restart_cmd_escaped' >/dev/null 2>&1 &"
+  # shellcheck disable=SC2086
+  if ! $DEPLOY_JETKVM_SSH_CMD -p "$DEPLOY_JETKVM_PORT" "$DEPLOY_JETKVM_USER@$DEPLOY_JETKVM_HOST" "$_jetkvm_detached_cmd"; then
+    _err "Certificate was uploaded, but connecting to the JetKVM device to launch the restart command failed."
+    return 1
+  fi
+
+  _info "Certificate deployed to JetKVM device; it will restart shortly to apply it."
+  return 0
+}

From c58d25eb90df30171b3aae64927b69a3f6229a63 Mon Sep 17 00:00:00 2001
From: Reto Vogel <reto@vogel.vu>
Date: Sat, 19 Sep 2026 15:44:32 +0200
Subject: [PATCH 16/17] Add support for Private DNS zones on Azure (#7227)

* Enhance Azure DNS script for private zones support

Added support for Azure Private DNS Zones and updated API versions accordingly.

* Update README.md

* Update Bearer Token description in dns_azure.sh

Clarified the usage of the Bearer Token in the script.

* Update dns_azure.sh

* Update dns_azure.sh

* Update README.md

* implement optimization based on input from maintainer

* Update dns_azure.sh

* create reusable function

* optimize function usage and make less verbose

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: Mashiro <adadam@qq.com>
Co-authored-by: MBWhitestone <25477219+MBWhitestone@users.noreply.github.com>
Co-authored-by: Pablo <Pablo1@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 dnsapi/dns_azure.sh | 41 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 4708e151..0ec2a2b9 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -10,6 +10,7 @@ Options:
  AZUREDNS_CLIENTSECRET Client Secret. Secret from creating the service principal
  AZUREDNS_MANAGEDIDENTITY Use Managed Identity. Use Managed Identity assigned to a resource instead of a service principal. "true"/"false"
  AZUREDNS_BEARERTOKEN Bearer Token. Used instead of service principal credentials or managed identity. Not saved, provide it on every run. Optional.
+ AZUREDNS_PRIVATEZONE Use Azure Private DNS Zones instead of Public DNS Zones. "true"/"false"
 '
 
 wiki=https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS
@@ -39,6 +40,12 @@ dns_azure_add() {
   #save subscription id to account conf file.
   _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID "$AZUREDNS_SUBSCRIPTIONID"
 
+  AZUREDNS_PRIVATEZONE="${AZUREDNS_PRIVATEZONE:-$(_readaccountconf_mutable AZUREDNS_PRIVATEZONE)}"
+  if [ -n "$AZUREDNS_PRIVATEZONE" ]; then
+    #save public/private dns to account conf file.
+    _saveaccountconf_mutable AZUREDNS_PRIVATEZONE "$AZUREDNS_PRIVATEZONE"
+  fi
+
   AZUREDNS_MANAGEDIDENTITY="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
   if [ "$AZUREDNS_MANAGEDIDENTITY" = true ]; then
     _info "Using Azure managed identity"
@@ -112,7 +119,9 @@ dns_azure_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
+  _azure_set_zone_vars
+
+  acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=$_azure_api_version"
   _debug "$acmeRecordURI"
   # Get existing TXT record
   _azure_rest GET "$acmeRecordURI" "" "$accesstoken"
@@ -138,7 +147,7 @@ dns_azure_add() {
     fi
   fi
   # Add the txtvalue TXT Record
-  body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
+  body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"$_azure_ttl_key\":10, \"$_azure_txt_key\":[$values]}}"
   _azure_rest PUT "$acmeRecordURI" "$body" "$accesstoken"
   if [ "$_code" = "200" ] || [ "$_code" = '201' ]; then
     _info "validation value added"
@@ -169,6 +178,8 @@ dns_azure_rm() {
     return 1
   fi
 
+  AZUREDNS_PRIVATEZONE="${AZUREDNS_PRIVATEZONE:-$(_readaccountconf_mutable AZUREDNS_PRIVATEZONE)}"
+
   AZUREDNS_MANAGEDIDENTITY="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
   if [ "$AZUREDNS_MANAGEDIDENTITY" = true ]; then
     _info "Using Azure managed identity"
@@ -227,8 +238,11 @@ dns_azure_rm() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
+  _azure_set_zone_vars
+
+  acmeRecordURI="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=$_azure_api_version"
   _debug "$acmeRecordURI"
+
   # Get existing TXT record
   _azure_rest GET "$acmeRecordURI" "" "$accesstoken"
   timestamp="$(_time)"
@@ -252,7 +266,7 @@ dns_azure_rm() {
       fi
     else
       # Remove only txtvalue from the TXT Record
-      body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
+      body="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"$_azure_ttl_key\":10, \"$_azure_txt_key\":[$values]}}"
       _azure_rest PUT "$acmeRecordURI" "$body" "$accesstoken"
       if [ "$_code" = "200" ] || [ "$_code" = '201' ]; then
         _info "validation value removed"
@@ -383,6 +397,21 @@ _azure_getaccess_token() {
   return 0
 }
 
+_azure_set_zone_vars() {
+  if [ "$AZUREDNS_PRIVATEZONE" = "true" ]; then
+    _azure_zone_type="privateDnsZones"
+    _azure_api_version="2024-06-01"
+    _azure_ttl_key="ttl"
+    _azure_txt_key="txtRecords"
+    _debug "Querying private DNS zone"
+  else
+    _azure_zone_type="dnszones"
+    _azure_api_version="2017-09-01"
+    _azure_ttl_key="TTL"
+    _azure_txt_key="TXTRecords"
+  fi
+}
+
 _get_root() {
   domain=$1
   subscriptionId=$2
@@ -390,6 +419,8 @@ _get_root() {
   i=1
   p=1
 
+  _azure_set_zone_vars
+
   ## Ref: https://learn.microsoft.com/en-us/rest/api/dns/zones/list?view=rest-dns-2018-05-01&tabs=HTTP
   ## returns up to 100 zones in one response. Handling more results is not implemented
   ## (ZoneListResult with continuation token for the next page of results)
@@ -398,7 +429,7 @@ _get_root() {
   ## https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-dns-limits
   ## The new limit is 250 Public DNS zones per subscription, while the old limit was only 100
   ##
-  _azure_rest GET "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?\$top=500&api-version=2017-09-01" "" "$accesstoken"
+  _azure_rest GET "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/$_azure_zone_type?\$top=500&api-version=$_azure_api_version" "" "$accesstoken"
   # Find matching domain name in Json response
   while true; do
     h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)

From 48966ba481beca25db5056e15f8d5c9922c273ef Mon Sep 17 00:00:00 2001
From: Karthik <47263234+kxbnb@users.noreply.github.com>
Date: Sat, 19 Sep 2026 09:45:02 -0400
Subject: [PATCH 17/17] Add DNSMint DNS API (#7238)

* Add DNSMint DNS API

DNSMint mints hostnames on domains it operates and serves from its own
authoritative nameservers, so a customer has no zone of their own and the
challenge is published through its API.

The hostname is derived server-side from the challenge name, so there is
no root zone to detect and no record id to track: the value published is
the value removed. Wildcards work because the API keeps the two newest
values for a name, which is what the apex and wildcard pair needs.

Tested against Let's Encrypt staging for a wildcard plus its apex.

* Add DNSMint DNS API

DNSMint mints hostnames on domains it operates and serves from its own
authoritative nameservers, so records are published through its API
rather than a zone you run.

An ACME challenge goes to the DNS-01 endpoint, which derives the hostname
from the challenge name: no root zone to detect, no record id to track,
and the value published is the value removed. Wildcards work because the
API keeps the two newest values for a name.

Any other TXT name is an ordinary record under a hostname and goes to the
records endpoint instead, which is why the add and rm functions branch on
the _acme-challenge label. Issuing certificates needs only the dns01:write
scope; the record endpoint needs hostnames:read and hostnames:write.

Tested against Let's Encrypt staging for a wildcard plus its apex, and
the non-challenge TXT path against the live API.

* dnsmint: honour DNSMint_Api instead of overwriting it

The assignment was unconditional, so exporting DNSMint_Api did nothing - the
plugin reset it to the default every time it was sourced. Every neighbouring
plugin with an _Api variable treats it as an override; this one only looked
like it did.

Found while writing the dnsapi2 entry: the sentence documenting the override
would have been false.

* dnsmint: format case blocks with shfmt -i 2

* dnsmint: portable record lookup on removal

grep -F is not on Solaris /usr/bin/grep, and "\n" in a sed replacement is a
GNU extension that BSD sed writes as a literal n. The second is the one that
loses data: without the split the whole reply stays on one line, so the match
succeeds whatever the value is and the id taken is the first record under the
hostname rather than the one holding the challenge. Removal then deletes
somebody else's TXT record.

Literal newline in the replacement, as dns_glesys.sh does it, and a case
pattern per line with the case outside a command substitution.

Docs and Issues now point at dnsapi2 and at the tracking issue upstream.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* dnsmint: echo into sed, and keep _head_n 1 on the id

Both from review on #7238.

The reply arrives with no trailing newline, so printf "%s" hands sed an
incomplete final line. Solaris /usr/bin/sed discards one, and here that line
is the whole reply: the loop then sees nothing and every removal reports the
record already gone, leaving the challenge TXT behind. echo, as lines 154 and
172 of this file already do.

_head_n 1 was dropped in 61ef816c. A record object carrying a nested id under
"data" makes _rid two lines and the DELETE URL is then malformed.

---------

Co-authored-by: kxbnb <hello@dnsmint.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 dnsapi/dns_dnsmint.sh | 243 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 243 insertions(+)
 create mode 100644 dnsapi/dns_dnsmint.sh

diff --git a/dnsapi/dns_dnsmint.sh b/dnsapi/dns_dnsmint.sh
new file mode 100644
index 00000000..4f7d0031
--- /dev/null
+++ b/dnsapi/dns_dnsmint.sh
@@ -0,0 +1,243 @@
+#!/usr/bin/env sh
+# shellcheck disable=SC2034
+dns_dnsmint_info='DNSMint.com
+ DNSMint mints hostnames on domains it operates and serves from its own
+ authoritative nameservers, so records are published through its API rather
+ than a zone you run.
+Site: dnsmint.com
+Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_dnsmint
+Options:
+ DNSMINT_API_KEY API key. dns01:write is enough to issue certificates.
+Issues: github.com/acmesh-official/acme.sh/issues/7251
+Author: DNSMint
+'
+
+DNSMint_Api="${DNSMint_Api:-https://dnsmint.com/api}"
+
+########  Public functions #####################
+
+#Usage: dns_dnsmint_add _acme-challenge.q7k4m2.example.dev "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_dnsmint_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using DNSMint"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _dnsmint_key; then
+    return 1
+  fi
+
+  # An ACME challenge goes to the DNS-01 endpoint, which derives the hostname
+  # itself and needs only dns01:write. Any other name is an ordinary record
+  # under a hostname, which is a different endpoint and a wider scope.
+  if _startswith "$fulldomain" "_acme-challenge."; then
+    if _dnsmint_challenge present "$fulldomain" "$txtvalue"; then
+      _info "Added, OK"
+      return 0
+    fi
+    return 1
+  fi
+
+  if _dnsmint_record_add "$fulldomain" "$txtvalue"; then
+    _info "Added, OK"
+    return 0
+  fi
+  return 1
+}
+
+#Usage: dns_dnsmint_rm _acme-challenge.q7k4m2.example.dev "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_dnsmint_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using DNSMint"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if ! _dnsmint_key; then
+    return 1
+  fi
+
+  if _startswith "$fulldomain" "_acme-challenge."; then
+    if _dnsmint_challenge cleanup "$fulldomain" "$txtvalue"; then
+      _info "Removed, OK"
+      return 0
+    fi
+    return 1
+  fi
+
+  if _dnsmint_record_rm "$fulldomain" "$txtvalue"; then
+    _info "Removed, OK"
+    return 0
+  fi
+  return 1
+}
+
+####################  Private functions below ##################################
+
+_dnsmint_key() {
+  DNSMINT_API_KEY="${DNSMINT_API_KEY:-$(_readaccountconf_mutable DNSMINT_API_KEY)}"
+  if [ -z "$DNSMINT_API_KEY" ]; then
+    DNSMINT_API_KEY=""
+    _err "You did not specify DNSMINT_API_KEY yet."
+    _err "Create a key with the dns01:write scope at https://dnsmint.com/dashboard"
+    _err "e.g."
+    _err "export DNSMINT_API_KEY=dnsm_xxxxxxxxxxxx_xxxxxxxx"
+    return 1
+  fi
+  _saveaccountconf_mutable DNSMINT_API_KEY "$DNSMINT_API_KEY"
+  return 0
+}
+
+_dnsmint_headers() {
+  export _H1="Authorization: Bearer $DNSMINT_API_KEY"
+  export _H2="Accept: application/json"
+  export _H3="Content-Type: application/json"
+}
+
+# One request. Sets $response and $_code; returns non-zero on a transport error.
+_dnsmint_rest() {
+  _m="$1"
+  _ep="$2"
+  _data="$3"
+
+  _dnsmint_headers
+  if [ "$_m" = "GET" ]; then
+    response="$(_get "$DNSMint_Api$_ep")"
+  else
+    _secure_debug2 _data "$_data"
+    response="$(_post "$_data" "$DNSMint_Api$_ep" "" "$_m")"
+  fi
+  _ret="$?"
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug "http response code $_code"
+  _debug2 response "$response"
+  if [ "$_ret" != "0" ]; then
+    _err "error $_ep"
+    return 1
+  fi
+  case "$_code" in
+  2*) return 0 ;;
+  *)
+    # The API says why in the body - a key narrowed to another hostname, a
+    # name that is not live - and that is more use than the status alone.
+    _err "error $_ep: HTTP $_code $response"
+    return 1
+    ;;
+  esac
+}
+
+# The DNS-01 endpoint. It derives the hostname from the challenge name, so
+# there is no zone to look up and no record id to track: the value published
+# is the value removed.
+_dnsmint_challenge() {
+  _action="$1"
+  _fqdn="$2"
+  _value="$3"
+  _dnsmint_rest POST "/httpreq/$_action" "{\"fqdn\":\"$_fqdn\",\"value\":\"$_value\"}"
+}
+
+# Everything below here is for names that are not ACME challenges. A record
+# under a hostname is addressed by the hostname's id and a name relative to
+# it, so the hostname has to be found first.
+_dnsmint_host() {
+  _name="$1"
+  _host_id=""
+  _host_sub=""
+
+  if ! _dnsmint_rest GET "/v1/hostnames?limit=500"; then
+    return 1
+  fi
+
+  for _h in $(echo "$response" | _egrep_o '"hostname":"[^"]*"' | cut -d'"' -f4); do
+    case "$_name" in
+    *".$_h")
+      # Longest suffix wins, so a.b.example.dev prefers b.example.dev over
+      # example.dev when both are hostnames on the account.
+      if [ "${#_h}" -gt "${#_host_sub}" ]; then
+        _host_sub="$_h"
+      fi
+      ;;
+    esac
+  done
+
+  if [ -z "$_host_sub" ]; then
+    _err "$_name is not under a hostname on this account"
+    return 1
+  fi
+
+  # The id sits next to the hostname in the same object.
+  _host_id="$(echo "$response" | _egrep_o "\"id\":\"[^\"]*\",\"hostname\":\"$_host_sub\"" | cut -d'"' -f4)"
+  if [ -z "$_host_id" ]; then
+    _err "could not read the id for $_host_sub"
+    return 1
+  fi
+
+  _record_name="${_name%".$_host_sub"}"
+  _debug _host_sub "$_host_sub"
+  _debug _record_name "$_record_name"
+  return 0
+}
+
+_dnsmint_record_add() {
+  _name="$1"
+  _value="$2"
+
+  if ! _dnsmint_host "$_name"; then
+    return 1
+  fi
+  _dnsmint_rest POST "/v1/hostnames/$_host_id/records" \
+    "{\"name\":\"$_record_name\",\"type\":\"TXT\",\"text\":\"$_value\"}"
+}
+
+_dnsmint_record_rm() {
+  _name="$1"
+  _value="$2"
+
+  if ! _dnsmint_host "$_name"; then
+    return 1
+  fi
+  if ! _dnsmint_rest GET "/v1/hostnames/$_host_id/records"; then
+    return 1
+  fi
+
+  # Records come back as {"id":...,"name":"<fqdn>","type":"TXT","ttl":...,
+  # "data":{...,"text":["<value>"]}}. Match on the value so a name holding
+  # several TXT records loses only the one that was added.
+  #
+  # The replacement carries a literal newline: "\n" there is a GNU extension
+  # and BSD sed inserts the letter n, which would leave the whole reply on one
+  # line and match the first record under the hostname whatever its value.
+  #
+  # echo rather than printf "%s": the reply arrives with no trailing newline,
+  # and Solaris /usr/bin/sed discards an incomplete final line. Here that line
+  # is the entire reply, so every removal would report the record already gone.
+  _records="$(
+    echo "$response" | sed 's/},{/}\
+{/g'
+  )"
+
+  _rid=""
+  while IFS= read -r _line; do
+    case "$_line" in
+    *"\"$_value\""*)
+      # _head_n 1 because a record object may carry a nested id under "data",
+      # and two lines in _rid would break the DELETE URL.
+      _rid="$(echo "$_line" | _egrep_o '"id":"[^"]*"' | cut -d'"' -f4 | _head_n 1)"
+      if [ -n "$_rid" ]; then
+        break
+      fi
+      ;;
+    esac
+  done <<EOF
+$_records
+EOF
+
+  if [ -z "$_rid" ]; then
+    _info "Record already gone, nothing to remove"
+    return 0
+  fi
+  _dnsmint_rest DELETE "/v1/hostnames/$_host_id/records/$_rid" ""
+}