From 251aac716a707d730733444b71247402be678f08 Mon Sep 17 00:00:00 2001
From: Jaap-Jan <jipjan@gmail.com>
Date: Fri, 21 Aug 2020 09:49:43 +0200
Subject: [PATCH 01/10] Add CloudFlare DNS plugin to certbot

---
 docker/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index e3eefb3..5224416 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -17,7 +17,8 @@ ENV NODE_ENV=production
 
 RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
 	&& apk update \
-	&& apk add python2 certbot jq \
+	&& apk add python2 py-pip certbot jq \
+	&& pip install certbot-dns-cloudflare \
 	&& rm -rf /var/cache/apk/*
 
 ENV NPM_BUILD_VERSION="${BUILD_VERSION}" NPM_BUILD_COMMIT="${BUILD_COMMIT}" NPM_BUILD_DATE="${BUILD_DATE}"

From 2d7576c57ea9d0219a5321678adf162f580e26b3 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 10:54:36 +0000
Subject: [PATCH 02/10] add cloudflare dns also to dev docker file

---
 docker/dev/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker/dev/Dockerfile b/docker/dev/Dockerfile
index 35f5651..5b67981 100644
--- a/docker/dev/Dockerfile
+++ b/docker/dev/Dockerfile
@@ -7,7 +7,8 @@ ENV S6_FIX_ATTRS_HIDDEN=1
 
 RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
 	&& apk update \
-	&& apk add python2 certbot jq \
+	&& apk add python2 py-pip certbot jq \
+	&& pip install certbot-dns-cloudflare \
 	&& rm -rf /var/cache/apk/*
 
 # Task

From b9a95840e09fa2a633c8cade91c206dfc5821492 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 11:40:41 +0000
Subject: [PATCH 03/10] add cloudflare dns option to letsencrypt via manual
 certificate

---
 frontend/js/app/nginx/certificates/form.ejs | 18 ++++++++++++++++++
 frontend/js/app/nginx/certificates/form.js  | 13 ++++++++++++-
 frontend/js/i18n/messages.json              |  3 ++-
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/frontend/js/app/nginx/certificates/form.ejs b/frontend/js/app/nginx/certificates/form.ejs
index 32edb6b..98de260 100644
--- a/frontend/js/app/nginx/certificates/form.ejs
+++ b/frontend/js/app/nginx/certificates/form.ejs
@@ -20,6 +20,24 @@
                             <input name="meta[letsencrypt_email]" type="email" class="form-control" placeholder="" value="<%- getLetsencryptEmail() %>" required>
                         </div>
                     </div>
+
+                    <!-- CloudFlare -->
+                    <div class="col-sm-12 col-md-12">
+                        <div class="form-group">
+                            <label class="custom-switch">
+                                <input type="checkbox" class="custom-switch-input" name="use_cloudflare" value="1">
+                                <span class="custom-switch-indicator"></span>
+                                <span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
+                            </label>
+                        </div>
+                    </div>
+                    <div class="col-sm-12 col-md-12 cloudflare">
+                        <div class="form-group">
+                            <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
+                            <input type="text" name="cloudflare_dns_api_token" class="form-control" id="input-domains" required>                            
+                        </div>
+                    </div>
+
                     <div class="col-sm-12 col-md-12">
                         <div class="form-group">
                             <label class="custom-switch">
diff --git a/frontend/js/app/nginx/certificates/form.js b/frontend/js/app/nginx/certificates/form.js
index 4c315c1..bdb4f6c 100644
--- a/frontend/js/app/nginx/certificates/form.js
+++ b/frontend/js/app/nginx/certificates/form.js
@@ -20,10 +20,20 @@ module.exports = Mn.View.extend({
         save:                           'button.save',
         other_certificate:              '#other_certificate',
         other_certificate_key:          '#other_certificate_key',
-        other_intermediate_certificate: '#other_intermediate_certificate'
+        other_intermediate_certificate: '#other_intermediate_certificate',
+        cloudflare_switch:              'input[name="use_cloudflare"]',
+        cloudflare:                     '.cloudflare'
     },
 
     events: {
+        'change @ui.cloudflare_switch': function() {
+            let checked = this.ui.cloudflare_switch.prop('checked');
+            if (checked) {
+                this.ui.cloudflare.show();
+            } else {
+                this.ui.cloudflare.hide();
+            }
+        },
         'click @ui.save': function (e) {
             e.preventDefault();
 
@@ -146,6 +156,7 @@ module.exports = Mn.View.extend({
             },
             createFilter: /^(?:[^.*]+\.?)+[^.]$/
         });
+        this.ui.cloudflare.hide();
     },
 
     initialize: function (options) {
diff --git a/frontend/js/i18n/messages.json b/frontend/js/i18n/messages.json
index 7b5205a..d0c9d8e 100644
--- a/frontend/js/i18n/messages.json
+++ b/frontend/js/i18n/messages.json
@@ -101,7 +101,8 @@
       "letsencrypt-email": "Email Address for Let's Encrypt",
       "letsencrypt-agree": "I Agree to the <a href=\"{url}\" target=\"_blank\">Let's Encrypt Terms of Service</a>",
       "delete-ssl": "The SSL certificates attached will NOT be removed, they will need to be removed manually.",
-      "hosts-warning": "These domains must be already configured to point to this installation"
+      "hosts-warning": "These domains must be already configured to point to this installation",
+      "use-cloudflare": "Use CloudFlare DNS verification"      
     },
     "proxy-hosts": {
       "title": "Proxy Hosts",

From ff1770204c8b553b287b6f4214489e4c3394ce6d Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 12:50:41 +0000
Subject: [PATCH 04/10] request via cloudflare dns working

---
 backend/internal/certificate.js             | 40 ++++++++++++++++++++-
 backend/schema/endpoints/certificates.json  |  6 ++++
 frontend/js/app/nginx/certificates/form.ejs |  4 +--
 frontend/js/app/nginx/certificates/form.js  |  9 ++++-
 4 files changed, 55 insertions(+), 4 deletions(-)

diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js
index 4f0caf3..1c71a45 100644
--- a/backend/internal/certificate.js
+++ b/backend/internal/certificate.js
@@ -146,7 +146,11 @@ const internalCertificate = {
 								.then(internalNginx.reload)
 								.then(() => {
 									// 4. Request cert
-									return internalCertificate.requestLetsEncryptSsl(certificate);
+									if (data.meta.cloudflare_use) {
+										return internalCertificate.requestLetsEncryptCloudFlareDnsSsl(certificate, data.meta.cloudflare_token);
+									} else {
+										return internalCertificate.requestLetsEncryptSsl(certificate);
+									}
 								})
 								.then(() => {
 									// 5. Remove LE config
@@ -748,6 +752,40 @@ const internalCertificate = {
 			});
 	},
 
+	/**
+	 * @param   {Object}  certificate   the certificate row
+	 * @param	{String} apiToken		the cloudflare api token
+	 * @returns {Promise}
+	 */
+	requestLetsEncryptCloudFlareDnsSsl: (certificate, apiToken) => {
+		logger.info('Requesting Let\'sEncrypt certificates via Cloudflare DNS for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
+
+		let tokenLoc = '~/cloudflare-token';
+		let storeKey = 'echo "dns_cloudflare_api_token = ' + apiToken + '" > ' + tokenLoc;	
+
+		let cmd = certbot_command + ' certonly --non-interactive ' +
+			'--cert-name "npm-' + certificate.id + '" ' +
+			'--agree-tos ' +
+			'--email "' + certificate.meta.letsencrypt_email + '" ' +			
+			'--domains "' + certificate.domain_names.join(',') + '" ' +
+			'--dns-cloudflare --dns-cloudflare-credentials ' + tokenLoc + ' ' +
+			(le_staging ? '--staging' : '');
+
+		if (debug_mode) {
+			logger.info('Command:', cmd);
+		}
+
+		return utils.exec(storeKey).then((result) => {
+			utils.exec(cmd).then((result) => {
+				utils.exec('rm ' + tokenLoc).then(result => {
+					logger.success(result);
+					return result;
+				});				
+			});
+		});
+	},
+
+
 	/**
 	 * @param   {Access}  access
 	 * @param   {Object}  data
diff --git a/backend/schema/endpoints/certificates.json b/backend/schema/endpoints/certificates.json
index d3294f8..27ea2d2 100644
--- a/backend/schema/endpoints/certificates.json
+++ b/backend/schema/endpoints/certificates.json
@@ -41,6 +41,12 @@
         },
         "letsencrypt_agree": {
           "type": "boolean"
+        },
+        "cloudflare_use": {
+          "type": "boolean"
+        },
+        "cloudflare_token": {
+          "type": "string"
         }
       }
     }
diff --git a/frontend/js/app/nginx/certificates/form.ejs b/frontend/js/app/nginx/certificates/form.ejs
index 98de260..2af4345 100644
--- a/frontend/js/app/nginx/certificates/form.ejs
+++ b/frontend/js/app/nginx/certificates/form.ejs
@@ -25,7 +25,7 @@
                     <div class="col-sm-12 col-md-12">
                         <div class="form-group">
                             <label class="custom-switch">
-                                <input type="checkbox" class="custom-switch-input" name="use_cloudflare" value="1">
+                                <input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
                                 <span class="custom-switch-indicator"></span>
                                 <span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
                             </label>
@@ -34,7 +34,7 @@
                     <div class="col-sm-12 col-md-12 cloudflare">
                         <div class="form-group">
                             <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
-                            <input type="text" name="cloudflare_dns_api_token" class="form-control" id="input-domains" required>                            
+                            <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token" required>
                         </div>
                     </div>
 
diff --git a/frontend/js/app/nginx/certificates/form.js b/frontend/js/app/nginx/certificates/form.js
index bdb4f6c..7387202 100644
--- a/frontend/js/app/nginx/certificates/form.js
+++ b/frontend/js/app/nginx/certificates/form.js
@@ -21,7 +21,7 @@ module.exports = Mn.View.extend({
         other_certificate:              '#other_certificate',
         other_certificate_key:          '#other_certificate_key',
         other_intermediate_certificate: '#other_intermediate_certificate',
-        cloudflare_switch:              'input[name="use_cloudflare"]',
+        cloudflare_switch:              'input[name="meta[cloudflare_use]"]',
         cloudflare:                     '.cloudflare'
     },
 
@@ -50,6 +50,9 @@ module.exports = Mn.View.extend({
             if (typeof data.meta !== 'undefined' && typeof data.meta.letsencrypt_agree !== 'undefined') {
                 data.meta.letsencrypt_agree = !!data.meta.letsencrypt_agree;
             }
+            if (typeof data.meta !== 'undefined' && typeof data.meta.cloudflare_use !== 'undefined') {
+                data.meta.cloudflare_use = !!data.meta.cloudflare_use;
+            }
 
             if (typeof data.domain_names === 'string' && data.domain_names) {
                 data.domain_names = data.domain_names.split(',');
@@ -140,6 +143,10 @@ module.exports = Mn.View.extend({
 
         getLetsencryptAgree: function () {
             return typeof this.meta.letsencrypt_agree !== 'undefined' ? this.meta.letsencrypt_agree : false;
+        },
+
+        getCloudflareUse: function () {
+            return typeof this.meta.cloudflare_use !== 'undefined' ? this.meta.cloudflare_use : false;
         }
     },
 

From 077cf75ef20c16eaa9e8bdb2a3cc8fc0a8b2dc1b Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 13:24:20 +0000
Subject: [PATCH 05/10] wildcard support

---
 backend/internal/certificate.js            | 73 ++++++++++++++--------
 frontend/js/app/nginx/certificates/form.js |  5 +-
 2 files changed, 50 insertions(+), 28 deletions(-)

diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js
index 1c71a45..c5e6a46 100644
--- a/backend/internal/certificate.js
+++ b/backend/internal/certificate.js
@@ -141,20 +141,11 @@ const internalCertificate = {
 								});
 						})
 						.then((in_use_result) => {
-							// 3. Generate the LE config
-							return internalNginx.generateLetsEncryptRequestConfig(certificate)
-								.then(internalNginx.reload)
-								.then(() => {
+							// Is CloudFlare, no config needed, so skip 3 and 5.
+							if (data.meta.cloudflare_use) {
+								return internalNginx.reload().then(() => {
 									// 4. Request cert
-									if (data.meta.cloudflare_use) {
-										return internalCertificate.requestLetsEncryptCloudFlareDnsSsl(certificate, data.meta.cloudflare_token);
-									} else {
-										return internalCertificate.requestLetsEncryptSsl(certificate);
-									}
-								})
-								.then(() => {
-									// 5. Remove LE config
-									return internalNginx.deleteLetsEncryptRequestConfig(certificate);
+									return internalCertificate.requestLetsEncryptCloudFlareDnsSsl(certificate, data.meta.cloudflare_token);
 								})
 								.then(internalNginx.reload)
 								.then(() => {
@@ -166,15 +157,44 @@ const internalCertificate = {
 								})
 								.catch((err) => {
 									// In the event of failure, revert things and throw err back
-									return internalNginx.deleteLetsEncryptRequestConfig(certificate)
-										.then(() => {
-											return internalCertificate.enableInUseHosts(in_use_result);
-										})
+									return internalCertificate.enableInUseHosts(in_use_result)
 										.then(internalNginx.reload)
 										.then(() => {
 											throw err;
 										});
 								});
+							} else {
+								// 3. Generate the LE config
+								return internalNginx.generateLetsEncryptRequestConfig(certificate)
+									.then(internalNginx.reload)
+									.then(() => {
+										// 4. Request cert
+										return internalCertificate.requestLetsEncryptSsl(certificate);
+									})
+									.then(() => {
+										// 5. Remove LE config
+										return internalNginx.deleteLetsEncryptRequestConfig(certificate);
+									})
+									.then(internalNginx.reload)
+									.then(() => {
+										// 6. Re-instate previously disabled hosts
+										return internalCertificate.enableInUseHosts(in_use_result);
+									})
+									.then(() => {
+										return certificate;
+									})
+									.catch((err) => {
+										// In the event of failure, revert things and throw err back
+										return internalNginx.deleteLetsEncryptRequestConfig(certificate)
+											.then(() => {
+												return internalCertificate.enableInUseHosts(in_use_result);
+											})
+											.then(internalNginx.reload)
+											.then(() => {
+												throw err;
+											});
+									});
+							}
 						})
 						.then(() => {
 							// At this point, the letsencrypt cert should exist on disk.
@@ -763,26 +783,25 @@ const internalCertificate = {
 		let tokenLoc = '~/cloudflare-token';
 		let storeKey = 'echo "dns_cloudflare_api_token = ' + apiToken + '" > ' + tokenLoc;	
 
-		let cmd = certbot_command + ' certonly --non-interactive ' +
+		let cmd = 
+			storeKey + " && " +
+			certbot_command + ' certonly --non-interactive ' +
 			'--cert-name "npm-' + certificate.id + '" ' +
 			'--agree-tos ' +
 			'--email "' + certificate.meta.letsencrypt_email + '" ' +			
 			'--domains "' + certificate.domain_names.join(',') + '" ' +
-			'--dns-cloudflare --dns-cloudflare-credentials ' + tokenLoc + ' ' +
-			(le_staging ? '--staging' : '');
+			'--dns-cloudflare --dns-cloudflare-credentials ' + tokenLoc +
+			(le_staging ? ' --staging' : '')
+			+ ' && rm ' + tokenLoc;
 
 		if (debug_mode) {
 			logger.info('Command:', cmd);
 		}
 
-		return utils.exec(storeKey).then((result) => {
-			utils.exec(cmd).then((result) => {
-				utils.exec('rm ' + tokenLoc).then(result => {
-					logger.success(result);
-					return result;
-				});				
+		return utils.exec(cmd).then((result) => {
+				logger.info(result);
+				return result;
 			});
-		});
 	},
 
 
diff --git a/frontend/js/app/nginx/certificates/form.js b/frontend/js/app/nginx/certificates/form.js
index 7387202..de4432b 100644
--- a/frontend/js/app/nginx/certificates/form.js
+++ b/frontend/js/app/nginx/certificates/form.js
@@ -39,6 +39,7 @@ module.exports = Mn.View.extend({
 
             if (!this.ui.form[0].checkValidity()) {
                 $('<input type="submit">').hide().appendTo(this.ui.form).click().remove();
+                $(this).addClass('btn-loading');
                 return;
             }
 
@@ -94,6 +95,7 @@ module.exports = Mn.View.extend({
             }
 
             this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
+            this.ui.save.addClass('btn-loading');
 
             // compile file data
             let form_data = new FormData();
@@ -132,6 +134,7 @@ module.exports = Mn.View.extend({
                 .catch(err => {
                     alert(err.message);
                     this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
+                    this.ui.save.removeClass('btn-loading');
                 });
         }
     },
@@ -161,7 +164,7 @@ module.exports = Mn.View.extend({
                     text:  input
                 };
             },
-            createFilter: /^(?:[^.*]+\.?)+[^.]$/
+            createFilter: /^(?:[^.]+\.?)+[^.]$/
         });
         this.ui.cloudflare.hide();
     },

From cff6c4d1f5ca239c42069393c45facde3ee39f44 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 16:48:14 +0000
Subject: [PATCH 06/10] - prevent wildcard generation when not using Cloudflare
 dns - fix cloudflare token required logic

---
 frontend/js/app/nginx/certificates/form.ejs |  2 +-
 frontend/js/app/nginx/certificates/form.js  | 27 ++++++++++++++++++---
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/frontend/js/app/nginx/certificates/form.ejs b/frontend/js/app/nginx/certificates/form.ejs
index 2af4345..19ea2c7 100644
--- a/frontend/js/app/nginx/certificates/form.ejs
+++ b/frontend/js/app/nginx/certificates/form.ejs
@@ -34,7 +34,7 @@
                     <div class="col-sm-12 col-md-12 cloudflare">
                         <div class="form-group">
                             <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
-                            <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token" required>
+                            <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
                         </div>
                     </div>
 
diff --git a/frontend/js/app/nginx/certificates/form.js b/frontend/js/app/nginx/certificates/form.js
index de4432b..5d263df 100644
--- a/frontend/js/app/nginx/certificates/form.js
+++ b/frontend/js/app/nginx/certificates/form.js
@@ -22,16 +22,19 @@ module.exports = Mn.View.extend({
         other_certificate_key:          '#other_certificate_key',
         other_intermediate_certificate: '#other_intermediate_certificate',
         cloudflare_switch:              'input[name="meta[cloudflare_use]"]',
+        cloudflare_token:               'input[name="meta[cloudflare_token]"',
         cloudflare:                     '.cloudflare'
     },
 
     events: {
         'change @ui.cloudflare_switch': function() {
             let checked = this.ui.cloudflare_switch.prop('checked');
-            if (checked) {
+            if (checked) {                
+                this.ui.cloudflare_token.prop('required', 'required');
                 this.ui.cloudflare.show();
-            } else {
-                this.ui.cloudflare.hide();
+            } else {                
+                this.ui.cloudflare_token.prop('required', false);
+                this.ui.cloudflare.hide();                
             }
         },
         'click @ui.save': function (e) {
@@ -39,7 +42,7 @@ module.exports = Mn.View.extend({
 
             if (!this.ui.form[0].checkValidity()) {
                 $('<input type="submit">').hide().appendTo(this.ui.form).click().remove();
-                $(this).addClass('btn-loading');
+                $(this).removeClass('btn-loading');
                 return;
             }
 
@@ -47,6 +50,22 @@ module.exports = Mn.View.extend({
             let data      = this.ui.form.serializeJSON();
             data.provider = this.model.get('provider');
 
+
+
+            let domain_err = false;
+            if (!data.meta.cloudflare_use) {                
+                data.domain_names.split(',').map(function (name) {
+                    if (name.match(/\*/im)) {
+                        domain_err = true;
+                    }
+                });
+            }
+
+            if (domain_err) {
+                alert('Cannot request Let\'s Encrypt Certificate for wildcard domains when not using CloudFlare DNS');
+                return;
+            }
+
             // Manipulate
             if (typeof data.meta !== 'undefined' && typeof data.meta.letsencrypt_agree !== 'undefined') {
                 data.meta.letsencrypt_agree = !!data.meta.letsencrypt_agree;

From c5aa2b9f771cbd4c78c239ed0791aeb8d9e4d2e4 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 18:29:16 +0000
Subject: [PATCH 07/10] add cloudflare renew and make revoke working for both
 by deleting unnecessary config command

---
 backend/internal/certificate.js | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js
index c5e6a46..2dadb34 100644
--- a/backend/internal/certificate.js
+++ b/backend/internal/certificate.js
@@ -818,7 +818,9 @@ const internalCertificate = {
 			})
 			.then((certificate) => {
 				if (certificate.provider === 'letsencrypt') {
-					return internalCertificate.renewLetsEncryptSsl(certificate)
+					let renewMethod = certificate.meta.cloudflare_use ? internalCertificate.renewLetsEncryptCloudFlareSsl : internalCertificate.renewLetsEncryptSsl;		
+
+					return renewMethod(certificate)
 						.then(() => {
 							return internalCertificate.getCertificateInfoFromFile('/etc/letsencrypt/live/npm-' + certificate.id + '/fullchain.pem');
 						})
@@ -872,6 +874,29 @@ const internalCertificate = {
 			});
 	},
 
+	/**
+	 * @param   {Object}  certificate   the certificate row
+	 * @returns {Promise}
+	 */
+	renewLetsEncryptCloudFlareSsl: (certificate) => {
+		logger.info('Renewing Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
+
+		let cmd = certbot_command + ' renew --non-interactive ' +
+			'--cert-name "npm-' + certificate.id + '" ' +
+			'--disable-hook-validation ' +
+			(le_staging ? '--staging' : '');
+
+		if (debug_mode) {
+			logger.info('Command:', cmd);
+		}
+
+		return utils.exec(cmd)
+			.then((result) => {
+				logger.info(result);
+				return result;
+			});
+	},
+
 	/**
 	 * @param   {Object}  certificate    the certificate row
 	 * @param   {Boolean} [throw_errors]
@@ -881,7 +906,6 @@ const internalCertificate = {
 		logger.info('Revoking Let\'sEncrypt certificates for Cert #' + certificate.id + ': ' + certificate.domain_names.join(', '));
 
 		let cmd = certbot_command + ' revoke --non-interactive ' +
-			'--config "' + le_config + '" ' +
 			'--cert-path "/etc/letsencrypt/live/npm-' + certificate.id + '/fullchain.pem" ' +
 			'--delete-after-revoke ' +
 			(le_staging ? '--staging' : '');

From ab67481e99e9135309318339e7be04eda90fdb0d Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Sun, 23 Aug 2020 18:56:25 +0000
Subject: [PATCH 08/10] fix eslint errors

---
 backend/internal/certificate.js | 40 ++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js
index 2dadb34..3508daf 100644
--- a/backend/internal/certificate.js
+++ b/backend/internal/certificate.js
@@ -147,22 +147,22 @@ const internalCertificate = {
 									// 4. Request cert
 									return internalCertificate.requestLetsEncryptCloudFlareDnsSsl(certificate, data.meta.cloudflare_token);
 								})
-								.then(internalNginx.reload)
-								.then(() => {
-									// 6. Re-instate previously disabled hosts
-									return internalCertificate.enableInUseHosts(in_use_result);
-								})
-								.then(() => {
-									return certificate;
-								})
-								.catch((err) => {
-									// In the event of failure, revert things and throw err back
-									return internalCertificate.enableInUseHosts(in_use_result)
-										.then(internalNginx.reload)
-										.then(() => {
-											throw err;
-										});
-								});
+									.then(internalNginx.reload)
+									.then(() => {
+										// 6. Re-instate previously disabled hosts
+										return internalCertificate.enableInUseHosts(in_use_result);
+									})
+									.then(() => {
+										return certificate;
+									})
+									.catch((err) => {
+										// In the event of failure, revert things and throw err back
+										return internalCertificate.enableInUseHosts(in_use_result)
+											.then(internalNginx.reload)
+											.then(() => {
+												throw err;
+											});
+									});
 							} else {
 								// 3. Generate the LE config
 								return internalNginx.generateLetsEncryptRequestConfig(certificate)
@@ -784,7 +784,7 @@ const internalCertificate = {
 		let storeKey = 'echo "dns_cloudflare_api_token = ' + apiToken + '" > ' + tokenLoc;	
 
 		let cmd = 
-			storeKey + " && " +
+			storeKey + ' && ' +
 			certbot_command + ' certonly --non-interactive ' +
 			'--cert-name "npm-' + certificate.id + '" ' +
 			'--agree-tos ' +
@@ -799,9 +799,9 @@ const internalCertificate = {
 		}
 
 		return utils.exec(cmd).then((result) => {
-				logger.info(result);
-				return result;
-			});
+			logger.info(result);
+			return result;
+		});
 	},
 
 

From e8596c155460199e508c71b86e273dc31b8e58e7 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Mon, 24 Aug 2020 09:00:00 +0000
Subject: [PATCH 09/10] cloudflare DNS also possible while adding proxy,
 redirection and 404

---
 frontend/js/app/nginx/dead/form.ejs        | 17 ++++++++++
 frontend/js/app/nginx/dead/form.js         | 38 ++++++++++++++++-----
 frontend/js/app/nginx/proxy/form.ejs       | 17 ++++++++++
 frontend/js/app/nginx/proxy/form.js        | 39 +++++++++++++++++-----
 frontend/js/app/nginx/redirection/form.ejs | 17 ++++++++++
 frontend/js/app/nginx/redirection/form.js  | 37 +++++++++++++++-----
 6 files changed, 140 insertions(+), 25 deletions(-)

diff --git a/frontend/js/app/nginx/dead/form.ejs b/frontend/js/app/nginx/dead/form.ejs
index f94d2cc..d48820f 100644
--- a/frontend/js/app/nginx/dead/form.ejs
+++ b/frontend/js/app/nginx/dead/form.ejs
@@ -73,6 +73,23 @@
                             </div>
                         </div>
 
+                        <!-- CloudFlare -->
+                        <div class="col-sm-12 col-md-12 letsencrypt">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-12 col-md-12 cloudflare letsencrypt">
+                            <div class="form-group">
+                                <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
+                                <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
+                            </div>
+                        </div>
+
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">
                             <div class="form-group">
diff --git a/frontend/js/app/nginx/dead/form.js b/frontend/js/app/nginx/dead/form.js
index 4d7ef6b..aca367a 100644
--- a/frontend/js/app/nginx/dead/form.js
+++ b/frontend/js/app/nginx/dead/form.js
@@ -23,6 +23,9 @@ module.exports = Mn.View.extend({
         hsts_enabled:       'input[name="hsts_enabled"]',
         hsts_subdomains:    'input[name="hsts_subdomains"]',
         http2_support:      'input[name="http2_support"]',
+        cloudflare_switch:  'input[name="meta[cloudflare_use]"]',
+        cloudflare_token:   'input[name="meta[cloudflare_token]"',
+        cloudflare:         '.cloudflare',
         letsencrypt:        '.letsencrypt'
     },
 
@@ -31,10 +34,12 @@ module.exports = Mn.View.extend({
             let id = this.ui.certificate_select.val();
             if (id === 'new') {
                 this.ui.letsencrypt.show().find('input').prop('disabled', false);
+                this.ui.cloudflare.hide();
             } else {
                 this.ui.letsencrypt.hide().find('input').prop('disabled', true);
             }
 
+
             let enabled = id === 'new' || parseInt(id, 10) > 0;
 
             let inputs = this.ui.ssl_forced.add(this.ui.http2_support);
@@ -76,6 +81,17 @@ module.exports = Mn.View.extend({
             }
         },
 
+        'change @ui.cloudflare_switch': function() {
+            let checked = this.ui.cloudflare_switch.prop('checked');
+            if (checked) {                
+                this.ui.cloudflare_token.prop('required', 'required');
+                this.ui.cloudflare.show();
+            } else {                
+                this.ui.cloudflare_token.prop('required', false);
+                this.ui.cloudflare.hide();                
+            }
+        },
+
         'click @ui.save': function (e) {
             e.preventDefault();
 
@@ -98,20 +114,23 @@ module.exports = Mn.View.extend({
             }
 
             // Check for any domain names containing wildcards, which are not allowed with letsencrypt
-            if (data.certificate_id === 'new') {
+            if (data.certificate_id === 'new') {                
                 let domain_err = false;
-                data.domain_names.map(function (name) {
-                    if (name.match(/\*/im)) {
-                        domain_err = true;
-                    }
-                });
+                if (!data.meta.cloudflare_use) {
+                    data.domain_names.map(function (name) {
+                        if (name.match(/\*/im)) {
+                            domain_err = true;
+                        }
+                    });
+                }
 
                 if (domain_err) {
-                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains');
+                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains without CloudFlare DNS.');
                     return;
                 }
 
-                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
+                data.meta.cloudflare_use = data.meta.cloudflare_use === '1';
+                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';                
             } else {
                 data.certificate_id = parseInt(data.certificate_id, 10);
             }
@@ -127,6 +146,8 @@ module.exports = Mn.View.extend({
             }
 
             this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
+            this.ui.save.addClass('btn-loading');
+
             method(data)
                 .then(result => {
                     view.model.set(result);
@@ -140,6 +161,7 @@ module.exports = Mn.View.extend({
                 .catch(err => {
                     alert(err.message);
                     this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
+                    this.ui.save.removeClass('btn-loading');
                 });
         }
     },
diff --git a/frontend/js/app/nginx/proxy/form.ejs b/frontend/js/app/nginx/proxy/form.ejs
index 0cc0d54..e003597 100644
--- a/frontend/js/app/nginx/proxy/form.ejs
+++ b/frontend/js/app/nginx/proxy/form.ejs
@@ -141,6 +141,23 @@
                             </div>
                         </div>
 
+                        <!-- CloudFlare -->
+                        <div class="col-sm-12 col-md-12 letsencrypt">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-12 col-md-12 cloudflare letsencrypt">
+                            <div class="form-group">
+                                <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
+                                <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
+                            </div>
+                        </div>
+
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">
                             <div class="form-group">
diff --git a/frontend/js/app/nginx/proxy/form.js b/frontend/js/app/nginx/proxy/form.js
index eb93bc8..0f64281 100644
--- a/frontend/js/app/nginx/proxy/form.js
+++ b/frontend/js/app/nginx/proxy/form.js
@@ -33,6 +33,9 @@ module.exports = Mn.View.extend({
         hsts_enabled:       'input[name="hsts_enabled"]',
         hsts_subdomains:    'input[name="hsts_subdomains"]',
         http2_support:      'input[name="http2_support"]',
+        cloudflare_switch:  'input[name="meta[cloudflare_use]"]',
+        cloudflare_token:   'input[name="meta[cloudflare_token]"',
+        cloudflare:         '.cloudflare',
         forward_scheme:     'select[name="forward_scheme"]',
         letsencrypt:        '.letsencrypt'
     },
@@ -46,6 +49,7 @@ module.exports = Mn.View.extend({
             let id = this.ui.certificate_select.val();
             if (id === 'new') {
                 this.ui.letsencrypt.show().find('input').prop('disabled', false);
+                this.ui.cloudflare.hide();
             } else {
                 this.ui.letsencrypt.hide().find('input').prop('disabled', true);
             }
@@ -91,6 +95,17 @@ module.exports = Mn.View.extend({
             }
         },
 
+        'change @ui.cloudflare_switch': function() {
+            let checked = this.ui.cloudflare_switch.prop('checked');
+            if (checked) {                
+                this.ui.cloudflare_token.prop('required', 'required');
+                this.ui.cloudflare.show();
+            } else {                
+                this.ui.cloudflare_token.prop('required', false);
+                this.ui.cloudflare.hide();                
+            }
+        },
+
         'click @ui.add_location_btn': function (e) {
             e.preventDefault();
             
@@ -134,20 +149,23 @@ module.exports = Mn.View.extend({
             }
 
             // Check for any domain names containing wildcards, which are not allowed with letsencrypt
-            if (data.certificate_id === 'new') {
+            if (data.certificate_id === 'new') {                
                 let domain_err = false;
-                data.domain_names.map(function (name) {
-                    if (name.match(/\*/im)) {
-                        domain_err = true;
-                    }
-                });
+                if (!data.meta.cloudflare_use) {
+                    data.domain_names.map(function (name) {
+                        if (name.match(/\*/im)) {
+                            domain_err = true;
+                        }
+                    });
+                }
 
                 if (domain_err) {
-                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains');
+                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains without CloudFlare DNS.');
                     return;
                 }
 
-                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
+                data.meta.cloudflare_use = data.meta.cloudflare_use === '1';
+                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';                
             } else {
                 data.certificate_id = parseInt(data.certificate_id, 10);
             }
@@ -163,6 +181,8 @@ module.exports = Mn.View.extend({
             }
 
             this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
+            this.ui.save.addClass('btn-loading');
+
             method(data)
                 .then(result => {
                     view.model.set(result);
@@ -176,6 +196,7 @@ module.exports = Mn.View.extend({
                 .catch(err => {
                     alert(err.message);
                     this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
+                    this.ui.save.removeClass('btn-loading');
                 });
         }
     },
@@ -203,7 +224,7 @@ module.exports = Mn.View.extend({
                     text:  input
                 };
             },
-            createFilter: /^(?:\*\.)?(?:[^.*]+\.?)+[^.]$/
+            createFilter: /^(?:\.)?(?:[^.*]+\.?)+[^.]$/
         });
 
         // Access Lists
diff --git a/frontend/js/app/nginx/redirection/form.ejs b/frontend/js/app/nginx/redirection/form.ejs
index 7cdb8a3..7d49769 100644
--- a/frontend/js/app/nginx/redirection/form.ejs
+++ b/frontend/js/app/nginx/redirection/form.ejs
@@ -97,6 +97,23 @@
                             </div>
                         </div>
 
+                        <!-- CloudFlare -->
+                        <div class="col-sm-12 col-md-12 letsencrypt">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="meta[cloudflare_use]" value="1">
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%= i18n('ssl', 'use-cloudflare') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-12 col-md-12 cloudflare letsencrypt">
+                            <div class="form-group">
+                                <label class="form-label">CloudFlare DNS API Token  <span class="form-required">*</span></label>
+                                <input type="text" name="meta[cloudflare_token]" class="form-control" id="cloudflare_token">
+                            </div>
+                        </div>
+
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">
                             <div class="form-group">
diff --git a/frontend/js/app/nginx/redirection/form.js b/frontend/js/app/nginx/redirection/form.js
index 0cef1a3..4e5b168 100644
--- a/frontend/js/app/nginx/redirection/form.js
+++ b/frontend/js/app/nginx/redirection/form.js
@@ -23,6 +23,9 @@ module.exports = Mn.View.extend({
         hsts_enabled:       'input[name="hsts_enabled"]',
         hsts_subdomains:    'input[name="hsts_subdomains"]',
         http2_support:      'input[name="http2_support"]',
+        cloudflare_switch:  'input[name="meta[cloudflare_use]"]',
+        cloudflare_token:   'input[name="meta[cloudflare_token]"',
+        cloudflare:         '.cloudflare',
         letsencrypt:        '.letsencrypt'
     },
 
@@ -31,6 +34,7 @@ module.exports = Mn.View.extend({
             let id = this.ui.certificate_select.val();
             if (id === 'new') {
                 this.ui.letsencrypt.show().find('input').prop('disabled', false);
+                this.ui.cloudflare.hide();
             } else {
                 this.ui.letsencrypt.hide().find('input').prop('disabled', true);
             }
@@ -76,6 +80,17 @@ module.exports = Mn.View.extend({
             }
         },
 
+        'change @ui.cloudflare_switch': function() {
+            let checked = this.ui.cloudflare_switch.prop('checked');
+            if (checked) {                
+                this.ui.cloudflare_token.prop('required', 'required');
+                this.ui.cloudflare.show();
+            } else {                
+                this.ui.cloudflare_token.prop('required', false);
+                this.ui.cloudflare.hide();                
+            }
+        },
+
         'click @ui.save': function (e) {
             e.preventDefault();
 
@@ -100,20 +115,23 @@ module.exports = Mn.View.extend({
             }
 
             // Check for any domain names containing wildcards, which are not allowed with letsencrypt
-            if (data.certificate_id === 'new') {
+            if (data.certificate_id === 'new') {                
                 let domain_err = false;
-                data.domain_names.map(function (name) {
-                    if (name.match(/\*/im)) {
-                        domain_err = true;
-                    }
-                });
+                if (!data.meta.cloudflare_use) {
+                    data.domain_names.map(function (name) {
+                        if (name.match(/\*/im)) {
+                            domain_err = true;
+                        }
+                    });
+                }
 
                 if (domain_err) {
-                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains');
+                    alert('Cannot request Let\'s Encrypt Certificate for wildcard domains without CloudFlare DNS.');
                     return;
                 }
 
-                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
+                data.meta.cloudflare_use = data.meta.cloudflare_use === '1';
+                data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';                
             } else {
                 data.certificate_id = parseInt(data.certificate_id, 10);
             }
@@ -129,6 +147,8 @@ module.exports = Mn.View.extend({
             }
 
             this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
+            this.ui.save.addClass('btn-loading');
+
             method(data)
                 .then(result => {
                     view.model.set(result);
@@ -142,6 +162,7 @@ module.exports = Mn.View.extend({
                 .catch(err => {
                     alert(err.message);
                     this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
+                    this.ui.save.removeClass('btn-loading');
                 });
         }
     },

From a5616056534bee2f70bd11e1af1a68c4e10512ea Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit <jaap-jan@dodotech.dev>
Date: Mon, 24 Aug 2020 09:09:52 +0000
Subject: [PATCH 10/10] show in ssl certificates list that CloudFlare is used

---
 frontend/js/app/nginx/certificates/list/item.ejs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/js/app/nginx/certificates/list/item.ejs b/frontend/js/app/nginx/certificates/list/item.ejs
index e7ee216..857a08b 100644
--- a/frontend/js/app/nginx/certificates/list/item.ejs
+++ b/frontend/js/app/nginx/certificates/list/item.ejs
@@ -28,7 +28,7 @@
     </div>
 </td>
 <td>
-    <%- i18n('ssl', provider) %>
+    <%- i18n('ssl', provider) %><% if (meta.cloudflare_use) { %> - CloudFlare DNS<% } %>
 </td>
 <td class="<%- isExpired() ? 'text-danger' : '' %>">
     <%- formatDbDate(expires_on, 'Do MMMM YYYY, h:mm a') %>