SSL-certifikat på macOS med Lego och LaunchDaemon

sudo mkdir -p /usr/local/bin
arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
version=$(curl -fsSL https://api.github.com/repos/go-acme/lego/releases/latest \
  | sed -n 's/.*"tag_name": "\(v[^"]*\)".*/\1/p' | head -1)
curl -fL "https://github.com/go-acme/lego/releases/download/${version}/lego_${version}_darwin_${arch}.tar.gz" -o lego.tar.gz
tar -xzf lego.tar.gz lego
sudo install -m 0755 lego /usr/local/bin/lego
rm -f lego lego.tar.gz
sudo install -d -m 0755 /usr/local/etc/lego
sudo install -d -m 0700 /usr/local/etc/lego/accounts /usr/local/etc/lego/certificates

sudo tee /usr/local/bin/fairssl-lego-sync.sh > /dev/null << 'SCRIPT'
#!/bin/bash
set -euo pipefail
TARGET="/usr/local/etc/ssl"
CERT_FILE="cert.pem"
KEY_FILE="key.pem"
RESTART_CMD="sudo nginx -s reload"

lego_name="$${1:-}"
cert_path="$${LEGO_HOOK_CERT_PATH:-}"
key_path="$${LEGO_HOOK_CERT_KEY_PATH:-}"
if { [ -z "$cert_path" ] || [ -z "$key_path" ]; } && [ -n "$lego_name" ]; then
    cert_path="/usr/local/etc/lego/certificates/${lego_name}.crt"
    key_path="/usr/local/etc/lego/certificates/${lego_name}.key"
fi
if [ -z "$cert_path" ] || [ -z "$key_path" ] || [ ! -s "$cert_path" ] || [ ! -s "$key_path" ]; then
    echo "Saknar Lego-certifikatfiler. Uppgradera till Lego v5.0.4+ och kontrollera /usr/local/etc/lego/certificates."
    exit 1
fi
sudo install -d -m 0755 "$TARGET"
sudo install -m 0644 "$cert_path" "$TARGET/$CERT_FILE"
sudo install -m 0600 "$key_path" "$TARGET/$KEY_FILE"
$RESTART_CMD
SCRIPT
sudo chmod +x /usr/local/bin/fairssl-lego-sync.sh

sudo /usr/local/bin/lego run \
  --domains "www.exempel.se" \
  --server https://fairssl.dk/acme \
  --eab --eab.kid DIN_EAB_KID --eab.hmac DIN_EAB_HMAC \
  --accept-tos --email acme-client@fairssl.dk \
  --http --http.webroot "/Library/WebServer/Documents" \
  --path "/usr/local/etc/lego" \
  --deploy-hook "/usr/local/bin/fairssl-lego-sync.sh www-exempel-se"

sudo tee /Library/LaunchDaemons/se.fairssl.lego-www-exempel-se.plist > /dev/null << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>se.fairssl.lego-www-exempel-se</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>/usr/local/bin/lego run --domains "www.exempel.se" --server https://fairssl.dk/acme --accept-tos --email acme-client@fairssl.dk --http --http.webroot "/Library/WebServer/Documents" --path "/usr/local/etc/lego" --renew-days 7 --deploy-hook "/usr/local/bin/fairssl-lego-sync.sh www-exempel-se"</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>4</integer>
        <key>Minute</key>
        <integer>17</integer>
    </dict>
    <key>StandardOutPath</key>
    <string>/var/log/lego.log</string>
    <key>StandardErrorPath</key>
    <string>/var/log/lego.err</string>
    <key>RunAtLoad</key>
    <false/>
</dict>
</plist>
EOF
sudo chown root:wheel /Library/LaunchDaemons/se.fairssl.lego-www-exempel-se.plist
sudo chmod 644 /Library/LaunchDaemons/se.fairssl.lego-www-exempel-se.plist
sudo launchctl load -w /Library/LaunchDaemons/se.fairssl.lego-www-exempel-se.plist