Initial commit

Author: larryboymi

.babelrc

@@ -0,0 +1,7 @@
+{
+  "presets": [
+    "es2015",
+    "react",
+    "stage-0"
+  ]
+}

.eslintrc

@@ -0,0 +1,3 @@
+{
+  "extends": "standard"
+}

.gitignore

@@ -0,0 +1,37 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+
+# Runtime data
+pids
+*.pid
+*.seed
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (http://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules
+jspm_packages
+
+# Optional npm cache directory
+.npm
+
+# Optional REPL history
+.node_repl_history

README.md

@@ -0,0 +1,28 @@
+# Node Lambda Lets-Encrypt
+
+Use [AWS Lambda](https://aws.amazon.com/lambda/) to manage SSL certificates for
+Lets-Encrypt.
+
+## Project status
+This project has just begun, I will be adding features as fast as I can to get it to completion in a relatively short time period (9-26-2016)
+
+# Why do I want this?
+Rather than having to dedicate a machine to running the Lets-Encrypt client to
+maintain your certificate for your site, you can let it all
+live on Amazon's infrastructure for cheap. You'll receive notification if
+anything goes wrong, and there's no hardware or virtual machines for you to
+manage.
+
+# How does it work?
+
+This works by running a Lambda function once per day which will check
+your certificate's expiration, and renew it if it is nearing expiration.
+
+Since Lambda is billed in 100ms increments and this only needs to run once a day
+for less than 10seconds each time the cost to run this is less than a
+penny per month(i.e. effectively free)
+
+## Special Thanks
+A few shout-outs to inspiring projects...
+* @ubergeek42 for https://github.com/ubergeek42/lambda-letsencrypt
+* @Daplie for https://github.com/Daplie/le-acme-core and https://github.com/Daplie/rsa-compat.js

app.js

@@ -0,0 +1,15 @@
+require('babel-register')
+
+const express = require('express')
+
+const app = express()
+app.use('/certificate', require('./routes/certificate'))
+
+app.listen(process.env.PORT || 3000)
+
+// production error handler
+// no stacktraces leaked to user
+app.use((err, req, res, next) => {
+  res.status(err.status || 500)
+  res.send(JSON.stringify(err))
+})

config/custom-environment-variables.json

@@ -0,0 +1,4 @@
+{
+  "AWS_ACCESS_KEY_ID": "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY": "AWS_SECRET_ACCESS_KEY"
+}

config/default.json

@@ -0,0 +1,17 @@
+{
+  "AWS_ACCESS_KEY_ID": "",
+  "AWS_SECRET_ACCESS_KEY": "",
+  "region": "us-east-1",
+  "s3-config-bucket": "",
+  "s3-cert-bucket": "",
+  "sns-arn": "",
+  "acme-challenge-expires-in": 3,
+  "acme-dns-retry": 30,
+  "acme-dns-retry-delay-ms": 2000,
+  "acme-site-key": "",
+  "acme-site-info-file": "",
+  "acme-user-info-file": "",
+  "acme-user-email": "",
+  "acme-user-key-bits": 2048,
+  "acme-directory-url": "https://acme-staging.api.letsencrypt.org"
+}

package.json

@@ -0,0 +1,50 @@
+{
+  "name": "node-letsencrypt-lambda",
+  "version": "1.0.0",
+  "description": "Free Lets-Encrypt certificate management for CloudFront/AWS written in nodejs",
+  "main": "app.js",
+  "scripts": {
+    "dev": "cross-env NODE_ENV=development node app"
+  },
+  "keywords": [
+    "letsencrypt",
+    "nodejs",
+    "aws"
+  ],
+  "author": "Larry Anderson",
+  "license": "ISC",
+  "dependencies": {
+    "aws-sdk": "~2.4.14",
+    "babel-loader": "^6.2.5",
+    "babel-plugin-transform-class-properties": "^6.16.0",
+    "babel-plugin-transform-runtime": "^6.12.0",
+    "babel-polyfill": "^6.16.0",
+    "babel-preset-es2015": "^6.16.0",
+    "babel-preset-react": "^6.16.0",
+    "babel-preset-stage-0": "^6.16.0",
+    "babel-register": "^6.16.3",
+    "config": "^1.20.3",
+    "es6-promisify": "^4.1.0",
+    "eslint": "^3.7.0",
+    "eslint-config-standard": "^6.2.0",
+    "eslint-plugin-standard": "^2.0.1",
+    "express": "^4.14.0",
+    "node-forge": "^0.6.42",
+    "promise": "^7.1.1",
+    "rsa-compat": "^1.2.7",
+    "superagent": "~1.8.4",
+    "superagent-promise": "^1.1.0",
+    "underscore": "^1.8.3",
+    "urlsafe-base64": "^1.0.0",
+    "webpack": "^1.13.2",
+    "winston": "~2.2.0"
+  },
+  "devDependencies": {
+    "concurrently": "^2.2.0",
+    "cross-env": "~1.0.8",
+    "eslint": "^3.6.0",
+    "eslint-config-standard": "^6.0.1",
+    "eslint-plugin-promise": "^2.0.1",
+    "eslint-plugin-standard": "^2.0.0"
+  }
+}

routes/certificate.js

@@ -0,0 +1,14 @@
+import generateCertificate from '../src/acme/generateCertificate'
+import isExpired from '../src/util/isExpired'
+import config from 'config'
+
+const runHandler = (expired) => (expired ? generateCertificate() : Promise.resolve({msg: 'Certificate is still valid, going back to bed.'}))
+
+module.exports = (req, res, next) => {
+  isExpired(config.get('acme-site-key'))
+  .then(runHandler)
+  .then((data) => {
+    res.send(data)
+  })
+  .catch(next)
+}

src/acme/authorize/getChallenges.js

@@ -0,0 +1,14 @@
+import config from 'config'
+import sendSignedRequest from '../sendSignedRequest'
+
+const getChallenges = (keypair, authzUrl) =>
+  sendSignedRequest({
+    resource: 'new-authz',
+    identifier: {
+      type: 'dns',
+      value: config.get('acme-site-key')
+    }
+  }, keypair, authzUrl)
+  .then((data) => Promise.resolve(data.body))
+
+module.exports = getChallenges