สร้าง Wildcard Certificate ด้วย Let's Encrypt + Certbot

#!/usr/bin/env bash
# -------------------------------------------------------------
# certbot-wildcard.sh - Create/renew Let's Encrypt Wildcard cert
# -------------------------------------------------------------
set -euo pipefail

# ⚙️ Configuration - แก้ไขค่าเหล่านี้
DOMAIN="example.com"                  # กำหนดโดเมนของคุณ
CF_API_TOKEN="YOUR_CF_TOKEN_HERE"      # ใส่ Token จาก Cloudflare

# 📋 Logging Functions
log(){ echo -e "\e[32m[INFO]\e[0m $*"; }
error(){ echo -e "\e[31m[ERROR]\e[0m $*" >&2; exit 1; }

# 🔍 Prerequisites Check
if ! command -v certbot >/dev/null; then 
    error "กรุณาติดตั้ง certbot ก่อน (sudo apt install certbot)"
fi

if [[ "${1:-}" == "auth" ]]; then
    # 📝 Create DNS TXT record for validation
    VALIDATION="$CERTBOT_VALIDATION"
    RECORD="_acme-challenge.$CERTBOT_DOMAIN"
    
    # Get Zone ID
    log "Getting Zone ID for $DOMAIN..."
    ZONE_ID=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN" \
        -H "Authorization: Bearer $CF_API_TOKEN" \
        -H "Content-Type: application/json" | jq -r '.result[0].id')
    
    # Create TXT record
    log "Creating TXT record: $RECORD"
    RESP=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
        -H "Authorization: Bearer $CF_API_TOKEN" \
        -H "Content-Type: application/json" \
        --data "{\"type\":\"TXT\",\"name\":\"$RECORD\",\"content\":\"$VALIDATION\",\"ttl\":120}")
    
    export CF_DNS_RECORD_ID=$(echo $RESP | jq -r '.result.id')
    log "✓ TXT record created (ID=$CF_DNS_RECORD_ID)"
    
    # Wait for DNS propagation
    log "Waiting 30 seconds for DNS propagation..."
    sleep 30

elif [[ "${1:-}" == "cleanup" ]]; then
    # 🧹 Remove DNS TXT record after validation
    if [[ -z "${CF_DNS_RECORD_ID:-}" ]]; then 
        error "DNS record ID not found"
    fi
    
    # Get Zone ID
    ZONE_ID=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN" \
        -H "Authorization: Bearer $CF_API_TOKEN" \
        -H "Content-Type: application/json" | jq -r '.result[0].id')
    
    # Delete TXT record
    log "Removing TXT record..."
    curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$CF_DNS_RECORD_ID" \
        -H "Authorization: Bearer $CF_API_TOKEN"
    log "✓ TXT record removed"

else
    # 🚀 Main function - Request certificate
    log "Requesting wildcard certificate for *.$DOMAIN"
    
    certbot certonly \
        --manual \
        --preferred-challenges dns \
        --manual-auth-hook   "$(realpath "$0") auth" \
        --manual-cleanup-hook "$(realpath "$0") cleanup" \
        -d "*.$DOMAIN" \
        -d "$DOMAIN" \
        --non-interactive \
        --agree-tos \
        --email admin@$DOMAIN
    
    log "✓ Certificate created successfully!"
    log "Certificate location: /etc/letsencrypt/live/$DOMAIN/"
fi

sudo /usr/local/bin/certbot-wildcard.sh