__uacme*, __nginx: allow external ACME provider, EAB authentication

type/__nginx/man.rst

@@ -28,6 +28,16 @@ uacme-hookscript
   Custom hook passed to the __uacme_obtain type: useful to integrate the
   dns-01 challenge with third-party DNS providers.
 
+acme-url
+  ACMEv2 server directory object URL. Lets'Encrypt is used by default.
+
+acme-eab-credentials
+  Specify RFC8555 External Account Binding credentials according to
+  https://tools.ietf.org/html/rfc8555#section-7.3.4, in order to associate a new
+  ACME account with an existing account in a non-ACME system such as a CA
+  customer database. KEYID must be an ASCII string. KEY must be
+  base64url-encoded.
+
 EXAMPLES
 --------
 

type/__nginx/manifest

@@ -36,6 +36,20 @@ then
 	set_custom_uacme_hookscript="--hookscript $uacme_hookscript"
 fi
 
+set_custom_acme_url=
+if [ -f "${__object:?}/parameter/acme-url" ];
+then
+	custom_acme_url=$(cat "${__object:?}/parameter/acme-url")
+	set_custom_acme_url="--acme-url $custom_acme_url"
+fi
+
+set_acme_eab_credentials=
+if [ -f "${__object:?}/parameter/acme-eab-credentials" ];
+then
+	acme_eab_credentials=$(cat "${__object:?}/parameter/acme-eab-credentials")
+	set_acme_eab_credentials="--eab-credentials $acme_eab_credentials"
+fi
+
 # Deploy simple HTTP vhost, allowing to serve ACME challenges.
 __nginx_vhost "301-to-https-$domain" \
 	--domain "$domain" --altdomains "$altdomains" --to-https
@@ -46,12 +60,18 @@ if [ -f "${__object:?}/parameter/force-cert-ownership-to" ]; then
 	cert_ownership=$(cat "${__object:?}/parameter/force-cert-ownership-to")
 fi
 
-__uacme_account
+# shellcheck disable=SC2086
+__uacme_account \
+	$set_custom_acme_url \
+	$set_acme_eab_credentials \
+
 # shellcheck disable=SC2086
 require="__nginx_vhost/301-to-https-$domain __uacme_account" \
 	__uacme_obtain "$domain" \
 		--altdomains "$altdomains" \
 		$set_custom_uacme_hookscript \
+		$set_custom_acme_url \
+		$set_acme_eab_credentials \
 		--owner "$cert_ownership" \
 		--install-key-to "$nginx_certdir/$domain/privkey.pem" \
 		--install-cert-to "/$nginx_certdir/$domain/fullchain.pem" \

type/__nginx/parameter/optional

@@ -2,4 +2,6 @@ config
 domain
 altdomains
 uacme-hookscript
+acme-url
+acme-eab-credentials
 force-cert-ownership-to