diff --git a/.drone.yml b/.drone.yml index 3d3c558..3fc571a 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1,21 +1,38 @@ kind: pipeline type: docker -name: build-multiarch-images +name: build-release-images +trigger: + event: + exclude: + - pull_request + ref: + - refs/tags/** platform: os: linux arch: amd64 steps: + +- name: get-tags + image: docker:git + commands: + - git fetch --tags + depends_on: + - clone + - name: make-tags image: node commands: - - echo -n "${DRONE_COMMIT_SHA:0:10}, latest" > .tags + - echo -n "${DRONE_TAG}, latest" > .tags + depends_on: + - get-tags -- name: build +- name: build-gitea image: thegeeklab/drone-docker-buildx privileged: true settings: + provenance: false registry: git.mrmeeb.stream username: from_secret: docker_username @@ -25,16 +42,135 @@ steps: platforms: - linux/arm64 - linux/amd64 + depends_on: + - make-tags + +- name: release-gitea + image: goreleaser/goreleaser + environment: + GITEA_TOKEN: + from_secret: gitea_token + commands: + - goreleaser release -f .goreleaser-gitea.yaml + depends_on: + - build-gitea - name: notify image: plugins/slack + when: + status: + - success + - failure settings: webhook: from_secret: slack_webhook + depends_on: + - release-gitea +--- +kind: pipeline +type: docker +name: build-main-images trigger: - branch: - - master event: exclude: - - pull_request \ No newline at end of file + - pull_request + ref: + - refs/heads/master + +platform: + os: linux + arch: amd64 + +steps: + +- name: make-tags + image: node + commands: + - echo -n "${DRONE_COMMIT_SHA:0:8}, latest" > .tags + when: + ref: + - refs/heads/master + depends_on: + - clone + +- name: build-gitea + image: thegeeklab/drone-docker-buildx + privileged: true + settings: + provenance: false + registry: git.mrmeeb.stream + username: + from_secret: docker_username + password: + from_secret: docker_password + repo: git.mrmeeb.stream/mrmeeb/certbot-cron + platforms: + - linux/arm64 + - linux/amd64 + depends_on: + - make-tags + +- name: notify + image: plugins/slack + when: + status: + - success + - failure + settings: + webhook: + from_secret: slack_webhook + depends_on: + - build-gitea + +--- +kind: pipeline +type: docker +name: build-develop-images +trigger: + event: + exclude: + - pull_request + branch: + - develop + +platform: + os: linux + arch: amd64 + +steps: + # Set tags for develop branch - git commit SHA and 'develop' +- name: make-tags + image: node + commands: + - echo -n "develop-${DRONE_COMMIT_SHA:0:8}, develop" > .tags + + # Build containers from develop branch +- name: build-gitea + image: thegeeklab/drone-docker-buildx + privileged: true + settings: + provenance: false + registry: git.mrmeeb.stream + username: + from_secret: docker_username + password: + from_secret: docker_password + repo: git.mrmeeb.stream/mrmeeb/certbot-cron + platforms: + - linux/arm64 + - linux/amd64 + depends_on: + - make-tags + +- name: notify + image: plugins/slack + when: + status: + - success + - failure + settings: + webhook: + from_secret: slack_webhook + depends_on: + - build-gitea \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a44aaa9 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +dist-gitea/ +.tags \ No newline at end of file diff --git a/.goreleaser-gitea.yaml b/.goreleaser-gitea.yaml new file mode 100644 index 0000000..e4e1962 --- /dev/null +++ b/.goreleaser-gitea.yaml @@ -0,0 +1,28 @@ + +dist: dist-gitea + +build: + skip: true + +archives: +- format: binary + +release: + draft: true + gitea: + owner: MrMeeb + name: certbot-cron-docker + +changelog: + sort: asc + filters: + exclude: + - '^docs:' + - '^test:' + +# .goreleaser.yaml +gitea_urls: + api: https://git.mrmeeb.stream/api/v1 + download: https://git.mrmeeb.stream + # set to true if you use a self-signed certificate + skip_tls_verify: false \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index eaa0775..d7c1b83 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,17 +1,15 @@ -FROM debian:bullseye-slim +FROM alpine:latest as base +ARG TARGETARCH -RUN apt update && apt install -y bash cron python3 python3-venv procps tini +FROM base AS base-amd64 +ENV S6_OVERLAY_ARCH=x86_64 -RUN python3 -m venv /opt/certbot/ && /opt/certbot/bin/pip install --upgrade pip +FROM base AS base-arm64 +ENV S6_OVERLAY_ARCH=aarch64 -RUN /opt/certbot/bin/pip install certbot certbot-dns-cloudflare && \ - ln -s /opt/certbot/bin/certbot /usr/bin/certbot +FROM base-${TARGETARCH}${TARGETVARIANT} -RUN mkdir -p /config - -COPY run.sh / renew.sh / - -RUN chmod +x /run.sh /renew.sh +ARG S6_OVERLAY_VERSION=3.1.5.0 ENV DOMAINS= ENV EMAIL= @@ -19,6 +17,42 @@ ENV INTERVAL="0 */6 * * *" ENV STAGING=false ENV PROPOGATION_TIME=10 ENV GENERATE_DHPARAM=true +ENV TZ=UTC +ENV PUID=1000 +ENV PGID=1000 +ENV CLOUDFLARE_TOKEN= -ENTRYPOINT ["/usr/bin/tini", "-s", "/run.sh"] +#Get required packages +RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl + +#Make folders +RUN mkdir /config && \ + mkdir /app && \ +#Create default user + useradd -u 1000 -U -d /config -s /bin/false mrmeeb && \ + usermod -G users mrmeeb + +#Install s6-overlay +RUN curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar Jpxf - -C / && \ + curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar Jpxf - -C / && \ + curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz" | tar Jpxf - -C / && \ + curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz" | tar Jpxf - -C / +ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSITY=1 + +RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip + +#Get required packages for building, build, then cleanup +RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \ + /app/certbot/bin/pip install certbot certbot-dns-cloudflare && \ + ln -s /app/certbot/bin/certbot /usr/bin/certbot &&\ + apk del .deps + +COPY root / + +RUN chmod +x /container-init.sh && \ + chmod +x /certbot-prepare.sh && \ + chmod +x /certbot-renew.sh && \ + chown -R ${PUID}:${PGID} /app /config + +ENTRYPOINT [ "/init" ] diff --git a/README.md b/README.md index 47818e8..c6cdc14 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,15 @@ # Certbot Cron Docker -[![Build Status](https://drone.mrmeeb.stream/api/badges/MrMeeb/certbot-cron-docker/status.svg)](https://drone.mrmeeb.stream/MrMeeb/certbot-cron-docker) +![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/master?label=latest&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge) ![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/develop?label=develop&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge) -Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours. +Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours by default. + +## Tags + +|Tag |Description| +|-------|-----------| +|latest |Latest image built from the main branch. Usually coincides with a tagged release.| +|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.| ## Running @@ -11,6 +18,7 @@ Dockerised Certbot that utilises cron to schedule creating and renewing SSL cert docker run -d --name certbot \ -e EMAIL=admin@domain.com \ -e DOMAINS=domain.com \ + -e CLOUDFLARE_TOKEN=123abc -v /docker/certbot-cron:/config \ git.mrmeeb.stream/mrmeeb/certbot-cron:latest ``` @@ -28,19 +36,23 @@ services: environment: - EMAIL=admin@domain.com - DOMAINS=domain.com,*.domain.com + - CLOUDFLARE_TOKEN=123abc ``` ## Environment Variables: | Variable | Default Value | Description | | --- | --- | --- | +|PUID |int |1000 |Sets the UID of the user certbot runs under | +|PGID |int |1000 |Sets the GID of the user certbot runs under | +|TZ |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) |UTC |Sets the timezone of the container | | EMAIL | None | Email address for renewal information & other communications | | DOMAINS | None | Domains to be included in the certificate. Comma separated list, no spaces. Wildcards supported | | INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax | | STAGING | false (case-sensitive) | Uses the LetsEncrypt staging endpoint for testing - avoids the aggressive rate-limiting of the production endpoint | | PROPOGATION_TIME | 10 | The amount of time (seconds) that certbot waits for the TXT records to propogate to Cloudflare before verifying - the more domains in the certificate, the longer you might need | | GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys | - +| CLOUDFLARE_TOKEN | N/A | Cloudflare token for verification | ## Volumes @@ -48,22 +60,6 @@ services: | --- | --- | | /config | Stores configs and LetsEncrypt output for mounting in other containers -## Building - -``` -git clone https://git.mrmeeb.stream/certbot-cron-docker - -cd certbot-cron-docker - -docker build -t certbot-cron . - -docker run -d --name certbot-cron \ - -e EMAIL=admin@domain.com \ - -e DOMAINS=domain.com \ - -v /docker/certbot-cron:/config \ - certbot-cron -``` - ## Other Thanks to [this guy](https://stackoverflow.com/questions/63447441/docker-stop-for-crond-times-out) for explaining how to make cron actually shutdown when stopping the container. \ No newline at end of file diff --git a/renew.sh b/renew.sh deleted file mode 100644 index db27d7c..0000000 --- a/renew.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -echo "Attempting to renew certificates" -if [[ $STAGING = true ]] -then - echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" - certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS - echo "Renewal attempt complete" -elif [[ $STAGING = false ]] -then - echo "Using production endpoint" - certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS - echo "Renewal attempt complete" -else - echo "Unrecognised option for STAGING variable - check your configuration" - - exit 8 -fi \ No newline at end of file diff --git a/root/certbot-prepare.sh b/root/certbot-prepare.sh new file mode 100644 index 0000000..d7c6437 --- /dev/null +++ b/root/certbot-prepare.sh @@ -0,0 +1,85 @@ +#!/command/with-contenv bash +# shellcheck shell=bash + +#Creating needed folders and files if they don't already exist +if [ ! -d /config/.secrets ] +then + mkdir /config/.secrets +fi + +if [ ! -d /config/letsencrypt ] +then + mkdir /config/letsencrypt +fi + +if [ ! -d /config/letsencrypt/keys ] +then + mkdir /config/letsencrypt/keys +fi + +if [ ! -d /config/logs ] +then + mkdir /config/logs +fi + +if [ ! -f /config/logs/renew.log ] +then + touch /config/logs/renew.log +fi + +if [ ! -f /config/.crontab.txt ] +then + touch /config/.crontab.txt +fi + +if [ ! -f /config/.secrets/cloudflare.ini ] +then + touch /config/.secrets/cloudflare.ini +fi + +if [ -n "$CLOUDFLARE_TOKEN" ] +then + echo "Cloudflare token is present" + + echo "dns_cloudflare_api_token = $CLOUDFLARE_TOKEN" > /config/.secrets/cloudflare.ini + +fi + +if [ ! -s /config/.secrets/cloudflare.ini ] +then + echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing. This can be done as an ENV var, or by editing the file directly" + + exit 22 +fi + +#Securing cloudflare.ini to supress warnings +chmod 600 /config/.secrets/cloudflare.ini + +echo "Creating certificates, or attempting to renew if they already exist" + +if [[ $STAGING = true ]] +then + echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" + certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS + echo "Creation/renewal attempt complete" +elif [[ $STAGING = false ]] +then + echo "Using production endpoint" + certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS + echo "Creation/renewal attempt complete" +else + echo "Unrecognised option for STAGING variable - check your configuration" + + exit 22 +fi + +if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]] +then + echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys" + openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096 +fi + +echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt + +echo "Starting automatic renewal job. Schedule is $INTERVAL" +crontab /config/.crontab.txt \ No newline at end of file diff --git a/root/certbot-renew.sh b/root/certbot-renew.sh new file mode 100644 index 0000000..485a0d5 --- /dev/null +++ b/root/certbot-renew.sh @@ -0,0 +1,20 @@ +#!/command/with-contenv bash +# shellcheck shell=bash +echo '' +date +echo "Attempting to renew certificates" +if [[ $STAGING = true ]] +then + echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" + certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS + echo "Renewal attempt complete" +elif [[ $STAGING = false ]] +then + echo "Using production endpoint" + certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS + echo "Renewal attempt complete" +else + echo "Unrecognised option for STAGING variable - check your configuration" + + exit 8 +fi \ No newline at end of file diff --git a/root/container-init.sh b/root/container-init.sh new file mode 100644 index 0000000..1f4fe54 --- /dev/null +++ b/root/container-init.sh @@ -0,0 +1,59 @@ +#!/command/with-contenv bash +# shellcheck shell=bash + +echo "" +echo "" +echo "================================================" +echo "| __ _______ __ ___________________ |" +echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |" +echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |" +echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |" +echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |" +echo "| |" +echo "================================================" +echo "" +echo "Initialising container" +echo " +---------------------------------------------------------------------- +ENVIRONMENT +---------------------------------------------------------------------- +PUID=${PUID} +PGID=${PGID} +TZ=${TZ} +DOMAINS=${DOMAINS} +EMAIL=${EMAIL} +INTERVAL=${INTERVAL} +STAGING=${STAGING} +PROPOGATION_TIME=${PROPOGATION_TIME} +GENERATE_DHPARAM=${GENERATE_DHPARAM} +CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN} +---------------------------------------------------------------------- +" + +#Setting UID and GID as configured +if [[ ! "${PUID}" -eq 0 ]] && [[ ! "${PGID}" -eq 0 ]]; then + echo "Executing usermod..." + mkdir "/tmp/temphome" + usermod -d "/tmp/temphome" mrmeeb + usermod -o -u "${PUID}" mrmeeb + usermod -d /config mrmeeb + rm -rf "/tmp/temphome" + groupmod -o -g "${PGID}" mrmeeb +else + echo "Running as root is not supported, please fix your PUID and PGID!" + exit 1 +fi + +echo "Checking permissions in /config and /app." + +if [ ! "$(stat -c %u /app)" -eq "${PUID}" ] || [ ! "$(stat -c %g /app)" -eq "${PGID}" ] +then + echo "Fixing permissions for /app (this can take some time)." + chown -R mrmeeb:mrmeeb /app +fi + +if [ ! "$(stat -c %u /config)" -eq "${PUID}" ] || [ ! "$(stat -c %g /config)" -eq "${PGID}" ] +then + echo "Fixing permissions for /config (this can take some time)." + chown -R mrmeeb:mrmeeb /config +fi \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/base b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/base new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/container-init b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/container-init new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/certbot-prepare/type b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/type new file mode 100644 index 0000000..3d92b15 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/type @@ -0,0 +1 @@ +oneshot \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/certbot-prepare/up b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/up new file mode 100644 index 0000000..9ba4be2 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/certbot-prepare/up @@ -0,0 +1 @@ +exec s6-setuidgid mrmeeb /certbot-prepare.sh \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/container-init/dependencies.d/base b/root/etc/s6-overlay/s6-rc.d/container-init/dependencies.d/base new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/container-init/type b/root/etc/s6-overlay/s6-rc.d/container-init/type new file mode 100644 index 0000000..3d92b15 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/container-init/type @@ -0,0 +1 @@ +oneshot \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/container-init/up b/root/etc/s6-overlay/s6-rc.d/container-init/up new file mode 100644 index 0000000..7682227 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/container-init/up @@ -0,0 +1 @@ +/container-init.sh \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/base b/root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/base new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/certbot-prepare b/root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/certbot-prepare new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/cron/finish b/root/etc/s6-overlay/s6-rc.d/cron/finish new file mode 100644 index 0000000..767f815 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/cron/finish @@ -0,0 +1 @@ +echo "$e" > /run/s6-linux-init-container-results/exitcode \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/cron/run b/root/etc/s6-overlay/s6-rc.d/cron/run new file mode 100644 index 0000000..c44da0d --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/cron/run @@ -0,0 +1,3 @@ +#!/command/with-contenv bash +# shellcheck shell=bash +exec crond -f \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/cron/type b/root/etc/s6-overlay/s6-rc.d/cron/type new file mode 100644 index 0000000..1780f9f --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/cron/type @@ -0,0 +1 @@ +longrun \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/base b/root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/base new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/certbot-prepare b/root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/certbot-prepare new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/logs/finish b/root/etc/s6-overlay/s6-rc.d/logs/finish new file mode 100644 index 0000000..767f815 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/logs/finish @@ -0,0 +1 @@ +echo "$e" > /run/s6-linux-init-container-results/exitcode \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/logs/run b/root/etc/s6-overlay/s6-rc.d/logs/run new file mode 100644 index 0000000..b997bcc --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/logs/run @@ -0,0 +1,3 @@ +#!/command/with-contenv bash +# shellcheck shell=bash +tail -fn 0 /config/logs/renew.log \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/logs/type b/root/etc/s6-overlay/s6-rc.d/logs/type new file mode 100644 index 0000000..1780f9f --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/logs/type @@ -0,0 +1 @@ +longrun \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/certbot-prepare b/root/etc/s6-overlay/s6-rc.d/user/contents.d/certbot-prepare new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/cron b/root/etc/s6-overlay/s6-rc.d/user/contents.d/cron new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/logs b/root/etc/s6-overlay/s6-rc.d/user/contents.d/logs new file mode 100644 index 0000000..e69de29 diff --git a/run.sh b/run.sh deleted file mode 100644 index 49b8dc9..0000000 --- a/run.sh +++ /dev/null @@ -1,85 +0,0 @@ -#!/bin/bash -echo "" -echo "" -echo "================================================" -echo "| __ _______ __ ___________________ |" -echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |" -echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |" -echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |" -echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |" -echo "| |" -echo "================================================" -echo "" -echo "" - - -#Creating needed folders and files if they don't already exist -if [ ! -d /config/.secrets ] -then - mkdir /config/.secrets -fi - -if [ ! -d /config/letsencrypt ] -then - mkdir /config/letsencrypt -fi - -if [ ! -f /config/.secrets/cloudflare.ini ] -then - touch /config/.secrets/cloudflare.ini -fi - -if [ ! -f /crontab.txt ] -then - touch /crontab.txt -fi - -if [ ! -s /config/.secrets/cloudflare.ini ] -then - echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing" - - exit 8 -fi - -#Securing cloudflare.ini to supress warnings -chmod 600 /config/.secrets/cloudflare.ini - -#Outputting Environment Variables to /etc/environment for use by cron-based scripts -env >> /etc/environment - -ln -s /config/letsencrypt /etc/letsencrypt - -echo "Domains being added to the certificate are "$DOMAINS - -echo "Propogation time is $PROPOGATION_TIME seconds" - -echo "Creating certificates, or attempting to renew if they already exist" - -if [[ $STAGING = true ]] -then - echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" - certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS - echo "Creation/renewal attempt complete" -elif [[ $STAGING = false ]] -then - echo "Using production endpoint" - certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS - echo "Creation/renewal attempt complete" -else - echo "Unrecognised option for STAGING variable - check your configuration" - - exit 8 -fi - -if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]] -then - echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys" - openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096 -fi - -echo "$INTERVAL /renew.sh > /proc/1/fd/1 2>/proc/1/fd/2" > /crontab.txt - -echo "Starting automatic renewal job. Schedule is $INTERVAL" -crontab /crontab.txt - -exec cron -f \ No newline at end of file