MrMeeb/certbot-cron-docker
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases 7 Wiki Activity

change to s6

Browse Source
This commit is contained in:
MrMeeb 2023-06-20 21:27:01 +00:00
parent e7bd87d5bd
commit a4b59c360e
26 changed files with 210 additions and 113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
Dockerfile
View File

@ -1,18 +1,15 @@
FROM alpine:latest as base
ARG TARGETARCH
RUN apt update && apt install -y bash cron python3 python3-venv procps tini
FROM base AS base-amd64
ENV S6_OVERLAY_ARCH=x86_64
RUN python3 -m venv /opt/certbot/ && /opt/certbot/bin/pip install --upgrade pip
FROM base AS base-arm64
ENV S6_OVERLAY_ARCH=aarch64
RUN /opt/certbot/bin/pip install certbot certbot-dns-cloudflare && \
ln -s /opt/certbot/bin/certbot /usr/bin/certbot
FROM base-${TARGETARCH}${TARGETVARIANT}
RUN mkdir -p /config
COPY run.sh / renew.sh /
RUN chmod +x /run.sh /renew.sh
ARG S6_OVERLAY_VERSION=3.1.5.0
ENV DOMAINS=
ENV EMAIL=
@ -27,5 +24,31 @@ ENV PGID=1000
#Get required packages
RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
ENTRYPOINT ["/usr/bin/tini", "-s", "/run.sh"]
#Make folders
RUN mkdir /config && \
mkdir /app && \
#Create default user
useradd -u 1000 -U -d /config -s /bin/false mrmeeb && \
usermod -G users mrmeeb
#Install s6-overlay
RUN curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar Jpxf - -C / && \
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar Jpxf - -C / && \
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz" | tar Jpxf - -C / && \
curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz" | tar Jpxf - -C /
ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSITY=1
RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
RUN /app/certbot/bin/pip install certbot certbot-dns-cloudflare && \
ln -s /app/certbot/bin/certbot /usr/bin/certbot
COPY root /
RUN chmod +x /container-init.sh && \
chmod +x /certbot-prepare.sh && \
chmod +x /certbot-renew.sh && \
chown -R ${PUID}:${PGID} /app /config
ENTRYPOINT [ "/init" ]

18
renew.sh
View File

@ -1,18 +0,0 @@
#!/bin/bash
echo "Attempting to renew certificates"
if [[ $STAGING = true ]]
then
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Renewal attempt complete"
elif [[ $STAGING = false ]]
then
echo "Using production endpoint"
certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Renewal attempt complete"
else
echo "Unrecognised option for STAGING variable - check your configuration"
exit 8
fi

85
root/certbot-prepare.sh Normal file
View File

@ -0,0 +1,85 @@
#!/command/with-contenv bash
# shellcheck shell=bash
#Creating needed folders and files if they don't already exist
if [ ! -d /config/.secrets ]
then
mkdir /config/.secrets
fi
if [ ! -d /config/letsencrypt ]
then
mkdir /config/letsencrypt
fi
if [ ! -d /config/letsencrypt/keys ]
then
mkdir /config/letsencrypt/keys
fi
if [ ! -d /config/logs ]
then
mkdir /config/logs
fi
if [ ! -f /config/logs/renew.log ]
then
touch /config/logs/renew.log
fi
if [ ! -f /config/.crontab.txt ]
then
touch /config/.crontab.txt
fi
if [ ! -f /config/.secrets/cloudflare.ini ]
then
touch /config/.secrets/cloudflare.ini
fi
if [ -n "$CLOUDFLARE_TOKEN" ]
then
echo "Cloudflare token is present"
echo "dns_cloudflare_api_token = $CLOUDFLARE_TOKEN" >> /config/.secrets/cloudflare.ini
fi
if [ ! -s /config/.secrets/cloudflare.ini ]
then
echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing. This can be done as an ENV var, or by editing the file directly"
exit 22
fi
#Securing cloudflare.ini to supress warnings
chmod 600 /config/.secrets/cloudflare.ini
echo "Creating certificates, or attempting to renew if they already exist"
if [[ $STAGING = true ]]
then
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Creation/renewal attempt complete"
elif [[ $STAGING = false ]]
then
echo "Using production endpoint"
certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Creation/renewal attempt complete"
else
echo "Unrecognised option for STAGING variable - check your configuration"
exit 22
fi
if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
then
echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
fi
echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt
echo "Starting automatic renewal job. Schedule is $INTERVAL"
crontab /config/.crontab.txt

20
root/certbot-renew.sh Normal file
View File

@ -0,0 +1,20 @@
#!/command/with-contenv bash
# shellcheck shell=bash
echo ''
date
echo "Attempting to renew certificates"
if [[ $STAGING = true ]]
then
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Renewal attempt complete"
elif [[ $STAGING = false ]]
then
echo "Using production endpoint"
certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Renewal attempt complete"
else
echo "Unrecognised option for STAGING variable - check your configuration"
exit 8
fi

58
root/container-init.sh Normal file
View File

@ -0,0 +1,58 @@
#!/command/with-contenv bash
# shellcheck shell=bash
echo ""
echo ""
echo "================================================"
echo "| __ _______ __ ___________________ |"
echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |"
echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |"
echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |"
echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |"
echo "| |"
echo "================================================"
echo ""
echo "Initialising container"
echo "
----------------------------------------------------------------------
ENVIRONMENT
----------------------------------------------------------------------
PUID=${PUID}
PGID=${PGID}
TZ=${TZ}
DOMAINS=${DOMAINS}
EMAIL=${EMAIL}
INTERVAL=${INTERVAL}
STAGING=${STAGING}
PROPOGATION_TIME=${PROPOGATION_TIME}
GENERATE_DHPARAM=${GENERATE_DHPARAM}
----------------------------------------------------------------------
"
#Setting UID and GID as configured
if [[ ! "${PUID}" -eq 0 ]] && [[ ! "${PGID}" -eq 0 ]]; then
echo "Executing usermod..."
mkdir "/tmp/temphome"
usermod -d "/tmp/temphome" mrmeeb
usermod -o -u "${PUID}" mrmeeb
usermod -d /config mrmeeb
rm -rf "/tmp/temphome"
groupmod -o -g "${PGID}" mrmeeb
else
echo "Running as root is not supported, please fix your PUID and PGID!"
exit 1
fi
echo "Checking permissions in /config and /app."
if [ ! "$(stat -c %u /app)" -eq "${PUID}" ] || [ ! "$(stat -c %g /app)" -eq "${PGID}" ]
then
echo "Fixing permissions for /app (this can take some time)."
chown -R mrmeeb:mrmeeb /app
fi
if [ ! "$(stat -c %u /config)" -eq "${PUID}" ] || [ ! "$(stat -c %g /config)" -eq "${PGID}" ]
then
echo "Fixing permissions for /config (this can take some time)."
chown -R mrmeeb:mrmeeb /config
fi

0
root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/base Normal file
View File

0
root/etc/s6-overlay/s6-rc.d/certbot-prepare/dependencies.d/container-init Normal file
View File

1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/type Normal file
View File

@ -0,0 +1 @@
oneshot

1
root/etc/s6-overlay/s6-rc.d/certbot-prepare/up Normal file
View File

@ -0,0 +1 @@
exec s6-setuidgid mrmeeb /certbot-prepare.sh

0
root/etc/s6-overlay/s6-rc.d/container-init/dependencies.d/base Normal file
View File

1
root/etc/s6-overlay/s6-rc.d/container-init/type Normal file
View File

@ -0,0 +1 @@
oneshot

1
root/etc/s6-overlay/s6-rc.d/container-init/up Normal file
View File

@ -0,0 +1 @@
/container-init.sh

0
root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/base Normal file
View File

0
root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/certbot-prepare Normal file
View File

1
root/etc/s6-overlay/s6-rc.d/cron/finish Normal file
View File

@ -0,0 +1 @@
echo "$e" > /run/s6-linux-init-container-results/exitcode

3
root/etc/s6-overlay/s6-rc.d/cron/run Normal file
View File

@ -0,0 +1,3 @@
#!/command/with-contenv bash
# shellcheck shell=bash
exec crond -f

1
root/etc/s6-overlay/s6-rc.d/cron/type Normal file
View File

@ -0,0 +1 @@
longrun

0
root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/base Normal file
View File

0
root/etc/s6-overlay/s6-rc.d/logs/dependencies.d/certbot-prepare Normal file
View File

1
root/etc/s6-overlay/s6-rc.d/logs/finish Normal file
View File

@ -0,0 +1 @@
echo "$e" > /run/s6-linux-init-container-results/exitcode

3
root/etc/s6-overlay/s6-rc.d/logs/run Normal file
View File

@ -0,0 +1,3 @@
#!/command/with-contenv bash
# shellcheck shell=bash
tail -fn 0 /config/logs/renew.log

1
root/etc/s6-overlay/s6-rc.d/logs/type Normal file
View File

@ -0,0 +1 @@
longrun

0
root/etc/s6-overlay/s6-rc.d/user/contents.d/certbot-prepare Normal file
View File

0
root/etc/s6-overlay/s6-rc.d/user/contents.d/cron Normal file
View File

0
root/etc/s6-overlay/s6-rc.d/user/contents.d/logs Normal file
View File

85
run.sh
View File

@ -1,85 +0,0 @@
#!/bin/bash
echo ""
echo ""
echo "================================================"
echo "| __ _______ __ ___________________ |"
echo "| / |/ / __ \/ |/ / ____/ ____/ __ ) |"
echo "| / /|_/ / /_/ / /|_/ / __/ / __/ / __ | |"
echo "| / / / / _, _/ / / / /___/ /___/ /_/ / |"
echo "| /_/ /_/_/ |_/_/ /_/_____/_____/_____/ |"
echo "| |"
echo "================================================"
echo ""
echo ""
#Creating needed folders and files if they don't already exist
if [ ! -d /config/.secrets ]
then
mkdir /config/.secrets
fi
if [ ! -d /config/letsencrypt ]
then
mkdir /config/letsencrypt
fi
if [ ! -f /config/.secrets/cloudflare.ini ]
then
touch /config/.secrets/cloudflare.ini
fi
if [ ! -f /crontab.txt ]
then
touch /crontab.txt
fi
if [ ! -s /config/.secrets/cloudflare.ini ]
then
echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing"
exit 8
fi
#Securing cloudflare.ini to supress warnings
chmod 600 /config/.secrets/cloudflare.ini
#Outputting Environment Variables to /etc/environment for use by cron-based scripts
env >> /etc/environment
ln -s /config/letsencrypt /etc/letsencrypt
echo "Domains being added to the certificate are "$DOMAINS
echo "Propogation time is $PROPOGATION_TIME seconds"
echo "Creating certificates, or attempting to renew if they already exist"
if [[ $STAGING = true ]]
then
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Creation/renewal attempt complete"
elif [[ $STAGING = false ]]
then
echo "Using production endpoint"
certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
echo "Creation/renewal attempt complete"
else
echo "Unrecognised option for STAGING variable - check your configuration"
exit 8
fi
if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
then
echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
fi
echo "$INTERVAL /renew.sh > /proc/1/fd/1 2>/proc/1/fd/2" > /crontab.txt
echo "Starting automatic renewal job. Schedule is $INTERVAL"
crontab /crontab.txt
exec cron -f