Add setuptools for certbot dependencies

revert Update alpine Docker tag to v3.20.0

.gitea/workflows/build-develop.yaml

@@ -0,0 +1,88 @@
+name: Build Image
+on:
+  push:
+    branches:
+      - 'develop'
+
+env:
+  TEST_TAG: mrmeeb/certbot-cron:test
+  FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron:develop
+
+jobs:
+  "Validate Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    steps:
+      - name: Build locally
+        uses: docker/build-push-action@v5
+        with:
+          load: true
+          tags: ${{ env.TEST_TAG }}
+          provenance: false
+      - name: Test certificate issuing
+        id: test
+        run: |
+          # First create a volume
+          docker volume create ${{ gitea.sha }} && \
+          # Then issue a certificate
+          docker run --rm -v ${{ gitea.sha }}:/config -e STAGING=true -e EMAIL=${{ secrets.EMAIL }} -e DOMAINS=${{ gitea.sha }}.mrmeeb.stream -e PLUGIN=cloudflare -e CLOUDFLARE_TOKEN=${{ secrets.CLOUDFLARE_TOKEN }} -e ONE_SHOT=true -e GENERATE_DHPARAM=false ${{ env.TEST_TAG }} && \
+          # Then revoke it again
+          docker run --rm --entrypoint "/usr/bin/certbot" -v ${{ gitea.sha }}:/config ${{ env.TEST_TAG }} revoke --non-interactive --agree-tos --email ${{ secrets.EMAIL }} --staging --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --cert-path /config/letsencrypt/live/${{ gitea.sha }}.mrmeeb.stream/fullchain.pem          
+      - name: Tidy up
+        if: always()
+        run: |
+          echo "Removing docker volume ${{ gitea.sha }}" && \
+          docker volume rm ${{ gitea.sha }}          
+      - name: Test Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Test Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+  
+  "Publish Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image"]
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.mrmeeb.stream
+          username: ${{ env.GITHUB_ACTOR }}
+          password: ${{ secrets.GTCR_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ env.FULL_TAG }}
+          provenance: false
+      - name: Build Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Build Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+
+  "Notify":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image", "Publish Image"]
+    steps:
+      - name: Notify of success
+        uses: rjstone/discord-webhook-notify@v1
+        if: success()
+        with:
+          severity: info
+          details: Build succeeded!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}

Dockerfile

@@ -40,7 +40,7 @@ ENV CLOUDFLARE_TOKEN=
 ENV CERT_COUNT=1
 
 #Get required packages
-RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl logrotate
+RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
 
 #Make folders
 RUN mkdir /config && \
@@ -71,7 +71,9 @@ RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
 
 COPY root /
 
-RUN chmod +x /container-init.sh /certbot-prepare.sh /check-one-shot.sh /renew-function.sh && \
+RUN chmod +x /container-init.sh && \
+    chmod +x /certbot-prepare.sh && \
+    chmod +x /check-one-shot.sh && \
     chown -R ${PUID}:${PGID} /app /config
 
 ENTRYPOINT [ "/init" ]

README.md

@@ -4,9 +4,10 @@ Dockerised Certbot that utilises cron to schedule creating and renewing SSL cert
 
 ## Tags
 
-I use the [Feature Branch](https://www.atlassian.com/git/tutorials/comparing-workflows/feature-branch-workflow) workflow. The `latest` tag contains all of the latest changes that have been merged from individual feature branches. Feature branches are squashed into `master`.
-
-Pinned releases are created by creating a tag off `master` to capture the repo in a particular state. They are recommended for stability.
+|Tag    |Description|
+|-------|-----------|
+|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
+|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
 
 ## Running
 

root/certbot-prepare.sh

@@ -47,7 +47,7 @@ function better_exit {
 }
 
 # Check APPRISE_URL is set if either NOTIFY_ON_SUCCESS or NOTIFY_ON_FAILURE are set
-if [ "${NOTIFY_ON_SUCCESS}" = "true" ] || [ "${NOTIFY_ON_FAILURE}" = "true" ] && [ -z "${APPRISE_URL}" ]; then
+if [ ! -z "${NOTIFY_ON_SUCCESS}" ] || [ ! -z "${NOTIFY_ON_FAILURE}" ] && [ -z "${APPRISE_URL}" ]; then
 
     echo "You have notifications enabled but have not set APPRISE_URL. Please set APPRISE_URL and restart the container."
     better_exit
@@ -59,7 +59,33 @@ echo "#!/command/with-contenv bash
 
 date
 echo \"Attempting to renew certificates\"
-source /renew-function.sh
+function renew() {
+
+    #Variables:
+
+    #\$1 = Certbot command
+
+    RENEWAL_DOMAINS=\$(echo \$1 | sed -r 's/.*\s-d\s(\S*).*/\1/')
+    CUSTOM_CA_PATH=\$(echo \$1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\1/')
+    CERTBOT_COMMAND=\$(echo \$1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\2/')
+
+    echo \"Renewing certificate for \${RENEWAL_DOMAINS}\"
+
+    echo \"REQUESTS_CA_BUNDLE=\${CUSTOM_CA_PATH} \${CERTBOT_COMMAND}\" | bash
+
+    if [ \$? = 0 ]; then
+        echo \"Renewal attempt of certificate for \${RENEWAL_DOMAINS} succeeded\"
+        if [ \"\${NOTIFY_ON_SUCCESS}\" = \"true\" ]; then
+            apprise -b \"Renewal of certificate for \${RENEWAL_DOMAINS} succeeded\" \${APPRISE_URL}
+        fi
+    else
+        echo \"Renewal attempt of certificate for \${RENEWAL_DOMAINS} failed\"
+        if [ \"\${NOTIFY_ON_FAILURE}\" = \"true\" ]; then
+            apprise -b \"Renewal of certificate for \${RENEWAL_DOMAINS} failed\" \${APPRISE_URL}
+        fi
+    fi
+
+}
 " > /config/.renew-list.sh
 chmod +x /config/.renew-list.sh
 
@@ -786,8 +812,7 @@ if [ $ONE_SHOT == "true" ]; then
 
 elif [ $ONE_SHOT == "false" ]; then
 
-    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log
-    0 0 * * * logrotate -v --state /config/logs/logrotate.status /logrotate.conf" > /config/.crontab.txt
+    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log" > /config/.crontab.txt
 
     echo ""
 

root/logrotate.conf

@@ -1,15 +0,0 @@
-missingok
-
-/config/logs/letsencrypt.log {
-    daily
-    rotate 10
-    postrotate
-        find /config/logs -type f -regex '.*letsencrypt\.log\.\(.[2-9]\|[2-9].\|[1-9][0-9]\{2,\}\).*' -delete
-    endscript
-}
-
-/config/logs/renew.log {
-    rotate 5
-    size 100k
-    compress
-}

root/renew-function.sh

@@ -1,27 +0,0 @@
-function renew() {
-
-    #Variables:
-
-    #$1 = Certbot command
-
-    RENEWAL_DOMAINS=$(echo $1 | sed -r 's/.*\s-d\s(\S*).*/\1/')
-    CUSTOM_CA_PATH=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\1/')
-    CERTBOT_COMMAND=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\2/')
-
-    echo "Renewing certificate for ${RENEWAL_DOMAINS}"
-
-    echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH} ${CERTBOT_COMMAND}" | bash
-
-    if [ $? = 0 ]; then
-        echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} succeeded"
-        if [ "${NOTIFY_ON_SUCCESS}" = "true" ]; then
-            apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} succeeded" ${APPRISE_URL}
-        fi
-    else
-        echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} failed"
-        if [ "${NOTIFY_ON_FAILURE}" = "true" ]; then
-            apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} failed" ${APPRISE_URL}
-        fi
-    fi
-
-}