Add new env vars to readme

Installs apprise and allows config of alerting for successful or failed renewals. Currently only supports renewals, not inital issuing. Not necessarily a problem as I'd hope you'd be watching the logs on first run.
I don't love how I create /config/.renew-list.sh. I should readdress this somehow

.gitea/workflows/build-develop.yaml

@@ -0,0 +1,88 @@
+name: Build Image
+on:
+  push:
+    branches:
+      - 'develop'
+
+env:
+  TEST_TAG: mrmeeb/certbot-cron:test
+  FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron:develop
+
+jobs:
+  "Validate Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    steps:
+      - name: Build locally
+        uses: docker/build-push-action@v5
+        with:
+          load: true
+          tags: ${{ env.TEST_TAG }}
+          provenance: false
+      - name: Test certificate issuing
+        id: test
+        run: |
+          # First create a volume
+          docker volume create ${{ gitea.sha }} && \
+          # Then issue a certificate
+          docker run --rm -v ${{ gitea.sha }}:/config -e STAGING=true -e EMAIL=${{ secrets.EMAIL }} -e DOMAINS=${{ gitea.sha }}.mrmeeb.stream -e PLUGIN=cloudflare -e CLOUDFLARE_TOKEN=${{ secrets.CLOUDFLARE_TOKEN }} -e ONE_SHOT=true -e GENERATE_DHPARAM=false ${{ env.TEST_TAG }} && \
+          # Then revoke it again
+          docker run --rm --entrypoint "/usr/bin/certbot" -v ${{ gitea.sha }}:/config ${{ env.TEST_TAG }} revoke --non-interactive --agree-tos --email ${{ secrets.EMAIL }} --staging --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --cert-path /config/letsencrypt/live/${{ gitea.sha }}.mrmeeb.stream/fullchain.pem          
+      - name: Tidy up
+        if: always()
+        run: |
+          echo "Removing docker volume ${{ gitea.sha }}" && \
+          docker volume rm ${{ gitea.sha }}          
+      - name: Test Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Test Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+  
+  "Publish Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image"]
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.mrmeeb.stream
+          username: ${{ env.GITHUB_ACTOR }}
+          password: ${{ secrets.GTCR_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ env.FULL_TAG }}
+          provenance: false
+      - name: Build Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Build Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+
+  "Notify":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image", "Publish Image"]
+    steps:
+      - name: Notify of success
+        uses: rjstone/discord-webhook-notify@v1
+        if: success()
+        with:
+          severity: info
+          details: Build succeeded!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}

.gitea/workflows/test-pr.yaml

@@ -2,7 +2,7 @@ name: Test Pull Request
 on:
   pull_request:
     branches:
-      - 'master'
+      - 'main'
       - 'develop'
 
 env:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21.2 AS base
+FROM alpine:3.19.1 as base
 ARG TARGETARCH
 
 FROM base AS base-amd64
@@ -9,7 +9,7 @@ ENV S6_OVERLAY_ARCH=aarch64
 
 FROM base-${TARGETARCH}${TARGETVARIANT}
 
-ARG S6_OVERLAY_VERSION="3.2.0.2"
+ARG S6_OVERLAY_VERSION="3.1.6.2"
 
 # Core variables
 ENV PUID=1000
@@ -40,7 +40,7 @@ ENV CLOUDFLARE_TOKEN=
 ENV CERT_COUNT=1
 
 #Get required packages
-RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl logrotate
+RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
 
 #Make folders
 RUN mkdir /config && \
@@ -62,7 +62,7 @@ RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
 #Added additional pip steps to fix cython 3.0.0 issue - https://github.com/yaml/pyyaml/issues/601
 COPY requirements.txt /app/certbot/requirements.txt
 RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
-    /app/certbot/bin/pip install wheel setuptools && \
+    /app/certbot/bin/pip install wheel && \
     /app/certbot/bin/pip install "Cython<3.0" pyyaml --no-build-isolation && \
     /app/certbot/bin/pip install -r /app/certbot/requirements.txt && \
     ln -s /app/certbot/bin/certbot /usr/bin/certbot && \
@@ -71,7 +71,9 @@ RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
 
 COPY root /
 
-RUN chmod +x /container-init.sh /certbot-prepare.sh /check-one-shot.sh /renew-function.sh && \
+RUN chmod +x /container-init.sh && \
+    chmod +x /certbot-prepare.sh && \
+    chmod +x /check-one-shot.sh && \
     chown -R ${PUID}:${PGID} /app /config
 
 ENTRYPOINT [ "/init" ]

README.md

@@ -4,9 +4,10 @@ Dockerised Certbot that utilises cron to schedule creating and renewing SSL cert
 
 ## Tags
 
-I use the [Feature Branch](https://www.atlassian.com/git/tutorials/comparing-workflows/feature-branch-workflow) workflow. The `latest` tag contains all of the latest changes that have been merged from individual feature branches. Feature branches are squashed into `master`.
+|Tag    |Description|
-
+|-------|-----------|
-Pinned releases are created by creating a tag off `master` to capture the repo in a particular state. They are recommended for stability.
+|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
+|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
 
 ## Running
 

renovate.json

@@ -1,10 +1,9 @@
 {
     "extends": [":automergeMinor", ":automergePr", ":automergeRequireAllStatusChecks", ":dependencyDashboard", ":disableRateLimiting", ":rebaseStalePrs"],
-    "baseBranches": ["master"],
+    "baseBranches": ["main"],
     "major": {
         "dependencyDashboardApproval": true
     },
-    "minimumReleaseAge": "7 days",
     "customManagers": [
         {
         "customType": "regex",

requirements.txt

@@ -1,5 +1,5 @@
 # For pinning Python packages to then be parsed by Renovate
 
-certbot ==3.1.0
+certbot ==2.9.0
-certbot-dns-cloudflare ==3.1.0
+certbot-dns-cloudflare ==2.9.0
-apprise ==1.9.2
+apprise ==1.8.0

root/certbot-prepare.sh

@@ -47,7 +47,7 @@ function better_exit {
 }
 
 # Check APPRISE_URL is set if either NOTIFY_ON_SUCCESS or NOTIFY_ON_FAILURE are set
-if [ "${NOTIFY_ON_SUCCESS}" = "true" ] || [ "${NOTIFY_ON_FAILURE}" = "true" ] && [ -z "${APPRISE_URL}" ]; then
+if [ ! -z "${NOTIFY_ON_SUCCESS}" ] || [ ! -z "${NOTIFY_ON_FAILURE}" ] && [ -z "${APPRISE_URL}" ]; then
 
     echo "You have notifications enabled but have not set APPRISE_URL. Please set APPRISE_URL and restart the container."
     better_exit
@@ -59,7 +59,33 @@ echo "#!/command/with-contenv bash
 
 date
 echo \"Attempting to renew certificates\"
-source /renew-function.sh
+function renew() {
+
+    #Variables:
+
+    #\$1 = Certbot command
+
+    RENEWAL_DOMAINS=\$(echo \$1 | sed -r 's/.*\s-d\s(\S*).*/\1/')
+    CUSTOM_CA_PATH=\$(echo \$1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\1/')
+    CERTBOT_COMMAND=\$(echo \$1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\2/')
+
+    echo \"Renewing certificate for \${RENEWAL_DOMAINS}\"
+
+    echo \"REQUESTS_CA_BUNDLE=\${CUSTOM_CA_PATH} \${CERTBOT_COMMAND}\" | bash
+
+    if [ \$? = 0 ]; then
+        echo \"Renewal attempt of certificate for \${RENEWAL_DOMAINS} succeeded\"
+        if [ \"\${NOTIFY_ON_SUCCESS}\" = \"true\" ]; then
+            apprise -b \"Renewal of certificate for \${RENEWAL_DOMAINS} succeeded\" \${APPRISE_URL}
+        fi
+    else
+        echo \"Renewal attempt of certificate for \${RENEWAL_DOMAINS} failed\"
+        if [ \"\${NOTIFY_ON_FAILURE}\" = \"true\" ]; then
+            apprise -b \"Renewal of certificate for \${RENEWAL_DOMAINS} failed\" \${APPRISE_URL}
+        fi
+    fi
+
+}
 " > /config/.renew-list.sh
 chmod +x /config/.renew-list.sh
 
@@ -786,8 +812,7 @@ if [ $ONE_SHOT == "true" ]; then
 
 elif [ $ONE_SHOT == "false" ]; then
 
-    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log
+    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log" > /config/.crontab.txt
-    0 0 * * * logrotate -v --state /config/logs/logrotate.status /logrotate.conf" > /config/.crontab.txt
 
     echo ""
 

root/check-one-shot.sh

@@ -4,7 +4,6 @@
 if [ $ONE_SHOT == "true" ]; then
 
     # Cleanly kill container by sending kill signal to supervisor process
-    echo 0 > /run/s6-linux-init-container-results/exitcode
+    kill 1
-    /run/s6/basedir/bin/halt
 
 fi

root/etc/s6-overlay/s6-rc.d/cron/finish

@@ -1,9 +1 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-if [ $ONE_SHOT == "false" ]; then
-
-    # Export exit code if not a ONE_SHOT
 echo "$e" > /run/s6-linux-init-container-results/exitcode
-
-fi

root/etc/s6-overlay/s6-rc.d/logs/finish

@@ -1,9 +1 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-if [ $ONE_SHOT == "false" ]; then
-
-    # Export exit code if not a ONE_SHOT
 echo "$e" > /run/s6-linux-init-container-results/exitcode
-
-fi

root/logrotate.conf

@@ -1,15 +0,0 @@
-missingok
-
-/config/logs/letsencrypt.log {
-    daily
-    rotate 10
-    postrotate
-        find /config/logs -type f -regex '.*letsencrypt\.log\.\(.[2-9]\|[2-9].\|[1-9][0-9]\{2,\}\).*' -delete
-    endscript
-}
-
-/config/logs/renew.log {
-    rotate 5
-    size 100k
-    compress
-}

root/renew-function.sh

@@ -1,27 +0,0 @@
-function renew() {
-
-    #Variables:
-
-    #$1 = Certbot command
-
-    RENEWAL_DOMAINS=$(echo $1 | sed -r 's/.*\s-d\s(\S*).*/\1/')
-    CUSTOM_CA_PATH=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\1/')
-    CERTBOT_COMMAND=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\2/')
-
-    echo "Renewing certificate for ${RENEWAL_DOMAINS}"
-
-    echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH} ${CERTBOT_COMMAND}" | bash
-
-    if [ $? = 0 ]; then
-        echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} succeeded"
-        if [ "${NOTIFY_ON_SUCCESS}" = "true" ]; then
-            apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} succeeded" ${APPRISE_URL}
-        fi
-    else
-        echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} failed"
-        if [ "${NOTIFY_ON_FAILURE}" = "true" ]; then
-            apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} failed" ${APPRISE_URL}
-        fi
-    fi
-
-}