.drone.yml

@@ -1,38 +1,21 @@
 kind: pipeline
 type: docker
-name: build-release-images
+name: build-multiarch-images
-trigger:
-  event:
-    exclude:
-    - pull_request
-  ref:
-    - refs/tags/**
 
 platform:
   os: linux
   arch: amd64
 
 steps:
-
-- name: get-tags
-  image: docker:git
-  commands:
-    - git fetch --tags
-  depends_on:
-    - clone
-
 - name: make-tags
   image: node
   commands:
-    - echo -n "${DRONE_TAG}, latest" > .tags
+    - echo -n "${DRONE_COMMIT_SHA:0:10}, latest" > .tags
-  depends_on:
-    - get-tags
 
-- name: build-gitea
+- name: build  
   image: thegeeklab/drone-docker-buildx
   privileged: true
   settings:
-    provenance: false
     registry: git.mrmeeb.stream
     username: 
       from_secret: docker_username
@@ -42,135 +25,16 @@ steps:
     platforms:
       - linux/arm64
       - linux/amd64
-  depends_on:
-    - make-tags
-
-- name: release-gitea
-  image: goreleaser/goreleaser
-  environment:
-    GITEA_TOKEN:
-      from_secret: gitea_token
-  commands:
-    - goreleaser release -f .goreleaser-gitea.yaml
-  depends_on:
-    - build-gitea
 
 - name: notify
   image: plugins/slack
-  when:
-    status:
-    - success
-    - failure
   settings:
     webhook: 
       from_secret: slack_webhook
-  depends_on:
-    - release-gitea
 
----
-kind: pipeline
-type: docker
-name: build-main-images
 trigger:
-  event:
-    exclude:
-    - pull_request
-  ref:
-    - refs/heads/master
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-
-- name: make-tags
-  image: node
-  commands:
-    - echo -n "${DRONE_COMMIT_SHA:0:8}, latest" > .tags
-  when:
-    ref:
-      - refs/heads/master
-  depends_on:
-    - clone
-
-- name: build-gitea
-  image: thegeeklab/drone-docker-buildx
-  privileged: true
-  settings:
-    provenance: false
-    registry: git.mrmeeb.stream
-    username: 
-      from_secret: docker_username
-    password: 
-      from_secret: docker_password
-    repo: git.mrmeeb.stream/mrmeeb/certbot-cron
-    platforms:
-      - linux/arm64
-      - linux/amd64
-  depends_on:
-    - make-tags
-
-- name: notify
-  image: plugins/slack
-  when:
-    status:
-    - success
-    - failure
-  settings:
-    webhook: 
-      from_secret: slack_webhook
-  depends_on:
-    - build-gitea
-
----
-kind: pipeline
-type: docker
-name: build-develop-images
-trigger:
-  event:
-    exclude:
-    - pull_request
   branch:
-    - develop
+    - master
-
+  event:
-platform:
+    exclude:
-  os: linux
+    - pull_request
-  arch: amd64
-
-steps:
-  # Set tags for develop branch - git commit SHA and 'develop'
-- name: make-tags
-  image: node
-  commands:
-    - echo -n "develop-${DRONE_COMMIT_SHA:0:8}, develop" > .tags
-   
-  # Build containers from develop branch
-- name: build-gitea
-  image: thegeeklab/drone-docker-buildx
-  privileged: true
-  settings:
-    provenance: false
-    registry: git.mrmeeb.stream
-    username: 
-      from_secret: docker_username
-    password: 
-      from_secret: docker_password
-    repo: git.mrmeeb.stream/mrmeeb/certbot-cron
-    platforms:
-      - linux/arm64
-      - linux/amd64
-  depends_on:
-    - make-tags
-
-- name: notify
-  image: plugins/slack
-  when:
-    status:
-    - success
-    - failure
-  settings:
-    webhook: 
-      from_secret: slack_webhook
-  depends_on:
-    - build-gitea

.gitignore

@@ -1,2 +0,0 @@
-dist-gitea/
-.tags

.goreleaser-gitea.yaml

@@ -1,28 +0,0 @@
-
-dist: dist-gitea
-
-build:
-  skip: true
-
-archives:
-- format: binary
-
-release:
-  draft: true
-  gitea:
-    owner: MrMeeb
-    name: certbot-cron-docker
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-      - '^docs:'
-      - '^test:'
-
-# .goreleaser.yaml
-gitea_urls:
-  api: https://git.mrmeeb.stream/api/v1
-  download: https://git.mrmeeb.stream
-  # set to true if you use a self-signed certificate
-  skip_tls_verify: false

Dockerfile

@@ -1,15 +1,17 @@
-FROM alpine:latest as base
+FROM debian:bullseye-slim
-ARG TARGETARCH
 
-FROM base AS base-amd64
+RUN apt update && apt install -y bash cron python3 python3-venv procps tini
-ENV S6_OVERLAY_ARCH=x86_64
 
-FROM base AS base-arm64
+RUN python3 -m venv /opt/certbot/ && /opt/certbot/bin/pip install --upgrade pip
-ENV S6_OVERLAY_ARCH=aarch64
 
-FROM base-${TARGETARCH}${TARGETVARIANT}
+RUN /opt/certbot/bin/pip install certbot certbot-dns-cloudflare && \
+    ln -s /opt/certbot/bin/certbot /usr/bin/certbot
 
-ARG S6_OVERLAY_VERSION=3.1.5.0
+RUN mkdir -p /config
+
+COPY run.sh / renew.sh /
+
+RUN chmod +x /run.sh /renew.sh
 
 ENV DOMAINS=
 ENV EMAIL=
@@ -17,38 +19,6 @@ ENV INTERVAL="0 */6 * * *"
 ENV STAGING=false
 ENV PROPOGATION_TIME=10
 ENV GENERATE_DHPARAM=true
-ENV TZ=UTC
-ENV PUID=1000
-ENV PGID=1000
 
-#Get required packages
+ENTRYPOINT ["/usr/bin/tini", "-s", "/run.sh"]
-RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
-
-#Make folders
-RUN mkdir /config && \
-    mkdir /app && \
-#Create default user
-    useradd -u 1000 -U -d /config -s /bin/false mrmeeb && \
-    usermod -G users mrmeeb
-
-#Install s6-overlay
-RUN curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar Jpxf - -C / && \
-    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar Jpxf - -C / && \
-    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz" | tar Jpxf - -C / && \
-    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz" | tar Jpxf - -C /
-ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSITY=1
-
-RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
-
-RUN /app/certbot/bin/pip install certbot certbot-dns-cloudflare && \
-    ln -s /app/certbot/bin/certbot /usr/bin/certbot
-
-COPY root /
-
-RUN chmod +x /container-init.sh && \
-    chmod +x /certbot-prepare.sh && \
-    chmod +x /certbot-renew.sh && \
-    chown -R ${PUID}:${PGID} /app /config
-
-ENTRYPOINT [ "/init" ]
 

README.md

@@ -1,15 +1,8 @@
 # Certbot Cron Docker
 
-![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/master?label=latest&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge) ![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/develop?label=develop&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge)
+[![Build Status](https://drone.mrmeeb.stream/api/badges/MrMeeb/certbot-cron-docker/status.svg)](https://drone.mrmeeb.stream/MrMeeb/certbot-cron-docker)
 
-Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours by default.
+Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Uses Cloudflare for DNS-01 verification. Automatic renewal attempt happens every 6 hours.
-
-## Tags
-
-|Tag    |Description|
-|-------|-----------|
-|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
-|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
 
 ## Running
 
@@ -41,16 +34,13 @@ services:
 
 | Variable | Default Value | Description |
 | --- | --- | --- |
-|PUID    |int    |1000   |Sets the UID of the user certbot runs under |
-|PGID    |int    |1000   |Sets the GID of the user certbot runs under |
-|TZ      |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)    |UTC    |Sets the timezone of the container |
 | EMAIL | None | Email address for renewal information & other communications |
 | DOMAINS | None | Domains to be included in the certificate. Comma separated list, no spaces. Wildcards supported |
 | INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax |
 | STAGING | false (case-sensitive) | Uses the LetsEncrypt staging endpoint for testing - avoids the aggressive rate-limiting of the production endpoint |
 | PROPOGATION_TIME | 10 | The amount of time (seconds) that certbot waits for the TXT records to propogate to Cloudflare before verifying - the more domains in the certificate, the longer you might need |
 | GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys |
-| CLOUDFLARE_TOKEN | N/A | Cloudflare token for verification |
+
 
 ## Volumes
 
@@ -58,6 +48,22 @@ services:
 | --- | --- |
 | /config | Stores configs and LetsEncrypt output for mounting in other containers
 
+## Building
+
+```
+git clone https://git.mrmeeb.stream/certbot-cron-docker
+
+cd certbot-cron-docker
+
+docker build -t certbot-cron .
+
+docker run -d --name certbot-cron \
+    -e EMAIL=admin@domain.com \
+    -e DOMAINS=domain.com \
+    -v /docker/certbot-cron:/config \
+    certbot-cron
+```
+
 ## Other
 
 Thanks to [this guy](https://stackoverflow.com/questions/63447441/docker-stop-for-crond-times-out) for explaining how to make cron actually shutdown when stopping the container.

renew.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+echo "Attempting to renew certificates"
+if [[ $STAGING = true ]] 
+then
+    echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
+    certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
+    echo "Renewal attempt complete"
+elif [[ $STAGING = false ]] 
+then
+    echo "Using production endpoint"
+    certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
+    echo "Renewal attempt complete"
+else
+    echo "Unrecognised option for STAGING variable - check your configuration"
+
+    exit 8
+fi

root/certbot-prepare.sh

@@ -1,85 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-#Creating needed folders and files if they don't already exist
-if [ ! -d /config/.secrets ]
-then
-    mkdir /config/.secrets
-fi
-
-if [ ! -d /config/letsencrypt ]
-then
-    mkdir /config/letsencrypt
-fi
-
-if [ ! -d /config/letsencrypt/keys ]
-then
-    mkdir /config/letsencrypt/keys
-fi
-
-if [ ! -d /config/logs ]
-then
-    mkdir /config/logs
-fi
-
-if [ ! -f /config/logs/renew.log ]
-then
-    touch /config/logs/renew.log
-fi
-
-if [ ! -f /config/.crontab.txt ]
-then
-    touch /config/.crontab.txt
-fi
-
-if [ ! -f /config/.secrets/cloudflare.ini ]
-then
-    touch /config/.secrets/cloudflare.ini
-fi
-
-if [ -n "$CLOUDFLARE_TOKEN" ]
-then
-    echo "Cloudflare token is present"
-
-    echo "dns_cloudflare_api_token = $CLOUDFLARE_TOKEN" >> /config/.secrets/cloudflare.ini
-
-fi
-
-if [ ! -s /config/.secrets/cloudflare.ini ]
-then
-    echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing. This can be done as an ENV var, or by editing the file directly"
-
-    exit 22
-fi
-
-#Securing cloudflare.ini to supress warnings
-chmod 600 /config/.secrets/cloudflare.ini
-
-echo "Creating certificates, or attempting to renew if they already exist"
-
-if [[ $STAGING = true ]] 
-then
-    echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
-    certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
-    echo "Creation/renewal attempt complete"
-elif [[ $STAGING = false ]] 
-then
-    echo "Using production endpoint"
-    certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
-    echo "Creation/renewal attempt complete"
-else
-    echo "Unrecognised option for STAGING variable - check your configuration"
-
-    exit 22
-fi
-
-if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
-then
-    echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
-    openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
-fi
-
-echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt
-
-echo "Starting automatic renewal job. Schedule is $INTERVAL"
-crontab /config/.crontab.txt

root/certbot-renew.sh

@@ -1,20 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-echo ''
-date
-echo "Attempting to renew certificates"
-if [[ $STAGING = true ]] 
-then
-    echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
-    certbot certonly --staging --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
-    echo "Renewal attempt complete"
-elif [[ $STAGING = false ]] 
-then
-    echo "Using production endpoint"
-    certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
-    echo "Renewal attempt complete"
-else
-    echo "Unrecognised option for STAGING variable - check your configuration"
-
-    exit 8
-fi

root/container-init.sh

@@ -1,58 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-echo ""
-echo ""
-echo "================================================"
-echo "|      __  _______  __  ___________________    |" 
-echo "|     /  |/  / __ \/  |/  / ____/ ____/ __ )   |"
-echo "|    / /|_/ / /_/ / /|_/ / __/ / __/ / __  |   |"
-echo "|   / /  / / _, _/ /  / / /___/ /___/ /_/ /    |"
-echo "|  /_/  /_/_/ |_/_/  /_/_____/_____/_____/     |"
-echo "|                                              |"
-echo "================================================"
-echo ""
-echo "Initialising container"
-echo "
-----------------------------------------------------------------------
-ENVIRONMENT
-----------------------------------------------------------------------
-PUID=${PUID}
-PGID=${PGID}
-TZ=${TZ}
-DOMAINS=${DOMAINS}
-EMAIL=${EMAIL}
-INTERVAL=${INTERVAL}
-STAGING=${STAGING}
-PROPOGATION_TIME=${PROPOGATION_TIME}
-GENERATE_DHPARAM=${GENERATE_DHPARAM}
-----------------------------------------------------------------------
-"
-
-#Setting UID and GID as configured
-if [[ ! "${PUID}" -eq 0 ]] && [[ ! "${PGID}" -eq 0 ]]; then
-    echo "Executing usermod..."
-    mkdir "/tmp/temphome"
-    usermod -d "/tmp/temphome" mrmeeb
-    usermod -o -u "${PUID}" mrmeeb
-    usermod -d /config mrmeeb
-    rm -rf "/tmp/temphome"
-    groupmod -o -g "${PGID}" mrmeeb
-else
-    echo "Running as root is not supported, please fix your PUID and PGID!"
-    exit 1
-fi
-
-echo "Checking permissions in /config and /app."
-
-if [ ! "$(stat -c %u /app)" -eq "${PUID}" ] || [ ! "$(stat -c %g /app)" -eq "${PGID}" ]
-then
-    echo "Fixing permissions for /app (this can take some time)."
-    chown -R mrmeeb:mrmeeb /app
-fi
-
-if [ ! "$(stat -c %u /config)" -eq "${PUID}" ] || [ ! "$(stat -c %g /config)" -eq "${PGID}" ]
-then
-    echo "Fixing permissions for /config (this can take some time)."
-    chown -R mrmeeb:mrmeeb /config
-fi

root/etc/s6-overlay/s6-rc.d/certbot-prepare/type

@@ -1 +0,0 @@
-oneshot

root/etc/s6-overlay/s6-rc.d/certbot-prepare/up

@@ -1 +0,0 @@
-exec s6-setuidgid mrmeeb /certbot-prepare.sh

root/etc/s6-overlay/s6-rc.d/container-init/type

@@ -1 +0,0 @@
-oneshot

root/etc/s6-overlay/s6-rc.d/container-init/up

@@ -1 +0,0 @@
-/container-init.sh

root/etc/s6-overlay/s6-rc.d/cron/finish

@@ -1 +0,0 @@
-echo "$e" > /run/s6-linux-init-container-results/exitcode

root/etc/s6-overlay/s6-rc.d/cron/run

@@ -1,3 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-exec crond -f

root/etc/s6-overlay/s6-rc.d/cron/type

@@ -1 +0,0 @@
-longrun

root/etc/s6-overlay/s6-rc.d/logs/finish

@@ -1 +0,0 @@
-echo "$e" > /run/s6-linux-init-container-results/exitcode

root/etc/s6-overlay/s6-rc.d/logs/run

@@ -1,3 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-tail -fn 0 /config/logs/renew.log

root/etc/s6-overlay/s6-rc.d/logs/type

@@ -1 +0,0 @@
-longrun

run.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+echo ""
+echo ""
+echo "================================================"
+echo "|      __  _______  __  ___________________    |" 
+echo "|     /  |/  / __ \/  |/  / ____/ ____/ __ )   |"
+echo "|    / /|_/ / /_/ / /|_/ / __/ / __/ / __  |   |"
+echo "|   / /  / / _, _/ /  / / /___/ /___/ /_/ /    |"
+echo "|  /_/  /_/_/ |_/_/  /_/_____/_____/_____/     |"
+echo "|                                              |"
+echo "================================================"
+echo ""
+echo ""
+                                         
+
+#Creating needed folders and files if they don't already exist
+if [ ! -d /config/.secrets ]
+then
+    mkdir /config/.secrets
+fi
+
+if [ ! -d /config/letsencrypt ]
+then
+    mkdir /config/letsencrypt
+fi
+
+if [ ! -f /config/.secrets/cloudflare.ini ]
+then
+    touch /config/.secrets/cloudflare.ini
+fi
+
+if [ ! -f /crontab.txt ]
+then
+    touch /crontab.txt
+fi
+
+if [ ! -s /config/.secrets/cloudflare.ini ]
+then
+    echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing"
+
+    exit 8
+fi
+
+#Securing cloudflare.ini to supress warnings
+chmod 600 /config/.secrets/cloudflare.ini
+
+#Outputting Environment Variables to /etc/environment for use by cron-based scripts
+env >> /etc/environment
+
+ln -s /config/letsencrypt /etc/letsencrypt
+
+echo "Domains being added to the certificate are "$DOMAINS
+
+echo "Propogation time is $PROPOGATION_TIME seconds"
+
+echo "Creating certificates, or attempting to renew if they already exist"
+
+if [[ $STAGING = true ]] 
+then
+    echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
+    certbot certonly --staging --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
+    echo "Creation/renewal attempt complete"
+elif [[ $STAGING = false ]] 
+then
+    echo "Using production endpoint"
+    certbot certonly --non-interactive --agree-tos --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --email $EMAIL -d $DOMAINS
+    echo "Creation/renewal attempt complete"
+else
+    echo "Unrecognised option for STAGING variable - check your configuration"
+
+    exit 8
+fi
+
+if [[ $GENERATE_DHPARAM = true ]] && [[ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]]
+then
+    echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
+    openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
+fi
+
+echo "$INTERVAL /renew.sh > /proc/1/fd/1 2>/proc/1/fd/2" > /crontab.txt
+
+echo "Starting automatic renewal job. Schedule is $INTERVAL"
+crontab /crontab.txt
+
+exec cron -f