add standalone and webroot methods

Reviewed-on: #4

.drone.yml

@@ -0,0 +1,176 @@
+kind: pipeline
+type: docker
+name: build-release-images
+trigger:
+  event:
+    exclude:
+    - pull_request
+  ref:
+    - refs/tags/**
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+
+- name: get-tags
+  image: docker:git
+  commands:
+    - git fetch --tags
+  depends_on:
+    - clone
+
+- name: make-tags
+  image: node
+  commands:
+    - echo -n "${DRONE_TAG}, latest" > .tags
+  depends_on:
+    - get-tags
+
+- name: build-gitea
+  image: thegeeklab/drone-docker-buildx
+  privileged: true
+  settings:
+    provenance: false
+    registry: git.mrmeeb.stream
+    username: 
+      from_secret: docker_username
+    password: 
+      from_secret: docker_password
+    repo: git.mrmeeb.stream/mrmeeb/certbot-cron
+    platforms:
+      - linux/arm64
+      - linux/amd64
+  depends_on:
+    - make-tags
+
+- name: release-gitea
+  image: goreleaser/goreleaser
+  environment:
+    GITEA_TOKEN:
+      from_secret: gitea_token
+  commands:
+    - goreleaser release -f .goreleaser-gitea.yaml
+  depends_on:
+    - build-gitea
+
+- name: notify
+  image: plugins/slack
+  when:
+    status:
+    - success
+    - failure
+  settings:
+    webhook: 
+      from_secret: slack_webhook
+  depends_on:
+    - release-gitea
+
+---
+kind: pipeline
+type: docker
+name: build-main-images
+trigger:
+  event:
+    exclude:
+    - pull_request
+  ref:
+    - refs/heads/master
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+
+- name: make-tags
+  image: node
+  commands:
+    - echo -n "${DRONE_COMMIT_SHA:0:8}, latest" > .tags
+  when:
+    ref:
+      - refs/heads/master
+  depends_on:
+    - clone
+
+- name: build-gitea
+  image: thegeeklab/drone-docker-buildx
+  privileged: true
+  settings:
+    provenance: false
+    registry: git.mrmeeb.stream
+    username: 
+      from_secret: docker_username
+    password: 
+      from_secret: docker_password
+    repo: git.mrmeeb.stream/mrmeeb/certbot-cron
+    platforms:
+      - linux/arm64
+      - linux/amd64
+  depends_on:
+    - make-tags
+
+- name: notify
+  image: plugins/slack
+  when:
+    status:
+    - success
+    - failure
+  settings:
+    webhook: 
+      from_secret: slack_webhook
+  depends_on:
+    - build-gitea
+
+---
+kind: pipeline
+type: docker
+name: build-develop-images
+trigger:
+  event:
+    exclude:
+    - pull_request
+  branch:
+    - develop
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  # Set tags for develop branch - git commit SHA and 'develop'
+- name: make-tags
+  image: node
+  commands:
+    - echo -n "develop-${DRONE_COMMIT_SHA:0:8}, develop" > .tags
+   
+  # Build containers from develop branch
+- name: build-gitea
+  image: thegeeklab/drone-docker-buildx
+  privileged: true
+  settings:
+    provenance: false
+    registry: git.mrmeeb.stream
+    username: 
+      from_secret: docker_username
+    password: 
+      from_secret: docker_password
+    repo: git.mrmeeb.stream/mrmeeb/certbot-cron
+    platforms:
+      - linux/arm64
+      - linux/amd64
+  depends_on:
+    - make-tags
+
+- name: notify
+  image: plugins/slack
+  when:
+    status:
+    - success
+    - failure
+  settings:
+    webhook: 
+      from_secret: slack_webhook
+  depends_on:
+    - build-gitea

.gitignore

@@ -0,0 +1,2 @@
+dist-gitea/
+.tags

.goreleaser-gitea.yaml

@@ -0,0 +1,28 @@
+
+dist: dist-gitea
+
+build:
+  skip: true
+
+archives:
+- format: binary
+
+release:
+  draft: true
+  gitea:
+    owner: MrMeeb
+    name: certbot-cron-docker
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
+
+# .goreleaser.yaml
+gitea_urls:
+  api: https://git.mrmeeb.stream/api/v1
+  download: https://git.mrmeeb.stream
+  # set to true if you use a self-signed certificate
+  skip_tls_verify: false

Dockerfile

@@ -0,0 +1,71 @@
+FROM alpine:latest as base
+ARG TARGETARCH
+
+FROM base AS base-amd64
+ENV S6_OVERLAY_ARCH=x86_64
+
+FROM base AS base-arm64
+ENV S6_OVERLAY_ARCH=aarch64
+
+FROM base-${TARGETARCH}${TARGETVARIANT}
+
+ARG S6_OVERLAY_VERSION=3.1.5.0
+
+# Core variables
+ENV PUID=1000
+ENV PGID=1000
+ENV TZ=UTC
+ENV GENERATE_DHPARAM=true
+ENV INTERVAL="0 */6 * * *"
+
+# Single domain
+ENV DOMAINS=
+ENV EMAIL=
+ENV STAGING=false
+
+# Custom CA support
+ENV CUSTOM_CA=
+ENV CUSTOM_CA_SERVER=
+
+# Different plugin support (to support Cloudflare but also normal mode)
+ENV PLUGIN=standalone
+ENV PROPOGATION_TIME=10
+ENV CLOUDFLARE_TOKEN=
+
+## Multi-cert support
+ENV CERT_COUNT=1
+
+#Get required packages
+RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
+
+#Make folders
+RUN mkdir /config && \
+    mkdir /app && \
+#Create default user
+    useradd -u 1000 -U -d /config -s /bin/false mrmeeb && \
+    usermod -G users mrmeeb
+
+#Install s6-overlay
+RUN curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" | tar Jpxf - -C / && \
+    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${S6_OVERLAY_ARCH}.tar.xz" | tar Jpxf - -C / && \
+    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz" | tar Jpxf - -C / && \
+    curl -fsSL "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz" | tar Jpxf - -C /
+ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSITY=1
+
+RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
+
+#Get required packages for building, build, then cleanup
+RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
+    /app/certbot/bin/pip install certbot certbot-dns-cloudflare && \
+    ln -s /app/certbot/bin/certbot /usr/bin/certbot &&\
+    apk del .deps
+
+COPY root /
+
+RUN chmod +x /container-init.sh && \
+    chmod +x /certbot-prepare.sh && \
+    chmod +x /certbot-renew.sh && \
+    chown -R ${PUID}:${PGID} /app /config
+
+ENTRYPOINT [ "/init" ]
+

README.md

@@ -1,3 +1,114 @@
-# certbot-cron-docker
+# Certbot Cron Docker
 
-Docker container that runs certbot on a schedule to create and renew SSL certificates
+![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/master?label=latest&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge) ![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/develop?label=develop&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge)
+
+Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Supports standalone, webroot or Cloudflare methods. Automatic renewal attempt happens every 6 hours by default.
+
+## Tags
+
+|Tag    |Description|
+|-------|-----------|
+|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
+|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
+
+## Running
+
+### Docker CLI
+```
+docker run -d --name certbot \
+    -e EMAIL=admin@domain.com \
+    -e DOMAINS=domain.com \
+    -e PLUGIN=cloudflare \
+    -e CLOUDFLARE_TOKEN=123abc
+    -v ./certbot-cron:/config \
+    git.mrmeeb.stream/mrmeeb/certbot-cron:latest
+```
+
+### Docker Compose
+```
+version: "3"
+services:
+  certbot:
+    image: git.mrmeeb.stream/mrmeeb/certbot-cron:latest
+    container_name: certbot
+    restart: unless-stopped
+    volumes:
+      - ./certbot:/config
+    environment:
+      - EMAIL=admin@domain.com
+      - DOMAINS=domain.com,*.domain.com
+      - PLUGIN=cloudflare
+      - CLOUDFLARE_TOKEN=123abc
+```
+
+## Environment Variables:
+
+### Core Options:
+
+Core options to the container
+
+| Variable | Default | Description |
+| --- | --- | --- |
+|PUID    |int    |1000   |Sets the UID of the user certbot runs under |
+|PGID    |int    |1000   |Sets the GID of the user certbot runs under |
+|TZ      |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)    |UTC    |Sets the timezone of the container |
+| GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys |
+| INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax |
+| CERT_COUNT | 1 | How many certificates certbot will try to issue (more than 1 not yet implemented) |
+
+### Certificate Options
+
+These options apply when `CERT_COUNT` is `1`
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| EMAIL | None | Email address for renewal information & other communications |
+| DOMAINS | None | Domains to be included in the certificate. Comma separated list, no spaces. Wildcards supported |
+| STAGING | false (case-sensitive) | Uses the LetsEncrypt staging endpoint for testing - avoids the aggressive rate-limiting of the production endpoint. **Not supported when using a custom Certificate Authority.** |
+
+### Plugins
+
+Plugins that can used for issuing a certificate
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| PLUGIN | standalone | Options are `webroot`, `standalone`, or `cloudflare` |
+
+- `webroot` - relies on a webserver running on the FQDN for which you're trying to issue a certificate to serve validation files
+  - Requires the webserver's root directory to be mounted to the container as `/config/webroot`
+- `standalone` - certbot spawns a webserver on port 80 for validation
+  - Requires this container to be bound to port 80 on the host
+- `cloudflare` - Creates a TXT record with Cloudflare pointing to the domain you're requesting a certificate for
+  - Requires the domain you're requesting a certificate for to be entered in Cloudflare
+
+#### Cloudflare Plugin
+
+Options that affect the behaviour of certbot running with the Cloudflare plugin
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| PROPOGATION_TIME | 10 | The amount of time (seconds) that certbot waits for the TXT records to propogate to Cloudflare before verifying - the more domains in the certificate, the longer you might need |
+| CLOUDFLARE_TOKEN | null | Cloudflare token for verification |
+
+### Custom Certificate Authority
+
+Options to use a custom Certificate Authority, for example when issuing internal certificates
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| CUSTOM_CA | null | Name of the root certificate Certbot/ACME will trust requesting the certificate, e.g `root.pem`. **Must be placed in `/config/custom_ca`** |
+| CUSTOM_CA_SERVER | null | Custom server URL used by Certbot/ACME when requesting a certificate, e.g `https://ca.internal/acme/acme/directory` |
+
+## Volumes
+
+| Docker path | Purpose |
+| --- | --- |
+| /config | Stores configs and LetsEncrypt output for mounting in other containers
+| /config/custom_ca | Mountpoint for a custom Certificate Authority root certificate. **Required if `CUSTOM_CA` is set**
+| /config/webroot | Mountpoint for the webroot of a separate webserver. **Required if `PLUGIN=webroot` is set**
+
+## Ports
+
+| Port | Purpose |
+| --- | --- |
+| 80 | Used by ACME to verify domain ownership. **Required if `PLUGIN=standalone` is set**

root/certbot-prepare.sh

@@ -0,0 +1,208 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+#Creating needed folders and files if they don't already exist
+if [ ! -d /config/.secrets ]
+then
+    mkdir /config/.secrets
+fi
+
+if [ ! -d /config/letsencrypt ]
+then
+    mkdir /config/letsencrypt
+fi
+
+if [ ! -d /config/letsencrypt/keys ]
+then
+    mkdir /config/letsencrypt/keys
+fi
+
+if [ ! -d /config/logs ]
+then
+    mkdir /config/logs
+fi
+
+if [ ! -f /config/logs/renew.log ]
+then
+    touch /config/logs/renew.log
+fi
+
+if [ ! -f /config/.crontab.txt ]
+then
+    touch /config/.crontab.txt
+fi
+
+#Cleanup renew list and create it fresh, ready for commands to be run and added
+echo "#!/command/with-contenv bash" > /config/renew-list.sh
+echo "" >> /config/.renew-list.sh
+
+function single_domain {
+
+    if [ ! -z $CUSTOM_CA ]
+    then
+
+        echo "Using a custom CA for issuing certificates"
+
+        if [ ! -d /config/custom_ca ]
+        then
+            mkdir /config/custom_ca
+            echo "Please place your custom CA file into /config/custom_ca and restart the container"
+            exit 1
+        fi
+
+        if [ -z "$(ls -A /config/custom_ca)" ]
+        then
+            echo "The CUSTOM_CA option is populated, but the /config/custom_ca dir is empty. Please place your root certificate in this directory and restart the container"
+            exit 1
+        fi
+
+        if [ -z $CUSTOM_CA_SERVER ]
+        then
+            echo "CUSTOM_CA_SERVER has not been defined. It is required for using a custom CA to issue a certificate"
+            exit 1
+        fi
+
+        #REQUESTS_CA_BUNDLE=/config/custom_ca/$CUSTOM_CA
+
+        CUSTOM_CA_PATH=/config/custom_ca/$CUSTOM_CA
+        CUSTOM_CA_SERVER_OPT="--server $CUSTOM_CA_SERVER"
+
+        if [ $STAGING ]
+        then
+
+            echo "Staging is not supported when using a custom CA, so overriding. To remove this alert, set staging to false."
+
+            STAGING=false
+
+        fi
+
+    fi
+
+    BASE_COMMAND=(certbot certonly --non-interactive --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --key-path /config/letsencrypt/keys --expand --agree-tos $CUSTOM_CA_SERVER_OPT --email $EMAIL -d $DOMAINS)
+
+    ## Run with Cloudflare plugin
+    if [ $PLUGIN == "cloudflare" ]
+    then
+
+        echo "Using Cloudflare plugin"
+
+        if [ ! -f /config/.secrets/cloudflare.ini ]
+        then
+            touch /config/.secrets/cloudflare.ini
+        fi
+
+        if [ -n "$CLOUDFLARE_TOKEN" ]
+        then
+            echo "Cloudflare token is present"
+
+            echo "dns_cloudflare_api_token = $CLOUDFLARE_TOKEN" > /config/.secrets/cloudflare.ini
+
+        fi
+
+        if [ ! -s /config/.secrets/cloudflare.ini ]
+        then
+            echo "cloudflare.ini is empty - please add your Cloudflare credentials or API key before continuing. This can be done as an ENV var, or by editing the file directly"
+
+            exit 1
+        fi
+
+        #Securing cloudflare.ini to supress warnings
+        chmod 600 /config/.secrets/cloudflare.ini
+
+        echo "Creating certificates, or attempting to renew if they already exist"
+
+        if [ $STAGING = true ] 
+        then
+            echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
+            ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        elif [ $STAGING = false ]
+        then
+            echo "Using production endpoint"
+            ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        else
+            echo "Unrecognised option for STAGING variable - check your configuration"
+
+            exit 1
+        fi
+
+    ## Run with Standalone plugin
+    elif [ $PLUGIN == "standalone" ]
+    then
+
+        echo "Using HTTP verification via built-in web-server - please ensure port 80 is exposed."
+
+        if [ $STAGING = true ]
+        then
+            echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
+            REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        elif [ $STAGING = false ]
+        then
+            echo "Using production endpoint"
+            REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        else
+            echo "Unrecognised option for STAGING variable - check your configuration"
+
+            exit 1
+        fi
+
+    ## Run with webroot plugin
+    elif [ $PLUGIN == "webroot" ]
+    then
+
+        echo "Using HTTP verification via webroot - please ensure you have mounted a webroot at /config/webroot from a web-server reachable via the domain you are issuing a certificate for."
+
+        if [ $STAGING = true ]
+        then
+            echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
+            REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        elif [ $STAGING = false ]
+        then
+            echo "Using production endpoint"
+            REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot
+            # Add to renewal list
+            echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot" >> /config/renew-list.sh
+            echo "Creation/renewal attempt complete"
+        else
+            echo "Unrecognised option for STAGING variable - check your configuration"
+
+            exit 1
+        fi
+
+    else
+
+        echo "Unrecognised option for PLUGIN variable - check your configuration"
+
+    fi
+
+    if [ $GENERATE_DHPARAM = true ] && [ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]
+    then
+        echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys"
+        openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
+    fi
+
+    echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt
+
+    echo "Starting automatic renewal job. Schedule is $INTERVAL"
+    crontab /config/.crontab.txt
+
+}
+
+if [ $CERT_COUNT == 1 ] 
+then
+    single_domain
+fi

root/certbot-renew.sh

@@ -0,0 +1,6 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+echo ''
+date
+echo "Attempting to renew certificates"
+bash /config/.renew-list.sh

root/container-init.sh

@@ -0,0 +1,55 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+echo ""
+echo ""
+echo "================================================"
+echo "|      __  _______  __  ___________________    |" 
+echo "|     /  |/  / __ \/  |/  / ____/ ____/ __ )   |"
+echo "|    / /|_/ / /_/ / /|_/ / __/ / __/ / __  |   |"
+echo "|   / /  / / _, _/ /  / / /___/ /___/ /_/ /    |"
+echo "|  /_/  /_/_/ |_/_/  /_/_____/_____/_____/     |"
+echo "|                                              |"
+echo "================================================"
+echo ""
+echo "Initialising container"
+echo "
+----------------------------------------------------------------------
+ENVIRONMENT (only core variables shown)
+----------------------------------------------------------------------
+PUID=${PUID}
+PGID=${PGID}
+TZ=${TZ}
+INTERVAL=${INTERVAL}
+GENERATE_DHPARAM=${GENERATE_DHPARAM}
+CERT_COUNT=${CERT_COUNT}
+----------------------------------------------------------------------
+"
+
+#Setting UID and GID as configured
+if [[ ! "${PUID}" -eq 0 ]] && [[ ! "${PGID}" -eq 0 ]]; then
+    echo "Executing usermod..."
+    mkdir "/tmp/temphome"
+    usermod -d "/tmp/temphome" mrmeeb
+    usermod -o -u "${PUID}" mrmeeb
+    usermod -d /config mrmeeb
+    rm -rf "/tmp/temphome"
+    groupmod -o -g "${PGID}" mrmeeb
+else
+    echo "Running as root is not supported, please fix your PUID and PGID!"
+    sleep infinity
+fi
+
+echo "Checking permissions in /config and /app."
+
+if [ ! "$(stat -c %u /app)" -eq "${PUID}" ] || [ ! "$(stat -c %g /app)" -eq "${PGID}" ]
+then
+    echo "Fixing permissions for /app (this can take some time)."
+    chown -R mrmeeb:mrmeeb /app
+fi
+
+if [ ! "$(stat -c %u /config)" -eq "${PUID}" ] || [ ! "$(stat -c %g /config)" -eq "${PGID}" ]
+then
+    echo "Fixing permissions for /config (this can take some time)."
+    chown -R mrmeeb:mrmeeb /config
+fi

root/etc/s6-overlay/s6-rc.d/certbot-prepare/type

@@ -0,0 +1 @@
+oneshot

root/etc/s6-overlay/s6-rc.d/certbot-prepare/up

@@ -0,0 +1 @@
+exec s6-setuidgid mrmeeb /certbot-prepare.sh

root/etc/s6-overlay/s6-rc.d/container-init/type

@@ -0,0 +1 @@
+oneshot

root/etc/s6-overlay/s6-rc.d/container-init/up

@@ -0,0 +1 @@
+/container-init.sh

root/etc/s6-overlay/s6-rc.d/cron/finish

@@ -0,0 +1 @@
+echo "$e" > /run/s6-linux-init-container-results/exitcode

root/etc/s6-overlay/s6-rc.d/cron/run

@@ -0,0 +1,3 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+exec crond -f

root/etc/s6-overlay/s6-rc.d/cron/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/logs/finish

@@ -0,0 +1 @@
+echo "$e" > /run/s6-linux-init-container-results/exitcode

root/etc/s6-overlay/s6-rc.d/logs/run

@@ -0,0 +1,3 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+tail -fn 0 /config/logs/renew.log

root/etc/s6-overlay/s6-rc.d/logs/type

@@ -0,0 +1 @@
+longrun