MrMeeb/certbot-cron-docker
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases 7 Wiki Activity

Compare commits

base: MrMeeb:master
Branches Tags
MrMeeb:master
MrMeeb:renovate/major-certbot
MrMeeb:fix/build-failure
MrMeeb:1.3.0
MrMeeb:1.2.1
MrMeeb:1.2.0
MrMeeb:1.1.2
MrMeeb:1.1.1
MrMeeb:1.1.0
MrMeeb:1.0.0
..
compare: MrMeeb:1.1.0
Branches Tags
MrMeeb:renovate/major-certbot
MrMeeb:master
MrMeeb:fix/build-failure
MrMeeb:1.3.0
MrMeeb:1.2.1
MrMeeb:1.2.0
MrMeeb:1.1.2
MrMeeb:1.1.1
MrMeeb:1.1.0
MrMeeb:1.0.0

No commits in common. "master" and "1.1.0" have entirely different histories.
master ... 1.1.0

22 changed files with 220 additions and 411 deletions
Show Stats Expand all files Collapse all files

176
.drone.yml Normal file
View File

@ -0,0 +1,176 @@
kind: pipeline
type: docker
name: build-release-images
trigger:
event:
exclude:
- pull_request
ref:
- refs/tags/**
platform:
os: linux
arch: amd64
steps:
- name: get-tags
image: docker:git
commands:
- git fetch --tags
depends_on:
- clone
- name: make-tags
image: node
commands:
- echo -n "${DRONE_TAG}, latest" > .tags
depends_on:
- get-tags
- name: build-gitea
image: thegeeklab/drone-docker-buildx
privileged: true
settings:
provenance: false
registry: git.mrmeeb.stream
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.mrmeeb.stream/mrmeeb/certbot-cron
platforms:
- linux/arm64
- linux/amd64
depends_on:
- make-tags
- name: release-gitea
image: goreleaser/goreleaser
environment:
GITEA_TOKEN:
from_secret: gitea_token
commands:
- goreleaser release -f .goreleaser-gitea.yaml
depends_on:
- build-gitea
- name: notify
image: plugins/slack
when:
status:
- success
- failure
settings:
webhook:
from_secret: slack_webhook
depends_on:
- release-gitea
---
kind: pipeline
type: docker
name: build-main-images
trigger:
event:
exclude:
- pull_request
ref:
- refs/heads/master
platform:
os: linux
arch: amd64
steps:
- name: make-tags
image: node
commands:
- echo -n "${DRONE_COMMIT_SHA:0:8}, latest" > .tags
when:
ref:
- refs/heads/master
depends_on:
- clone
- name: build-gitea
image: thegeeklab/drone-docker-buildx
privileged: true
settings:
provenance: false
registry: git.mrmeeb.stream
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.mrmeeb.stream/mrmeeb/certbot-cron
platforms:
- linux/arm64
- linux/amd64
depends_on:
- make-tags
- name: notify
image: plugins/slack
when:
status:
- success
- failure
settings:
webhook:
from_secret: slack_webhook
depends_on:
- build-gitea
---
kind: pipeline
type: docker
name: build-develop-images
trigger:
event:
exclude:
- pull_request
branch:
- develop
platform:
os: linux
arch: amd64
steps:
# Set tags for develop branch - git commit SHA and 'develop'
- name: make-tags
image: node
commands:
- echo -n "develop-${DRONE_COMMIT_SHA:0:8}, develop" > .tags
# Build containers from develop branch
- name: build-gitea
image: thegeeklab/drone-docker-buildx
privileged: true
settings:
provenance: false
registry: git.mrmeeb.stream
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.mrmeeb.stream/mrmeeb/certbot-cron
platforms:
- linux/arm64
- linux/amd64
depends_on:
- make-tags
- name: notify
image: plugins/slack
when:
status:
- success
- failure
settings:
webhook:
from_secret: slack_webhook
depends_on:
- build-gitea

91
.gitea/workflows/build-main.yaml
View File

@ -1,91 +0,0 @@
name: Build Image
on:
push:
branches:
- 'master'
env:
TEST_TAG: mrmeeb/certbot-cron:test
FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron:latest
jobs:
"Validate Image":
runs-on: [ubuntu-docker-latest, linux/amd64]
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Build locally
uses: docker/build-push-action@v5
with:
context: .
load: true
tags: ${{ env.TEST_TAG }}
provenance: false
- name: Test certificate issuing
id: test
run: |
# First create a volume
docker volume create ${{ gitea.sha }} && \
# Then issue a certificate
docker run --rm -v ${{ gitea.sha }}:/config -e STAGING=true -e EMAIL=${{ secrets.EMAIL }} -e DOMAINS=${{ gitea.sha }}.mrmeeb.stream -e PLUGIN=cloudflare -e CLOUDFLARE_TOKEN=${{ secrets.CLOUDFLARE_TOKEN }} -e ONE_SHOT=true -e GENERATE_DHPARAM=false ${{ env.TEST_TAG }} && \
# Then revoke it again
docker run --rm --entrypoint "/usr/bin/certbot" -v ${{ gitea.sha }}:/config ${{ env.TEST_TAG }} revoke --non-interactive --agree-tos --email ${{ secrets.EMAIL }} --staging --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --cert-path /config/letsencrypt/live/${{ gitea.sha }}.mrmeeb.stream/fullchain.pem
- name: Tidy up
if: always()
run: |
echo "Removing docker volume ${{ gitea.sha }}" && \
docker volume rm ${{ gitea.sha }}
- name: Test Failure
uses: rjstone/discord-webhook-notify@v1
if: failure()
with:
severity: error
details: Test Failed!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}
"Publish Image":
runs-on: [ubuntu-docker-latest, linux/amd64]
needs: ["Validate Image"]
steps:
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Gitea Container Registry
uses: docker/login-action@v3
with:
registry: git.mrmeeb.stream
username: ${{ env.GITHUB_ACTOR }}
password: ${{ secrets.GTCR_TOKEN }}
- name: Build and push
uses: docker/build-push-action@v5
with:
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ env.FULL_TAG }}
provenance: false
- name: Build Failure
uses: rjstone/discord-webhook-notify@v1
if: failure()
with:
severity: error
details: Build Failed!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}
"Notify":
runs-on: [ubuntu-docker-latest, linux/amd64]
needs: ["Validate Image", "Publish Image"]
steps:
- name: Notify of success
uses: rjstone/discord-webhook-notify@v1
if: success()
with:
severity: info
details: Build succeeded!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}

80
.gitea/workflows/build-tagged-release.yaml
View File

@ -1,80 +0,0 @@
name: Build Tagged Release Image
on:
push:
tags:
- '*'
env:
FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron
jobs:
"Build Image":
runs-on: [ubuntu-docker-latest, linux/amd64]
steps:
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Gitea Container Registry
uses: docker/login-action@v3
with:
registry: git.mrmeeb.stream
username: ${{ env.GITHUB_ACTOR }}
password: ${{ secrets.GTCR_TOKEN }}
- name: Docker metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.FULL_TAG }}
tags: |
type=pep440,pattern={{version}}
- name: Build and push
uses: docker/build-push-action@v5
with:
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
provenance: false
- name: Notify on failure
uses: rjstone/discord-webhook-notify@v1
if: failure()
with:
severity: error
details: Build failed!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}
"Create Release":
runs-on: ubuntu-latest
needs: ["Build Image"]
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Go
uses: actions/setup-go@v4
with:
go-version: 1.24.2
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v5
with:
distribution: goreleaser
version: latest
args: release --clean -f .goreleaser-gitea.yaml
env:
GITEA_TOKEN: ${{ secrets.GORELEASER_TOKEN }}
"Notify":
runs-on: [ubuntu-docker-latest, linux/amd64]
needs: ["Build Image", "Create Release"]
steps:
- name: Notify of success
uses: rjstone/discord-webhook-notify@v1
if: success()
with:
severity: info
details: Build succeeded!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}

47
.gitea/workflows/test-pr.yaml
View File

@ -1,47 +0,0 @@
name: Test Pull Request
on:
pull_request:
branches:
- 'master'
- 'develop'
env:
FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron:develop
jobs:
"Build Image":
runs-on: [ubuntu-docker-latest, linux/amd64]
steps:
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build
uses: docker/build-push-action@v5
with:
push: false
platforms: linux/amd64,linux/arm64
tags: ${{ env.FULL_TAG }}
provenance: false
- name: Notify on failure
uses: rjstone/discord-webhook-notify@v1
if: failure()
with:
severity: error
details: Build failed!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}
"Notify":
runs-on: [ubuntu-docker-latest, linux/amd64]
needs: ["Build Image"]
steps:
- name: Notify of success
uses: rjstone/discord-webhook-notify@v1
if: success()
with:
severity: info
details: Build succeeded!
webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
username: Gitea
avatarUrl: ${{ vars.RUNNER_ICON_URL }}

11
.goreleaser-gitea.yaml
View File

@ -1,21 +1,14 @@
dist: dist-gitea dist: dist-gitea
builds: build:
- skip: true skip: true
archives: archives:
- format: binary - format: binary
release: release:
draft: true draft: true
header: |
# Certbot Cron v{{ .Tag }}
## Docker Image:
`git.mrmeeb.stream/mrmeeb/certbot-cron:{{ .Tag }}`
gitea: gitea:
owner: MrMeeb owner: MrMeeb
name: certbot-cron-docker name: certbot-cron-docker

23
Dockerfile
View File

@ -1,4 +1,4 @@
FROM alpine:3.21.3 AS base FROM alpine:latest as base
ARG TARGETARCH ARG TARGETARCH
FROM base AS base-amd64 FROM base AS base-amd64
@ -9,7 +9,7 @@ ENV S6_OVERLAY_ARCH=aarch64
FROM base-${TARGETARCH}${TARGETVARIANT} FROM base-${TARGETARCH}${TARGETVARIANT}
ARG S6_OVERLAY_VERSION="3.2.0.2" ARG S6_OVERLAY_VERSION=3.1.5.0
# Core variables # Core variables
ENV PUID=1000 ENV PUID=1000
@ -17,10 +17,6 @@ ENV PGID=1000
ENV TZ=UTC ENV TZ=UTC
ENV GENERATE_DHPARAM=true ENV GENERATE_DHPARAM=true
ENV INTERVAL="0 */6 * * *" ENV INTERVAL="0 */6 * * *"
ENV ONE_SHOT=false
ENV APPRISE_URL=
ENV NOTIFY_ON_FAILURE=false
ENV NOTIFY_ON_SUCCESS=false
# Single domain # Single domain
ENV DOMAINS= ENV DOMAINS=
@ -40,7 +36,7 @@ ENV CLOUDFLARE_TOKEN=
ENV CERT_COUNT=1 ENV CERT_COUNT=1
#Get required packages #Get required packages
RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl logrotate RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
#Make folders #Make folders
RUN mkdir /config && \ RUN mkdir /config && \
@ -59,19 +55,16 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2 S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 S6_VERBOSI
RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip RUN python3 -m venv /app/certbot/ && /app/certbot/bin/pip install --upgrade pip
#Get required packages for building, build, then cleanup #Get required packages for building, build, then cleanup
#Added additional pip steps to fix cython 3.0.0 issue - https://github.com/yaml/pyyaml/issues/601
COPY requirements.txt /app/certbot/requirements.txt
RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \ RUN apk add --no-cache --virtual .deps gcc python3-dev libc-dev libffi-dev && \
/app/certbot/bin/pip install wheel setuptools && \ /app/certbot/bin/pip install certbot certbot-dns-cloudflare && \
/app/certbot/bin/pip install "Cython<3.0" pyyaml --no-build-isolation && \ ln -s /app/certbot/bin/certbot /usr/bin/certbot &&\
/app/certbot/bin/pip install -r /app/certbot/requirements.txt && \
ln -s /app/certbot/bin/certbot /usr/bin/certbot && \
ln -s /app/certbot/bin/apprise /usr/bin/apprise && \
apk del .deps apk del .deps
COPY root / COPY root /
RUN chmod +x /container-init.sh /certbot-prepare.sh /check-one-shot.sh /renew-function.sh && \ RUN chmod +x /container-init.sh && \
chmod +x /certbot-prepare.sh && \
chmod +x /certbot-renew.sh && \
chown -R ${PUID}:${PGID} /app /config chown -R ${PUID}:${PGID} /app /config
ENTRYPOINT [ "/init" ] ENTRYPOINT [ "/init" ]

15
README.md
View File

@ -1,12 +1,15 @@
# Certbot Cron Docker # Certbot Cron Docker
![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/master?label=latest&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge) ![Drone (self-hosted) with branch](https://img.shields.io/drone/build/MrMeeb/certbot-cron-docker/develop?label=develop&server=https%3A%2F%2Fdrone.mrmeeb.stream&style=for-the-badge)
Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Supports standalone, webroot or Cloudflare methods. Automatic renewal attempt happens every 6 hours by default. Dockerised Certbot that utilises cron to schedule creating and renewing SSL certificates. Supports standalone, webroot or Cloudflare methods. Automatic renewal attempt happens every 6 hours by default.
## Tags ## Tags
I use the [Feature Branch](https://www.atlassian.com/git/tutorials/comparing-workflows/feature-branch-workflow) workflow. The `latest` tag contains all of the latest changes that have been merged from individual feature branches. Feature branches are squashed into `master`. |Tag |Description|
|-------|-----------|
Pinned releases are created by creating a tag off `master` to capture the repo in a particular state. They are recommended for stability. |latest |Latest image built from the main branch. Usually coincides with a tagged release.|
|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
## Running ## Running
@ -49,13 +52,9 @@ Core options to the container
|PUID |int |1000 |Sets the UID of the user certbot runs under | |PUID |int |1000 |Sets the UID of the user certbot runs under |
|PGID |int |1000 |Sets the GID of the user certbot runs under | |PGID |int |1000 |Sets the GID of the user certbot runs under |
|TZ |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) |UTC |Sets the timezone of the container | |TZ |[List of valid TZs](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) |UTC |Sets the timezone of the container |
| ONE_SHOT | false | Whether container exits after first run of certbot, or starts cron-based auto-renewal |
| GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys | | GENERATE_DHPARAM | true (case-sensitive) | Generate Diffie-Hellman keys in /config/letsencrypt/keys |
| INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax | | INTERVAL | 0 */6 * * * | How often certbot attempts to renew the certificate. Cron syntax |
| CERT_COUNT | 1 | How many certificates certbot will try to issue. [Details here](https://git.mrmeeb.stream/MrMeeb/certbot-cron-docker#multiple-certificates) | | CERT_COUNT | 1 | How many certificates certbot will try to issue (more than 1 not yet implemented) |
| APPRISE_URL | None | URL for Apprise notifications. [Syntax](https://github.com/caronc/apprise?tab=readme-ov-file#supported-notifications)
| NOTIFY_ON_SUCCESS | false | Notify on a successful renewal attempt. Note that this isn't just when the cert is renewed, but on every renewal attempt. |
| NOTIFY_ON_FAILURE | false | Notify on a failed renewal attempt.
### Certificate Options ### Certificate Options

29
renovate.json
View File

@ -1,29 +0,0 @@
{
"extends": [":automergeMinor", ":automergePr", ":automergeRequireAllStatusChecks", ":dependencyDashboard", ":disableRateLimiting", ":rebaseStalePrs"],
"baseBranches": ["master"],
"major": {
"dependencyDashboardApproval": true
},
"minimumReleaseAge": "7 days",
"customManagers": [
{
"customType": "regex",
"fileMatch": ["Dockerfile"],
"matchStrings": ["ARG S6_OVERLAY_VERSION=[\"](?<currentValue>.*)[\"]"],
"datasourceTemplate": "github-releases",
"depNameTemplate": "just-containers/s6-overlay"
}
],
"packageRules": [
{
"matchDatasources": ["github-releases"],
"matchDepNames": ["just-containers/s6-overlay"],
"extractVersion": "^v(?<version>.*)$",
"versioning": "loose"
},
{
"matchPackagePatterns": ["certbot"],
"groupName": "certbot"
}
]
}

5
requirements.txt
View File

@ -1,5 +0,0 @@
# For pinning Python packages to then be parsed by Renovate
certbot ==3.3.0
certbot-dns-cloudflare ==3.3.0
apprise ==1.9.3

65
root/certbot-prepare.sh
View File

@ -46,22 +46,9 @@ function better_exit {
} }
# Check APPRISE_URL is set if either NOTIFY_ON_SUCCESS or NOTIFY_ON_FAILURE are set
if [ "${NOTIFY_ON_SUCCESS}" = "true" ] || [ "${NOTIFY_ON_FAILURE}" = "true" ] && [ -z "${APPRISE_URL}" ]; then
echo "You have notifications enabled but have not set APPRISE_URL. Please set APPRISE_URL and restart the container."
better_exit
fi
# Cleanup renew list and create it fresh, ready for commands to be run and added # Cleanup renew list and create it fresh, ready for commands to be run and added
echo "#!/command/with-contenv bash echo "#!/command/with-contenv bash" > /config/.renew-list.sh
echo "" >> /config/.renew-list.sh
date
echo \"Attempting to renew certificates\"
source /renew-function.sh
" > /config/.renew-list.sh
chmod +x /config/.renew-list.sh
# Create original config file to track changes to environmental variables # Create original config file to track changes to environmental variables
if [ ! -f /config/.donoteditthisfile ] if [ ! -f /config/.donoteditthisfile ]
@ -319,14 +306,14 @@ function single_domain {
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ $STAGING = false ] elif [ $STAGING = false ]
then then
echo "Using production endpoint" echo "Using production endpoint"
${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds $PROPOGATION_TIME --dns-cloudflare-credentials /config/.secrets/cloudflare.ini" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
echo "Unrecognised option for STAGING variable - check your configuration" echo "Unrecognised option for STAGING variable - check your configuration"
@ -345,14 +332,14 @@ function single_domain {
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone --staging" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ $STAGING = false ] elif [ $STAGING = false ]
then then
echo "Using production endpoint" echo "Using production endpoint"
REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --standalone" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
echo "Unrecognised option for STAGING variable - check your configuration" echo "Unrecognised option for STAGING variable - check your configuration"
@ -371,14 +358,14 @@ function single_domain {
echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY" echo "Using staging endpoint - THIS SHOULD BE USED FOR TESTING ONLY"
REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ $STAGING = false ] elif [ $STAGING = false ]
then then
echo "Using production endpoint" echo "Using production endpoint"
REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot
# Add to renewal list # Add to renewal list
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
echo "Unrecognised option for STAGING variable - check your configuration" echo "Unrecognised option for STAGING variable - check your configuration"
@ -644,7 +631,7 @@ echo \
${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging\"" >> /config/.renew-list.sh echo "${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini --staging" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ ${STAGING_MULTI} = false ] elif [ ${STAGING_MULTI} = false ]
@ -653,7 +640,7 @@ echo \
${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=$CUSTOM_CA_PATH ${BASE_COMMAND[@]} --dns-cloudflare --dns-cloudflare-propagation-seconds ${PROPOGATION_TIME_MULTI} --dns-cloudflare-credentials /config/.secrets/cloudflare.ini" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
@ -674,7 +661,7 @@ echo \
REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone --staging REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone --staging
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone --staging\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone --staging" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ ${STAGING_MULTI} = false ] elif [ ${STAGING_MULTI} = false ]
@ -683,7 +670,7 @@ echo \
REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --standalone" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
@ -704,7 +691,7 @@ echo \
REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot --staging" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
elif [ ${STAGING_MULTI} = false ] elif [ ${STAGING_MULTI} = false ]
@ -713,7 +700,7 @@ echo \
REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot
# Add to renewal list # Add to renewal list
echo "## Certificate ${x}" >> /config/.renew-list.sh echo "## Certificate ${x}" >> /config/.renew-list.sh
echo "renew \"REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot\"" >> /config/.renew-list.sh echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH_MULTI} ${BASE_COMMAND[@]} --webroot --webroot-path /config/webroot" >> /config/.renew-list.sh
echo "" >> /config/.renew-list.sh echo "" >> /config/.renew-list.sh
echo "Creation/renewal attempt complete" echo "Creation/renewal attempt complete"
else else
@ -767,31 +754,15 @@ else
echo "CERT_COUNT varaible not recognised. It needs to be a value of 1 or greater." echo "CERT_COUNT varaible not recognised. It needs to be a value of 1 or greater."
fi fi
# Finish /config/.renew-list.sh now all certs have been added
echo "
echo \"Renewal attempts complete\"" >> /config/.renew-list.sh
if [ $GENERATE_DHPARAM = true ] && [ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ] if [ $GENERATE_DHPARAM = true ] && [ ! -s /config/letsencrypt/keys/ssl-dhparams.pem ]
then then
echo ""
echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys. This can take a long time!" echo "Generating Diffie-Hellman keys, saved to /config/letsencrypt/keys. This can take a long time!"
openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096 openssl dhparam -out /config/letsencrypt/keys/ssl-dhparams.pem 4096
fi fi
if [ $ONE_SHOT == "true" ]; then echo "$INTERVAL /certbot-renew.sh >> /config/logs/renew.log" > /config/.crontab.txt
echo "" echo ""
echo "ONE_SHOT is true - exiting container" echo "Starting automatic renewal job. Schedule is $INTERVAL"
crontab /config/.crontab.txt
elif [ $ONE_SHOT == "false" ]; then
echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log
0 0 * * * logrotate -v --state /config/logs/logrotate.status /logrotate.conf" > /config/.crontab.txt
echo ""
echo "Starting automatic renewal job. Schedule is $INTERVAL"
crontab /config/.crontab.txt
fi

6
root/certbot-renew.sh Normal file
View File

@ -0,0 +1,6 @@
#!/command/with-contenv bash
# shellcheck shell=bash
echo ''
date
echo "Attempting to renew certificates"
bash /config/.renew-list.sh

10
root/check-one-shot.sh
View File

@ -1,10 +0,0 @@
#!/command/with-contenv bash
# shellcheck shell=bash
if [ $ONE_SHOT == "true" ]; then
# Cleanly kill container by sending kill signal to supervisor process
echo 0 > /run/s6-linux-init-container-results/exitcode
/run/s6/basedir/bin/halt
fi

9
root/container-init.sh
View File

@ -28,16 +28,9 @@ echo \
"PUID=${PUID} "PUID=${PUID}
PGID=${PGID} PGID=${PGID}
TZ=${TZ} TZ=${TZ}
ONE_SHOT=${ONE_SHOT}
INTERVAL=${INTERVAL} INTERVAL=${INTERVAL}
GENERATE_DHPARAM=${GENERATE_DHPARAM} GENERATE_DHPARAM=${GENERATE_DHPARAM}
CERT_COUNT=${CERT_COUNT} CERT_COUNT=${CERT_COUNT}"
NOTIFY_ON_SUCCESS=${NOTIFY_ON_SUCCESS}
NOTIFY_ON_FAILURE=${NOTIFY_ON_FAILURE}"
if [ ! -z ${APPRISE_URL} ]; then
echo \
"APPRISE_URL=[hidden]"
fi
## Send extra detail to logs if single certificate config ## Send extra detail to logs if single certificate config
if [ ${CERT_COUNT} == 1 ]; then if [ ${CERT_COUNT} == 1 ]; then
echo \ echo \

0
root/etc/s6-overlay/s6-rc.d/check-one-shot/dependencies.d/base
View File

1
root/etc/s6-overlay/s6-rc.d/check-one-shot/type
View File

@ -1 +0,0 @@
oneshot

1
root/etc/s6-overlay/s6-rc.d/check-one-shot/up
View File

@ -1 +0,0 @@
exec /check-one-shot.sh

0
root/etc/s6-overlay/s6-rc.d/check-one-shot/dependencies.d/certbot-prepare → root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/certbot-prepare
View File

0
root/etc/s6-overlay/s6-rc.d/cron/dependencies.d/check-one-shot
View File

10
root/etc/s6-overlay/s6-rc.d/cron/finish
View File

@ -1,9 +1 @@
#!/command/with-contenv bash echo "$e" > /run/s6-linux-init-container-results/exitcode
# shellcheck shell=bash
if [ $ONE_SHOT == "false" ]; then
# Export exit code if not a ONE_SHOT
echo "$e" > /run/s6-linux-init-container-results/exitcode
fi

10
root/etc/s6-overlay/s6-rc.d/logs/finish
View File

@ -1,9 +1 @@
#!/command/with-contenv bash echo "$e" > /run/s6-linux-init-container-results/exitcode
# shellcheck shell=bash
if [ $ONE_SHOT == "false" ]; then
# Export exit code if not a ONE_SHOT
echo "$e" > /run/s6-linux-init-container-results/exitcode
fi

15
root/logrotate.conf
View File

@ -1,15 +0,0 @@
missingok
/config/logs/letsencrypt.log {
daily
rotate 10
postrotate
find /config/logs -type f -regex '.*letsencrypt\.log\.\(.[2-9]\|[2-9].\|[1-9][0-9]\{2,\}\).*' -delete
endscript
}
/config/logs/renew.log {
rotate 5
size 100k
compress
}

27
root/renew-function.sh
View File

@ -1,27 +0,0 @@
function renew() {
#Variables:
#$1 = Certbot command
RENEWAL_DOMAINS=$(echo $1 | sed -r 's/.*\s-d\s(\S*).*/\1/')
CUSTOM_CA_PATH=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\1/')
CERTBOT_COMMAND=$(echo $1 | sed -r 's/REQUESTS_CA_BUNDLE=(\S*)\s(.*)/\2/')
echo "Renewing certificate for ${RENEWAL_DOMAINS}"
echo "REQUESTS_CA_BUNDLE=${CUSTOM_CA_PATH} ${CERTBOT_COMMAND}" | bash
if [ $? = 0 ]; then
echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} succeeded"
if [ "${NOTIFY_ON_SUCCESS}" = "true" ]; then
apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} succeeded" ${APPRISE_URL}
fi
else
echo "Renewal attempt of certificate for ${RENEWAL_DOMAINS} failed"
if [ "${NOTIFY_ON_FAILURE}" = "true" ]; then
apprise -b "Renewal of certificate for ${RENEWAL_DOMAINS} failed" ${APPRISE_URL}
fi
fi
}