Add renewal notifications (#20)

Reviewed-on: #20

.gitea/workflows/build-develop.yaml

@@ -0,0 +1,88 @@
+name: Build Image
+on:
+  push:
+    branches:
+      - 'develop'
+
+env:
+  TEST_TAG: mrmeeb/certbot-cron:test
+  FULL_TAG: git.mrmeeb.stream/mrmeeb/certbot-cron:develop
+
+jobs:
+  "Validate Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    steps:
+      - name: Build locally
+        uses: docker/build-push-action@v5
+        with:
+          load: true
+          tags: ${{ env.TEST_TAG }}
+          provenance: false
+      - name: Test certificate issuing
+        id: test
+        run: |
+          # First create a volume
+          docker volume create ${{ gitea.sha }} && \
+          # Then issue a certificate
+          docker run --rm -v ${{ gitea.sha }}:/config -e STAGING=true -e EMAIL=${{ secrets.EMAIL }} -e DOMAINS=${{ gitea.sha }}.mrmeeb.stream -e PLUGIN=cloudflare -e CLOUDFLARE_TOKEN=${{ secrets.CLOUDFLARE_TOKEN }} -e ONE_SHOT=true -e GENERATE_DHPARAM=false ${{ env.TEST_TAG }} && \
+          # Then revoke it again
+          docker run --rm --entrypoint "/usr/bin/certbot" -v ${{ gitea.sha }}:/config ${{ env.TEST_TAG }} revoke --non-interactive --agree-tos --email ${{ secrets.EMAIL }} --staging --config-dir /config/letsencrypt --work-dir /config/.tmp --logs-dir /config/logs --cert-path /config/letsencrypt/live/${{ gitea.sha }}.mrmeeb.stream/fullchain.pem          
+      - name: Tidy up
+        if: always()
+        run: |
+          echo "Removing docker volume ${{ gitea.sha }}" && \
+          docker volume rm ${{ gitea.sha }}          
+      - name: Test Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Test Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+  
+  "Publish Image":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image"]
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.mrmeeb.stream
+          username: ${{ env.GITHUB_ACTOR }}
+          password: ${{ secrets.GTCR_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ env.FULL_TAG }}
+          provenance: false
+      - name: Build Failure
+        uses: rjstone/discord-webhook-notify@v1
+        if: failure()
+        with:
+          severity: error
+          details: Build Failed!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}
+
+  "Notify":
+    runs-on: [ubuntu-docker-latest, linux/amd64]
+    needs: ["Validate Image", "Publish Image"]
+    steps:
+      - name: Notify of success
+        uses: rjstone/discord-webhook-notify@v1
+        if: success()
+        with:
+          severity: info
+          details: Build succeeded!
+          webhookUrl: ${{ secrets.DISCORD_WEBHOOK }}
+          username: Gitea
+          avatarUrl: ${{ vars.RUNNER_ICON_URL }}

.gitea/workflows/build-main.yaml

@@ -12,12 +12,9 @@ jobs:
   "Validate Image":
     runs-on: [ubuntu-docker-latest, linux/amd64]
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - name: Build locally
         uses: docker/build-push-action@v5
         with:
-          context: .
           load: true
           tags: ${{ env.TEST_TAG }}
           provenance: false

.gitea/workflows/build-tagged-release.yaml

@@ -55,7 +55,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with: 
-          go-version: 1.25.1
+          go-version: 1.22.2
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.23.4 AS base
+FROM alpine:3.20.0 as base
 ARG TARGETARCH
 
 FROM base AS base-amd64
@@ -9,7 +9,7 @@ ENV S6_OVERLAY_ARCH=aarch64
 
 FROM base-${TARGETARCH}${TARGETVARIANT}
 
-ARG S6_OVERLAY_VERSION="3.2.1.0"
+ARG S6_OVERLAY_VERSION="3.1.6.2"
 
 # Core variables
 ENV PUID=1000
@@ -40,7 +40,7 @@ ENV CLOUDFLARE_TOKEN=
 ENV CERT_COUNT=1
 
 #Get required packages
-RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl logrotate
+RUN apk update && apk add curl bash python3 py3-virtualenv procps tzdata nano shadow xz busybox-suid openssl
 
 #Make folders
 RUN mkdir /config && \

README.md

@@ -4,9 +4,10 @@ Dockerised Certbot that utilises cron to schedule creating and renewing SSL cert
 
 ## Tags
 
-I use the [Feature Branch](https://www.atlassian.com/git/tutorials/comparing-workflows/feature-branch-workflow) workflow. The `latest` tag contains all of the latest changes that have been merged from individual feature branches. Feature branches are squashed into `master`.
+|Tag    |Description|
-
+|-------|-----------|
-Pinned releases are created by creating a tag off `master` to capture the repo in a particular state. They are recommended for stability.
+|latest |Latest image built from the main branch. Usually coincides with a tagged release.|
+|develop|Latest image built from the develop branch. Commits are made to the develop branch before being merged to main. Old versions of `develop` are removed after 14 days.|
 
 ## Running
 

renovate.json

@@ -4,7 +4,6 @@
     "major": {
         "dependencyDashboardApproval": true
     },
-    "minimumReleaseAge": "7 days",
     "customManagers": [
         {
         "customType": "regex",

requirements.txt

@@ -1,5 +1,5 @@
 # For pinning Python packages to then be parsed by Renovate
 
-certbot ==4.2.0
+certbot ==2.10.0
-certbot-dns-cloudflare ==4.2.0
+certbot-dns-cloudflare ==2.10.0
-apprise ==1.9.4
+apprise ==1.8.0

root/certbot-prepare.sh

@@ -47,7 +47,7 @@ function better_exit {
 }
 
 # Check APPRISE_URL is set if either NOTIFY_ON_SUCCESS or NOTIFY_ON_FAILURE are set
-if [ "${NOTIFY_ON_SUCCESS}" = "true" ] || [ "${NOTIFY_ON_FAILURE}" = "true" ] && [ -z "${APPRISE_URL}" ]; then
+if [ ! -z "${NOTIFY_ON_SUCCESS}" ] || [ ! -z "${NOTIFY_ON_FAILURE}" ] && [ -z "${APPRISE_URL}" ]; then
 
     echo "You have notifications enabled but have not set APPRISE_URL. Please set APPRISE_URL and restart the container."
     better_exit
@@ -786,8 +786,7 @@ if [ $ONE_SHOT == "true" ]; then
 
 elif [ $ONE_SHOT == "false" ]; then
 
-    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log
+    echo "$INTERVAL /config/.renew-list.sh >> /config/logs/renew.log" > /config/.crontab.txt
-    0 0 * * * logrotate -v --state /config/logs/logrotate.status /logrotate.conf" > /config/.crontab.txt
 
     echo ""
 

root/check-one-shot.sh

@@ -4,7 +4,6 @@
 if [ $ONE_SHOT == "true" ]; then
 
     # Cleanly kill container by sending kill signal to supervisor process
-    echo 0 > /run/s6-linux-init-container-results/exitcode
+    kill 1
-    /run/s6/basedir/bin/halt
 
 fi

root/etc/s6-overlay/s6-rc.d/cron/finish

@@ -1,9 +1 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-if [ $ONE_SHOT == "false" ]; then
-
-    # Export exit code if not a ONE_SHOT
 echo "$e" > /run/s6-linux-init-container-results/exitcode
-
-fi

root/etc/s6-overlay/s6-rc.d/logs/finish

@@ -1,9 +1 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-
-if [ $ONE_SHOT == "false" ]; then
-
-    # Export exit code if not a ONE_SHOT
 echo "$e" > /run/s6-linux-init-container-results/exitcode
-
-fi

root/logrotate.conf

@@ -1,15 +0,0 @@
-missingok
-
-/config/logs/letsencrypt.log {
-    daily
-    rotate 10
-    postrotate
-        find /config/logs -type f -regex '.*letsencrypt\.log\.\(.[2-9]\|[2-9].\|[1-9][0-9]\{2,\}\).*' -delete
-    endscript
-}
-
-/config/logs/renew.log {
-    rotate 5
-    size 100k
-    compress
-}