[add] initial commit
This commit is contained in:
28
certbot/Dockerfile
Normal file
28
certbot/Dockerfile
Normal file
@@ -0,0 +1,28 @@
|
||||
FROM certbot/certbot:v1.3.0
|
||||
|
||||
ARG USER_UUID=12000
|
||||
ARG USER_GUID=12000
|
||||
ARG GROUP_NAME=certbot
|
||||
ARG USER_NAME=certbot
|
||||
|
||||
# http://linuxcommand.org/lc3_man_pages/seth.html
|
||||
RUN set -eux; \
|
||||
addgroup -g $USER_GUID $GROUP_NAME; \
|
||||
adduser -u $USER_UUID -G $GROUP_NAME -s /sbin/nologin -D $USER_NAME;
|
||||
|
||||
# create temp dir for service
|
||||
RUN mkdir -p /service/temp \
|
||||
&& chown -R $USER_NAME:$GROUP_NAME /service/temp
|
||||
|
||||
# create and set permission for proxy mounts
|
||||
RUN mkdir -p /service/html \
|
||||
&& chown -R $USER_NAME:$GROUP_NAME /service/html \
|
||||
&& mkdir -p /service/ssl \
|
||||
&& chown -R $USER_NAME:$GROUP_NAME /service/ssl
|
||||
|
||||
COPY ./files/entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh
|
||||
|
||||
USER $USER_NAME
|
||||
|
||||
ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
2
certbot/files/domains.env
Normal file
2
certbot/files/domains.env
Normal file
@@ -0,0 +1,2 @@
|
||||
DOMAINS=example.com www api test\n example.dev www api test
|
||||
SERVER=kweb\n test
|
||||
230
certbot/files/entrypoint.sh
Normal file
230
certbot/files/entrypoint.sh
Normal file
@@ -0,0 +1,230 @@
|
||||
#!/bin/sh
|
||||
|
||||
# configuration
|
||||
web_root_path="/service/html"
|
||||
cert_root_path="/service/ssl"
|
||||
temp_path="/service/temp"
|
||||
cert_bot_path="/etc/letsencrypt"
|
||||
server_retries=10
|
||||
log_file="" # leave empty for stdout
|
||||
|
||||
|
||||
# variables
|
||||
local_webserver="http://$(ip route show | awk '/default/ {print $3}')"
|
||||
domain_file="$temp_path/domains.txt"
|
||||
certs_updated="$cert_root_path/.updated"
|
||||
|
||||
#functions
|
||||
function log()
|
||||
{
|
||||
local time=$(date +%F_%T)
|
||||
local prefix="LOG"
|
||||
case $1 in
|
||||
ERR | ERROR)
|
||||
prefix="ERR"
|
||||
shift
|
||||
;;
|
||||
WAR | WARNING)
|
||||
prefix="WAR"
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
local func=$1; shift
|
||||
# remove any \n
|
||||
#local text=$(echo "$@"| tr '\n' '#' | sed 's|#|\\n |g')
|
||||
case "$log_file" in
|
||||
"")
|
||||
echo "[$time]:[$prefix]:[$0][$func]: $@" 2>&1
|
||||
;;
|
||||
*)
|
||||
echo "[$time]:[$prefix]:[$0][$func]: $@" >> log_path
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
function env_domain_file()
|
||||
{
|
||||
log env_domain_file $(echo "ENV DOMAINS: $DOMAINS" | tr '\n' '#' | sed 's|#|\\n |g')
|
||||
echo -e "$DOMAINS" > $1
|
||||
}
|
||||
|
||||
function verify_domain()
|
||||
{
|
||||
# TODO: create and verify token in web_root_path via curl
|
||||
if nslookup $1 > /dev/null 2>&1; then
|
||||
# domain exists
|
||||
return 0
|
||||
else
|
||||
# false
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function read_file()
|
||||
{
|
||||
local func=$1
|
||||
local file=$2
|
||||
local result=0
|
||||
|
||||
while read -r line || [[ -n "$line" ]]; do
|
||||
# skip empty lines if READ_EMPTY_LINES is not set
|
||||
[ -z ${READ_EMPTY_LINES+x} ] && [ "${#line}" -lt 1 ] && continue
|
||||
log read_file "LINE: $line"
|
||||
log read_file "FUNC START [$func]"
|
||||
if $func $line; then
|
||||
log read_file "FUNC END [$func]"
|
||||
else
|
||||
result=1
|
||||
log ERROR read_file "FUNC END [$func]"
|
||||
fi
|
||||
done < "$file"
|
||||
|
||||
return $result
|
||||
}
|
||||
|
||||
function init_cert()
|
||||
{
|
||||
local domain=$1
|
||||
local cert_path="$cert_root_path/$domain"
|
||||
if [[ ! -f "$cert_path/fullchain.pem" ]]; then
|
||||
log init_cert "Creating temporary cert for [$domain]"
|
||||
mkdir -p "$cert_path"
|
||||
openssl genrsa -out "$cert_path/privkey.pem" 4096
|
||||
openssl req -new -key "$cert_path/privkey.pem" -out "$temp_path/$domain.csr" -nodes -subj \
|
||||
"/C=PT/ST=World/L=World/O=${domain}/OU=temp lda/CN=${domain}/emailAddress=contact@${domain}"
|
||||
openssl x509 -req -days 365 -in "$temp_path/$domain.csr" -signkey "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem"
|
||||
fi
|
||||
}
|
||||
|
||||
function copy_cert()
|
||||
{
|
||||
local domain=$1
|
||||
local cert_path="$cert_root_path/$domain"
|
||||
if [[ -f "$cert_bot_path/live/$domain/privkey.pem" ]]; then
|
||||
cp "$cert_bot_path/live/$domain/privkey.pem" "$cert_path/privkey.pem"
|
||||
cp "$cert_bot_path/live/$domain/fullchain.pem" "$cert_path/fullchain.pem"
|
||||
return 0
|
||||
else
|
||||
log ERROR copy_cert "No key exists at "$cert_bot_path/live/$domain/privkey.pem" for [$domain]"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function verify_webserver()
|
||||
{
|
||||
wget -q -O /dev/null "$1/check/" > /dev/null 2>&1
|
||||
}
|
||||
|
||||
function verify_local_webserver()
|
||||
{
|
||||
local domain=$1
|
||||
# todo check if configured for domain
|
||||
wget -q -O /dev/null "$local_webserver/check/" > /dev/null 2>&1
|
||||
}
|
||||
|
||||
function get_cert()
|
||||
{
|
||||
local root_domain=$1
|
||||
local domains=$2 # comma seperated list, first is file path
|
||||
local retries=0
|
||||
local webserver_exists=0
|
||||
verify_local_webserver $root_domain && webserver_exists=1
|
||||
while [ ! $webserver_exists -eq 1 ] && [ "$retries" -lt "$server_retries" ]; do
|
||||
retries=$(( retries+1 ))
|
||||
log get_cert WARNING "Webserver for [$root_domain] not reachable, trying again in 1s"
|
||||
sleep 1
|
||||
verify_local_webserver $root_domain && webserver_exists=1
|
||||
done
|
||||
|
||||
if [ $webserver_exists -eq 1 ] ; then
|
||||
log get_cert "Getting cert for [$root_domain] with [$domains]"
|
||||
# certbotx certonly \
|
||||
# --config-dir "$cert_bot_path" \
|
||||
# --agree-tos \
|
||||
# --domains "$domains" \
|
||||
# --email "contact@${root_domain}" \
|
||||
# --no-eff-email \
|
||||
# --expand \
|
||||
# --noninteractive \
|
||||
# --webroot \
|
||||
# --webroot-path "$web_root_path" \
|
||||
# $OPTIONS || true
|
||||
else
|
||||
log get_cert ERROR "Webserver for [$root_domain] not reachable after $server_retries retries"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function domain_init()
|
||||
{
|
||||
if [ "$1" == "" ]; then
|
||||
log domain_init "Skipping empty input"
|
||||
return 0
|
||||
fi
|
||||
local domain=$1;
|
||||
# don't really care at this point if the domain exists
|
||||
# if ! verify_domain $domain; then
|
||||
# log ERROR domain_init "Root domain [$domain] does not exist"
|
||||
# return 1
|
||||
# fi
|
||||
init_cert $domain
|
||||
}
|
||||
|
||||
function domain_handler()
|
||||
{
|
||||
if [ "$1" == "" ]; then
|
||||
log domain_handler "Skipping empty input"
|
||||
return 0
|
||||
fi
|
||||
local domain=$1; shift
|
||||
local subs=$@
|
||||
local domain_string="$domain"
|
||||
log domain_handler "Checking root domain [$domain]"
|
||||
if ! verify_domain $domain; then
|
||||
log ERROR domain_handler "Root domain [$domain] does not exist"
|
||||
return 1
|
||||
fi
|
||||
for sub in $subs ; do
|
||||
local subdomain="$sub.$domain"
|
||||
log domain_handler "Checking sub domain [$subdomain]"
|
||||
if ! verify_domain $subdomain; then
|
||||
log WARNING domain_handler "Sub domain [$subdomain] does not exist"
|
||||
else
|
||||
domain_string="$domain_string,$subdomain"
|
||||
fi
|
||||
done
|
||||
init_cert $domain
|
||||
if ! get_cert $domain $domain_string; then
|
||||
log ERROR domain_handler "No cert generated by certbot for [$domain]"
|
||||
return 1
|
||||
fi
|
||||
copy_cert $domain
|
||||
}
|
||||
|
||||
function main()
|
||||
{
|
||||
intervall="${1-12h}"
|
||||
while :; do
|
||||
log main "Starting intervall"
|
||||
|
||||
# load env variable with domains
|
||||
env_domain_file "$domain_file"
|
||||
|
||||
# create temp certs for domains if none exists
|
||||
# nginx need certs to start
|
||||
read_file domain_init "$domain_file"
|
||||
|
||||
# get or renew domain certs
|
||||
# requires nginx to be started
|
||||
# timout is set via $server_retries (default 10s)
|
||||
read_file domain_handler "$domain_file"
|
||||
|
||||
# indicated that certs have been updated to nginx
|
||||
touch "$certs_updated"
|
||||
log main "Ending intervall"
|
||||
log main "Next interval in $intervall"
|
||||
sleep "$intervall"
|
||||
done
|
||||
}
|
||||
|
||||
main $@
|
||||
Reference in New Issue
Block a user