Renewal hooks #161

nemchik · 2021-09-27T22:30:32Z

This supersedes #89

The changes here use the default location that already exists for hooks (/config/etc/letsencrypt/renewal-hooks) and remove the suggestions in the documentation for users to make changes.

Essentially, the feature will exist undocumented.

Will need to rebase after #169

LinuxServer-CI · 2021-09-27T22:42:09Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.19.0-pkg-c57b6bd2-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.19.0-pkg-c57b6bd2-pr-161/shellcheck-result.xml

LinuxServer-CI · 2021-10-10T00:47:08Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-1f5c12f0-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-1f5c12f0-pr-161/shellcheck-result.xml

root/etc/cont-init.d/50-config

LinuxServer-CI · 2021-10-13T16:22:22Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-d2857f71-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-d2857f71-pr-161/shellcheck-result.xml

LinuxServer-CI · 2021-10-27T15:34:43Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-b4afa965-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.20.0-pkg-b4afa965-pr-161/shellcheck-result.xml

NemesisRE · 2021-11-12T17:22:04Z

This would be great, first of all it is the proper way and clean way to do it.
Additionally it would give experienced users the possibility to reuse the certificates on other services or run other task.

github-actions · 2021-12-13T02:13:47Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

LinuxServer-CI · 2022-10-01T14:28:37Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

LinuxServer-CI · 2022-10-01T15:34:07Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

LinuxServer-CI · 2022-10-01T15:35:54Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

LinuxServer-CI · 2022-10-01T16:49:19Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

LinuxServer-CI · 2022-10-03T03:27:22Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

nemchik · 2022-10-03T03:34:52Z

readme-vars.yml

 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
+  - { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }


markdownlint change

nemchik · 2022-10-03T03:34:58Z

readme-vars.yml

  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`,`aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
  - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
-  - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
+  - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from <https://www.duckdns.org>" }


markdownlint change

nemchik · 2022-10-03T03:35:05Z

readme-vars.yml

  * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
  * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
-  * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+  * A list of commands can be found here: <https://www.fail2ban.org/wiki/index.php/Commands>


markdownlint change

nemchik · 2022-10-03T03:35:10Z

readme-vars.yml

  * You can check the new sample and adjust your active config as needed.

  ### Migration from the old `linuxserver/letsencrypt` image
+


markdownlint change

nemchik · 2022-10-03T03:35:16Z

readme-vars.yml

  - { date: "20.11.21:", desc: "Added support for dnspod validation." }
  - { date: "15.11.21:", desc: "Added support for deSEC DNS for wildcard certificate generation." }
-  - { date: "26.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate https://httpoxy.org/ vulnerabilities. Ref: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus" }
+  - { date: "26.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate <https://httpoxy.org/> vulnerabilities. Ref: <https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus>" }


markdownlint change

nemchik · 2022-10-03T03:36:07Z

root/app/le-renew.sh

@@ -1,27 +1,8 @@
 #!/usr/bin/with-contenv bash

-. /config/.donoteditthisfile.conf


These variables are no longer used in this file (they are used in the hooks).

nemchik · 2022-10-03T03:38:12Z

root/etc/cont-init.d/50-certbot

-# copy dns default configs
-cp -n /defaults/dns-conf/* /config/dns-conf/
-chown -R abc:abc /config/dns-conf
-


Not removed, just relocated below the next if statement.

nemchik · 2022-10-03T03:39:17Z

root/etc/cont-init.d/50-certbot

-sed -i 's|^certbot_dns_domeneshop:||g' /config/dns-conf/domeneshop.ini
-sed -i 's|^certbot_dns_inwx:||g' /config/dns-conf/inwx.ini
-sed -i 's|^certbot_dns_transip:||g' /config/dns-conf/transip.ini
-


Not removed, just relocated up under where the dns-conf files are copied from /defaults just to keep them together.

nemchik · 2022-10-03T03:45:02Z

root/etc/cont-init.d/50-certbot

    fi
-    rm -rf /config/etc/letsencrypt
-    mkdir -p /config/etc/letsencrypt
+    rm -rf /config/etc/letsencrypt/{live,renewal}


After reviewing what actually happens when you run certbot delete, these two folders are the only things touched. Normally certbot delete is used to remove one cert at a time, and this assumes you have the required .conf file in the renewal folder, and the fullchain.pem and other files in the live folder. In case these things get messed up, it's safer to remove the whole live and renewal folder.

certbot doesn't recommend this, but in the two scenarios where this script decides to remove these folders it makes sense, and will be more consistent with fixing user issues compared to using certbot delete in the recommended way.

p.s. I did write up the code changes to iterate through the output of certbot certificates and then use certbot delete on each one, but if the user's files and folders are messed up at all certbot delete won't handle it nicely, and the next run of certbot renew could attempt to renew a certificate with issues.

Oh right, the reason for removing these subfolders and not the parent folder:
I want to keep the /config/etc/letsencrypt/renewal-hooks folder, which should allow for user modifications. I reviewed the other folders in /config/etc/letsencrypt and they don't seem like they will cause any issues being left behind.

Added removing the /config/etc/letsencrypt/archive folder after testing it is required to remove it as well.

nemchik · 2022-10-03T03:45:23Z

root/etc/cont-init.d/50-certbot

-    if [ -d /config/keys/letsencrypt ]; then
-        cd /config/keys/letsencrypt || exit
-    else
+    certbot certonly --non-interactive --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL


Added --non-interactive

LinuxServer-CI · 2022-10-03T03:46:27Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.30.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

nemchik · 2022-10-03T03:47:55Z

I did some extra research and testing and ran a bunch of certbot commands from inside one of my swag containers to confirm that all this works, and is the best way (that I can think of) to handle these changes.

LinuxServer-CI · 2022-10-05T19:27:54Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

LinuxServer-CI · 2022-10-05T19:49:10Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

thespad

LGTM

LinuxServer-CI · 2022-10-05T20:32:48Z

I am a bot, here are the test results for this PR:
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/index.html
https://ci-tests.linuxserver.io/lspipepr/swag/1.31.0-pkg-f50ec6c1-pr-161/shellcheck-result.xml

nemchik requested a review from aptalca September 27, 2021 22:30

aptalca reviewed Oct 13, 2021

View reviewed changes

root/etc/cont-init.d/50-config Outdated Show resolved Hide resolved

github-actions bot added the no-pr-activity label Dec 13, 2021

nemchik mentioned this pull request Aug 7, 2022

[feature request] Custom hook after renewal/creation #25

Closed

nemchik force-pushed the renewal-hooks branch 2 times, most recently from 5f7da20 to 7101a00 Compare October 1, 2022 14:15

nemchik force-pushed the renewal-hooks branch 2 times, most recently from eb7426d to e76759b Compare October 1, 2022 15:24

nemchik force-pushed the renewal-hooks branch from e76759b to 9a2586b Compare October 1, 2022 16:39

github-actions bot removed the no-pr-activity label Oct 2, 2022

nemchik force-pushed the renewal-hooks branch from 9a2586b to f7206ef Compare October 3, 2022 03:14

nemchik force-pushed the renewal-hooks branch from f7206ef to 2ec3895 Compare October 3, 2022 03:33

nemchik commented Oct 3, 2022

View reviewed changes

nemchik force-pushed the renewal-hooks branch from 2ec3895 to 2e18bc3 Compare October 5, 2022 19:12

nemchik force-pushed the renewal-hooks branch from 2e18bc3 to ee3c69a Compare October 5, 2022 19:35

use certbot file hooks instead of command line hooks

51dc4ce

nemchik force-pushed the renewal-hooks branch from ee3c69a to 51dc4ce Compare October 5, 2022 19:41

thespad approved these changes Oct 5, 2022

View reviewed changes

nemchik merged commit e2d02de into master Oct 5, 2022

nemchik deleted the renewal-hooks branch October 5, 2022 21:11

		* You can check the new sample and adjust your active config as needed.

		### Migration from the old `linuxserver/letsencrypt` image

		@@ -1,27 +1,8 @@
		#!/usr/bin/with-contenv bash

		. /config/.donoteditthisfile.conf

Uh oh!

Renewal hooks #161

Renewal hooks #161

Uh oh!

Conversation

nemchik commented Sep 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LinuxServer-CI commented Sep 27, 2021

Uh oh!

LinuxServer-CI commented Oct 10, 2021

Uh oh!

Uh oh!

LinuxServer-CI commented Oct 13, 2021

Uh oh!

LinuxServer-CI commented Oct 27, 2021

Uh oh!

NemesisRE commented Nov 12, 2021

Uh oh!

github-actions bot commented Dec 13, 2021

Uh oh!

LinuxServer-CI commented Oct 1, 2022

Uh oh!

LinuxServer-CI commented Oct 1, 2022

Uh oh!

LinuxServer-CI commented Oct 1, 2022

Uh oh!

LinuxServer-CI commented Oct 1, 2022

Uh oh!

LinuxServer-CI commented Oct 3, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LinuxServer-CI commented Oct 3, 2022

Uh oh!

nemchik commented Oct 3, 2022

Uh oh!

LinuxServer-CI commented Oct 5, 2022

Uh oh!

LinuxServer-CI commented Oct 5, 2022

Uh oh!

thespad left a comment

Choose a reason for hiding this comment

Uh oh!

LinuxServer-CI commented Oct 5, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

nemchik commented Sep 27, 2021 •

edited

Loading