Skip to content
This repository was archived by the owner on Jan 13, 2022. It is now read-only.

Commit 85059af

Browse files
hrpatelhrpatel
authored
Certbot initial commits (#1)
- Add certbot container for manage TLS certificates - Adds a docker volume shared with the nginx container for retrieving TLS certificates - Add README, CHANGELOG - Add build scripts and setup Travis-CI builds
1 parent e329dde commit 85059af

File tree

11 files changed

+413
-1
lines changed

11 files changed

+413
-1
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
### JetBrains template
2+
.idea/

‎.travis.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
2+
stages:
3+
- Tests
4+
- SDLC Tasks
5+
- Build and Publish
6+
7+
jobs:
8+
include:
9+
- stage: Tests
10+
name: Shellcheck
11+
env:
12+
- SHELLCHECK_OPTS="-e SC1008 -e SC2154"
13+
language: bash
14+
script:
15+
- shellcheck $(find . -type f -name '*.sh')
16+
- name: Dockerfile linter
17+
language: minimal
18+
script:
19+
- docker run --rm -v $PWD:/root/ projectatomic/dockerfile-lint dockerfile_lint -f ./Dockerfile
20+
- stage: "SDLC Tasks"
21+
name: Tag & iteration update
22+
sudo: required
23+
language: bash
24+
script:
25+
- bash bin/travis-ci/check_tag.sh
26+
- stage: Build and Publish
27+
name: Docker image
28+
env:
29+
- secure: "syHwTME2FzcgZnn8VZgi2WGSctRlhYmt+6F3KVwhOUfgwRLqJZuohXSWm7/siS6BAqtk6poXIjpn7uAJXk+h7gEefQPaqe4GwwXJAn+zNq7K1Q1DCOhHlTjWdEn0dd1lH1rc8PnrS48U+TkP5yjQ24Y/20MnJy2omQ2awxBphZbBK1X5L8DIeYeMXi39/qhY+yUdmkS7kmC0eYMGK0ijVhDCQGt+MBkTPtdq2XwtGy0L5wHGeGz+epXRSLU8JIN1w29dTbEIR+SfrRfOB3fJo8rNoIecMt68+Jb5Xg33AehYL4t65Cx2z9+KtGvWeLIQEGlsG9gntJjMHqTUjcZnrO7b5ynSUKn5loaHJc4oM8IA2cpwidDHGVD1hNqo9Bg4k6zHn98t+VqS8Cztxp2acHyubR+32jESxVbU+eR3A0eGSWTa8o+HLU1cEDw43x3qwG4E++msGAarnhKSYuKys6l2UKBYy9OP3j1rT9B+Oxm+dPQooUY1ueBhDwq7ijSt/n4qjwP7ZExCdggvT1PDeCwtwedMqJ5MskWLKwqpT3Hny7twBXBgZv+jKSb7ZxID4imbmr3lO0O+cuqve6N1Exc2labZEu90pawqem+a6OaspXriNu1YBD9GyXlUmpGBh5YgzCDBnwjlSTJ7p6xiXTF6AEd7nnnhWPwkp2SxPdI="
30+
- secure: "aAjuXpAhD67jVis8/gHoe4mwXESRCKCOrsmgqDpIJzj+0WIs1Z9bEq84dcCmkAz+Fz6eA6kiJIHrHsHzASOysVtAIpJ0ApKkUtyDP41GjF7nS4d9SuMKzamEfgoFTQDBwF2i+L9wwdQ0UNVQ53bZomU1cbwhcDWXoKcpSvW3fWL0q8rKN4f0oLi73FYMQ3+Dq9NM5r7DH7CUtjxwVZuvxWnP5JC+Rqm8Du+ObVSxbLvkzSebnCPXh0BZxEIJYh3da3rcckJQfDIyTgXKytEjnbEf4vmlnKsNIIR3NuzgWFLToPKeckI/BNY930QxX3epZs2Pa6EgTzBdDZBuGmAPdnXRTD9i5y+6Ffpv7duRpTngRAujUmAzdwU/B2utmW1BnJpvbbepBcFjyHDOGHgeL1Q0JmpH573oRkkOip85nkIWv03qWVqOZSky5DtfQuPp6SEd5/WlvhC7Etcz49YZb6Wjl+cOYV+WYorjBwe1jSPOQO4oJ5Qlnbw8NQ3lNk93t71z7/YWtyaoHp/NHMPdf+ZsOZn+YS2Iu2dXfoTZNTgpJpFaAu3mkTV09XsygM5uDJ83kqAwMNoToHU1iyGD/SRzfpojyMeSXOyHaIqiHdSrqaKopyD1o81oiIdji4pKTw9sGFOmnFRvWHd7+/8kYFnK/IwN6CbmLdBcCMVhegg="
31+
- secure: "okThdoKinSf0fpKZLb2Xw31nW5PdMZyF2l0FAP6TrjtcSc2PQ56BhcwWY8yjvFNfR8o2uVTwfKYhitXDDOngqBiJclRMV6zJfBzNKig/a3ouXQHbMybjxiAcH3kBYBzZEpkf7nf/R2xH0TfiMQS34b17VU0yYkOHjDe9NIWLZ8qDHPOMa3p0vuw23WpIaU6HaoD2Pzn/YqD79HlDwo4x+9FA4ffF0iYzRhRAlMK05WNXX0ZMoEvTMKwyGkVgu0U7kI+Tzj4z0O3ZIEc0tmthBuhOdjxc9FPjIN09tRhh15HeV55gn/uoZN79AOgBUG1ZLRahMEEXSGMtiWbBE8RRH8u46mP/bR6SLfqZ5whsDzQ4d8a1uNB7GRxaTHLZW+6Ij3YyNP6xtHQJiGk6U9iYTf4yUI4C2SkcDH+Zq+ipNuyJI4JduH5H1mQaK28I5Mu/s/BBVp6PJ7B/V3YKbv4Rv/DwiC8tGAfR+EQ/DGOvu69xiIKLc3IC4wI9TtLRQWrm7KZnPI1KlfFtYE7O/GotxoAbf/8kQ1HXfx1q0mP3o4ithtsz8XQX3h63jhD4hsBmNfiwEJCxO6Qwtq7ihxJOOh2rM9YGv8Ib3JQ6r+SLyfCO6Uhz0/buE/Xg+Xo1J8hMHmfy3T/d+MU7g+oOO2Oj9dxTSDiH7aLWwOlG653ltIM="
32+
language: minimal
33+
sudo: required
34+
services:
35+
- docker
36+
script:
37+
- bash bin/travis-ci/docker_upgrade.sh
38+
- bash bin/travis-ci/docker_build.sh
39+
- if [[ ${TRAVIS_BRANCH} = "master" ]]; then bash bin/travis-ci/docker_publish.sh; fi

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Changelog
2+
All notable changes to this project will be documented in this file.
3+
4+
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
5+
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
6+
7+
## [v0.1.1] - 2018-10-02
8+
### Added
9+
- Project `CHANGELOG.md`, `README.md`, and `LICENSE`
10+
- Initial commit of Docker, CI build, and configuration
11+
- Move `certbot` directory from `moodle-docker` to this repo

‎Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM certbot/certbot:v0.27.1
2+
3+
LABEL name="certbot"
4+
LABEL version="latest"
5+
6+
RUN apk --no-cache add openssl curl
7+
8+
COPY ./bin/ /usr/local/bin/
9+
RUN chmod +x /usr/local/bin/run_certbot.sh \
10+
&& chmod +x /usr/local/bin/entrypoint.sh
11+
12+
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

‎README.md‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,65 @@
1-
# certbot-docker
1+
# certbot-docker
2+
3+
A container that runs `certbot` to help manage certificates.
4+
5+
Docker volumes are used to share certificates and other files (e.g. challenges) across containers. This means multiple web server containers can take advantage of a single `certbot` container.
6+
7+
### Sample usage
8+
In your `docker-compose.yaml` file:
9+
10+
```bash
11+
nginx-web-server:
12+
environment:
13+
...
14+
CERT_DIR: "${CERT_DIR}"
15+
CERT_DOMAIN: "${CERT_DOMAIN}"
16+
CHALLENGE_DIR: "${CHALLENGE_DIR}"
17+
volumes:
18+
...
19+
# Directory for serving certbot challenge files
20+
- type: volume
21+
source: certbot-challenges
22+
target: ${CHALLENGE_DIR}
23+
# Directory for serving certificates
24+
- type: volume
25+
source: certbot-certs
26+
target: ${CERT_DIR}
27+
28+
certbot:
29+
depends_on:
30+
- nginx-web-server
31+
environment:
32+
ADMIN_EMAIL: "${ADMIN_EMAIL}"
33+
CERT_DOMAIN: "${CERT_DOMAIN}"
34+
volumes:
35+
- type: volume
36+
source: certbot-challenges
37+
target: /challenges
38+
- type: volume
39+
source: certbot-certs
40+
target: /certs
41+
42+
volumes:
43+
certbot-challenges:
44+
certbot-certs:
45+
```
46+
47+
Web server configuration. E.g. for `nginx.conf`:
48+
49+
```bash
50+
server {
51+
listen ${HTTP_PORT};
52+
53+
server_name _;
54+
55+
location /.well-known/acme-challenge {
56+
root ${CHALLENGE_DIR};
57+
default_type "text/plain";
58+
try_files $uri =404;
59+
}
60+
61+
location / {
62+
return 301 https://$host$request_uri;
63+
}
64+
}
65+
```

‎bin/entrypoint.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/sh
2+
3+
echo "Starting 'certbot' entrypoint..."
4+
5+
cert_url="http://${CERT_DOMAIN}"
6+
until curl --output /dev/null --silent --head --fail --connect-timeout 30 "${cert_url}"; do
7+
echo "Cannot resolve '${cert_url}', sleeping and trying again..."
8+
sleep 60
9+
done
10+
11+
echo "Successful response from '${cert_url}', attempting to obtain certificate..."
12+
/usr/local/bin/run_certbot.sh -e "${ADMIN_EMAIL}" -d "${CERT_DOMAIN}" -r /challenges

‎bin/run_certbot.sh‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
#!/bin/sh
2+
# shellcheck disable=SC2039,SC2113
3+
4+
set -e
5+
6+
print_usage() {
7+
cat << EOF
8+
usage: ${0} options
9+
10+
This script wraps certbot to obtain and renew certificates.
11+
12+
OPTIONS:
13+
Parameters:
14+
-d Domain for certificate.
15+
-e Administrator email used when obtaining certificates.
16+
-r Webroot location to place challenge auth files.
17+
18+
Version: ${VERSION}
19+
EOF
20+
}
21+
22+
function check_for_cert {
23+
if [ -z "${1}" ] ; then
24+
echo "Missing parameter 1: Domain name"
25+
return 1
26+
fi
27+
local cert_domain="${1}"
28+
29+
local cert_dir="/etc/letsencrypt/live/${cert_domain}"
30+
31+
echo "Check if certificate directory exists"
32+
[ -d "${cert_dir}" ] && return 0 || return 1
33+
}
34+
35+
function copy_certificates {
36+
if [ -z "${1}" ] ; then
37+
echo "Missing parameter 1: Domain name"
38+
return 1
39+
fi
40+
local cert_domain="${1}"
41+
42+
echo "Copy certificate files to /certs/ docker volume"
43+
cp -v /etc/letsencrypt/live/"${cert_domain}"/cert.pem /certs/"${cert_domain}".pem
44+
cp -v /etc/letsencrypt/live/"${cert_domain}"/privkey.pem /certs/"${cert_domain}".key.pem
45+
cp -v /etc/letsencrypt/live/"${cert_domain}"/chain.pem /certs/"${cert_domain}".chain.pem
46+
cp -v /etc/letsencrypt/live/"${cert_domain}"/fullchain.pem /certs/"${cert_domain}".fullchain.pem
47+
}
48+
49+
function obtain_certificate {
50+
# Obtain certificate for provided domain
51+
if [ -z "${1}" ] ; then
52+
echo "Missing parameter 1: Admin email"
53+
return 1
54+
fi
55+
local admin_email="${1}"
56+
57+
if [ -z "${2}" ] ; then
58+
echo "Missing parameter 2: Certificate domain name"
59+
return 1
60+
fi
61+
local cert_domain="${2}"
62+
63+
if [ -z "${3}" ] ; then
64+
echo "Missing parameter 3: Webroot location"
65+
return 1
66+
fi
67+
local cert_webroot="${3}"
68+
69+
echo "Obtaining certificate for ${cert_domain}"
70+
certbot certonly \
71+
--agree-tos \
72+
--domain "${cert_domain}" \
73+
--email "${admin_email}" \
74+
--keep-until-expiring \
75+
--max-log-backups 100 \
76+
--non-interactive \
77+
--renew-by-default \
78+
--webroot -w "${cert_webroot}"
79+
}
80+
81+
function renew_certificate {
82+
if [ -z "${1}" ] ; then
83+
echo "Missing parameter 1: Webroot location"
84+
return 1
85+
fi
86+
local cert_webroot="${1}"
87+
88+
echo "Renewing certificates registered on system."
89+
certbot renew \
90+
--non-interactive \
91+
--webroot -w "${cert_webroot}"
92+
}
93+
94+
function process_certificates {
95+
if [ -z "${1}" ] ; then
96+
echo "Missing required parameter 1: Admin email"
97+
return 1
98+
fi
99+
local admin_email="${1}"
100+
101+
if [ -z "${2}" ] ; then
102+
echo "Missing required parameter 2: Certificate domain name"
103+
return 1
104+
fi
105+
local cert_domain="${2}"
106+
107+
if [ -z "${3}" ] ; then
108+
echo "Missing required parameter 3: Webroot location"
109+
return 1
110+
fi
111+
local cert_webroot="${3}"
112+
113+
if check_for_cert "${cert_domain}"; then
114+
renew_certificate "${cert_webroot}"
115+
else
116+
obtain_certificate "${admin_email}" "${cert_domain}" "${cert_webroot}"
117+
fi
118+
119+
copy_certificates "${cert_domain}"
120+
}
121+
122+
admin_email="${admin_email:-}"
123+
certificate_domain="${certificate_domain:-}"
124+
certificate_webroot="${certificate_webroot:-}"
125+
while getopts ":d:e:r:A:SD" opt; do
126+
case ${opt} in
127+
'd') certificate_domain="${OPTARG}" ;;
128+
'e') admin_email="${OPTARG}" ;;
129+
'r') certificate_webroot="${OPTARG}" ;;
130+
'?')
131+
echo "Invalid option: -${OPTARG}"
132+
print_usage
133+
exit 0
134+
;;
135+
':')
136+
echo "Missing option argument for -${OPTARG}"
137+
print_usage
138+
exit 0
139+
;;
140+
'*') # Anything else
141+
echo "Unknown error while processing options"
142+
print_usage
143+
exit 1
144+
;;
145+
esac
146+
done
147+
148+
process_certificates "${admin_email}" "${certificate_domain}" "${certificate_webroot}"

‎bin/travis-ci/check_tag.sh‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
#
3+
# Copyright (c) 2018 SD Elements Inc.
4+
#
5+
# All Rights Reserved.
6+
#
7+
# NOTICE: All information contained herein is, and remains
8+
# the property of SD Elements Incorporated and its suppliers,
9+
# if any. The intellectual and technical concepts contained
10+
# herein are proprietary to SD Elements Incorporated
11+
# and its suppliers and may be covered by U.S., Canadian and other Patents,
12+
# patents in process, and are protected by trade secret or copyright law.
13+
# Dissemination of this information or reproduction of this material
14+
# is strictly forbidden unless prior written permission is obtained
15+
# from SD Elements Inc..
16+
# Version
17+
18+
set -eo pipefail
19+
20+
# echo "Installing shtdlib"
21+
shtdlib_local_path="/usr/local/bin/shtdlib.sh"
22+
sudo curl -s -L -o "${shtdlib_local_path}" https://github.com/sdelements/shtdlib/raw/master/shtdlib.sh
23+
sudo chmod 775 "${shtdlib_local_path}"
24+
# shellcheck disable=SC1091,SC1090
25+
source "${shtdlib_local_path}"
26+
color_echo green "shtdlib.sh installed successfully"
27+
28+
# Get the latest tag from GitHub
29+
latest_tag="$(git fetch -t && git tag -l | sort --version-sort | tail -n1)"
30+
color_echo green "Latest Git tag: '${latest_tag}'"
31+
32+
# Get the latest tag from the CHANGELOG
33+
changelog_ver="$(grep -oP '\[v\d\.\d\.\d\]' CHANGELOG.md | tr -d '[]' | sort -nr | head -n1)"
34+
color_echo green "CHANGELOG version: '${changelog_ver}'"
35+
36+
# Validate version strings
37+
version_pattern='^v\d\.\d\.\d$'
38+
echo "${latest_tag}" | grep -qP ${version_pattern} || ( color_echo red "Invalid tag from repo: '${latest_tag}'" && exit 1 )
39+
echo "${changelog_ver}" | grep -qP ${version_pattern} || ( color_echo red "Invalid tag from CHANGELOG: '${changelog_ver}'" && exit 1 )
40+
41+
# Ensure tags in CHANGELOG and iteration are greater than highest repo tag
42+
if [ "${latest_tag}" = "${changelog_ver}" ] \
43+
|| ! compare_versions "${latest_tag}" "${changelog_ver}"; then
44+
color_echo red "Error: Version in CHANGELOG.md not updated"
45+
exit 1
46+
else
47+
color_echo green "Version bumps PASS!"
48+
fi

‎bin/travis-ci/docker_build.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
#
3+
# Copyright (c) 2018 SD Elements Inc.
4+
#
5+
# All Rights Reserved.
6+
#
7+
# NOTICE: All information contained herein is, and remains
8+
# the property of SD Elements Incorporated and its suppliers,
9+
# if any. The intellectual and technical concepts contained
10+
# herein are proprietary to SD Elements Incorporated
11+
# and its suppliers and may be covered by U.S., Canadian and other Patents,
12+
# patents in process, and are protected by trade secret or copyright law.
13+
# Dissemination of this information or reproduction of this material
14+
# is strictly forbidden unless prior written permission is obtained
15+
# from SD Elements Inc..
16+
# Version
17+
18+
set -eo pipefail
19+
20+
# Build image
21+
docker build --no-cache --tag "${DOCKER_REGISTRY_URL}/postfix" .
22+
docker images

‎bin/travis-ci/docker_publish.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
#
3+
# Copyright (c) 2018 SD Elements Inc.
4+
#
5+
# All Rights Reserved.
6+
#
7+
# NOTICE: All information contained herein is, and remains
8+
# the property of SD Elements Incorporated and its suppliers,
9+
# if any. The intellectual and technical concepts contained
10+
# herein are proprietary to SD Elements Incorporated
11+
# and its suppliers and may be covered by U.S., Canadian and other Patents,
12+
# patents in process, and are protected by trade secret or copyright law.
13+
# Dissemination of this information or reproduction of this material
14+
# is strictly forbidden unless prior written permission is obtained
15+
# from SD Elements Inc..
16+
# Version
17+
18+
set -eo pipefail
19+
20+
# Log into our Docker registry
21+
echo "${DOCKER_REGISTRY_PASSWORD}" | docker login -u "${DOCKER_REGISTRY_USER}" --password-stdin "${DOCKER_REGISTRY_URL}"
22+
23+
# Push image
24+
docker push "${DOCKER_REGISTRY_URL}/postfix:latest"

0 commit comments

Comments
 (0)