first
This commit is contained in:
traveler
commit
5aa7d034f7
3292 changed files with 465160 additions and 0 deletions
28
data/Dockerfiles/acme/Dockerfile
Executable file
28
data/Dockerfiles/acme/Dockerfile
Executable file
|
|
@ -0,0 +1,28 @@
|
|||
FROM alpine:3.20
|
||||
|
||||
LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
|
||||
|
||||
|
||||
RUN apk upgrade --no-cache \
|
||||
&& apk add --update --no-cache \
|
||||
bash \
|
||||
curl \
|
||||
openssl \
|
||||
bind-tools \
|
||||
jq \
|
||||
mariadb-client \
|
||||
redis \
|
||||
tini \
|
||||
tzdata \
|
||||
python3 \
|
||||
acme-tiny --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community/
|
||||
|
||||
COPY acme.sh /srv/acme.sh
|
||||
COPY functions.sh /srv/functions.sh
|
||||
COPY obtain-certificate.sh /srv/obtain-certificate.sh
|
||||
COPY reload-configurations.sh /srv/reload-configurations.sh
|
||||
COPY expand6.sh /srv/expand6.sh
|
||||
|
||||
RUN chmod +x /srv/*.sh
|
||||
|
||||
CMD ["/sbin/tini", "-g", "--", "/srv/acme.sh"]
|
||||
431
data/Dockerfiles/acme/acme.sh
Executable file
431
data/Dockerfiles/acme/acme.sh
Executable file
|
|
@ -0,0 +1,431 @@
|
|||
#!/bin/bash
|
||||
set -o pipefail
|
||||
exec 5>&1
|
||||
|
||||
# Do not attempt to write to slave
|
||||
if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
|
||||
export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT}"
|
||||
else
|
||||
export REDIS_CMDLINE="redis-cli -h redis -p 6379"
|
||||
fi
|
||||
|
||||
until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
|
||||
echo "Waiting for Redis..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
source /srv/functions.sh
|
||||
# Thanks to https://github.com/cvmiller -> https://github.com/cvmiller/expand6
|
||||
source /srv/expand6.sh
|
||||
|
||||
# Skipping IP check when we like to live dangerously
|
||||
if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
SKIP_IP_CHECK=y
|
||||
fi
|
||||
|
||||
# Skipping HTTP check when we like to live dangerously
|
||||
if [[ "${SKIP_HTTP_VERIFICATION}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
SKIP_HTTP_VERIFICATION=y
|
||||
fi
|
||||
|
||||
# Request certificate for MAILCOW_HOSTNAME only
|
||||
if [[ "${ONLY_MAILCOW_HOSTNAME}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
ONLY_MAILCOW_HOSTNAME=y
|
||||
fi
|
||||
|
||||
if [[ "${AUTODISCOVER_SAN}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
AUTODISCOVER_SAN=y
|
||||
fi
|
||||
|
||||
# Request individual certificate for every domain
|
||||
if [[ "${ENABLE_SSL_SNI}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
ENABLE_SSL_SNI=y
|
||||
fi
|
||||
|
||||
if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
log_f "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..."
|
||||
sleep 365d
|
||||
exec $(readlink -f "$0")
|
||||
fi
|
||||
|
||||
log_f "Waiting for Docker API..."
|
||||
until ping dockerapi -c1 > /dev/null; do
|
||||
sleep 1
|
||||
done
|
||||
log_f "Docker API OK"
|
||||
|
||||
log_f "Waiting for Postfix..."
|
||||
until ping postfix -c1 > /dev/null; do
|
||||
sleep 1
|
||||
done
|
||||
log_f "Postfix OK"
|
||||
|
||||
log_f "Waiting for Dovecot..."
|
||||
until ping dovecot -c1 > /dev/null; do
|
||||
sleep 1
|
||||
done
|
||||
log_f "Dovecot OK"
|
||||
|
||||
ACME_BASE=/var/lib/acme
|
||||
SSL_EXAMPLE=/var/lib/ssl-example
|
||||
|
||||
mkdir -p ${ACME_BASE}/acme
|
||||
|
||||
# Migrate
|
||||
[[ -f ${ACME_BASE}/acme/private/privkey.pem ]] && mv ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/acme/key.pem
|
||||
[[ -f ${ACME_BASE}/acme/private/account.key ]] && mv ${ACME_BASE}/acme/private/account.key ${ACME_BASE}/acme/account.pem
|
||||
if [[ -f ${ACME_BASE}/acme/key.pem && -f ${ACME_BASE}/acme/cert.pem ]]; then
|
||||
if verify_hash_match ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/acme/key.pem; then
|
||||
log_f "Migrating to SNI folder structure..."
|
||||
CERT_DOMAIN=($(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "Subject:" | sed -e 's/\(Subject:\)\|\(CN = \)\|\(CN=\)//g' | sed -e 's/^[[:space:]]*//'))
|
||||
CERT_DOMAINS=(${CERT_DOMAIN} $(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "DNS:" | sed -e 's/\(DNS:\)\|,//g' | sed "s/${CERT_DOMAIN}//" | sed -e 's/^[[:space:]]*//'))
|
||||
mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
|
||||
mv ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/${CERT_DOMAIN}/cert.pem
|
||||
# key is only copied, not moved, because it is used by all other requests too
|
||||
cp ${ACME_BASE}/acme/key.pem ${ACME_BASE}/${CERT_DOMAIN}/key.pem
|
||||
chmod 600 ${ACME_BASE}/${CERT_DOMAIN}/key.pem
|
||||
echo -n ${CERT_DOMAINS[*]} > ${ACME_BASE}/${CERT_DOMAIN}/domains
|
||||
mv ${ACME_BASE}/acme/acme.csr ${ACME_BASE}/${CERT_DOMAIN}/acme.csr
|
||||
log_f "OK" no_date
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ ! -f ${ACME_BASE}/dhparams.pem ]] && cp ${SSL_EXAMPLE}/dhparams.pem ${ACME_BASE}/dhparams.pem
|
||||
|
||||
if [[ -f ${ACME_BASE}/cert.pem ]] && [[ -f ${ACME_BASE}/key.pem ]] && [[ $(stat -c%s ${ACME_BASE}/cert.pem) != 0 ]]; then
|
||||
ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer)
|
||||
if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* && ${ISSUER} != *"Fake LE Intermediate"* ]]; then
|
||||
log_f "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..."
|
||||
sleep 3650d
|
||||
exec $(readlink -f "$0")
|
||||
fi
|
||||
else
|
||||
if [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ]] && [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ]] && verify_hash_match ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem; then
|
||||
log_f "Restoring previous acme certificate and restarting script..."
|
||||
cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/cert.pem
|
||||
cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ${ACME_BASE}/key.pem
|
||||
# Restarting with env var set to trigger a restart,
|
||||
exec env TRIGGER_RESTART=1 $(readlink -f "$0")
|
||||
else
|
||||
log_f "Restoring mailcow snake-oil certificates and restarting script..."
|
||||
cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
|
||||
cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
|
||||
exec env TRIGGER_RESTART=1 $(readlink -f "$0")
|
||||
fi
|
||||
fi
|
||||
|
||||
chmod 600 ${ACME_BASE}/key.pem
|
||||
|
||||
log_f "Waiting for database..."
|
||||
while ! /usr/bin/mariadb-admin status --ssl=false --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent > /dev/null; do
|
||||
sleep 2
|
||||
done
|
||||
log_f "Database OK"
|
||||
|
||||
log_f "Waiting for Nginx..."
|
||||
until $(curl --output /dev/null --silent --head --fail http://nginx.${COMPOSE_PROJECT_NAME}_mailcow-network:8081); do
|
||||
sleep 2
|
||||
done
|
||||
log_f "Nginx OK"
|
||||
|
||||
log_f "Waiting for resolver..."
|
||||
until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
|
||||
sleep 2
|
||||
done
|
||||
log_f "Resolver OK"
|
||||
|
||||
# Waiting for domain table
|
||||
log_f "Waiting for domain table..."
|
||||
while [[ -z ${DOMAIN_TABLE} ]]; do
|
||||
curl --silent http://nginx.${COMPOSE_PROJECT_NAME}_mailcow-network/ >/dev/null 2>&1
|
||||
DOMAIN_TABLE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
|
||||
[[ -z ${DOMAIN_TABLE} ]] && sleep 10
|
||||
done
|
||||
log_f "OK" no_date
|
||||
|
||||
log_f "Initializing, please wait..."
|
||||
|
||||
while true; do
|
||||
POSTFIX_CERT_SERIAL="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
DOVECOT_CERT_SERIAL="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
# Re-using previous acme-mailcow account and domain keys
|
||||
if [[ ! -f ${ACME_BASE}/acme/key.pem ]]; then
|
||||
log_f "Generating missing domain private rsa key..."
|
||||
openssl genrsa 4096 > ${ACME_BASE}/acme/key.pem
|
||||
else
|
||||
log_f "Using existing domain rsa key ${ACME_BASE}/acme/key.pem"
|
||||
fi
|
||||
if [[ ! -f ${ACME_BASE}/acme/account.pem ]]; then
|
||||
log_f "Generating missing Lets Encrypt account key..."
|
||||
if [[ ! -z ${ACME_CONTACT} ]]; then
|
||||
if ! verify_email "${ACME_CONTACT}"; then
|
||||
log_f "Invalid email address, will not start registration!"
|
||||
sleep 365d
|
||||
exec $(readlink -f "$0")
|
||||
else
|
||||
ACME_CONTACT_PARAMETER="--contact mailto:${ACME_CONTACT}"
|
||||
log_f "Valid email address, using ${ACME_CONTACT} for registration"
|
||||
fi
|
||||
else
|
||||
ACME_CONTACT_PARAMETER=""
|
||||
fi
|
||||
openssl genrsa 4096 > ${ACME_BASE}/acme/account.pem
|
||||
else
|
||||
log_f "Using existing Lets Encrypt account key ${ACME_BASE}/acme/account.pem"
|
||||
fi
|
||||
|
||||
chmod 600 ${ACME_BASE}/acme/key.pem
|
||||
chmod 600 ${ACME_BASE}/acme/account.pem
|
||||
|
||||
unset EXISTING_CERTS
|
||||
declare -a EXISTING_CERTS
|
||||
for cert_dir in ${ACME_BASE}/*/ ; do
|
||||
if [[ ! -f ${cert_dir}domains ]] || [[ ! -f ${cert_dir}cert.pem ]] || [[ ! -f ${cert_dir}key.pem ]]; then
|
||||
continue
|
||||
fi
|
||||
EXISTING_CERTS+=("$(basename ${cert_dir})")
|
||||
done
|
||||
|
||||
# Cleaning up and init validation arrays
|
||||
unset SQL_DOMAIN_ARR
|
||||
unset VALIDATED_CONFIG_DOMAINS
|
||||
unset ADDITIONAL_VALIDATED_SAN
|
||||
unset ADDITIONAL_WC_ARR
|
||||
unset ADDITIONAL_SAN_ARR
|
||||
unset CERT_ERRORS
|
||||
unset CERT_CHANGED
|
||||
unset CERT_AMOUNT_CHANGED
|
||||
unset VALIDATED_CERTIFICATES
|
||||
CERT_ERRORS=0
|
||||
CERT_CHANGED=0
|
||||
CERT_AMOUNT_CHANGED=0
|
||||
declare -a SQL_DOMAIN_ARR
|
||||
declare -a VALIDATED_CONFIG_DOMAINS
|
||||
declare -a ADDITIONAL_VALIDATED_SAN
|
||||
declare -a ADDITIONAL_WC_ARR
|
||||
declare -a ADDITIONAL_SAN_ARR
|
||||
declare -a VALIDATED_CERTIFICATES
|
||||
IFS=',' read -r -a TMP_ARR <<< "${ADDITIONAL_SAN}"
|
||||
for i in "${TMP_ARR[@]}" ; do
|
||||
if [[ "$i" =~ \.\*$ ]]; then
|
||||
ADDITIONAL_WC_ARR+=(${i::-2})
|
||||
else
|
||||
ADDITIONAL_SAN_ARR+=($i)
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
|
||||
# Fetch certs for autoconfig and autodiscover subdomains
|
||||
ADDITIONAL_WC_ARR+=('autodiscover' 'autoconfig')
|
||||
fi
|
||||
|
||||
if [[ ${SKIP_IP_CHECK} != "y" ]]; then
|
||||
# Start IP detection
|
||||
log_f "Detecting IP addresses..."
|
||||
IPV4=$(get_ipv4)
|
||||
IPV6=$(get_ipv6)
|
||||
log_f "OK: ${IPV4}, ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}"
|
||||
fi
|
||||
|
||||
#########################################
|
||||
# IP and webroot challenge verification #
|
||||
SQL_DOMAINS=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0 and active=1" -Bs)
|
||||
if [[ ! $? -eq 0 ]]; then
|
||||
log_f "Failed to read SQL domains, retrying in 1 minute..."
|
||||
sleep 1m
|
||||
exec $(readlink -f "$0")
|
||||
fi
|
||||
while read domains; do
|
||||
if [[ -z "${domains}" ]]; then
|
||||
# ignore empty lines
|
||||
continue
|
||||
fi
|
||||
SQL_DOMAIN_ARR+=("${domains}")
|
||||
done <<< "${SQL_DOMAINS}"
|
||||
|
||||
if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
|
||||
for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
|
||||
unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
|
||||
declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
|
||||
for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
|
||||
if [[ "${SUBDOMAIN}.${SQL_DOMAIN}" != "${MAILCOW_HOSTNAME}" ]]; then
|
||||
if check_domain "${SUBDOMAIN}.${SQL_DOMAIN}"; then
|
||||
VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${SUBDOMAIN}.${SQL_DOMAIN}")
|
||||
fi
|
||||
fi
|
||||
done
|
||||
VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
|
||||
done
|
||||
fi
|
||||
|
||||
if check_domain ${MAILCOW_HOSTNAME}; then
|
||||
VALIDATED_MAILCOW_HOSTNAME="${MAILCOW_HOSTNAME}"
|
||||
fi
|
||||
|
||||
if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
|
||||
for SAN in "${ADDITIONAL_SAN_ARR[@]}"; do
|
||||
# Skip on CAA errors for SAN
|
||||
SAN_PARENT_DOMAIN=$(echo ${SAN} | cut -d. -f2-)
|
||||
SAN_CAAS=( $(dig CAA ${SAN_PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
|
||||
if [[ ! -z ${SAN_CAAS} ]]; then
|
||||
if [[ ${SAN_CAAS[@]} =~ "letsencrypt.org" ]]; then
|
||||
log_f "Validated CAA for parent domain ${SAN_PARENT_DOMAIN} of ${SAN}"
|
||||
else
|
||||
log_f "Skipping ACME validation for ${SAN}: Lets Encrypt disallowed for ${SAN} by CAA record"
|
||||
continue
|
||||
fi
|
||||
fi
|
||||
if [[ ${SAN} == ${MAILCOW_HOSTNAME} ]]; then
|
||||
continue
|
||||
fi
|
||||
if check_domain ${SAN}; then
|
||||
ADDITIONAL_VALIDATED_SAN+=("${SAN}")
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Unique domains for server certificate
|
||||
if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
|
||||
# create certificate for server name and fqdn SANs only
|
||||
SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
|
||||
else
|
||||
# create certificate for all domains, including all subdomains from other domains [*]
|
||||
SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
|
||||
fi
|
||||
if [[ ! -z ${SERVER_SAN_VALIDATED[*]} ]]; then
|
||||
CERT_NAME=${SERVER_SAN_VALIDATED[0]}
|
||||
VALIDATED_CERTIFICATES+=("${CERT_NAME}")
|
||||
|
||||
# obtain server certificate if required
|
||||
ACME_CONTACT_PARAMETER=${ACME_CONTACT_PARAMETER} DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
|
||||
RETURN="$?"
|
||||
if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
|
||||
CERT_AMOUNT_CHANGED=1
|
||||
CERT_CHANGED=1
|
||||
elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
|
||||
CERT_CHANGED=1
|
||||
elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
|
||||
:
|
||||
else
|
||||
CERT_ERRORS=1
|
||||
fi
|
||||
# copy hostname certificate to default/server certificate
|
||||
# do not a key when cert is missing, this can lead to a mismatch of cert/key
|
||||
if [[ -f ${ACME_BASE}/${CERT_NAME}/cert.pem ]]; then
|
||||
cp ${ACME_BASE}/${CERT_NAME}/cert.pem ${ACME_BASE}/cert.pem
|
||||
cp ${ACME_BASE}/${CERT_NAME}/key.pem ${ACME_BASE}/key.pem
|
||||
fi
|
||||
fi
|
||||
|
||||
# individual certificates for SNI [@]
|
||||
if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
|
||||
for VALIDATED_DOMAINS in "${VALIDATED_CONFIG_DOMAINS[@]}"; do
|
||||
VALIDATED_DOMAINS_ARR=(${VALIDATED_DOMAINS})
|
||||
|
||||
unset VALIDATED_DOMAINS_SORTED
|
||||
declare -a VALIDATED_DOMAINS_SORTED
|
||||
VALIDATED_DOMAINS_SORTED=(${VALIDATED_DOMAINS_ARR[0]} $(echo ${VALIDATED_DOMAINS_ARR[@]:1} | xargs -n1 | sort -u | xargs))
|
||||
|
||||
# remove all domain names that are already inside the server certificate (SERVER_SAN_VALIDATED)
|
||||
for domain in "${SERVER_SAN_VALIDATED[@]}"; do
|
||||
for i in "${!VALIDATED_DOMAINS_SORTED[@]}"; do
|
||||
if [[ ${VALIDATED_DOMAINS_SORTED[i]} = $domain ]]; then
|
||||
unset 'VALIDATED_DOMAINS_SORTED[i]'
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
if [[ ! -z ${VALIDATED_DOMAINS_SORTED[*]} ]]; then
|
||||
CERT_NAME=${VALIDATED_DOMAINS_SORTED[0]}
|
||||
VALIDATED_CERTIFICATES+=("${CERT_NAME}")
|
||||
# obtain certificate if required
|
||||
DOMAINS=${VALIDATED_DOMAINS_SORTED[@]} /srv/obtain-certificate.sh rsa
|
||||
RETURN="$?"
|
||||
if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
|
||||
CERT_AMOUNT_CHANGED=1
|
||||
CERT_CHANGED=1
|
||||
elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
|
||||
CERT_CHANGED=1
|
||||
elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
|
||||
:
|
||||
else
|
||||
CERT_ERRORS=1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -z ${VALIDATED_CERTIFICATES[*]} ]]; then
|
||||
log_f "Cannot validate any hostnames, skipping Let's Encrypt for 1 hour."
|
||||
log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
|
||||
${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
|
||||
sleep 1h
|
||||
exec $(readlink -f "$0")
|
||||
fi
|
||||
|
||||
# find orphaned certificates if no errors occurred
|
||||
if [[ "${CERT_ERRORS}" == "0" ]]; then
|
||||
for EXISTING_CERT in "${EXISTING_CERTS[@]}"; do
|
||||
if [[ ! "`printf '_%s_\n' "${VALIDATED_CERTIFICATES[@]}"`" == *"_${EXISTING_CERT}_"* ]]; then
|
||||
DATE=$(date +%Y-%m-%d_%H_%M_%S)
|
||||
log_f "Found orphaned certificate: ${EXISTING_CERT} - archiving it at ${ACME_BASE}/backups/${EXISTING_CERT}/"
|
||||
BACKUP_DIR=${ACME_BASE}/backups/${EXISTING_CERT}/${DATE}
|
||||
# archive rsa cert and any other files
|
||||
mkdir -p ${ACME_BASE}/backups/${EXISTING_CERT}
|
||||
mv ${ACME_BASE}/${EXISTING_CERT} ${BACKUP_DIR}
|
||||
CERT_CHANGED=1
|
||||
CERT_AMOUNT_CHANGED=1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# reload on new or changed certificates
|
||||
if [[ "${CERT_CHANGED}" == "1" ]]; then
|
||||
rm -f "${ACME_BASE}/force_renew" 2> /dev/null
|
||||
RELOAD_LOOP_C=1
|
||||
while [[ "${POSTFIX_CERT_SERIAL}" == "${POSTFIX_CERT_SERIAL_NEW}" ]] || [[ "${DOVECOT_CERT_SERIAL}" == "${DOVECOT_CERT_SERIAL_NEW}" ]] || [[ ${#POSTFIX_CERT_SERIAL_NEW} -ne 36 ]] || [[ ${#DOVECOT_CERT_SERIAL_NEW} -ne 36 ]]; do
|
||||
log_f "Reloading or restarting services... (${RELOAD_LOOP_C})"
|
||||
RELOAD_LOOP_C=$((RELOAD_LOOP_C + 1))
|
||||
CERT_AMOUNT_CHANGED=${CERT_AMOUNT_CHANGED} /srv/reload-configurations.sh
|
||||
log_f "Waiting for containers to settle..."
|
||||
sleep 10
|
||||
until nc -z dovecot 143; do
|
||||
sleep 1
|
||||
done
|
||||
until nc -z postfix 25; do
|
||||
sleep 1
|
||||
done
|
||||
POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
|
||||
if [[ ${RELOAD_LOOP_C} -gt 3 ]]; then
|
||||
log_f "Some services do return old end dates, something went wrong!"
|
||||
${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
|
||||
break;
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
case "$CERT_ERRORS" in
|
||||
0) # all successful
|
||||
if [[ "${CERT_CHANGED}" == "1" ]]; then
|
||||
if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
|
||||
log_f "Certificates successfully requested and renewed where required, sleeping one day"
|
||||
else
|
||||
log_f "Certificates were successfully renewed where required, sleeping for another day."
|
||||
fi
|
||||
else
|
||||
log_f "Certificates were successfully validated, no changes or renewals required, sleeping for another day."
|
||||
fi
|
||||
sleep 1d
|
||||
;;
|
||||
*) # non-zero
|
||||
log_f "Some errors occurred, retrying in 30 minutes..."
|
||||
${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
|
||||
sleep 30m
|
||||
exec $(readlink -f "$0")
|
||||
;;
|
||||
esac
|
||||
|
||||
done
|
||||
131
data/Dockerfiles/acme/expand6.sh
Executable file
131
data/Dockerfiles/acme/expand6.sh
Executable file
|
|
@ -0,0 +1,131 @@
|
|||
#!/bin/bash
|
||||
|
||||
##################################################################################
|
||||
#
|
||||
# Copyright (C) 2017 Craig Miller
|
||||
#
|
||||
# See the file "LICENSE" for information on usage and redistribution
|
||||
# of this file, and for a DISCLAIMER OF ALL WARRANTIES.
|
||||
# Distributed under GPLv2 License
|
||||
#
|
||||
##################################################################################
|
||||
|
||||
|
||||
# IPv6 Address Expansion functions
|
||||
#
|
||||
# by Craig Miller 19 Feb 2017
|
||||
#
|
||||
# 16 Nov 2017 v0.93 - added CLI functionality
|
||||
|
||||
|
||||
VERSION=0.93
|
||||
|
||||
empty_addr="0000:0000:0000:0000:0000:0000:0000:0000"
|
||||
empty_addr_len=${#empty_addr}
|
||||
|
||||
function usage {
|
||||
echo " $0 - expand compressed IPv6 addresss "
|
||||
echo " e.g. $0 2001:db8:1:12:123::456 "
|
||||
echo " "
|
||||
echo " -t self test"
|
||||
echo " "
|
||||
echo " By Craig Miller - Version: $VERSION"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [ "$1" == "-h" ]; then
|
||||
#call help
|
||||
usage
|
||||
fi
|
||||
|
||||
#
|
||||
# Expands IPv6 quibble to 4 digits with leading zeros e.g. db8 -> 0db8
|
||||
#
|
||||
# Returns string with expanded quibble
|
||||
|
||||
function expand_quibble() {
|
||||
addr=$1
|
||||
# create array of quibbles
|
||||
addr_array=(${addr//:/ })
|
||||
addr_array_len=${#addr_array[@]}
|
||||
# step thru quibbles
|
||||
for ((i=0; i< $addr_array_len ; i++ ))
|
||||
do
|
||||
quibble=${addr_array[$i]}
|
||||
quibble_len=${#quibble}
|
||||
case $quibble_len in
|
||||
1) quibble="000$quibble";;
|
||||
2) quibble="00$quibble";;
|
||||
3) quibble="0$quibble";;
|
||||
esac
|
||||
addr_array[$i]=$quibble
|
||||
done
|
||||
# reconstruct addr from quibbles
|
||||
return_str=${addr_array[*]}
|
||||
return_str="${return_str// /:}"
|
||||
echo $return_str
|
||||
}
|
||||
|
||||
#
|
||||
# Expands IPv6 address :: format to full zeros
|
||||
#
|
||||
# Returns string with expanded address
|
||||
|
||||
function expand() {
|
||||
if [[ $1 == *"::"* ]]; then
|
||||
# check for leading zeros on front_addr
|
||||
if [[ $1 == "::"* ]]; then
|
||||
front_addr=0
|
||||
else
|
||||
front_addr=$(echo $1 | sed -r 's;([^ ]+)::.*;\1;')
|
||||
fi
|
||||
# check for trailing zeros on back_addr
|
||||
if [[ $1 == *"::" ]]; then
|
||||
back_addr=0
|
||||
else
|
||||
back_addr=$(echo $1 | sed -r 's;.*::([^ ]+);\1;')
|
||||
fi
|
||||
front_addr=$(expand_quibble $front_addr)
|
||||
back_addr=$(expand_quibble $back_addr)
|
||||
|
||||
new_addr=$empty_addr
|
||||
front_addr_len=${#front_addr}
|
||||
back_addr_len=${#back_addr}
|
||||
# calculate fill needed
|
||||
num_zeros=$(($empty_addr_len - $front_addr_len - $back_addr_len - 1))
|
||||
|
||||
#fill_str=${empty_addr[0]:0:$num_zeros}
|
||||
new_addr="$front_addr:${empty_addr[0]:0:$num_zeros}$back_addr"
|
||||
|
||||
# return expanded address
|
||||
echo $new_addr
|
||||
else
|
||||
# return input with expandd quibbles
|
||||
expand_quibble $1
|
||||
fi
|
||||
}
|
||||
|
||||
# self test - call with '-t' parameter
|
||||
if [ "$1" == "-t" ]; then
|
||||
# add address examples to test
|
||||
expand fd11::1d70:cf84:18ef:d056
|
||||
expand 2a01::1
|
||||
expand fe80::f203:8cff:fe3f:f041
|
||||
expand 2001:db8:123::5
|
||||
expand 2001:470:ebbd:0:f203:8cff:fe3f:f041
|
||||
# special cases
|
||||
expand ::1
|
||||
expand fd32:197d:3022:1101::
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# allow script to be sourced (with no arguements)
|
||||
if [[ $1 != "" ]]; then
|
||||
# validate input is an IPv6 address
|
||||
if [[ $1 == *":"* ]]; then
|
||||
expand $1
|
||||
else
|
||||
echo "ERROR: unregcognized IPv6 address $1"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
132
data/Dockerfiles/acme/functions.sh
Executable file
132
data/Dockerfiles/acme/functions.sh
Executable file
|
|
@ -0,0 +1,132 @@
|
|||
#!/bin/bash
|
||||
|
||||
log_f() {
|
||||
if [[ ${2} == "no_nl" ]]; then
|
||||
echo -n "$(date) - ${1}"
|
||||
elif [[ ${2} == "no_date" ]]; then
|
||||
echo "${1}"
|
||||
elif [[ ${2} != "redis_only" ]]; then
|
||||
echo "$(date) - ${1}"
|
||||
fi
|
||||
if [[ ${3} == "b64" ]]; then
|
||||
${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"base64,$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}")\"}" > /dev/null
|
||||
else
|
||||
${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}" | \
|
||||
tr '%&;$"[]{}-\r\n' ' ')\"}" > /dev/null
|
||||
fi
|
||||
}
|
||||
|
||||
verify_email(){
|
||||
regex="^(([A-Za-z0-9]+((\.|\-|\_|\+)?[A-Za-z0-9]?)*[A-Za-z0-9]+)|[A-Za-z0-9]+)@(([A-Za-z0-9]+)+((\.|\-|\_)?([A-Za-z0-9]+)+)*)+\.([A-Za-z]{2,})+$"
|
||||
if [[ $1 =~ ${regex} ]]; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
verify_hash_match(){
|
||||
CERT_HASH=$(openssl x509 -in "${1}" -noout -pubkey | openssl md5)
|
||||
KEY_HASH=$(openssl pkey -in "${2}" -pubout | openssl md5)
|
||||
if [[ ${CERT_HASH} != ${KEY_HASH} ]]; then
|
||||
log_f "Certificate and key hashes do not match!"
|
||||
return 1
|
||||
else
|
||||
log_f "Verified hashes."
|
||||
return 0
|
||||
fi
|
||||
}
|
||||
|
||||
get_ipv4(){
|
||||
local IPV4=
|
||||
local IPV4_SRCS=
|
||||
local TRY=
|
||||
IPV4_SRCS[0]="ip4.mailcow.email"
|
||||
IPV4_SRCS[1]="ip4.nevondo.com"
|
||||
until [[ ! -z ${IPV4} ]] || [[ ${TRY} -ge 10 ]]; do
|
||||
IPV4=$(curl --connect-timeout 3 -m 10 -L4s ${IPV4_SRCS[$RANDOM % ${#IPV4_SRCS[@]} ]} | grep -E "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$")
|
||||
[[ ! -z ${TRY} ]] && sleep 1
|
||||
TRY=$((TRY+1))
|
||||
done
|
||||
echo ${IPV4}
|
||||
}
|
||||
|
||||
get_ipv6(){
|
||||
local IPV6=
|
||||
local IPV6_SRCS=
|
||||
local TRY=
|
||||
IPV6_SRCS[0]="ip6.mailcow.email"
|
||||
IPV6_SRCS[1]="ip6.nevondo.com"
|
||||
until [[ ! -z ${IPV6} ]] || [[ ${TRY} -ge 10 ]]; do
|
||||
IPV6=$(curl --connect-timeout 3 -m 10 -L6s ${IPV6_SRCS[$RANDOM % ${#IPV6_SRCS[@]} ]} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$")
|
||||
[[ ! -z ${TRY} ]] && sleep 1
|
||||
TRY=$((TRY+1))
|
||||
done
|
||||
echo ${IPV6}
|
||||
}
|
||||
|
||||
check_domain(){
|
||||
DOMAIN=$1
|
||||
A_DOMAIN=$(dig A ${DOMAIN} +short | tail -n 1)
|
||||
AAAA_DOMAIN=$(dig AAAA ${DOMAIN} +short | tail -n 1)
|
||||
# Hard-fail on CAA errors for MAILCOW_HOSTNAME
|
||||
PARENT_DOMAIN=$(echo ${DOMAIN} | cut -d. -f2-)
|
||||
CAAS=( $(dig CAA ${PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
|
||||
if [[ ! -z ${CAAS} ]]; then
|
||||
if [[ ${CAAS[@]} =~ "letsencrypt.org" ]]; then
|
||||
log_f "Validated CAA for parent domain ${PARENT_DOMAIN}"
|
||||
else
|
||||
log_f "Lets Encrypt disallowed for ${PARENT_DOMAIN} by CAA record"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
# Check if CNAME without v6 enabled target
|
||||
if [[ ! -z ${AAAA_DOMAIN} ]] && [[ -z $(echo ${AAAA_DOMAIN} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$") ]]; then
|
||||
AAAA_DOMAIN=
|
||||
fi
|
||||
if [[ ! -z ${AAAA_DOMAIN} ]]; then
|
||||
log_f "Found AAAA record for ${DOMAIN}: ${AAAA_DOMAIN} - skipping A record check"
|
||||
if [[ $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) == $(expand ${AAAA_DOMAIN}) ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT6_TO_SOURCE} != "n" ]]; then
|
||||
if verify_challenge_path "${DOMAIN}" 6; then
|
||||
log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN})"
|
||||
return 0
|
||||
else
|
||||
log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN}), but HTTP validation failed"
|
||||
fi
|
||||
else
|
||||
log_f "Cannot match your IP $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) against hostname ${DOMAIN} (DNS returned $(expand ${AAAA_DOMAIN}))"
|
||||
fi
|
||||
elif [[ ! -z ${A_DOMAIN} ]]; then
|
||||
log_f "Found A record for ${DOMAIN}: ${A_DOMAIN}"
|
||||
if [[ ${IPV4:-ERR} == ${A_DOMAIN} ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT_TO_SOURCE} != "n" ]]; then
|
||||
if verify_challenge_path "${DOMAIN}" 4; then
|
||||
log_f "Confirmed A record ${A_DOMAIN}"
|
||||
return 0
|
||||
else
|
||||
log_f "Confirmed A record with IP ${A_DOMAIN}, but HTTP validation failed"
|
||||
fi
|
||||
else
|
||||
log_f "Cannot match your IP ${IPV4} against hostname ${DOMAIN} (DNS returned ${A_DOMAIN})"
|
||||
fi
|
||||
else
|
||||
log_f "No A or AAAA record found for hostname ${DOMAIN}"
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
verify_challenge_path(){
|
||||
if [[ ${SKIP_HTTP_VERIFICATION} == "y" ]]; then
|
||||
echo '(skipping check, returning 0)'
|
||||
return 0
|
||||
fi
|
||||
# verify_challenge_path URL 4|6
|
||||
RANDOM_N=${RANDOM}${RANDOM}${RANDOM}
|
||||
echo ${RANDOM_N} > /var/www/acme/${RANDOM_N}
|
||||
if [[ "$(curl --insecure -${2} -L http://${1}/.well-known/acme-challenge/${RANDOM_N} --silent)" == "${RANDOM_N}" ]]; then
|
||||
rm /var/www/acme/${RANDOM_N}
|
||||
return 0
|
||||
else
|
||||
rm /var/www/acme/${RANDOM_N}
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
130
data/Dockerfiles/acme/obtain-certificate.sh
Executable file
130
data/Dockerfiles/acme/obtain-certificate.sh
Executable file
|
|
@ -0,0 +1,130 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Return values / exit codes
|
||||
# 0 = cert created successfully
|
||||
# 1 = cert renewed successfully
|
||||
# 2 = cert not due for renewal
|
||||
# * = errors
|
||||
|
||||
|
||||
source /srv/functions.sh
|
||||
|
||||
CERT_DOMAINS=(${DOMAINS[@]})
|
||||
CERT_DOMAIN=${CERT_DOMAINS[0]}
|
||||
ACME_BASE=/var/lib/acme
|
||||
|
||||
TYPE=${1}
|
||||
PREFIX=""
|
||||
# only support rsa certificates for now
|
||||
if [[ "${TYPE}" != "rsa" ]]; then
|
||||
log_f "Unknown certificate type '${TYPE}' requested"
|
||||
exit 5
|
||||
fi
|
||||
DOMAINS_FILE=${ACME_BASE}/${CERT_DOMAIN}/domains
|
||||
CERT=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}cert.pem
|
||||
SHARED_KEY=${ACME_BASE}/acme/${PREFIX}key.pem # must already exist
|
||||
KEY=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}key.pem
|
||||
CSR=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}acme.csr
|
||||
|
||||
if [[ -z ${CERT_DOMAINS[*]} ]]; then
|
||||
log_f "Missing CERT_DOMAINS to obtain a certificate"
|
||||
exit 3
|
||||
fi
|
||||
|
||||
if [[ "${LE_STAGING}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
|
||||
if [[ ! -z "${DIRECTORY_URL}" ]]; then
|
||||
log_f "Cannot use DIRECTORY_URL with LE_STAGING=y - ignoring DIRECTORY_URL"
|
||||
fi
|
||||
log_f "Using Let's Encrypt staging servers"
|
||||
DIRECTORY_URL='--directory-url https://acme-staging-v02.api.letsencrypt.org/directory'
|
||||
elif [[ ! -z "${DIRECTORY_URL}" ]]; then
|
||||
log_f "Using custom directory URL ${DIRECTORY_URL}"
|
||||
DIRECTORY_URL="--directory-url ${DIRECTORY_URL}"
|
||||
fi
|
||||
|
||||
if [[ -f ${DOMAINS_FILE} && "$(cat ${DOMAINS_FILE})" == "${CERT_DOMAINS[*]}" ]]; then
|
||||
if [[ ! -f ${CERT} || ! -f "${KEY}" || -f "${ACME_BASE}/force_renew" ]]; then
|
||||
log_f "Certificate ${CERT} doesn't exist yet or forced renewal - start obtaining"
|
||||
# Certificate exists and did not change but could be due for renewal (30 days)
|
||||
elif ! openssl x509 -checkend 2592000 -noout -in ${CERT} > /dev/null; then
|
||||
log_f "Certificate ${CERT} is due for renewal (< 30 days) - start renewing"
|
||||
else
|
||||
log_f "Certificate ${CERT} validation done, neither changed nor due for renewal."
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
log_f "Certificate ${CERT} missing or changed domains '${CERT_DOMAINS[*]}' - start obtaining"
|
||||
fi
|
||||
|
||||
|
||||
# Make backup
|
||||
if [[ -f ${CERT} ]]; then
|
||||
DATE=$(date +%Y-%m-%d_%H_%M_%S)
|
||||
BACKUP_DIR=${ACME_BASE}/backups/${CERT_DOMAIN}/${PREFIX}${DATE}
|
||||
log_f "Creating backups in ${BACKUP_DIR} ..."
|
||||
mkdir -p ${BACKUP_DIR}/
|
||||
[[ -f ${DOMAINS_FILE} ]] && cp ${DOMAINS_FILE} ${BACKUP_DIR}/
|
||||
[[ -f ${CERT} ]] && cp ${CERT} ${BACKUP_DIR}/
|
||||
[[ -f ${KEY} ]] && cp ${KEY} ${BACKUP_DIR}/
|
||||
[[ -f ${CSR} ]] && cp ${CSR} ${BACKUP_DIR}/
|
||||
fi
|
||||
|
||||
mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
|
||||
if [[ ! -f ${KEY} ]]; then
|
||||
log_f "Copying shared private key for this certificate..."
|
||||
cp ${SHARED_KEY} ${KEY}
|
||||
chmod 600 ${KEY}
|
||||
fi
|
||||
|
||||
# Generating CSR
|
||||
printf "[SAN]\nsubjectAltName=" > /tmp/_SAN
|
||||
printf "DNS:%s," "${CERT_DOMAINS[@]}" >> /tmp/_SAN
|
||||
sed -i '$s/,$//' /tmp/_SAN
|
||||
openssl req -new -sha256 -key ${KEY} -subj "/" -reqexts SAN -config <(cat "$(openssl version -d | sed 's/.*"\(.*\)"/\1/g')/openssl.cnf" /tmp/_SAN) > ${CSR}
|
||||
|
||||
# acme-tiny writes info to stderr and ceritifcate to stdout
|
||||
# The redirects will do the following:
|
||||
# - redirect stdout to temp certificate file
|
||||
# - redirect acme-tiny stderr to stdout (logs to variable ACME_RESPONSE)
|
||||
# - tee stderr to get live output and log to dockerd
|
||||
|
||||
log_f "Checking resolver..."
|
||||
until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
|
||||
sleep 2
|
||||
done
|
||||
log_f "Resolver OK"
|
||||
log_f "Using command acme-tiny ${DIRECTORY_URL} ${ACME_CONTACT_PARAMETER} --account-key ${ACME_BASE}/acme/account.pem --disable-check --csr ${CSR} --acme-dir /var/www/acme/"
|
||||
ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} ${ACME_CONTACT_PARAMETER} \
|
||||
--account-key ${ACME_BASE}/acme/account.pem \
|
||||
--disable-check \
|
||||
--csr ${CSR} \
|
||||
--acme-dir /var/www/acme/ 2>&1 > /tmp/_cert.pem | tee /dev/fd/5; exit ${PIPESTATUS[0]})
|
||||
SUCCESS="$?"
|
||||
ACME_RESPONSE_B64=$(echo "${ACME_RESPONSE}" | openssl enc -e -A -base64)
|
||||
log_f "${ACME_RESPONSE_B64}" redis_only b64
|
||||
case "$SUCCESS" in
|
||||
0) # cert requested
|
||||
log_f "Deploying certificate ${CERT}..."
|
||||
# Deploy the new certificate and key
|
||||
# Moving temp cert to {domain} folder
|
||||
if verify_hash_match /tmp/_cert.pem ${KEY}; then
|
||||
RETURN=0 # certificate created
|
||||
if [[ -f ${CERT} ]]; then
|
||||
RETURN=1 # certificate renewed
|
||||
fi
|
||||
mv -f /tmp/_cert.pem ${CERT}
|
||||
echo -n ${CERT_DOMAINS[*]} > ${DOMAINS_FILE}
|
||||
rm /var/www/acme/* 2> /dev/null
|
||||
log_f "Certificate successfully obtained"
|
||||
exit ${RETURN}
|
||||
else
|
||||
log_f "Certificate was successfully requested, but key and certificate have non-matching hashes, ignoring certificate"
|
||||
exit 4
|
||||
fi
|
||||
;;
|
||||
*) # non-zero is non-fun
|
||||
log_f "Failed to obtain certificate ${CERT} for domains '${CERT_DOMAINS[*]}'"
|
||||
redis-cli -h redis SET ACME_FAIL_TIME "$(date +%s)"
|
||||
exit 100${SUCCESS}
|
||||
;;
|
||||
esac
|
||||
45
data/Dockerfiles/acme/reload-configurations.sh
Executable file
45
data/Dockerfiles/acme/reload-configurations.sh
Executable file
|
|
@ -0,0 +1,45 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Reading container IDs
|
||||
# Wrapping as array to ensure trimmed content when calling $NGINX etc.
|
||||
NGINX=($(curl --silent --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"nginx-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
|
||||
DOVECOT=($(curl --silent --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"dovecot-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
|
||||
POSTFIX=($(curl --silent --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"postfix-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
|
||||
|
||||
reload_nginx(){
|
||||
echo "Reloading Nginx..."
|
||||
NGINX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/${NGINX}/exec -d '{"cmd":"reload", "task":"nginx"}' --silent -H 'Content-type: application/json' | jq -r .type)
|
||||
[[ ${NGINX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Nginx, restarting container..."; restart_container ${NGINX} ; }
|
||||
}
|
||||
|
||||
reload_dovecot(){
|
||||
echo "Reloading Dovecot..."
|
||||
DOVECOT_RELOAD_RET=$(curl -X POST --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/${DOVECOT}/exec -d '{"cmd":"reload", "task":"dovecot"}' --silent -H 'Content-type: application/json' | jq -r .type)
|
||||
[[ ${DOVECOT_RELOAD_RET} != 'success' ]] && { echo "Could not reload Dovecot, restarting container..."; restart_container ${DOVECOT} ; }
|
||||
}
|
||||
|
||||
reload_postfix(){
|
||||
echo "Reloading Postfix..."
|
||||
POSTFIX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/${POSTFIX}/exec -d '{"cmd":"reload", "task":"postfix"}' --silent -H 'Content-type: application/json' | jq -r .type)
|
||||
[[ ${POSTFIX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Postfix, restarting container..."; restart_container ${POSTFIX} ; }
|
||||
}
|
||||
|
||||
restart_container(){
|
||||
for container in $*; do
|
||||
echo "Restarting ${container}..."
|
||||
C_REST_OUT=$(curl -X POST --insecure https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/${container}/restart --silent | jq -r '.msg')
|
||||
echo "${C_REST_OUT}"
|
||||
done
|
||||
}
|
||||
|
||||
if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
|
||||
restart_container ${NGINX}
|
||||
restart_container ${DOVECOT}
|
||||
restart_container ${POSTFIX}
|
||||
else
|
||||
reload_nginx
|
||||
#reload_dovecot
|
||||
restart_container ${DOVECOT}
|
||||
#reload_postfix
|
||||
restart_container ${POSTFIX}
|
||||
fi
|
||||
Loading…
Add table
Add a link
Reference in a new issue