diff --git a/.gitignore b/.gitignore index 68f5d131..8d3b4fb3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -/data/certbot +certbot/ diff --git a/LICENSE b/LICENSE index 854a0821..192d4a78 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,7 @@ MIT License Copyright (c) 2018 Philipp Schmieder +Copyright (c) 2023 Luke 10X Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/data/nginx/app.conf b/data/nginx/app.conf deleted file mode 100644 index 52dc0e78..00000000 --- a/data/nginx/app.conf +++ /dev/null @@ -1,31 +0,0 @@ -server { - listen 80; - server_name example.org; - server_tokens off; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - return 301 https://$host$request_uri; - } -} - -server { - listen 443 ssl; - server_name example.org; - server_tokens off; - - ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - location / { - proxy_pass http://example.org; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } -} diff --git a/docker-compose.yml b/docker-compose.yml index 9615cc1f..ff2cfbd7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,9 +5,10 @@ services: image: nginx:1.15-alpine restart: unless-stopped volumes: - - ./data/nginx:/etc/nginx/conf.d - - ./data/certbot/conf:/etc/letsencrypt - - ./data/certbot/www:/var/www/certbot + - ./nginx/conf.d:/etc/nginx/conf.d:ro + - ./nginx/www:/var/www/sites:ro + - ./certbot/letsencrypt:/etc/letsencrypt:ro + - ./certbot/www:/var/www/certbot:ro ports: - "80:80" - "443:443" @@ -16,6 +17,6 @@ services: image: certbot/certbot restart: unless-stopped volumes: - - ./data/certbot/conf:/etc/letsencrypt - - ./data/certbot/www:/var/www/certbot + - ./certbot/letsencrypt:/etc/letsencrypt:rw + - ./certbot/www:/var/www/certbot:rw entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'" diff --git a/init-letsencrypt.sh b/init-letsencrypt.sh index a3f3cb01..d0259024 100755 --- a/init-letsencrypt.sh +++ b/init-letsencrypt.sh @@ -5,9 +5,18 @@ if ! [ -x "$(command -v docker-compose)" ]; then exit 1 fi -domains=(example.org www.example.org) +function lsconf() { + for file in ./nginx/conf.d/*.conf; do + filename=$(basename "$file") + echo "${filename%.*}" + done +} + +configs=$(lsconf | xargs) +domains=($configs) + rsa_key_size=4096 -data_path="./data/certbot" +data_path="./certbot/letsencrypt" email="" # Adding a valid address is strongly recommended staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits @@ -19,17 +28,17 @@ if [ -d "$data_path" ]; then fi -if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then +if [ ! -e "$data_path/options-ssl-nginx.conf" ] || [ ! -e "$data_path/ssl-dhparams.pem" ]; then echo "### Downloading recommended TLS parameters ..." - mkdir -p "$data_path/conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem" + mkdir -p "$data_path" + curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/options-ssl-nginx.conf" + curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/ssl-dhparams.pem" echo fi echo "### Creating dummy certificate for $domains ..." path="/etc/letsencrypt/live/$domains" -mkdir -p "$data_path/conf/live/$domains" +mkdir -p "$data_path/live/$domains" docker-compose run --rm --entrypoint "\ openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\ -keyout '$path/privkey.pem' \ diff --git a/nginx/conf.d/.gitignore b/nginx/conf.d/.gitignore new file mode 100644 index 00000000..d6b7ef32 --- /dev/null +++ b/nginx/conf.d/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore diff --git a/nginx/www/.gitignore b/nginx/www/.gitignore new file mode 100644 index 00000000..d6b7ef32 --- /dev/null +++ b/nginx/www/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore