diff --git a/README.md b/README.md index 14c6f8f..6abbdfa 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ -> A multi-arch [Let's Encrypt](https://letsencrypt.org/) Docker image using [Lego CLI](https://go-acme.github.io/lego/) client with convenient environment variables support on top of the latest __Debian [12-slim](https://hub.docker.com/_/debian/tags?page=1&name=12-slim)__ ([Bookworm](https://www.debian.org/News/2023/20230610)). +> A multi-arch [Let's Encrypt](https://letsencrypt.org/) Docker image using [Lego CLI](https://go-acme.github.io/lego/) client with convenient environment variables and auto-renewal support on top of the latest __Debian [12-slim](https://hub.docker.com/_/debian/tags?page=1&name=12-slim)__ ([Bookworm](https://www.debian.org/News/2023/20230610)). ## Usage @@ -26,24 +26,30 @@ FROM joseluisq/docker-lets-encrypt # your stuff... ``` -## Example +## Examples Below is an example of obtaining a **wildcard certificate** using the **Cloudflare** provider. In this case, make sure to create first a [Cloudflare API User Token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) for your specific domain with the `DNS:Edit` permission. +### Using Docker run + ```sh docker run -it --rm \ + # Lego CLI options -e ENV_LEGO_ENABLE=true \ -e ENV_LEGO_ACCEPT_TOS=true \ -e ENV_LEGO_EMAIL=email@domain.com \ -e ENV_LEGO_DOMAINS="*.domain.com" \ - # -e ENV_LEGO_PATH=/etc/ssl/.lego \ + # Lego CLI DNS provider -e ENV_LEGO_DNS=cloudflare \ -e CLOUDFLARE_EMAIL=email@domain.com \ -e CLOUDFLARE_DNS_API_TOKEN= \ - -w /root \ - -v $PWD:/etc/ssl/.lego \ + # TLS auto-renewal feature (optional) + -e ENV_CERT_AUTO_RENEW=true \ + -e ENV_CERT_AUTO_RENEW_CRON_INTERVAL="0 0 * * *" \ + # Directory mapping (bind mount) for certificate/key files + -v /etc/ssl/certs/domain.com:/etc/ssl/.lego \ joseluisq/docker-lets-encrypt # 2024/01/01 00:00:30 [INFO] [*.domain.com] acme: Obtaining bundled SAN certificate @@ -69,6 +75,40 @@ docker run -it --rm \ - The container `.lego` directory will contain the certificates and keys, make sure to bind it to a specific host directory. See https://go-acme.github.io/lego/usage/cli/general-instructions/ - See the **Cloudflare** provider options for more details https://go-acme.github.io/lego/dns/cloudflare/ +### Using Docker Compose + +Below is an equivalent example like above but using [Docker Compose](https://docs.docker.com/compose/intro/features-uses/). + +```yaml +version: "3.3" + +services: + joseluisq-net: + image: joseluisq/docker-lets-encrypt:0.0.3 + environment: + # Lego CLI options + - "ENV_LEGO_ENABLE=true" + - "ENV_LEGO_ACCEPT_TOS=true" + - "ENV_LEGO_EMAIL=${ENV_LEGO_EMAIL}" + - "ENV_LEGO_DOMAINS=*.domain.com" + # Lego CLI DNS provider + - "ENV_LEGO_DNS=cloudflare" + - "CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}" + - "CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}" + # TLS auto-renewal feature (optional) + - "ENV_CERT_AUTO_RENEW=true" + - "ENV_CERT_AUTO_RENEW_CRON_INTERVAL=0 0 * * *" + volumes: + # Directory mapping (bind mount) for certificate/key files + - /etc/ssl/certs/domain.com:/etc/ssl/.lego + deploy: + replicas: 1 + update_config: + parallelism: 1 + restart_policy: + condition: on-failure +``` + ## Environment variables The image provides environment variables support for several [Lego CLI](https://go-acme.github.io/lego/usage/cli/) arguments. diff --git a/certificate_renew.sh b/certificate_renew.sh index 5d02a77..aae4b2d 100755 --- a/certificate_renew.sh +++ b/certificate_renew.sh @@ -2,7 +2,7 @@ # # Custom script to renew a certificate before it expires. -# This script can be run by a cron-tab to check for the certificate expiration programmatically. +# This script will be run by a cron-tab to check for the certificate expiration programmatically. # echo "[info] Starting certificate check script..." diff --git a/entrypoint.sh b/entrypoint.sh index 1766bcd..1869881 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -61,11 +61,12 @@ elif [[ -n "$ENV_LEGO_ENABLE" ]] && [[ "$ENV_LEGO_ENABLE" = "true" ]]; then ## Enable auto-renew on-demand if [[ -z "$ENV_LEGO_RENEW" ]] || [[ "$ENV_LEGO_RENEW" = "false" ]]; then if [[ -n "$ENV_CERT_AUTO_RENEW" ]] && [[ "$ENV_CERT_AUTO_RENEW" = "true" ]]; then - # Set the default crontab, redirect output to Docker stdout + # Set the default Crontab and redirect its output to Docker stdout declare -p | grep -Ev 'BASHOPTS|BASH_VERSINFO|EUID|PPID|SHELLOPTS|UID' > /container.env cmd="SHELL=/bin/bash BASH_ENV=/container.env /usr/local/bin/certificate_renew.sh > /proc/1/fd/1 2>&1" crontab -l | echo "$ENV_CERT_AUTO_RENEW_CRON_INTERVAL $cmd" | crontab - - echo "[info] The certificate auto-renew process is configured and waiting for the iteration..." + echo "[info] The certificate auto-renewal process is configured successfully!" + echo "[info] Waiting for the Crontab scheduler to run the task..." echo "[info] Crontab interval: $ENV_CERT_AUTO_RENEW_CRON_INTERVAL" cron -f exit