mirror of
https://github.com/nginx-proxy/docker-letsencrypt-nginx-proxy-companion
synced 2024-11-26 13:03:52 +01:00
181 lines
7.9 KiB
Bash
Executable File
181 lines
7.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -u
|
|
|
|
# shellcheck source=functions.sh
|
|
source /app/functions.sh
|
|
|
|
function print_version {
|
|
if [[ -n "${COMPANION_VERSION:-}" ]]; then
|
|
echo "Info: running acme-companion version ${COMPANION_VERSION}"
|
|
fi
|
|
}
|
|
|
|
function check_docker_socket {
|
|
if [[ $DOCKER_HOST == unix://* ]]; then
|
|
socket_file=${DOCKER_HOST#unix://}
|
|
if [[ ! -S $socket_file ]]; then
|
|
echo "Error: you need to share your Docker host socket with a volume at $socket_file" >&2
|
|
echo "Typically you should run your container with: '-v /var/run/docker.sock:$socket_file:ro'" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
}
|
|
|
|
function check_writable_directory {
|
|
local dir="$1"
|
|
if [[ $(get_self_cid) ]]; then
|
|
if ! docker_api "/containers/$(get_self_cid)/json" | jq ".Mounts[].Destination" | grep -q "^\"$dir\"$"; then
|
|
echo "Warning: '$dir' does not appear to be a mounted volume."
|
|
fi
|
|
else
|
|
echo "Warning: can't check if '$dir' is a mounted volume without self container ID."
|
|
fi
|
|
if [[ ! -d "$dir" ]]; then
|
|
echo "Error: can't access to '$dir' directory !" >&2
|
|
echo "Check that '$dir' directory is declared as a writable volume." >&2
|
|
exit 1
|
|
fi
|
|
if ! touch "$dir/.check_writable" 2>/dev/null ; then
|
|
echo "Error: can't write to the '$dir' directory !" >&2
|
|
echo "Check that '$dir' directory is export as a writable volume." >&2
|
|
exit 1
|
|
fi
|
|
rm -f "$dir/.check_writable"
|
|
}
|
|
|
|
function check_dh_group {
|
|
# DH params will be supplied for acme-companion here:
|
|
local DHPARAM_FILE='/etc/nginx/certs/dhparam.pem'
|
|
|
|
# Should be 2048, 3072, or 4096 (default):
|
|
local DHPARAM_BITS="${DHPARAM_BITS:=4096}"
|
|
|
|
# Skip generation if DHPARAM_SKIP is set to true
|
|
if parse_true "${DHPARAM_SKIP:=false}"; then
|
|
echo "Info: Skipping Diffie-Hellman group setup."
|
|
return 0
|
|
fi
|
|
|
|
# Let's check DHPARAM_BITS is set to a supported value
|
|
if [[ ! "$DHPARAM_BITS" =~ ^(2048|3072|4096)$ ]]; then
|
|
echo "Error: Unsupported DHPARAM_BITS size: ${DHPARAM_BITS}. Supported values are 2048, 3072, or 4096 (default)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Use an existing pre-generated DH group from RFC7919 (https://datatracker.ietf.org/doc/html/rfc7919#appendix-A):
|
|
local RFC7919_DHPARAM_FILE="/app/dhparam/ffdhe${DHPARAM_BITS}.pem"
|
|
local EXPECTED_DHPARAM_HASH; EXPECTED_DHPARAM_HASH=$(sha256sum "$RFC7919_DHPARAM_FILE" | cut -d ' ' -f1)
|
|
|
|
# DH params may be provided by the user (rarely necessary)
|
|
if [[ -f "$DHPARAM_FILE" ]]; then
|
|
local USER_PROVIDED_DH
|
|
|
|
# Check if the DH params file is user provided or comes from acme-companion
|
|
local DHPARAM_HASH; DHPARAM_HASH=$(sha256sum "$DHPARAM_FILE" | cut -d ' ' -f1)
|
|
|
|
for f in /app/dhparam/ffdhe*.pem; do
|
|
local FFDHE_HASH; FFDHE_HASH=$(sha256sum "$f" | cut -d ' ' -f1)
|
|
if [[ "$DHPARAM_HASH" == "$FFDHE_HASH" ]]; then
|
|
# This is an acme-companion created DH params file
|
|
USER_PROVIDED_DH='false'
|
|
|
|
# Check if /etc/nginx/certs/dhparam.pem matches the expected pre-generated DH group
|
|
if [[ "$DHPARAM_HASH" == "$EXPECTED_DHPARAM_HASH" ]]; then
|
|
set_ownership_and_permissions "$DHPARAM_FILE"
|
|
echo "Info: ${DHPARAM_BITS} bits RFC7919 Diffie-Hellman group found, generation skipped."
|
|
return 0
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if parse_true "${USER_PROVIDED_DH:=true}"; then
|
|
# This is a user provided DH params file
|
|
set_ownership_and_permissions "$DHPARAM_FILE"
|
|
echo "Info: A custom dhparam.pem file was provided. Best practice is to use standardized RFC7919 Diffie-Hellman groups instead."
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
# The RFC7919 DH params file either need to be created or replaced
|
|
echo "Info: Setting up ${DHPARAM_BITS} bits RFC7919 Diffie-Hellman group..."
|
|
cp "$RFC7919_DHPARAM_FILE" "${DHPARAM_FILE}.tmp"
|
|
mv "${DHPARAM_FILE}.tmp" "$DHPARAM_FILE"
|
|
set_ownership_and_permissions "$DHPARAM_FILE"
|
|
}
|
|
|
|
function check_default_cert_key {
|
|
local cn='letsencrypt-nginx-proxy-companion'
|
|
|
|
if [[ -e /etc/nginx/certs/default.crt && -e /etc/nginx/certs/default.key ]]; then
|
|
default_cert_cn="$(openssl x509 -noout -subject -in /etc/nginx/certs/default.crt)"
|
|
# Check if the existing default certificate is still valid for more
|
|
# than 3 months / 7776000 seconds (60 x 60 x 24 x 30 x 3).
|
|
check_cert_min_validity /etc/nginx/certs/default.crt 7776000
|
|
cert_validity=$?
|
|
[[ "$DEBUG" == 1 ]] && echo "Debug: a default certificate with $default_cert_cn is present."
|
|
fi
|
|
|
|
# Create a default cert and private key if:
|
|
# - either default.crt or default.key are absent
|
|
# OR
|
|
# - the existing default cert/key were generated by the container
|
|
# and the cert validity is less than three months
|
|
if [[ ! -e /etc/nginx/certs/default.crt || ! -e /etc/nginx/certs/default.key ]] || [[ "${default_cert_cn:-}" =~ $cn && "${cert_validity:-}" -ne 0 ]]; then
|
|
openssl req -x509 \
|
|
-newkey rsa:4096 -sha256 -nodes -days 365 \
|
|
-subj "/CN=$cn" \
|
|
-keyout /etc/nginx/certs/default.key.new \
|
|
-out /etc/nginx/certs/default.crt.new \
|
|
&& mv /etc/nginx/certs/default.key.new /etc/nginx/certs/default.key \
|
|
&& mv /etc/nginx/certs/default.crt.new /etc/nginx/certs/default.crt \
|
|
&& reload_nginx
|
|
echo "Info: a default key and certificate have been created at /etc/nginx/certs/default.key and /etc/nginx/certs/default.crt."
|
|
elif [[ "$DEBUG" == 1 && "${default_cert_cn:-}" =~ $cn ]]; then
|
|
echo "Debug: the self generated default certificate is still valid for more than three months. Skipping default certificate creation."
|
|
elif [[ "$DEBUG" == 1 ]]; then
|
|
echo "Debug: the default certificate is user provided. Skipping default certificate creation."
|
|
fi
|
|
set_ownership_and_permissions "/etc/nginx/certs/default.key"
|
|
set_ownership_and_permissions "/etc/nginx/certs/default.crt"
|
|
}
|
|
|
|
function check_default_account {
|
|
# The default account is now for empty account email
|
|
if [[ -f /etc/acme.sh/default/account.conf ]]; then
|
|
if grep -q ACCOUNT_EMAIL /etc/acme.sh/default/account.conf; then
|
|
sed -i '/ACCOUNT_EMAIL/d' /etc/acme.sh/default/account.conf
|
|
fi
|
|
fi
|
|
}
|
|
|
|
if [[ "$*" == "/bin/bash /app/start.sh" ]]; then
|
|
print_version
|
|
check_docker_socket
|
|
if [[ -z "$(get_nginx_proxy_container)" ]]; then
|
|
echo "Error: can't get nginx-proxy container ID !" >&2
|
|
echo "Check that you are doing one of the following :" >&2
|
|
echo -e "\t- Use the --volumes-from option to mount volumes from the nginx-proxy container." >&2
|
|
echo -e "\t- Set the NGINX_PROXY_CONTAINER env var on the letsencrypt-companion container to the name of the nginx-proxy container." >&2
|
|
echo -e "\t- Label the nginx-proxy container to use with 'com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy'." >&2
|
|
exit 1
|
|
elif [[ -z "$(get_docker_gen_container)" ]] && ! is_docker_gen_container "$(get_nginx_proxy_container)"; then
|
|
echo "Error: can't get docker-gen container id !" >&2
|
|
echo "If you are running a three containers setup, check that you are doing one of the following :" >&2
|
|
echo -e "\t- Set the NGINX_DOCKER_GEN_CONTAINER env var on the letsencrypt-companion container to the name of the docker-gen container." >&2
|
|
echo -e "\t- Label the docker-gen container to use with 'com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen'." >&2
|
|
exit 1
|
|
fi
|
|
check_writable_directory '/etc/nginx/certs'
|
|
check_writable_directory '/etc/nginx/vhost.d'
|
|
check_writable_directory '/etc/acme.sh'
|
|
check_writable_directory '/usr/share/nginx/html'
|
|
[[ -f /app/letsencrypt_user_data ]] && check_writable_directory '/etc/nginx/conf.d'
|
|
check_default_cert_key
|
|
check_dh_group
|
|
reload_nginx
|
|
check_default_account
|
|
fi
|
|
|
|
exec "$@"
|