Add dns alias support
This commit is contained in:
Agung RB
parent
a8f98a205f
commit
8d566e1c99
@ -33,7 +33,7 @@ param_env_vars:
|
||||
- { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
|
||||
- { env_var: "URL", env_value: "yourdomain.url", desc: "Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns)." }
|
||||
- { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
|
||||
- { env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`)." }
|
||||
- { env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http`, `dns`, `duckdns` or `dns-alias` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`)." }
|
||||
param_usage_include_vols: true
|
||||
param_volumes:
|
||||
- { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "All the config files including the webroot reside here." }
|
||||
@ -53,12 +53,13 @@ opt_param_env_vars:
|
||||
- { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
|
||||
- { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
|
||||
- { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
|
||||
- { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
|
||||
- { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns` or 'dns-alias`. Retrieve your token from https://www.duckdns.org" }
|
||||
- { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
|
||||
- { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
|
||||
- { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
|
||||
- { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
|
||||
- { env_var: "MAXMINDDB_LICENSE_KEY", env_value: "", desc: "Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly."}
|
||||
- { env_var: "ALIAS_URL", env_value: "", desc: "Required if `VALIDATION` is set to `dns-alias`. Set to duckdns url ie. `example.duckdns.org`"}
|
||||
opt_param_usage_include_vols: false
|
||||
opt_param_volumes:
|
||||
- { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "Configuration files." }
|
||||
@ -95,6 +96,7 @@ app_setup_block: |
|
||||
* Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
|
||||
* Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
|
||||
* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
|
||||
* For `dns-alias` validation, set `ALIAS_URL` and `DUCKDNSTOKEN` variable. This mode useful if you current dns provider doesn't have API support (ie. free TLD on cloudflare). Set CNAME _acme-challenge.yoururl.com => yoursubdomain.duckdns.org. If subdomain is set, point all subdomains (ie. _acme-challenge.www.yoururl.com) to the same duckdns url.
|
||||
* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
|
||||
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
|
||||
* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
|
||||
@ -151,6 +153,7 @@ app_setup_nginx_reverse_proxy_block: ""
|
||||
|
||||
# changelog
|
||||
changelogs:
|
||||
- { date: "22.05.21:", desc: "Add support for dns alias mode." }
|
||||
- { date: "20.05.21:", desc: "Modify resolver.conf generation to detect and ignore ipv6." }
|
||||
- { date: "14.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use linuxserver.io wheel index for pip packages. Switch to using [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) for `dhparams.pem` per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919). Added `worker_processes.conf`, which sets the number of nginx workers, and `resolver.conf`, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later." }
|
||||
- { date: "21.04.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method." }
|
||||
|
||||
@ -2,7 +2,11 @@
|
||||
|
||||
. /config/.donoteditthisfile.conf
|
||||
|
||||
if [ "$VALIDATION" = "duckdns" ]; then
|
||||
curl https://www.duckdns.org/update?domains=${CERTBOT_DOMAIN}\&token=${ORIGDUCKDNSTOKEN}\&txt=${CERTBOT_VALIDATION}
|
||||
elif [ "$VALIDATION" = "dns-alias" ]; then
|
||||
curl https://www.duckdns.org/update?domains=${ORIGALIASURL}\&token=${ORIGDUCKDNSTOKEN}\&txt=${CERTBOT_VALIDATION}
|
||||
fi
|
||||
|
||||
echo "sleeping 60"
|
||||
sleep 60
|
||||
|
||||
@ -7,7 +7,7 @@ echo
|
||||
echo "<------------------------------------------------->"
|
||||
echo "cronjob running on "$(date)
|
||||
echo "Running certbot renew"
|
||||
if [ "$ORIGVALIDATION" = "dns" ] || [ "$ORIGVALIDATION" = "duckdns" ]; then
|
||||
if [ "$ORIGVALIDATION" = "dns" ] || [ "$ORIGVALIDATION" = "duckdns" ] || [ "$ORIGVALIDATION" = "dns-alias" ]; then
|
||||
certbot -n renew \
|
||||
--post-hook "if ps aux | grep [n]ginx: > /dev/null; then s6-svc -h /var/run/s6/services/nginx; fi; \
|
||||
cd /config/keys/letsencrypt && \
|
||||
|
||||
@ -13,7 +13,8 @@ VALIDATION=${VALIDATION}\\n\
|
||||
CERTPROVIDER=${CERTPROVIDER}\\n\
|
||||
DNSPLUGIN=${DNSPLUGIN}\\n\
|
||||
EMAIL=${EMAIL}\\n\
|
||||
STAGING=${STAGING}\\n"
|
||||
STAGING=${STAGING}\\n\
|
||||
ALIAS_URL=${ALIAS_URL}\\n"
|
||||
|
||||
# Echo init finish for test runs
|
||||
if [ -n "${TEST_RUN}" ]; then
|
||||
@ -121,6 +122,16 @@ fi
|
||||
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
|
||||
sleep infinity
|
||||
|
||||
# check to make sure DUCKDNSTOKEN is set if duckdns or dns-alias is used
|
||||
[[ "$VALIDATION" =~ ^(duckdns|dns-alias)$ ]] && [[ -z "$DUCKDNSTOKEN" ]] && \
|
||||
echo "Please set DUCKDNSTOKEN. See docker info for more details." && \
|
||||
sleep infinity
|
||||
|
||||
# check to make sure ALIAS_URL is set if dns-alias validation is used
|
||||
[[ "$VALIDATION" = "dns-alias" ]] && [[ -z "$ALIAS_URL" ]] && \
|
||||
echo "Please set ALIAS_URL. See docker info for more details." && \
|
||||
sleep infinity
|
||||
|
||||
# import user crontabs
|
||||
rm /etc/crontabs/*
|
||||
cp /config/crontabs/* /etc/crontabs/
|
||||
@ -130,7 +141,7 @@ if [ -f "/config/donoteditthisfile.conf" ]; then
|
||||
mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
|
||||
fi
|
||||
if [ ! -f "/config/.donoteditthisfile.conf" ]; then
|
||||
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
|
||||
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\" ORIGALIASURL=\"$ALIAS_URL\"" > /config/.donoteditthisfile.conf
|
||||
echo "Created .donoteditthisfile.conf"
|
||||
fi
|
||||
|
||||
@ -256,6 +267,10 @@ elif [ "$VALIDATION" = "duckdns" ]; then
|
||||
echo "the resulting certificate will only cover the main domain due to a limitation of duckdns, ie. subdomain.duckdns.org"
|
||||
export URL_REAL="-d ${URL}"
|
||||
fi
|
||||
elif [ "$VALIDATION" = "dns-alias" ]; then
|
||||
PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-auth-hook /app/duckdns-txt"
|
||||
chmod +x /app/duckdns-txt
|
||||
echo "dns-alias validation is selected"
|
||||
else
|
||||
PREFCHAL="--non-interactive --standalone --preferred-challenges http"
|
||||
echo "http validation is selected"
|
||||
@ -271,7 +286,7 @@ else
|
||||
fi
|
||||
|
||||
# checking for changes in cert variables, revoking certs if necessary
|
||||
if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
|
||||
if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ] || [ ! "$ALIAS_URL" = "$ORIGALIASURL" ]; then
|
||||
echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
|
||||
if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
|
||||
ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
|
||||
@ -298,7 +313,7 @@ if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "
|
||||
fi
|
||||
|
||||
# saving new variables
|
||||
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
|
||||
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\" ORIGALIASURL=\"$ALIAS_URL\"" > /config/.donoteditthisfile.conf
|
||||
|
||||
# alter extension for error message
|
||||
if [ "$DNSPLUGIN" = "google" ]; then
|
||||
|
||||
Loading…
Reference in New Issue
Block a user