aya/myos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wip: letsencrypt

Browse Source
This commit is contained in:
Yann Autissier
2022-10-21 03:50:14 +02:00
parent 1203c9f005
commit 04df1bd919
34 changed files with 183 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stack/node.mk
+55 -7
View File
@@ -2,9 +2,9 @@ CMDS += node-exec stack-node-exec node-exec:% node-ex
node ?= node/node
ENV_VARS += DOCKER_HOST_IFACE DOCKER_HOST_INET4 DOCKER_INTERNAL_DOCKER_HOST
# target bootstrap-stack-node: Fire node-ssl-certs
# target bootstrap-stack-node: Fire node-certbot node-ssl-certs
.PHONY: bootstrap-stack-node
bootstrap-stack-node: docker-network-create-$(DOCKER_NETWORK_PUBLIC) node-ssl-certs
bootstrap-stack-node: docker-network-create-$(DOCKER_NETWORK_PUBLIC) $(if $(CERTBOT),node-certbot) node-ssl-certs
# target node: Fire stack-node-up
.PHONY: node
@@ -14,15 +14,63 @@ node: stack-node-up
.PHONY: node-%
node-%: stack-node-%;
# target node-ssl-certs: Create ${DOMAIN}.key.pem and ${DOMAIN}.crt.pem files
# target node-ssl-certs: Create invalid ${DOMAIN}/privkey.pem and ${DOMAIN}/cert.pem certificate files
.PHONY: node-ssl-certs
node-ssl-certs:
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine [ -f /certs/$(DOMAIN).crt.pem -a -f /certs/$(DOMAIN).key.pem ] \
|| $(RUN) docker run --rm -e DOMAIN=$(DOMAIN) --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine sh -c "\
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine \
[ -f /certs/live/$(DOMAIN)/cert.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|| $(RUN) docker run --rm -e DOMAIN=$(DOMAIN) --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine sh -c "\
apk --no-cache add openssl \
&& { [ -f /certs/${DOMAIN}.key.pem ] || openssl genrsa -out /certs/${DOMAIN}.key.pem 2048; } \
&& openssl req -key /certs/${DOMAIN}.key.pem -out /certs/${DOMAIN}.crt.pem \
&& mkdir -p /certs/live/${DOMAIN} \
&& { [ -f /certs/live/${DOMAIN}/privkey.pem ] || openssl genrsa -out /certs/live/${DOMAIN}/privkey.pem 2048; } \
&& openssl req -key /certs/live/${DOMAIN}/privkey.pem -out /certs/live/${DOMAIN}/cert.pem \
-addext extendedKeyUsage=serverAuth \
-addext subjectAltName=DNS:${DOMAIN} \
-subj \"/C=/ST=/L=/O=/CN=${DOMAIN}\" \
-x509 -days 365"
# target node-certbot: Create letsencrypt ${DOMAIN}/privkey.pem and ${DOMAIN}/cert.pem files
.PHONY: node-certbot
node-certbot: node-docker-build-certbot
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine [ -f /certs/live/$(DOMAIN)/cert.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|| $(RUN) docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/etc/letsencrypt/ --mount source=$(NODE_DOCKER_VOLUME),target=/var/log/letsencrypt/ -e DOMAIN=$(DOMAIN) --network host node/certbot \
--non-interactive --agree-tos --email hostmaster@${DOMAIN} certonly \
--preferred-challenges dns --authenticator dns-standalone \
--dns-standalone-address=0.0.0.0 \
--dns-standalone-port=53 \
-d ${DOMAIN} \
-d *.${DOMAIN}
# target node-certbot-certificates: List letsencrypt certificates
.PHONY: node-certbot-certificates
node-certbot-certificates: node-docker-build-certbot
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/etc/letsencrypt/ node/certbot certificates
# target node-certbot-renew: Renew letsencrypt certificates
.PHONY: node-certbot-renew
node-certbot-renew: node-docker-build-certbot
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/etc/letsencrypt/ --network host node/certbot renew
# target node-certbot-staging: Create staging letsencrypt ${DOMAIN}/privkey.pem and ${DOMAIN}/cert.pem files
.PHONY: node-certbot-staging
node-certbot-staging: node-docker-build-certbot
docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/certs alpine [ -f /certs/live/$(DOMAIN)/cert.pem -a -f /certs/live/$(DOMAIN)/privkey.pem ] \
|| $(RUN) docker run --rm --mount source=$(NODE_DOCKER_VOLUME),target=/etc/letsencrypt/ --mount source=$(NODE_DOCKER_VOLUME),target=/var/log/letsencrypt/ -e DOMAIN=$(DOMAIN) --network host node/certbot \
--non-interactive --agree-tos --email hostmaster@${DOMAIN} certonly \
--preferred-challenges dns --authenticator dns-standalone \
--dns-standalone-address=0.0.0.0 \
--dns-standalone-port=53 \
--staging \
-d ${DOMAIN} \
-d *.${DOMAIN}
# target node-docker-build-%: Build % docker
.PHONY: node-docker-build-%
node-docker-build-%:
$(call docker-build,docker/$*,node/$*:$(DOCKER_IMAGE_TAG))
# target node-docker-rebuild-%: Rebuild % docker
.PHONY: node-docker-rebuild-%
node-docker-rebuild-%:
$(call make,node-docker-build-$* DOCKER_BUILD_CACHE=false)