Skip to content

Commit 1bbd253

Browse files
solidnerdsolidnerd
committed
Initial Commit
0 parents  commit 1bbd253

File tree

8 files changed

+193
-0
lines changed

8 files changed

+193
-0
lines changed

‎.dockerignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.gitlab-ci.yml
2+
README.md
3+
LICENSE

‎.gitlab-ci.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
stages:
2+
- build
3+
- release
4+
5+
before_script:
6+
- docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
7+
8+
build:
9+
stage: build
10+
image: docker:1.12
11+
script:
12+
- docker build -t $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME .
13+
- docker push $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME
14+
15+
release-latest:
16+
stage: release
17+
image: docker:1.12
18+
variables:
19+
GIT_STRATEGY: none
20+
script:
21+
- docker pull $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME
22+
- docker tag $CI_REGISTRY_IMAGE:$CI_BUILD_REF_NAME $CI_REGISTRY_IMAGE:latest
23+
- docker push $CI_REGISTRY_IMAGE:latest

‎Dockerfile

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
FROM quay.io/letsencrypt/letsencrypt:v0.11.1
2+
3+
COPY letsencrypt-hooks/* /letsencrypt/hooks/
4+
COPY docker-entrypoint.sh /docker-entrypoint.sh
5+
6+
RUN apt-get update && apt-get install -y curl && \
7+
chmod +x /letsencrypt/hooks/authenticator.sh \
8+
/letsencrypt/hooks/cleanup.sh \
9+
/docker-entrypoint.sh && \
10+
apt-get clean && \
11+
rm -rf /var/lib/apt/lists/* \
12+
/tmp/* \
13+
/var/tmp/*
14+
15+
ENV PATH="$PATH:/letsencrypt/hooks"
16+
17+
ENTRYPOINT ["/docker-entrypoint.sh"]
18+
19+
VOLUME ["/etc/letsencrypt","/var/lib/letsencrypt","/var/log/letsencrypt"]

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2017 Niclas Mietz
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
Let's Encrypt DNS Challenge
2+
===========================
3+
4+
This repo contains only an image for an letsencrpyt container to use dns challenge with cloudflare.
5+
6+
It uses the certbot image directly.
7+
8+
## How to run this ?
9+
10+
### With interactive mode for to decide if you want ip logging
11+
12+
```bash
13+
docker run --rm -it -v "/etc/letsencrypt:/etc/letsencrypt" \
14+
-v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
15+
-v "/var/log/letsencrypt:/var/log/letsencrypt" \
16+
-e CERTBOT_DOMAIN=<domain> \
17+
-e CLOUDFLARE_API_KEY=<cloudflare api key> \
18+
-e CLOUDFLARE_EMAIL=<email address> \
19+
solidnerd/letsencrpyt-dns:0.1.0
20+
```
21+
22+
### Accept IP Logging
23+
24+
```bash
25+
docker run --rm -it -v "/etc/letsencrypt:/etc/letsencrypt" \
26+
-v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
27+
-v "/var/log/letsencrypt:/var/log/letsencrypt" \
28+
-e CERTBOT_DOMAIN=<domain> \
29+
-e CLOUDFLARE_API_KEY=<cloudflare api key> \
30+
-e CLOUDFLARE_EMAIL=<email address> \
31+
-e CERBOT_IP_LOGGING=true \
32+
solidnerd/letsencrpyt-dns:0.1.0
33+
```
34+
35+
## Configuration
36+
37+
|Variable | Description |
38+
|:-------| :---------- |
39+
|CERTBOT_DOMAIN| Domain that should receive a certificate |
40+
| CLOUDFLARE_API_KEY | Global Api Key from Cloudflare |
41+
| CLOUDFLARE_EMAIL | Email Address that is used to login in cloudflare |
42+
| CERTBOT_IP_LOGGING | Accepts that the IP will be logged from the server that requests a certificate |
43+
44+
## Issues
45+
46+
Make an issue on the [GitHub Repo](https://github.com/solidnerd/letsencrypt-dns) .
47+
48+
## Inspiration
49+
50+
This repo got a lot of inspiration from the lets encrypt user guide.
51+
52+
- http://letsencrypt.readthedocs.io/en/latest/using.html#hooks

‎docker-entrypoint.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
if [[ -n "${CLOUDFLARE_API_KEY}" && -n "${CLOUDFLARE_EMAIL}" && -n "${CERTBOT_DOMAIN}" ]]; then
4+
if [[ $CERBOT_IP_LOGGING == true ]]; then
5+
exec certbot certonly --manual --preferred-challenges=dns --manual-public-ip-logging-ok --manual-auth-hook authenticator.sh --manual-cleanup-hook cleanup.sh -d ${CERTBOT_DOMAIN}
6+
else
7+
exec certbot certonly --manual --preferred-challenges=dns --manual-auth-hook authenticator.sh --manual-cleanup-hook cleanup.sh -d ${CERTBOT_DOMAIN}
8+
fi
9+
else
10+
echo "One of the following variables were not set: "
11+
echo "CLOUDFLARE_API_KEY"
12+
echo "CLOUDFLARE_EMAIL"
13+
echo "CERTBOT_DOMAIN"
14+
exit 1
15+
fi
16+
17+

‎letsencrypt-hooks/authenticator.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
3+
# Get your API key from https://www.cloudflare.com/a/account/my-account
4+
CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY:-"your-api-key"}
5+
CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL:-"your.CLOUDFLARE_EMAIL@example.com"}
6+
7+
# Strip only the top domain to get the zone id
8+
DOMAIN=$(expr match "$CERTBOT_DOMAIN" '.*\.\(.*\..*\)')
9+
10+
# Get the Cloudflare zone id
11+
ZONE_EXTRA_PARAMS="status=active&page=1&per_page=20&order=status&direction=desc&match=all"
12+
ZONE_ID=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN&$ZONE_EXTRA_PARAMS" \
13+
-H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
14+
-H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
15+
-H "Content-Type: application/json" | python -c "import sys,json;print(json.load(sys.stdin)['result'][0]['id'])")
16+
17+
# Create TXT record
18+
CREATE_DOMAIN="_acme-challenge.$CERTBOT_DOMAIN"
19+
RECORD_ID=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
20+
-H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
21+
-H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
22+
-H "Content-Type: application/json" \
23+
--data '{"type":"TXT","name":"'"$CREATE_DOMAIN"'","content":"'"$CERTBOT_VALIDATION"'","ttl":120}' \
24+
| python -c "import sys,json;print(json.load(sys.stdin)['result']['id'])")
25+
# Save info for cleanup
26+
if [ ! -d /tmp/CERTBOT_$CERTBOT_DOMAIN ];then
27+
mkdir -m 0700 /tmp/CERTBOT_$CERTBOT_DOMAIN
28+
fi
29+
echo $ZONE_ID > /tmp/CERTBOT_$CERTBOT_DOMAIN/ZONE_ID
30+
echo $RECORD_ID > /tmp/CERTBOT_$CERTBOT_DOMAIN/RECORD_ID
31+
32+
# Sleep to make sure the change has time to propagate over to DNS
33+
sleep 25

‎letsencrypt-hooks/cleanup.sh

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
# Get your API key from https://www.cloudflare.com/a/account/my-account
4+
CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY:-"your-api-key"}
5+
CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL:-"your.CLOUDFLARE_EMAIL@example.com"}
6+
7+
if [ -f /tmp/CERTBOT_$CERTBOT_DOMAIN/ZONE_ID ]; then
8+
ZONE_ID=$(cat /tmp/CERTBOT_$CERTBOT_DOMAIN/ZONE_ID)
9+
rm -f /tmp/CERTBOT_$CERTBOT_DOMAIN/ZONE_ID
10+
fi
11+
12+
if [ -f /tmp/CERTBOT_$CERTBOT_DOMAIN/RECORD_ID ]; then
13+
RECORD_ID=$(cat /tmp/CERTBOT_$CERTBOT_DOMAIN/RECORD_ID)
14+
rm -f /tmp/CERTBOT_$CERTBOT_DOMAIN/RECORD_ID
15+
fi
16+
17+
# Remove the challenge TXT record from the zone
18+
if [ -n "${ZONE_ID}" ]; then
19+
if [ -n "${RECORD_ID}" ]; then
20+
curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
21+
-H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
22+
-H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
23+
-H "Content-Type: application/json"
24+
fi
25+
fi

0 commit comments

Comments
 (0)