mirror of
https://github.com/m8tin/cis.git
synced 2025-12-06 07:48:26 +01:00
Issuing SSL certificates
There are two modes you can use the script renewCerts.sh.
- dns
- http
Dns mode
This mode is meant to use inside a docker container defined by the Dockerfile.
To configure, build and run the Container there is a file docker-compose.yml.template.
You can copy this file to docker-compose.yml and set the needed environment variables there.
- AUTOACME_CONTAINER_HOSTNAME
is used to enable the use of the host name within the container. For example, for meaningful commit messages. - AUTOACME_GIT_REPOSITORY_VIA_SSH (optional)
is used to specify a Git repository to which the keys and certificates are transferred. Therefore, SSH keys are generated on first launch (docker compose up -d) and the repository is cloned to~/acmeResults/. The public key must be granted write access to the repository
(e.g. as repository's deploy key). The key can be viewed viadocker compose logs. - AUTOACME_PATH_IN_GIT_REPOSITORY (optional)
specifies a path inside the repository were the certiticates are saved.
(e.g. AUTOACME_PATH_IN_GIT_REPOSITORY="/foo/bar/" => /root/autoACME/foo/bar/your-domain.net/fullchain.crt) - AUTOACME_DNS_PROVIDER
sets the provider modul of acme.sh used to communicate with your domain provider.
(For further information see: https://github.com/acmesh-official/acme.sh/wiki/dnsapi)
You may have to set additional environment variables depending on your provider...
Manual docker commands
Instead of using docker compose you can build and run the container manually:
docker build -t cis/autoacme .
docker run --name autoacme -d cis/autoacme
This may be useful for investiagtion...
Http mode
If you plan to use renewCerts.sh directly on your host computer this mode may fit your needs.
Here you need a nginx webserver. The domain have to point to it and following configuration is needed:
- The content of folder
/var/www/letsencrypt/.well-known/acme-challenge/has to be accessable viahttp://your-domain.net/.well-known/acme-challenge/ - The certificates are stored to
/etc/nginx/ssl. If this folder is a git repository then changes will be commited and pushed. - An entry into the crontab is needed to do automatic updates.