Sign inSign up

quara/letsgo

By quara

•Updated almost 4 years ago

Request Let's Encrypt certificates using dns-01 challenge and Digital Ocean API

Image
0

225

quara/letsgo repository overview

⁠Minimal Let's Encrypt CLI

The goal of this project is to offer a binary, as small as possible, which can generate valid TLS certificates issued by Let's Encrypt, while fetching necessary tokens from a remote keystore (Azure Key Vault).

The current size of the built executable is approximately 13Mb, while the lego CLI is 34Mb and does not include Azure Key Vault integration. Binaries can be fetched from latest release⁠.

This library is designed to work only with DNS-01 challenges, using Digital Ocean provider.

⁠Configuration

letsgo can only be configured through environment variables. It does not accept any command line argument.

⁠Authentication
Environment VariableOptionalDefaultDescription
DO_AUTH_TOKEN_VAULT✅Name or URI of Azure Keyvault holding auth token
DO_AUTH_TOKEN_SECRET✅"do-auth-token"Name of secret stored in Azure Keyvault
DO_AUTH_TOKEN_FILE✅Path to file holding auth token
DO_AUTH_TOKEN✅Auth token value

💥 At least one of DO_AUTH_TOKEN_VAULT, DO_AUTH_TOKEN_FILE, or DO_AUTH_TOKEN must be set to a non-null value

⁠Certificate
Environment VariableOptionalDefaultDescription
DOMAINS💥Comma-separated list of domain names

DOMAINS environment variable must be set to a non-null value.

⁠Let's Encrypt Account
Environment VariableOptionalDefaultDescription
ACCOUNT_EMAIL💥Email of Let's Encrypt account for which certificate is issued
ACCOUNT_KEY_FILE✅"./account.key"Path to account key file. If account key does not exist, it is generated and saved to path.
LE_TOS_AGREED✅trueAgree to Let's Encrypt terms of usage

ACCOUNT_EMAIL environment variable must be set to a non-null value.

⁠CA Directory
Environment VariableRequiredDefaultDescription
CA_DIR✅"STAGING"Name of CA directory environment or URL to CA directory. Allowed values are PRODUCTION⁠, STAGING⁠, TEST⁠, or any http URL.
LE_CRT_KEY_TYPE✅"RSA2048"Certificate key type. Both Let's Encrypt staging and production environments use the RSA2048 key type.
⁠DNS Challenge
Environment VariableOptionalDefaultDescription
DNS_RESOLVERS✅A comma-separated list of DNS resolvers used to verify challenge in host:port format
DNS_TIMEOUT✅Timeout in seconds for DNS challenge resolution
DISABLE_CP✅trueDisable complete propagation check, I.E, only a single resolver must verify the DNS challenge to succeed. When enbled, all resolvers must verify the challenge.

⁠Usage examples

  • Generate a certificate using token value:
docker run -it --rm \
  -v $(pwd):/certs \
  --workdir /certs  \
  -e DOMAINS="example.com,*.example.com"\
  -e ACCOUNT_EMAIL="[email protected]" \
  -e DO_AUTH_TOKEN="xxxxxxxxxxxxxxxxxxxx" \
  quara/letsgo

Don't forget to add a volume to the command, else the certificate will be lost once container is deleted.

  • Generate a certificate using Azure Keyvault:
docker run -it --rm \
  -v $(pwd):/certs \
  --workdir /certs  \
  -e DOMAINS="example.com,*.example.com"\
  -e ACCOUNT_EMAIL="[email protected]" \
  -e DO_AUTH_TOKEN_VAULT="example-keyvault" \
  quara/letsgo

Tag summary

Content type

Image

Digest

sha256:1e553a4d2…

Size

6.7 MB

Last updated

almost 4 years ago

docker pull quara/letsgo:v0.8.0