Sign inSign up

thebrones/certbot-runner

By thebrones

•Updated over 4 years ago

Certbot runner for clusters in docker

Image
API management
Web servers
0

10K+

thebrones/certbot-runner repository overview

⁠Certbot-Runner

Release 1.0

Certbot in a docker container that runs a http server to use as a reverse-proxy backend. This container needs to catch the challange from Let's Encrypt so a rule on the reverse-proxy is required. This container is useful on bigger clusters with multiple proxy-servers.

⁠Components:

  • Certbot standalone.
  • Scheduled (cron) job to run certbot monthly.
  • Msmtp for sending E-mail alerts when job fails.
  • Configurable actions to execute after succesful run to for example rsync the config and reload the configuration of the proxyserver(s).

⁠Setup:

This will need a file mounted with the certs to maintain "domains.conf".

example.com
example2.com

Also mount a "settings.conf" file for setting the following options, take note of the TOS parameter. Will look for a way to put these in a env parameter soon.

EMAIL='[email protected]'
TOS='--agree-tos --dry-run'
RIGHTS='1000:1000'
ACTON='curl https://example.com/trigger && curl https://example.com/trigger '

E-mail parameter will be used to certbot and sending alerts. The action parameter can be used to execute a command like curl. Rights parameter is for setting the uid and gid of the output file, useful for setting it to www-data for example.

Output folder: /output/ for .pem files

Don't forget to add a file in the mount /etc/msmtprc for sending alerts. This file configures the msmtp service to send outbound mail.

account default
host mailserver.com
port 25
from "[email protected]"
logfile /var/log/msmtp.log

Final start command:

docker run thebrones\certbot-runner
  -v /use/local/path/domains.conf:/domains.conf \
  -v /use/local/path/settings.conf:/settings.conf \
  -v /use/local/path/output:/output -p 80:80 \
  -v /use/local/path/msmtprc:/etc/msmtprc \
  -p 8080:80

Or with compose:

version: '3'
services:
  certbot-runner:
    image: thebrones/certbot-runner
    ports:
    - 8080:80
    volumes:
      - /use/local/path/domains.conf:/domains.conf
      - /use/local/path/settings.conf:/settings.conf 
      - /use/local/path/output:/output
      - /use/local/path/msmtprc:/etc/msmtprc

Example HAProxy configuration:

# Frontend part for forwarding traffic to certbot:
frontend http_front
   bind *:80
   acl acme-challenge path_beg /.well-known/acme-challenge/
   use_backend certbot if acme-challenge

# Backend part:
backend certbot
   server certbot-runner certbot-runner-ip:8080
# Note that there is no check, backend is only up for a few seconds at a time.

⁠Sources

Tag summary

Content type

Image

Digest

Size

88.3 MB

Last updated

over 4 years ago

docker pull thebrones/certbot-runner