Let’s EncryptのSSL証明書をDocker使って自動更新

#!/bin/bash
#############################
# script/cert
#############################
# Domain,MasterID,Password,Mailaddress
CREDENTIAL_PATH="/usr/local/etc/mydns-credential.csv"
# callback by renew
RENEW_HOOK="reload on"

MODE=$1
TARGET=$2
DOMAIN=""
EMAIL_ADDRESS=""

usage() {
  echo "Usage: cert [ new [domain] | renew |  reload ]" 1>&2
  exit 1
}

_init() {
    if [ -z $TARGET ]; then
        usage
        return 1
    fi
    # check credential
    if [ ! -f $CREDENTIAL_PATH ]; then
        echo "${CREDENTIAL_PATH} Not Found."
        return 1
    fi

    local found=false
    while IFS=, read domain master_id password email_address
    do
        if [ $domain = $TARGET ]; then
            DOMAIN=$domain
            EMAIL_ADDRESS=$email_address
            found=true
            break
        fi
    done < $CREDENTIAL_PATH

    if [ ! "${found}" ]; then
        echo "${TARGET} Not Found."
        return 1
    fi
    return 0
}

_new_cert() {
    local auth_hook=/opt/${DOMAIN}/txtregist.php
    local cleanup_hook=/opt/${DOMAIN}/txtdelete.php

    certbot certonly --manual \
        --preferred-challenges=dns \
        --manual-auth-hook ${auth_hook} \
        --manual-cleanup-hook ${cleanup_hook} \
        -d ${DOMAIN} -d *.${DOMAIN} \
        --server https://acme-v02.api.letsencrypt.org/directory \
        --agree-tos -m ${EMAIL_ADDRESS} \

    if [ $? -ne 0 ]; then
        return 1
    fi
    return 0
}

case $MODE in
    "new")
        _init || exit 1
        _new_cert || exit 1
        ;;
    "renew")
        certbot renew --renew-hook "${RENEW_HOOK}"
        reload
        ;;
    "reload")
        reload --force
        ;;
    *)
      usage
esac

exit 0

#!/bin/bash
#############################
# script/reload
#############################
RELOAD_FILE=/tmp/reload
RELOAD_COMMAND=/usr/local/sbin/reload-command

_reload_on() {
    if [ ! -f ${RELOAD_FILE} ]; then
        touch ${RELOAD_FILE}
    fi
}

_reload_off() {
    if [ -f ${RELOAD_FILE} ]; then
        rm ${RELOAD_FILE}
    fi
}

_reload() {
    if [ -f ${RELOAD_FILE} ]; then
        sh -x ${RELOAD_COMMAND}
        if [ $? -eq 0 ]; then
            _reload_off
        fi
    fi
}

case $1 in
    "on")
        _reload_on
        ;;
    "off")
        _reload_off
        ;;
    "--force")
        _reload_on
        _reload
        ;;
    *)
      _reload
esac

exit 0

FROM php:7.4-cli

# Install some needed packages
RUN DEBIAN_FRONTEND=noninteractive apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    certbot \
    wget \
    unzip

RUN wget 'https://github.com/disco-v8/DirectEdit/archive/master.zip' -O /tmp/master.zip

COPY ./entrypoint.sh /
COPY ./script /usr/local/sbin
COPY ./conf /usr/local/etc

RUN chmod +x /usr/local/sbin/* \
  && chmod 600 /usr/local/etc/* \
  && ln -s /usr/local/bin/php /usr/bin/php

ENTRYPOINT ["sh", "/entrypoint.sh"]
CMD ["cert"]

VOLUME ["/etc/letsencrypt"]

#!/bin/bash
#############################
# entrypoint.sh
#############################
TEMPLATE_ARCHIVE=/tmp/master.zip
CREDENTIAL_PATH="/usr/local/etc/mydns-credential.csv"

# check credential && archive
if [ -f ${CREDENTIAL_PATH} ] && [ -f ${TEMPLATE_ARCHIVE} ]; then
    while IFS=, read domain master_id password email_address
    do
        domain_dir=/opt/${domain}
        config_file=${domain_dir}/txtedit.conf

        if [ ! -d ${domain_dir} ]; then
            mkdir -p ${domain_dir}
            unzip -qq -j -d ${domain_dir} ${TEMPLATE_ARCHIVE}
            chmod +x ${domain_dir}/*.php

            # create txtedit.conf
            sed -i -e "s/yourmasterid/${master_id}/" \
                -e "s/yourpasswd/${password}/" \
                -e "s/yourdomain/${domain}/" \
                ${config_file}
            chmod 600 ${config_file}
        fi
    done < $CREDENTIAL_PATH
fi

exec "$@"