diff --git a/.github/workflows/external_trigger.yml b/.github/workflows/external_trigger.yml index 5daab23..391a0d4 100644 --- a/.github/workflows/external_trigger.yml +++ b/.github/workflows/external_trigger.yml @@ -10,7 +10,7 @@ jobs: external-trigger-master: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.1 + - uses: linuxserver/github-workflows/.github/actions/checkout@v1 - name: External Trigger if: github.ref == 'refs/heads/master' diff --git a/.github/workflows/external_trigger_scheduler.yml b/.github/workflows/external_trigger_scheduler.yml index a98082b..04c23ef 100644 --- a/.github/workflows/external_trigger_scheduler.yml +++ b/.github/workflows/external_trigger_scheduler.yml @@ -12,7 +12,7 @@ jobs: external-trigger-scheduler: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.1 + - uses: linuxserver/github-workflows/.github/actions/checkout@v1 with: fetch-depth: '0' diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml index e50325c..9094028 100644 --- a/.github/workflows/greetings.yml +++ b/.github/workflows/greetings.yml @@ -12,7 +12,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/first-interaction@v1 + - uses: linuxserver/github-workflows/.github/actions/first-interaction@v1 with: issue-message: 'Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.' pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!' diff --git a/.github/workflows/package_trigger_scheduler.yml b/.github/workflows/package_trigger_scheduler.yml index 3d80cf8..c99c271 100644 --- a/.github/workflows/package_trigger_scheduler.yml +++ b/.github/workflows/package_trigger_scheduler.yml @@ -12,7 +12,7 @@ jobs: package-trigger-scheduler: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.1 + - uses: linuxserver/github-workflows/.github/actions/checkout@v1 with: fetch-depth: '0' diff --git a/Dockerfile b/Dockerfile index b829a5f..21f8b4f 100755 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.22 +FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.24 # set version label ARG BUILD_DATE @@ -49,36 +49,34 @@ RUN \ nginx-mod-stream \ nginx-mod-stream-geoip2 \ nginx-vim \ - php84-bcmath \ - php84-bz2 \ - php84-dom \ - php84-exif \ - php84-ftp \ - php84-gd \ - php84-gmp \ - php84-imap \ - php84-intl \ - php84-ldap \ - php84-mysqli \ - php84-mysqlnd \ - php84-opcache \ - php84-pdo_mysql \ - php84-pdo_odbc \ - php84-pdo_pgsql \ - php84-pdo_sqlite \ - php84-pear \ - php84-pecl-apcu \ - php84-pecl-memcached \ - php84-pecl-redis \ - php84-pgsql \ - php84-posix \ - php84-soap \ - php84-sockets \ - php84-sodium \ - php84-sqlite3 \ - php84-tokenizer \ - php84-xmlreader \ - php84-xsl \ + php85-bcmath \ + php85-bz2 \ + php85-dom \ + php85-exif \ + php85-ftp \ + php85-gd \ + php85-gmp \ + php85-intl \ + php85-ldap \ + php85-mysqli \ + php85-mysqlnd \ + php85-pdo_mysql \ + php85-pdo_odbc \ + php85-pdo_pgsql \ + php85-pdo_sqlite \ + php85-pear \ + php85-pecl-apcu \ + php85-pecl-memcached \ + php85-pecl-redis \ + php85-pgsql \ + php85-posix \ + php85-soap \ + php85-sockets \ + php85-sodium \ + php85-sqlite3 \ + php85-tokenizer \ + php85-xmlreader \ + php85-xsl \ whois && \ echo "**** install certbot plugins ****" && \ if [ -z ${CERTBOT_VERSION+x} ]; then \ @@ -88,7 +86,7 @@ RUN \ pip install -U --no-cache-dir \ pip \ wheel && \ - pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.22/ \ + pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.24/ \ certbot==${CERTBOT_VERSION} \ certbot-dns-acmedns \ certbot-dns-aliyun \ @@ -121,6 +119,7 @@ RUN \ certbot-dns-linode \ certbot-dns-loopia \ certbot-dns-luadns \ + certbot-dns-mijn-host \ certbot-dns-namecheap \ certbot-dns-netcup \ certbot-dns-njalla \ diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index fdb4c9d..92786b0 100755 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.22 +FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.24 # set version label ARG BUILD_DATE @@ -49,36 +49,34 @@ RUN \ nginx-mod-stream \ nginx-mod-stream-geoip2 \ nginx-vim \ - php84-bcmath \ - php84-bz2 \ - php84-dom \ - php84-exif \ - php84-ftp \ - php84-gd \ - php84-gmp \ - php84-imap \ - php84-intl \ - php84-ldap \ - php84-mysqli \ - php84-mysqlnd \ - php84-opcache \ - php84-pdo_mysql \ - php84-pdo_odbc \ - php84-pdo_pgsql \ - php84-pdo_sqlite \ - php84-pear \ - php84-pecl-apcu \ - php84-pecl-memcached \ - php84-pecl-redis \ - php84-pgsql \ - php84-posix \ - php84-soap \ - php84-sockets \ - php84-sodium \ - php84-sqlite3 \ - php84-tokenizer \ - php84-xmlreader \ - php84-xsl \ + php85-bcmath \ + php85-bz2 \ + php85-dom \ + php85-exif \ + php85-ftp \ + php85-gd \ + php85-gmp \ + php85-intl \ + php85-ldap \ + php85-mysqli \ + php85-mysqlnd \ + php85-pdo_mysql \ + php85-pdo_odbc \ + php85-pdo_pgsql \ + php85-pdo_sqlite \ + php85-pear \ + php85-pecl-apcu \ + php85-pecl-memcached \ + php85-pecl-redis \ + php85-pgsql \ + php85-posix \ + php85-soap \ + php85-sockets \ + php85-sodium \ + php85-sqlite3 \ + php85-tokenizer \ + php85-xmlreader \ + php85-xsl \ whois && \ echo "**** install certbot plugins ****" && \ if [ -z ${CERTBOT_VERSION+x} ]; then \ @@ -88,7 +86,7 @@ RUN \ pip install -U --no-cache-dir \ pip \ wheel && \ - pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.22/ \ + pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.24/ \ certbot==${CERTBOT_VERSION} \ certbot-dns-acmedns \ certbot-dns-aliyun \ @@ -121,6 +119,7 @@ RUN \ certbot-dns-linode \ certbot-dns-loopia \ certbot-dns-luadns \ + certbot-dns-mijn-host \ certbot-dns-namecheap \ certbot-dns-netcup \ certbot-dns-njalla \ diff --git a/Jenkinsfile b/Jenkinsfile index e31d35d..d529383 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -629,7 +629,7 @@ pipeline { pids[$!]="$i" done for p in "${!pids[@]}"; do - wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; } + wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; } done fi ''' @@ -698,7 +698,7 @@ pipeline { pids[$!]="$i" done for p in "${!pids[@]}"; do - wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; } + wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; } done fi ''' @@ -759,7 +759,7 @@ pipeline { pids[$!]="$i" done for p in "${!pids[@]}"; do - wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* ]] && exit 1; } + wait "$p" || { [[ "${pids[$p]}" != *"quay.io"* && "${pids[$p]}" != *"registry.gitlab.com"* ]] && exit 1; } done fi ''' @@ -941,10 +941,10 @@ pipeline { fi done docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${META_TAG} -t ${PUSHIMAGE}:latest -t ${PUSHIMAGE}:${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" && "${PUSHIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } if [ -n "${SEMVER}" ]; then docker buildx imagetools create --prefer-index=false -t ${PUSHIMAGE}:${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${PUSHIMAGE}" != "${QUAYIMAGE}" && "${PUSHIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } fi done ''' @@ -977,26 +977,26 @@ pipeline { fi done docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${META_TAG} -t ${MANIFESTIMAGE}:amd64-latest -t ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${META_TAG} -t ${MANIFESTIMAGE}:arm64v8-latest -t ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } if [ -n "${SEMVER}" ]; then docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:amd64-${SEMVER} ${CACHEIMAGE}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } docker buildx imagetools create --prefer-index=false -t ${MANIFESTIMAGE}:arm64v8-${SEMVER} ${CACHEIMAGE}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } fi done for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}" "${QUAYIMAGE}"; do docker buildx imagetools create -t ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm64v8-latest || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } docker buildx imagetools create -t ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } if [ -n "${SEMVER}" ]; then docker buildx imagetools create -t ${MANIFESTIMAGE}:${SEMVER} ${MANIFESTIMAGE}:amd64-${SEMVER} ${MANIFESTIMAGE}:arm64v8-${SEMVER} || \ - { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" ]]; then exit 1; fi; } + { if [[ "${MANIFESTIMAGE}" != "${QUAYIMAGE}" && "${MANIFESTIMAGE}" != "${GITLABIMAGE}" ]]; then exit 1; fi; } fi done ''' diff --git a/README.md b/README.md index 672aa1b..8522031 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ The architectures supported by this image are: 2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`) * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables * After setup, navigate to `https://example.com` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`). -* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances. +* Certs are checked twice daily using ACME Renewal Information (ARI) to determine the optimal renewal window. If your cert is about to expire, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. ### Certbot Plugins @@ -190,6 +190,7 @@ services: - VALIDATION=http - SUBDOMAINS=www, #optional - CERTPROVIDER= #optional + - CERT_PROFILE= #optional - DNSPLUGIN=cloudflare #optional - PROPAGATION= #optional - EMAIL= #optional @@ -221,6 +222,7 @@ docker run -d \ -e VALIDATION=http \ -e SUBDOMAINS=www, `#optional` \ -e CERTPROVIDER= `#optional` \ + -e CERT_PROFILE= `#optional` \ -e DNSPLUGIN=cloudflare `#optional` \ -e PROPAGATION= `#optional` \ -e EMAIL= `#optional` \ @@ -254,7 +256,8 @@ Containers are configured using parameters passed at runtime (such as those abov | `-e VALIDATION=http` | Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set). | | `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only) | | `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. | -| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. | +| `-e CERT_PROFILE=` | Optionally define a cert profile to use for cert generation. This is useful if you want to use a custom cert profile instead of the default one. Currently only supported for Let's Encrypt. See https://letsencrypt.org/docs/profiles/ | +| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `mijn-host`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. | | `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. | | `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). | | `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` | @@ -433,6 +436,10 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **09.09.26:** - Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers. +* **19.07.26:** - Rebase to Alpine 3.24 with PHP 8.5. +* **10.07.26:** - Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay. +* **19.06.26:** - Add support for mijn.host dns validation. * **01.06.26:** - Remove obsolete old cert check logic. * **23.01.26:** - Reorder init to fix proxy conf version checks. * **21.12.25:** - Add support for hetzner-cloud dns validation. diff --git a/package_versions.txt b/package_versions.txt index 6c0a1f1..b0d88de 100755 --- a/package_versions.txt +++ b/package_versions.txt @@ -1,377 +1,376 @@ -NAME VERSION TYPE -Simple Launcher 1.1.0.14 binary (+5 duplicates) -acl-libs 2.3.2-r1 apk -acme 5.6.0 python -alpine-baselayout 3.7.0-r0 apk -alpine-baselayout-data 3.7.0-r0 apk -alpine-keys 2.5-r0 apk -alpine-release 3.22.4-r0 apk -annotated-types 0.7.0 python -anyio 4.13.0 python -aom-libs 3.12.1-r0 apk -apache2-utils 2.4.67-r0 apk -apk-tools 2.14.9-r3 apk -apr 1.7.5-r0 apk -apr-util 1.6.3-r1 apk -argon2-libs 20190702-r5 apk -autocommand 2.2.2 python -azure-common 1.1.28 python -azure-core 1.41.0 python -azure-identity 1.25.3 python -azure-mgmt-core 1.6.0 python -azure-mgmt-dns 9.0.0 python -backports-tarfile 1.2.0 python -bash 5.2.37-r0 apk -beautifulsoup4 4.14.3 python -boto3 1.43.18 python -botocore 1.43.18 python -brotli-libs 1.1.0-r2 apk -bs4 0.0.2 python -busybox 1.37.0-r20 apk -busybox-binsh 1.37.0-r20 apk -c-ares 1.34.6-r0 apk -c-client 2007f-r15 apk -ca-certificates 20260413-r0 apk -ca-certificates-bundle 20260413-r0 apk -catatonit 0.2.1-r0 apk -certbot 5.6.0 python -certbot-dns-acmedns 0.1.0 python -certbot-dns-aliyun 2.0.0 python -certbot-dns-azure 1.5.0 python -certbot-dns-bunny 3.0.0 python -certbot-dns-cloudflare 5.6.0 python -certbot-dns-cpanel 0.4.0 python -certbot-dns-desec 1.3.2 python -certbot-dns-digitalocean 5.6.0 python -certbot-dns-directadmin 1.0.15 python -certbot-dns-dnsimple 5.6.0 python -certbot-dns-dnsmadeeasy 5.6.0 python -certbot-dns-dnspod 0.1.0 python -certbot-dns-do 0.31.0 python -certbot-dns-domeneshop 0.2.9 python -certbot-dns-dreamhost 1.0 python -certbot-dns-duckdns 1.8.0 python -certbot-dns-dynudns 0.0.6 python -certbot-dns-freedns 0.2.0 python -certbot-dns-gehirn 5.6.0 python -certbot-dns-glesys 2.1.0 python -certbot-dns-godaddy 2.8.0 python -certbot-dns-google 5.6.0 python -certbot-dns-he 1.0.0 python -certbot-dns-hetzner 4.0.0 python -certbot-dns-hetzner-cloud 1.0.5 python -certbot-dns-infomaniak 0.2.4 python -certbot-dns-inwx 3.0.3 python -certbot-dns-ionos 2024.11.9 python -certbot-dns-linode 5.6.0 python -certbot-dns-loopia 1.0.1 python -certbot-dns-luadns 5.6.0 python -certbot-dns-namecheap 1.0.0 python -certbot-dns-netcup 2.0.3 python -certbot-dns-njalla 2.0.2 python -certbot-dns-nsone 5.6.0 python -certbot-dns-ovh 5.6.0 python -certbot-dns-porkbun 0.11.0 python -certbot-dns-rfc2136 5.6.0 python -certbot-dns-route53 5.6.0 python -certbot-dns-sakuracloud 5.6.0 python -certbot-dns-standalone 1.2.1 python -certbot-dns-transip 0.5.2 python -certbot-dns-vultr 1.1.0 python -certbot-plugin-gandi 1.5.0 python -certifi 2026.5.20 python -cffi 2.0.0 python -charset-normalizer 3.4.7 python -cli UNKNOWN binary -cli-32 UNKNOWN binary -cli-64 UNKNOWN binary -cli-arm64 UNKNOWN binary -cloudflare 5.2.0 python -composer 2.10.0 binary -configargparse 1.7.5 python -configobj 5.0.9 python -coreutils 9.7-r1 apk -coreutils-env 9.7-r1 apk -coreutils-fmt 9.7-r1 apk -coreutils-sha512sum 9.7-r1 apk -cryptography 48.0.0 python -curl 8.14.1-r2 apk -distro 1.9.0 python -dns-lexicon 3.25.2 python -dnslib 0.9.26 python -dnspython 2.8.0 python -domeneshop 0.4.4 python -fail2ban 1.1.0 python -fail2ban 1.1.0-r3 apk -fail2ban-pyc 1.1.0-r3 apk -filelock 3.29.0 python -findutils 4.10.0-r0 apk -fontconfig 2.15.0-r3 apk -freetype 2.13.3-r0 apk -future 1.0.0 python -gdbm 1.24-r0 apk -git 2.49.1-r0 apk -git-init-template 2.49.1-r0 apk -git-perl 2.49.1-r0 apk -gmp 6.3.0-r3 apk -gnupg 2.4.9-r0 apk -gnupg-dirmngr 2.4.9-r0 apk -gnupg-gpgconf 2.4.9-r0 apk -gnupg-keyboxd 2.4.9-r0 apk -gnupg-utils 2.4.9-r0 apk -gnupg-wks-client 2.4.9-r0 apk -gnutls 3.8.13-r0 apk -google-api-core 2.30.3 python -google-api-python-client 2.197.0 python -google-auth 2.53.0 python -google-auth-httplib2 0.4.0 python -googleapis-common-protos 1.75.0 python -gpg 2.4.9-r0 apk -gpg-agent 2.4.9-r0 apk -gpg-wks-server 2.4.9-r0 apk -gpgsm 2.4.9-r0 apk -gpgv 2.4.9-r0 apk -gui UNKNOWN binary -gui-32 UNKNOWN binary -gui-64 UNKNOWN binary -gui-arm64 UNKNOWN binary -h11 0.16.0 python -hcloud 2.20.0 python -httpcore 1.0.9 python -httplib2 0.31.2 python -httpx 0.28.1 python -icu-data-en 76.1-r1 apk -icu-libs 76.1-r1 apk -idna 3.17 python -importlib-metadata 8.7.1 python -inotify-tools 4.23.9.0-r0 apk -inotify-tools-libs 4.23.9.0-r0 apk -inwx-domrobot 3.2.0 python -iptables 1.8.11-r1 apk -iptables-legacy 1.8.11-r1 apk -isodate 0.7.2 python -jaraco-context 6.1.0 python -jaraco-functools 4.4.0 python -jaraco-text 4.0.0 python -jinja2 3.1.6 python -jmespath 1.1.0 python -josepy 2.2.0 python -jq 1.8.1-r0 apk -jsonpickle 4.1.2 python -libapk2 2.14.9-r3 apk -libassuan 2.5.7-r0 apk -libattr 2.5.2-r2 apk -libavif 1.3.0-r0 apk -libbsd 0.12.2-r0 apk -libbz2 1.0.8-r6 apk -libcrypto3 3.5.6-r0 apk -libcurl 8.14.1-r2 apk -libdav1d 1.5.1-r0 apk -libedit 20250104.3.1-r1 apk -libevent 2.1.12-r8 apk -libexpat 2.7.5-r0 apk -libffi 3.4.8-r0 apk -libgcc 14.2.0-r6 apk -libgcrypt 1.10.3-r1 apk -libgd 2.3.3-r10 apk -libgpg-error 1.55-r0 apk -libice 1.1.2-r0 apk -libidn2 2.3.7-r0 apk -libintl 0.24.1-r0 apk -libip4tc 1.8.11-r1 apk -libip6tc 1.8.11-r1 apk -libjpeg-turbo 3.1.0-r0 apk -libksba 1.6.7-r0 apk -libldap 2.6.8-r0 apk -libmaxminddb-libs 1.9.1-r0 apk -libmd 1.1.0-r0 apk -libmemcached-libs 1.1.4-r1 apk -libmnl 1.0.5-r2 apk -libncursesw 6.5_p20250503-r0 apk -libnftnl 1.2.9-r0 apk -libpanelw 6.5_p20250503-r0 apk -libpng 1.6.57-r0 apk -libpq 17.10-r0 apk -libproc2 4.0.4-r3 apk -libpsl 0.21.5-r3 apk -libsasl 2.1.28-r8 apk -libseccomp 2.6.0-r0 apk -libsharpyuv 1.5.0-r0 apk -libsm 1.2.5-r0 apk -libsodium 1.0.20-r1 apk -libssl3 3.5.6-r0 apk -libstdc++ 14.2.0-r6 apk -libtasn1 4.21.0-r0 apk -libunistring 1.3-r0 apk -libuuid 2.41-r9 apk -libwebp 1.5.0-r0 apk -libx11 1.8.11-r0 apk -libxau 1.0.12-r0 apk -libxcb 1.17.0-r0 apk -libxdmcp 1.1.5-r1 apk -libxext 1.3.6-r2 apk -libxml2 2.13.9-r1 apk -libxpm 3.5.19-r0 apk -libxslt 1.1.43-r3 apk -libxt 1.3.1-r0 apk -libxtables 1.8.11-r1 apk -libyuv 0.0.1887.20251502-r1 apk -libzip 1.11.4-r0 apk -linux-pam 1.7.0-r4 apk -logrotate 3.21.0-r1 apk -loopialib 0.2.0 python -lxml 6.1.1 python -lz4-libs 1.10.0-r0 apk -markupsafe 3.0.3 python -memcached 1.6.32-r0 apk -mock 5.2.0 python -more-itertools 10.8.0 python -mpdecimal 4.0.1-r0 apk -msal 1.37.0 python -msal-extensions 1.3.1 python -musl 1.2.5-r12 apk -musl-utils 1.2.5-r12 apk -nano 8.4-r0 apk -ncurses-terminfo-base 6.5_p20250503-r0 apk -netcat-openbsd 1.229.1-r0 apk -nettle 3.10.2-r0 apk -nghttp2-libs 1.69.0-r0 apk -nginx 1.28.3-r2 apk -nginx-mod-devel-kit 1.28.3-r2 apk -nginx-mod-http-brotli 1.28.3-r2 apk -nginx-mod-http-dav-ext 1.28.3-r2 apk -nginx-mod-http-echo 1.28.3-r2 apk -nginx-mod-http-fancyindex 1.28.3-r2 apk -nginx-mod-http-geoip2 1.28.3-r2 apk -nginx-mod-http-headers-more 1.28.3-r2 apk -nginx-mod-http-image-filter 1.28.3-r2 apk -nginx-mod-http-perl 1.28.3-r2 apk -nginx-mod-http-redis2 1.28.3-r2 apk -nginx-mod-http-set-misc 1.28.3-r2 apk -nginx-mod-http-upload-progress 1.28.3-r2 apk -nginx-mod-http-xslt-filter 1.28.3-r2 apk -nginx-mod-mail 1.28.3-r2 apk -nginx-mod-rtmp 1.28.3-r2 apk -nginx-mod-stream 1.28.3-r2 apk -nginx-mod-stream-geoip2 1.28.3-r2 apk -nginx-vim 1.28.3-r2 apk -npth 1.8-r0 apk -oniguruma 6.9.10-r0 apk -openssl 3.5.6-r0 apk -p11-kit 0.25.5-r2 apk -packaging 26.0 python -packaging 26.2 python -parsedatetime 2.6 python -pcre2 10.46-r0 apk -perl 5.40.4-r0 apk -perl-error 0.17030-r0 apk -perl-git 2.49.1-r0 apk -php84 8.4.16-r0 apk -php84-bcmath 8.4.16-r0 apk -php84-bz2 8.4.16-r0 apk -php84-common 8.4.16-r0 apk -php84-ctype 8.4.16-r0 apk -php84-curl 8.4.16-r0 apk -php84-dom 8.4.16-r0 apk -php84-exif 8.4.16-r0 apk -php84-fileinfo 8.4.16-r0 apk -php84-fpm 8.4.16-r0 apk -php84-ftp 8.4.16-r0 apk -php84-gd 8.4.16-r0 apk -php84-gmp 8.4.16-r0 apk -php84-iconv 8.4.16-r0 apk -php84-intl 8.4.16-r0 apk -php84-ldap 8.4.16-r0 apk -php84-mbstring 8.4.16-r0 apk -php84-mysqli 8.4.16-r0 apk -php84-mysqlnd 8.4.16-r0 apk -php84-opcache 8.4.16-r0 apk -php84-openssl 8.4.16-r0 apk -php84-pdo 8.4.16-r0 apk -php84-pdo_mysql 8.4.16-r0 apk -php84-pdo_odbc 8.4.16-r0 apk -php84-pdo_pgsql 8.4.16-r0 apk -php84-pdo_sqlite 8.4.16-r0 apk -php84-pear 8.4.16-r0 apk -php84-pecl-apcu 5.1.27-r0 apk -php84-pecl-igbinary 3.2.16-r1 apk -php84-pecl-imap 1.0.3-r0 apk -php84-pecl-memcached 3.3.0-r0 apk -php84-pecl-msgpack 3.0.0-r0 apk -php84-pecl-redis 6.3.0-r0 apk -php84-pgsql 8.4.16-r0 apk -php84-phar 8.4.16-r0 apk -php84-posix 8.4.16-r0 apk -php84-session 8.4.16-r0 apk -php84-simplexml 8.4.16-r0 apk -php84-soap 8.4.16-r0 apk -php84-sockets 8.4.16-r0 apk -php84-sodium 8.4.16-r0 apk -php84-sqlite3 8.4.16-r0 apk -php84-tokenizer 8.4.16-r0 apk -php84-xml 8.4.16-r0 apk -php84-xmlreader 8.4.16-r0 apk -php84-xmlwriter 8.4.16-r0 apk -php84-xsl 8.4.16-r0 apk -php84-zip 8.4.16-r0 apk -pinentry 1.3.1-r0 apk -pip 26.1.2 python -pkb-client 2.3.1 python -platformdirs 4.4.0 python -popt 1.19-r4 apk -procps-ng 4.0.4-r3 apk -proto-plus 1.28.0 python -protobuf 7.35.0 python -pyacmedns 0.4 python -pyasn1 0.6.3 python -pyasn1-modules 0.4.2 python -pyc 3.12.13-r0 apk -pycparser 3.0 python -pydantic 2.13.4 python -pydantic-core 2.46.4 python -pyjwt 2.13.0 python -pynamecheap 0.0.3 python -pyopenssl 26.2.0 python -pyotp 2.9.0 python -pyparsing 3.3.2 python -pyrfc3339 2.1.0 python -python-dateutil 2.9.0.post0 python -python-digitalocean 1.17.0 python -python-transip 0.6.0 python -python3 3.12.13-r0 apk -python3-pyc 3.12.13-r0 apk -python3-pycache-pyc0 3.12.13-r0 apk -pyyaml 6.0.3 python -readline 8.2.13-r1 apk -requests 2.34.2 python -requests-file 3.0.1 python -requests-mock 1.12.1 python -requests-unixsocket 0.4.1 python -s3transfer 0.18.0 python -scanelf 1.3.8-r1 apk -setuptools 82.0.1 python -shadow 4.17.3-r0 apk -six 1.17.0 python -skalibs-libs 2.14.4.0-r0 apk -sniffio 1.3.1 python -soupsieve 2.8.4 python -sqlite-libs 3.49.2-r1 apk -ssl_client 1.37.0-r20 apk -tiff 4.7.1-r0 apk -tldextract 5.3.1 python -tomli 2.4.0 python -typing-extensions 4.15.0 python -typing-inspection 0.4.2 python -tzdata 2026b-r0 apk -unixodbc 2.3.12-r0 apk -uritemplate 4.2.0 python -urllib3 2.7.0 python -utmps-libs 0.1.3.1-r0 apk -wheel 0.46.3 python -wheel 0.47.0 python -whois 5.6.3-r0 apk -xz-libs 5.8.3-r0 apk -zipp 3.23.0 python -zlib 1.3.2-r0 apk -zope-interface 8.5 python -zstd-libs 1.5.7-r0 apk +NAME VERSION TYPE +Simple Launcher 1.1.0.14 binary (+5 duplicates) +acl-libs 2.3.2-r1 apk +acme 5.8.0 python +alpine-baselayout 3.7.2-r1 apk +alpine-baselayout-data 3.7.2-r1 apk +alpine-keys 2.6-r0 apk +alpine-release 3.24.2-r0 apk +annotated-types 0.8.0 python +anyio 4.15.1 python +aom-libs 3.14.1-r0 apk +apache2-utils 2.4.68-r0 apk +apk-tools 3.0.8-r0 apk +apr 1.7.6-r0 apk +apr-util 1.6.4-r0 apk +argon2-libs 20190702-r5 apk +autocommand 2.2.2 python +azure-common 1.1.28 python +azure-core 1.41.0 python +azure-identity 1.26.0 python +azure-mgmt-core 1.6.0 python +azure-mgmt-dns 9.0.0 python +backports-tarfile 1.2.0 python +bash 5.3.9-r1 apk +beautifulsoup4 4.15.0 python +boto3 1.43.108 python +botocore 1.43.108 python +brotli-libs 1.2.0-r1 apk +bs4 0.0.2 python +busybox 1.37.0-r31 apk +busybox-binsh 1.37.0-r31 apk +c-ares 1.34.8-r0 apk +ca-certificates 20260909-r0 apk +ca-certificates-bundle 20260909-r0 apk +catatonit 0.2.1-r0 apk +certbot 5.8.0 python +certbot-dns-acmedns 0.1.0 python +certbot-dns-aliyun 2.0.0 python +certbot-dns-azure 1.5.0 python +certbot-dns-bunny 3.0.0 python +certbot-dns-cloudflare 5.8.0 python +certbot-dns-cpanel 0.4.0 python +certbot-dns-desec 1.3.2 python +certbot-dns-digitalocean 5.8.0 python +certbot-dns-directadmin 1.0.15 python +certbot-dns-dnsimple 5.8.0 python +certbot-dns-dnsmadeeasy 5.8.0 python +certbot-dns-dnspod 0.1.0 python +certbot-dns-do 0.31.0 python +certbot-dns-domeneshop 0.2.9 python +certbot-dns-dreamhost 1.0 python +certbot-dns-duckdns 1.9.0 python +certbot-dns-dynudns 0.0.6 python +certbot-dns-freedns 0.2.0 python +certbot-dns-gehirn 5.8.0 python +certbot-dns-glesys 2.1.0 python +certbot-dns-godaddy 2.8.0 python +certbot-dns-google 5.8.0 python +certbot-dns-he 1.0.0 python +certbot-dns-hetzner 4.0.0 python +certbot-dns-hetzner-cloud 1.0.5 python +certbot-dns-infomaniak 0.3.3 python +certbot-dns-inwx 3.0.3 python +certbot-dns-ionos 2024.11.9 python +certbot-dns-linode 5.8.0 python +certbot-dns-loopia 1.0.1 python +certbot-dns-luadns 5.8.0 python +certbot-dns-mijn-host 0.0.10 python +certbot-dns-namecheap 1.0.0 python +certbot-dns-netcup 2.0.3 python +certbot-dns-njalla 2.0.2 python +certbot-dns-nsone 5.8.0 python +certbot-dns-ovh 5.8.0 python +certbot-dns-porkbun 0.11.0 python +certbot-dns-rfc2136 5.8.0 python +certbot-dns-route53 5.8.0 python +certbot-dns-sakuracloud 5.8.0 python +certbot-dns-standalone 1.2.1 python +certbot-dns-transip 0.5.2 python +certbot-dns-vultr 1.1.0 python +certbot-plugin-gandi 1.5.0 python +certifi 2026.7.22 python +cffi 2.1.1 python +charset-normalizer 3.5.2 python +cli UNKNOWN binary +cli-32 UNKNOWN binary +cli-64 UNKNOWN binary +cli-arm64 UNKNOWN binary +cloudflare 5.9.0 python +composer 2.10.3 binary +configargparse 1.8.0 python +configobj 5.0.9 python +coreutils 9.11-r0 apk +coreutils-env 9.11-r0 apk +coreutils-fmt 9.11-r0 apk +coreutils-sha512sum 9.11-r0 apk +cryptography 50.0.2 python +curl 8.22.0-r0 apk +distro 1.9.0 python +dns-lexicon 3.25.2 python +dnslib 0.9.26 python +dnspython 2.8.0 python +domeneshop 0.4.4 python +fail2ban 1.1.0 python +fail2ban 1.1.0-r3 apk +fail2ban-pyc 1.1.0-r3 apk +filelock 4.0.9 python +findutils 4.10.0-r1 apk +fontconfig 2.17.1-r1 apk +freetype 2.14.3-r0 apk +future 1.0.0 python +gdbm 1.26-r0 apk +git 2.54.0-r0 apk +git-init-template 2.54.0-r0 apk +git-perl 2.54.0-r0 apk +gmp 6.3.0-r4 apk +gnupg 2.4.9-r1 apk +gnupg-dirmngr 2.4.9-r1 apk +gnupg-gpgconf 2.4.9-r1 apk +gnupg-keyboxd 2.4.9-r1 apk +gnupg-utils 2.4.9-r1 apk +gnupg-wks-client 2.4.9-r1 apk +gnutls 3.8.13-r0 apk +google-api-core 2.40.0 python +google-api-python-client 2.201.0 python +google-auth 2.59.1 python +google-auth-httplib2 0.4.4 python +googleapis-common-protos 1.75.5 python +gpg 2.4.9-r1 apk +gpg-agent 2.4.9-r1 apk +gpg-wks-server 2.4.9-r1 apk +gpgsm 2.4.9-r1 apk +gpgv 2.4.9-r1 apk +gui UNKNOWN binary +gui-32 UNKNOWN binary +gui-64 UNKNOWN binary +gui-arm64 UNKNOWN binary +h11 0.16.0 python +hcloud 2.26.0 python +httpcore 1.0.9 python +httplib2 0.32.0 python +httpx 0.28.1 python +icu-data-en 78.1-r0 apk +icu-libs 78.1-r0 apk +idna 3.20 python +importlib-metadata 8.7.1 python +inotify-tools 4.23.9.0-r0 apk +inotify-tools-libs 4.23.9.0-r0 apk +inwx-domrobot 3.2.0 python +iptables 1.8.13-r0 apk +iptables-legacy 1.8.13-r0 apk +isodate 0.7.2 python +jaraco-context 6.1.0 python +jaraco-functools 4.4.0 python +jaraco-text 4.0.0 python +jinja2 3.1.6 python +jmespath 1.1.0 python +josepy 2.2.0 python +jq 1.8.2-r0 apk +jsonpickle 4.1.3 python +libapk 3.0.8-r0 apk +libassuan 3.0.2-r0 apk +libattr 2.5.2-r2 apk +libavif 1.4.1-r0 apk +libbsd 0.12.2-r0 apk +libbz2 1.0.8-r6 apk +libcrypto3 3.5.9-r0 apk +libcurl 8.22.0-r0 apk +libdav1d 1.5.3-r0 apk +libedit 20260508.3.1-r1 apk +libevent 2.1.13-r0 apk +libexpat 2.8.5-r0 apk +libffi 3.5.2-r1 apk +libgcc 15.2.0-r5 apk +libgcrypt 1.12.2-r0 apk +libgd 2.3.3-r10 apk +libgpg-error 1.61-r0 apk +libice 1.1.2-r0 apk +libidn2 2.3.8-r0 apk +libintl 1.0-r0 apk +libip4tc 1.8.13-r0 apk +libip6tc 1.8.13-r0 apk +libjpeg-turbo 3.1.3-r0 apk +libksba 1.7.0-r0 apk +libldap 2.6.15-r0 apk +libmaxminddb-libs 1.13.3-r0 apk +libmd 1.2.0-r0 apk +libmemcached-libs 1.1.4-r1 apk +libmnl 1.0.5-r2 apk +libncursesw 6.6_p20260516-r0 apk +libnftnl 1.3.1-r0 apk +libpanelw 6.6_p20260516-r0 apk +libpng 1.6.59-r0 apk +libpq 18.6-r0 apk +libproc2 4.0.6-r0 apk +libpsl 0.21.5-r3 apk +libsasl 2.1.28-r9 apk +libseccomp 2.6.0-r2 apk +libsharpyuv 1.6.0-r0 apk +libsm 1.2.6-r0 apk +libsodium 1.0.22-r0 apk +libssl3 3.5.9-r0 apk +libstdc++ 15.2.0-r5 apk +libtasn1 4.21.0-r0 apk +libunistring 1.4.2-r0 apk +libuuid 2.42.3-r1 apk +libwebp 1.6.0-r0 apk +libx11 1.8.13-r0 apk +libxau 1.0.12-r0 apk +libxcb 1.17.0-r2 apk +libxdmcp 1.1.5-r1 apk +libxext 1.3.7-r0 apk +libxml2 2.13.9-r2 apk +libxpm 3.5.19-r0 apk +libxslt 1.1.43-r3 apk +libxt 1.3.1-r0 apk +libxtables 1.8.13-r0 apk +libyuv 0.0.1928-r0 apk +libzip 1.11.4-r2 apk +linux-pam 1.7.1-r2 apk +logrotate 3.22.0-r0 apk +loopialib 0.2.0 python +lxml 6.1.3 python +lz4-libs 1.10.0-r1 apk +markupsafe 3.0.4 python +memcached 1.6.42-r0 apk +mock 5.2.0 python +more-itertools 10.8.0 python +mpdecimal 4.0.1-r0 apk +msal 1.39.0 python +msal-extensions 1.3.1 python +musl 1.2.6-r2 apk +musl-utils 1.2.6-r2 apk +nano 9.2-r0 apk +ncurses-terminfo-base 6.6_p20260516-r0 apk +netcat-openbsd 1.234.1-r0 apk +nettle 3.10.2-r0 apk +nghttp2-libs 1.69.0-r0 apk +nginx 1.30.4-r1 apk +nginx-mod-devel-kit 1.30.4-r1 apk +nginx-mod-http-brotli 1.30.4-r1 apk +nginx-mod-http-dav-ext 1.30.4-r1 apk +nginx-mod-http-echo 1.30.4-r1 apk +nginx-mod-http-fancyindex 1.30.4-r1 apk +nginx-mod-http-geoip2 1.30.4-r1 apk +nginx-mod-http-headers-more 1.30.4-r1 apk +nginx-mod-http-image-filter 1.30.4-r1 apk +nginx-mod-http-perl 1.30.4-r1 apk +nginx-mod-http-redis2 1.30.4-r1 apk +nginx-mod-http-set-misc 1.30.4-r1 apk +nginx-mod-http-upload-progress 1.30.4-r1 apk +nginx-mod-http-xslt-filter 1.30.4-r1 apk +nginx-mod-mail 1.30.4-r1 apk +nginx-mod-rtmp 1.30.4-r1 apk +nginx-mod-stream 1.30.4-r1 apk +nginx-mod-stream-geoip2 1.30.4-r1 apk +nginx-vim 1.30.4-r1 apk +npth 1.8-r0 apk +oniguruma 6.9.10-r0 apk +openssl 3.5.9-r0 apk +opentelemetry-api 1.45.0 python +p11-kit 0.26.2-r0 apk +packaging 26.0 python +packaging 26.3 python +parsedatetime 2.6 python +pcre2 10.48-r0 apk +perl 5.42.2-r1 apk +perl-error 0.17030-r0 apk +perl-git 2.54.0-r0 apk +php85 8.5.11-r0 apk +php85-bcmath 8.5.11-r0 apk +php85-bz2 8.5.11-r0 apk +php85-common 8.5.11-r0 apk +php85-ctype 8.5.11-r0 apk +php85-curl 8.5.11-r0 apk +php85-dom 8.5.11-r0 apk +php85-exif 8.5.11-r0 apk +php85-fileinfo 8.5.11-r0 apk +php85-fpm 8.5.11-r0 apk +php85-ftp 8.5.11-r0 apk +php85-gd 8.5.11-r0 apk +php85-gmp 8.5.11-r0 apk +php85-iconv 8.5.11-r0 apk +php85-intl 8.5.11-r0 apk +php85-ldap 8.5.11-r0 apk +php85-mbstring 8.5.11-r0 apk +php85-mysqli 8.5.11-r0 apk +php85-mysqlnd 8.5.11-r0 apk +php85-openssl 8.5.11-r0 apk +php85-pdo 8.5.11-r0 apk +php85-pdo_mysql 8.5.11-r0 apk +php85-pdo_odbc 8.5.11-r0 apk +php85-pdo_pgsql 8.5.11-r0 apk +php85-pdo_sqlite 8.5.11-r0 apk +php85-pear 8.5.11-r0 apk +php85-pecl-apcu 5.1.28-r0 apk +php85-pecl-igbinary 3.2.17_rc1-r0 apk +php85-pecl-memcached 3.4.0-r0 apk +php85-pecl-msgpack 3.0.1-r0 apk +php85-pecl-redis 6.3.0-r0 apk +php85-pgsql 8.5.11-r0 apk +php85-phar 8.5.11-r0 apk +php85-posix 8.5.11-r0 apk +php85-session 8.5.11-r0 apk +php85-simplexml 8.5.11-r0 apk +php85-soap 8.5.11-r0 apk +php85-sockets 8.5.11-r0 apk +php85-sodium 8.5.11-r0 apk +php85-sqlite3 8.5.11-r0 apk +php85-tokenizer 8.5.11-r0 apk +php85-xml 8.5.11-r0 apk +php85-xmlreader 8.5.11-r0 apk +php85-xmlwriter 8.5.11-r0 apk +php85-xsl 8.5.11-r0 apk +php85-zip 8.5.11-r0 apk +pinentry 1.3.2-r0 apk +pip 26.2.1 python +pkb-client 2.3.1 python +platformdirs 4.4.0 python +popt 1.19-r4 apk +procps-ng 4.0.6-r0 apk +proto-plus 1.29.0 python +protobuf 7.36.2 python +pyacmedns 0.4 python +pyasn1 0.6.4 python +pyasn1-modules 0.4.2 python +pyc 3.14.8-r0 apk +pycparser 3.0 python +pydantic 2.13.5 python +pydantic-core 2.46.5 python +pyjwt 2.15.1 python +pynamecheap 0.0.3 python +pyopenssl 26.4.0 python +pyotp 2.10.0 python +pyparsing 3.3.3 python +pyrfc3339 2.1.0 python +python-dateutil 2.9.0.post0 python +python-digitalocean 1.17.0 python +python-transip 0.6.0 python +python3 3.14.8-r0 apk +python3-pyc 3.14.8-r0 apk +python3-pycache-pyc0 3.14.8-r0 apk +pyyaml 6.0.3 python +readline 8.3.3-r1 apk +requests 2.34.2 python +requests-file 3.0.1 python +requests-mock 1.12.1 python +requests-unixsocket 0.4.1 python +s3transfer 0.19.2 python +scanelf 1.3.9-r1 apk +setuptools 84.0.0 python +shadow 4.18.0-r1 apk +six 1.17.0 python +skalibs-libs 2.15.0.0-r0 apk +sniffio 1.3.1 python +soupsieve 2.10 python +sqlite-libs 3.53.4-r0 apk +ssl_client 1.37.0-r31 apk +tiff 4.7.1-r0 apk +tldextract 5.3.2 python +tomli 2.4.0 python +typing-extensions 4.16.0 python +typing-inspection 0.4.4 python +tzdata 2026d-r0 apk +unixodbc 2.3.14-r1 apk +uritemplate 4.2.0 python +urllib3 2.8.0 python +utmps-libs 0.1.3.3-r0 apk +wheel 0.46.3 python +wheel 0.48.0 python +whois 5.6.6-r0 apk +xz-libs 5.8.4-r0 apk +zipp 3.23.0 python +zlib 1.3.2-r0 apk +zope-interface 8.6 python +zstd-libs 1.5.7-r2 apk diff --git a/readme-vars.yml b/readme-vars.yml index 787c662..4b2fa39 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -32,7 +32,8 @@ opt_param_usage_include_env: true opt_param_env_vars: - {env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only)"} - {env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt."} - - {env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`."} + - {env_var: "CERT_PROFILE", env_value: "", desc: "Optionally define a cert profile to use for cert generation. This is useful if you want to use a custom cert profile instead of the default one. Currently only supported for Let's Encrypt. See https://letsencrypt.org/docs/profiles/ "} + - {env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `mijn-host`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`."} - {env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins."} - {env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)."} - {env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`"} @@ -65,7 +66,7 @@ app_setup_block: | 2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`) * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables * After setup, navigate to `https://example.com` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`). - * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances. + * Certs are checked twice daily using ACME Renewal Information (ARI) to determine the optimal renewal window. If your cert is about to expire, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. ### Certbot Plugins @@ -214,11 +215,15 @@ init_diagram: | svc-swag-auto-reload -> legacy-services } Base Images: { - "baseimage-alpine-nginx:3.22" <- "baseimage-alpine:3.22" + "baseimage-alpine-nginx:3.24" <- "baseimage-alpine:3.24" } "swag:latest" <- Base Images # changelog changelogs: + - {date: "09.09.26:", desc: "Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers."} + - {date: "19.07.26:", desc: "Rebase to Alpine 3.24 with PHP 8.5."} + - {date: "10.07.26:", desc: "Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay."} + - {date: "19.06.26:", desc: "Add support for mijn.host dns validation."} - {date: "01.06.26:", desc: "Remove obsolete old cert check logic."} - {date: "23.01.26:", desc: "Reorder init to fix proxy conf version checks."} - {date: "21.12.25:", desc: "Add support for hetzner-cloud dns validation."} diff --git a/root/defaults/dns-conf/mijn-host.ini b/root/defaults/dns-conf/mijn-host.ini new file mode 100644 index 0000000..4c124ce --- /dev/null +++ b/root/defaults/dns-conf/mijn-host.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/mijnhost/certbot-dns-mijn-host +# Replace with your API key from your mijn.host account. +dns_mijn_host_api_key = yourapikeygoeshere diff --git a/root/defaults/dns-conf/ovh.ini b/root/defaults/dns-conf/ovh.ini index f8fef57..1d474ee 100644 --- a/root/defaults/dns-conf/ovh.ini +++ b/root/defaults/dns-conf/ovh.ini @@ -1,4 +1,4 @@ -# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-ovh/certbot_dns_ovh/__init__.py#L20 +# Instructions: https://github.com/certbot/certbot/blob/main/certbot-dns-ovh/src/certbot_dns_ovh/__init__.py#L24 # Replace with your values dns_ovh_endpoint = ovh-eu dns_ovh_application_key = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw diff --git a/root/defaults/nginx/tinyauth-location.conf.sample b/root/defaults/nginx/tinyauth-location.conf.sample index 3bdae98..e7196b8 100644 --- a/root/defaults/nginx/tinyauth-location.conf.sample +++ b/root/defaults/nginx/tinyauth-location.conf.sample @@ -1,9 +1,22 @@ -## Version 2025/06/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample +## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf ## Send a subrequest to tinyauth to verify if the user is authenticated and has permission to access the resource auth_request /tinyauth; +auth_request_set $redirection_url $upstream_http_x_tinyauth_location; +error_page 401 403 =302 $redirection_url; -## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal -error_page 401 = @tinyauth_login; +## Translate the user information response headers from the auth subrequest into variables +auth_request_set $email $upstream_http_remote_email; +auth_request_set $groups $upstream_http_remote_groups; +auth_request_set $name $upstream_http_remote_name; +auth_request_set $user $upstream_http_remote_user; + +## Inject the user information into the request made to the actual upstream +proxy_set_header Remote-Email $email; +proxy_set_header Remote-Groups $groups; +proxy_set_header Remote-Name $name; +proxy_set_header Remote-User $user; + +## Can be extended with more custom headers https://tinyauth.app/docs/reference/headers#nginxnginx-proxy-manager diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index a4256c8..bbb2691 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -1,4 +1,4 @@ -## Version 2025/06/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample +## Version 2026/09/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf @@ -6,30 +6,17 @@ location /tinyauth { internal; - include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_tinyauth tinyauth; proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx; - proxy_set_header x-forwarded-proto $scheme; - proxy_set_header x-forwarded-host $http_host; - proxy_set_header x-forwarded-uri $request_uri; -} - -# virtual location for tinyauth 401 redirects -location @tinyauth_login { - internal; - - ## Set the $target_url variable based on the original request - set_escape_uri $target_url $scheme://$http_host$request_uri; - - ## Set the $signin_url variable - set $domain $host; - if ($host ~* "^[^.]+\.([^.]+\..+)$") { - set $domain $1; - } - set $signin_url https://tinyauth.$domain/login?redirect_uri=$target_url; - - ## Redirect to login - return 302 $signin_url; + # Don't send the body to the auth server + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + + # Headers needed for authentication + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Original-Method $request_method; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; } diff --git a/root/etc/crontabs/root b/root/etc/crontabs/root index c848b3f..49c2d31 100644 --- a/root/etc/crontabs/root +++ b/root/etc/crontabs/root @@ -5,4 +5,4 @@ 0 3 * * 6 run-parts /etc/periodic/weekly 0 5 1 * * run-parts /etc/periodic/monthly -8 2 * * * /app/le-renew.sh >> /config/log/letsencrypt/renewal.log 2>&1 +0 */12 * * * sleep $((60 + $RANDOM % 230)); /app/le-renew.sh >> /config/log/letsencrypt/renewal.log 2>&1 diff --git a/root/etc/s6-overlay/s6-rc.d/init-certbot-config/run b/root/etc/s6-overlay/s6-rc.d/init-certbot-config/run index e018d62..f0cf582 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-certbot-config/run +++ b/root/etc/s6-overlay/s6-rc.d/init-certbot-config/run @@ -12,12 +12,13 @@ EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\ ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\ VALIDATION=${VALIDATION}\\n\ CERTPROVIDER=${CERTPROVIDER}\\n\ +CERT_PROFILE=${CERT_PROFILE}\\n\ DNSPLUGIN=${DNSPLUGIN}\\n\ EMAIL=${EMAIL}\\n\ STAGING=${STAGING}\\n" # Sanitize variables -SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER) +SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER CERT_PROFILE) for i in "${SANED_VARS[@]}"; do export echo "${i}"="${!i//\"/}" export echo "${i}"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')" @@ -80,7 +81,7 @@ if [[ -f "/config/donoteditthisfile.conf" ]]; then mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf fi if [[ ! -f "/config/.donoteditthisfile.conf" ]]; then - echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf + echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\" ORIGCERT_PROFILE=\"${CERT_PROFILE}\"" >/config/.donoteditthisfile.conf echo "Created .donoteditthisfile.conf" fi @@ -186,7 +187,8 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] || [[ ! "${DNSPLUGIN}" = "${ORIGDNSPLUGIN}" ]] || [[ ! "${PROPAGATION}" = "${ORIGPROPAGATION}" ]] || [[ ! "${STAGING}" = "${ORIGSTAGING}" ]] || - [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]]; then + [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]] || + [[ ! "${CERT_PROFILE}" = "${ORIGCERT_PROFILE}" ]]; then echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created" if [[ "${ORIGCERTPROVIDER}" = "zerossl" ]]; then REV_ACMESERVER=("https://acme.zerossl.com/v2/DV90") @@ -204,7 +206,7 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] || fi # saving new variables -echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf +echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\" ORIGCERT_PROFILE=\"${CERT_PROFILE}\"" >/config/.donoteditthisfile.conf # if zerossl is selected or staging is set to true, use the relevant server if [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ "${STAGING}" = "true" ]]; then @@ -227,6 +229,21 @@ fi set_ini_value "server" "${ACMESERVER}" /config/etc/letsencrypt/cli.ini +# set certificate profile (e.g. "shortlived" for 6-day certs, "classic" for 90-day) +# Profiles are a Let's Encrypt ACME feature; ZeroSSL ignores it. +if [[ -n "${CERT_PROFILE}" ]]; then + if [[ "${CERTPROVIDER}" = "zerossl" ]]; then + echo "ZeroSSL does not support ACME profiles, ignoring CERT_PROFILE variable" + sed -i "/^preferred-profile\b/d" /config/etc/letsencrypt/cli.ini + else + echo "Requesting certificate with profile: ${CERT_PROFILE}" + set_ini_value "preferred-profile" "${CERT_PROFILE}" /config/etc/letsencrypt/cli.ini + fi +else + # remove if previously set so going back to default works + sed -i "/^preferred-profile\b/d" /config/etc/letsencrypt/cli.ini +fi + # figuring out domain only vs domain & subdomains vs subdomains only DOMAINS_ARRAY=() if [[ -z "${SUBDOMAINS}" ]] || [[ "${ONLY_SUBDOMAINS}" != true ]]; then diff --git a/root/etc/s6-overlay/s6-rc.d/init-renew/run b/root/etc/s6-overlay/s6-rc.d/init-renew/run index b402a0b..5645a5b 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-renew/run +++ b/root/etc/s6-overlay/s6-rc.d/init-renew/run @@ -3,7 +3,7 @@ # Check if the cert is expired or expires within a day, if so, renew if openssl x509 -in /config/keys/letsencrypt/fullchain.pem -noout -checkend 86400 >/dev/null; then - echo "The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am)." + echo "The cert does not expire within the next day. Letting the cron script handle the renewal attempts." else echo "The cert is either expired or it expires within the next day. Attempting to renew. This could take up to 10 minutes." /app/le-renew.sh