mirror of
https://github.com/linuxserver/docker-swag.git
synced 2026-03-06 10:23:33 +09:00
Compare commits
16 Commits
1.31.0-ls1
...
2.0.0-ls16
| Author | SHA1 | Date | |
|---|---|---|---|
|
47cb0bffe3 | ||
|
|
d159fde608 | ||
|
263cceda4c | ||
|
|
631fe9ecc3 | ||
|
|
f2bc6b05bc | ||
|
|
3f8ac5552f | ||
|
|
a26528919c | ||
|
14cc464d65 | ||
|
|
4221059496 | ||
|
|
d00d2dbe95 | ||
|
|
c07939aed0 | ||
|
|
8b1311c3f1 | ||
|
|
fcffe2b169 | ||
|
|
b82c474941 | ||
|
56bb365cee | ||
|
|
b692c69c4d |
8
.github/workflows/external_trigger.yml
vendored
8
.github/workflows/external_trigger.yml
vendored
@@ -48,8 +48,12 @@ jobs:
|
||||
| jq -r '.config.digest')
|
||||
image_info=$(curl -sL \
|
||||
--header "Authorization: Bearer ${token}" \
|
||||
"https://ghcr.io/v2/${image}/blobs/${digest}" \
|
||||
| jq -r '.container_config')
|
||||
"https://ghcr.io/v2/${image}/blobs/${digest}")
|
||||
if [[ $(echo $image_info | jq -r '.container_config') == "null" ]]; then
|
||||
image_info=$(echo $image_info | jq -r '.config')
|
||||
else
|
||||
image_info=$(echo $image_info | jq -r '.container_config')
|
||||
fi
|
||||
IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
|
||||
IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
|
||||
if [ -z "${IMAGE_VERSION}" ]; then
|
||||
|
||||
16
README.md
16
README.md
@@ -63,13 +63,15 @@ The architectures supported by this image are:
|
||||
### Validation and initial setup
|
||||
|
||||
* Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
|
||||
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
|
||||
* For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
|
||||
* For `dns` validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`
|
||||
* Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
|
||||
* Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
|
||||
* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
|
||||
* DuckDNS only supoprts two types of DNS validated certificates (not both at the same time):
|
||||
1. Certs that only cover your main subdomain (ie. `yoursubdomain.duckdns.org`, leave the `SUBDOMAINS` variable empty)
|
||||
2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`)
|
||||
* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
|
||||
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
|
||||
* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
|
||||
* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
|
||||
|
||||
@@ -159,7 +161,6 @@ services:
|
||||
- CERTPROVIDER= #optional
|
||||
- DNSPLUGIN=cloudflare #optional
|
||||
- PROPAGATION= #optional
|
||||
- DUCKDNSTOKEN= #optional
|
||||
- EMAIL= #optional
|
||||
- ONLY_SUBDOMAINS=false #optional
|
||||
- EXTRA_DOMAINS= #optional
|
||||
@@ -187,7 +188,6 @@ docker run -d \
|
||||
-e CERTPROVIDER= `#optional` \
|
||||
-e DNSPLUGIN=cloudflare `#optional` \
|
||||
-e PROPAGATION= `#optional` \
|
||||
-e DUCKDNSTOKEN= `#optional` \
|
||||
-e EMAIL= `#optional` \
|
||||
-e ONLY_SUBDOMAINS=false `#optional` \
|
||||
-e EXTRA_DOMAINS= `#optional` \
|
||||
@@ -211,12 +211,11 @@ Container images are configured using parameters passed at runtime (such as thos
|
||||
| `-e PGID=1000` | for GroupID - see below for explanation |
|
||||
| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London. |
|
||||
| `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
|
||||
| `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
|
||||
| `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
|
||||
| `-e VALIDATION=http` | Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set). |
|
||||
| `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only) |
|
||||
| `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
|
||||
| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
|
||||
| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `duckdns`, `dynu`, `gandi`, `gehirn`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
|
||||
| `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
|
||||
| `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from <https://www.duckdns.org> |
|
||||
| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
|
||||
| `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
|
||||
| `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
|
||||
@@ -336,6 +335,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
|
||||
|
||||
## Versions
|
||||
|
||||
* **05.11.22:** - Update acmedns plugin handling.
|
||||
* **06.10.22:** - Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic.
|
||||
* **05.10.22:** - Use certbot file hooks instead of command line hooks
|
||||
* **04.10.22:** - Add godaddy and porkbun dns plugins.
|
||||
|
||||
@@ -12,13 +12,13 @@ c-client-2007f-r13
|
||||
ca-certificates-20220614-r0
|
||||
ca-certificates-bundle-20220614-r0
|
||||
coreutils-9.0-r2
|
||||
curl-7.80.0-r3
|
||||
expat-2.4.9-r0
|
||||
curl-7.80.0-r4
|
||||
expat-2.5.0-r0
|
||||
fail2ban-0.11.2-r1
|
||||
freetype-2.11.1-r2
|
||||
gdbm-1.22-r0
|
||||
git-2.34.4-r0
|
||||
git-perl-2.34.4-r0
|
||||
git-2.34.5-r0
|
||||
git-perl-2.34.5-r0
|
||||
gmp-6.2.1-r1
|
||||
gnupg-2.2.31-r2
|
||||
gnupg-dirmngr-2.2.31-r2
|
||||
@@ -41,8 +41,8 @@ libbsd-0.11.3-r1
|
||||
libbz2-1.0.8-r1
|
||||
libc-utils-0.7.2-r3
|
||||
libcap-2.61-r0
|
||||
libcrypto1.1-1.1.1q-r0
|
||||
libcurl-7.80.0-r3
|
||||
libcrypto1.1-1.1.1s-r1
|
||||
libcurl-7.80.0-r4
|
||||
libedit-20210910.3.1-r0
|
||||
libevent-2.1.12-r4
|
||||
libffi-3.4.2-r1
|
||||
@@ -70,18 +70,18 @@ libsasl-2.1.28-r0
|
||||
libseccomp-2.5.2-r0
|
||||
libsm-1.2.3-r0
|
||||
libsodium-1.0.18-r0
|
||||
libssl1.1-1.1.1q-r0
|
||||
libssl1.1-1.1.1s-r1
|
||||
libstdc++-10.3.1_git20211027-r0
|
||||
libtasn1-4.18.0-r0
|
||||
libunistring-0.9.10-r1
|
||||
libuuid-2.37.4-r0
|
||||
libwebp-1.2.2-r0
|
||||
libx11-1.7.2-r0
|
||||
libx11-1.7.3.1-r0
|
||||
libxau-1.0.9-r0
|
||||
libxcb-1.14-r2
|
||||
libxdmcp-1.1.3-r0
|
||||
libxext-1.3.4-r0
|
||||
libxml2-2.9.14-r1
|
||||
libxml2-2.9.14-r2
|
||||
libxpm-3.5.13-r0
|
||||
libxslt-1.1.35-r0
|
||||
libxt-1.2.1-r0
|
||||
@@ -120,41 +120,41 @@ nginx-mod-stream-geoip2-1.20.2-r1
|
||||
nginx-vim-1.20.2-r1
|
||||
npth-1.6-r1
|
||||
oniguruma-6.9.7.1-r0
|
||||
openssl-1.1.1q-r0
|
||||
openssl-1.1.1s-r1
|
||||
p11-kit-0.24.0-r1
|
||||
pcre-8.45-r1
|
||||
pcre2-10.40-r0
|
||||
perl-5.34.0-r1
|
||||
perl-error-0.17029-r1
|
||||
perl-git-2.34.4-r0
|
||||
php8-8.0.18-r0
|
||||
php8-bcmath-8.0.18-r0
|
||||
php8-bz2-8.0.18-r0
|
||||
php8-common-8.0.18-r0
|
||||
php8-ctype-8.0.18-r0
|
||||
php8-curl-8.0.18-r0
|
||||
php8-dom-8.0.18-r0
|
||||
php8-exif-8.0.18-r0
|
||||
php8-fileinfo-8.0.18-r0
|
||||
php8-fpm-8.0.18-r0
|
||||
php8-ftp-8.0.18-r0
|
||||
php8-gd-8.0.18-r0
|
||||
php8-gmp-8.0.18-r0
|
||||
php8-iconv-8.0.18-r0
|
||||
php8-imap-8.0.18-r0
|
||||
php8-intl-8.0.18-r0
|
||||
php8-ldap-8.0.18-r0
|
||||
php8-mbstring-8.0.18-r0
|
||||
php8-mysqli-8.0.18-r0
|
||||
php8-mysqlnd-8.0.18-r0
|
||||
php8-opcache-8.0.18-r0
|
||||
php8-openssl-8.0.18-r0
|
||||
php8-pdo-8.0.18-r0
|
||||
php8-pdo_mysql-8.0.18-r0
|
||||
php8-pdo_odbc-8.0.18-r0
|
||||
php8-pdo_pgsql-8.0.18-r0
|
||||
php8-pdo_sqlite-8.0.18-r0
|
||||
php8-pear-8.0.18-r0
|
||||
perl-git-2.34.5-r0
|
||||
php8-8.0.25-r0
|
||||
php8-bcmath-8.0.25-r0
|
||||
php8-bz2-8.0.25-r0
|
||||
php8-common-8.0.25-r0
|
||||
php8-ctype-8.0.25-r0
|
||||
php8-curl-8.0.25-r0
|
||||
php8-dom-8.0.25-r0
|
||||
php8-exif-8.0.25-r0
|
||||
php8-fileinfo-8.0.25-r0
|
||||
php8-fpm-8.0.25-r0
|
||||
php8-ftp-8.0.25-r0
|
||||
php8-gd-8.0.25-r0
|
||||
php8-gmp-8.0.25-r0
|
||||
php8-iconv-8.0.25-r0
|
||||
php8-imap-8.0.25-r0
|
||||
php8-intl-8.0.25-r0
|
||||
php8-ldap-8.0.25-r0
|
||||
php8-mbstring-8.0.25-r0
|
||||
php8-mysqli-8.0.25-r0
|
||||
php8-mysqlnd-8.0.25-r0
|
||||
php8-opcache-8.0.25-r0
|
||||
php8-openssl-8.0.25-r0
|
||||
php8-pdo-8.0.25-r0
|
||||
php8-pdo_mysql-8.0.25-r0
|
||||
php8-pdo_odbc-8.0.25-r0
|
||||
php8-pdo_pgsql-8.0.25-r0
|
||||
php8-pdo_sqlite-8.0.25-r0
|
||||
php8-pear-8.0.25-r0
|
||||
php8-pecl-apcu-5.1.21-r0
|
||||
php8-pecl-igbinary-3.2.6-r0
|
||||
php8-pecl-mailparse-3.1.3-r0
|
||||
@@ -162,21 +162,21 @@ php8-pecl-mcrypt-1.0.4-r0
|
||||
php8-pecl-memcached-3.1.5-r1
|
||||
php8-pecl-redis-5.3.6-r0
|
||||
php8-pecl-xmlrpc-1.0.0_rc3-r0
|
||||
php8-pgsql-8.0.18-r0
|
||||
php8-phar-8.0.18-r0
|
||||
php8-posix-8.0.18-r0
|
||||
php8-session-8.0.18-r0
|
||||
php8-simplexml-8.0.18-r0
|
||||
php8-soap-8.0.18-r0
|
||||
php8-sockets-8.0.18-r0
|
||||
php8-sodium-8.0.18-r0
|
||||
php8-sqlite3-8.0.18-r0
|
||||
php8-tokenizer-8.0.18-r0
|
||||
php8-xml-8.0.18-r0
|
||||
php8-xmlreader-8.0.18-r0
|
||||
php8-xmlwriter-8.0.18-r0
|
||||
php8-xsl-8.0.18-r0
|
||||
php8-zip-8.0.18-r0
|
||||
php8-pgsql-8.0.25-r0
|
||||
php8-phar-8.0.25-r0
|
||||
php8-posix-8.0.25-r0
|
||||
php8-session-8.0.25-r0
|
||||
php8-simplexml-8.0.25-r0
|
||||
php8-soap-8.0.25-r0
|
||||
php8-sockets-8.0.25-r0
|
||||
php8-sodium-8.0.25-r0
|
||||
php8-sqlite3-8.0.25-r0
|
||||
php8-tokenizer-8.0.25-r0
|
||||
php8-xml-8.0.25-r0
|
||||
php8-xmlreader-8.0.25-r0
|
||||
php8-xmlwriter-8.0.25-r0
|
||||
php8-xsl-8.0.25-r0
|
||||
php8-zip-8.0.25-r0
|
||||
pinentry-1.2.0-r0
|
||||
popt-1.18-r0
|
||||
procps-3.3.17-r0
|
||||
@@ -211,7 +211,7 @@ py3-toml-0.10.2-r2
|
||||
py3-tomli-1.2.2-r0
|
||||
py3-urllib3-1.26.7-r0
|
||||
py3-webencodings-0.5.1-r4
|
||||
python3-3.9.13-r1
|
||||
python3-3.9.15-r0
|
||||
readline-8.1.1-r0
|
||||
s6-ipcserver-2.11.0.0-r0
|
||||
scanelf-1.3.3-r0
|
||||
@@ -219,7 +219,7 @@ shadow-4.8.1-r1
|
||||
skalibs-2.11.0.0-r0
|
||||
sqlite-libs-3.36.0-r0
|
||||
ssl_client-1.34.1-r7
|
||||
tzdata-2022c-r0
|
||||
tzdata-2022f-r1
|
||||
unixodbc-2.3.9-r1
|
||||
utmps-0.1.0.3-r0
|
||||
whois-5.5.10-r0
|
||||
|
||||
@@ -32,7 +32,7 @@ param_usage_include_env: true
|
||||
param_env_vars:
|
||||
- { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
|
||||
- { env_var: "URL", env_value: "yourdomain.url", desc: "Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns)." }
|
||||
- { env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`)." }
|
||||
- { env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set)." }
|
||||
param_usage_include_vols: true
|
||||
param_volumes:
|
||||
- { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "All the config files including the webroot reside here." }
|
||||
@@ -49,11 +49,10 @@ cap_add_param_vars:
|
||||
# optional container parameters
|
||||
opt_param_usage_include_env: true
|
||||
opt_param_env_vars:
|
||||
- { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
|
||||
- { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only)" }
|
||||
- { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
|
||||
- { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
|
||||
- { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `duckdns`, `dynu`, `gandi`, `gehirn`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
|
||||
- { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
|
||||
- { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from <https://www.duckdns.org>" }
|
||||
- { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
|
||||
- { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
|
||||
- { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
|
||||
@@ -80,13 +79,15 @@ app_setup_block: |
|
||||
### Validation and initial setup
|
||||
|
||||
* Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
|
||||
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
|
||||
* For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
|
||||
* For `dns` validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`
|
||||
* Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
|
||||
* Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
|
||||
* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
|
||||
* DuckDNS only supoprts two types of DNS validated certificates (not both at the same time):
|
||||
1. Certs that only cover your main subdomain (ie. `yoursubdomain.duckdns.org`, leave the `SUBDOMAINS` variable empty)
|
||||
2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`)
|
||||
* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
|
||||
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
|
||||
* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
|
||||
* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
|
||||
|
||||
@@ -156,6 +157,7 @@ app_setup_nginx_reverse_proxy_block: ""
|
||||
|
||||
# changelog
|
||||
changelogs:
|
||||
- { date: "05.11.22:", desc: "Update acmedns plugin handling."}
|
||||
- { date: "06.10.22:", desc: "Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic." }
|
||||
- { date: "05.10.22:", desc: "Use certbot file hooks instead of command line hooks" }
|
||||
- { date: "04.10.22:", desc: "Add godaddy and porkbun dns plugins." }
|
||||
|
||||
@@ -158,10 +158,13 @@ if [ "$VALIDATION" = "dns" ]; then
|
||||
elif [[ "$DNSPLUGIN" =~ ^(azure|gandi)$ ]]; then
|
||||
if [ -n "$PROPAGATION" ]; then echo "${DNSPLUGIN} dns plugin does not support setting propagation time"; fi
|
||||
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini"
|
||||
elif [[ "$DNSPLUGIN" =~ ^(duckdns)$ ]]; then
|
||||
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
|
||||
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini --dns-duckdns-no-txt-restore ${PROPAGATIONPARAM}"
|
||||
elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
|
||||
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
|
||||
PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
|
||||
elif [[ "$DNSPLUGIN" =~ ^(aliyun|cpanel|desec|dnspod|do|domeneshop|duckdns|dynu|godaddy|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|porkbun|transip|vultr)$ ]]; then
|
||||
elif [[ "$DNSPLUGIN" =~ ^(acmedns|aliyun|cpanel|desec|dnspod|do|domeneshop|dynu|godaddy|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|porkbun|transip|vultr)$ ]]; then
|
||||
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
|
||||
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
|
||||
elif [[ "$DNSPLUGIN" =~ ^(standalone)$ ]]; then
|
||||
@@ -221,7 +224,7 @@ if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "
|
||||
if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
|
||||
certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
|
||||
fi
|
||||
rm -rf /config/etc/letsencrypt/{archive,live,renewal}
|
||||
rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
|
||||
fi
|
||||
|
||||
# saving new variables
|
||||
@@ -241,7 +244,7 @@ if [ -f "/config/keys/letsencrypt/chain.pem" ] && { [ "${CERTPROVIDER}" == "lets
|
||||
if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
|
||||
certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
|
||||
fi
|
||||
rm -rf /config/etc/letsencrypt/{archive,live,renewal}
|
||||
rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
|
||||
fi
|
||||
|
||||
# generating certs if necessary
|
||||
|
||||
Reference in New Issue
Block a user