Merge pull request #300 from linuxserver/shellcheck

Shellcheck and formatting
Brace for impact
2026-03-03 00:43:34 +09:00 · 2022-11-29 13:48:31 -06:00 · 2022-11-29 15:18:56 +00:00 · 2022-11-29 15:10:47 +00:00 · 2022-11-29 16:08:12 +01:00 · 2022-11-29 09:06:43 -06:00
34 changed files with 317 additions and 230 deletions
--- a/.github/ISSUE_TEMPLATE/issue.bug.md
+++ b/.github/ISSUE_TEMPLATE/issue.bug.md
@@ -1,40 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-
---
-[linuxserverurl]: https://linuxserver.io
-[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-
-<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
-
-<!--- Provide a general summary of the bug in the Title above -->
-
------------------------------
-
-## Expected Behavior
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Steps to Reproduce
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Environment
-**OS:**
-**CPU architecture:** x86_64/arm32/arm64
-**How docker service was installed:**
-<!--- ie. from the official docker repo, from the distro repo, nas OS provided, etc. -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Command used to create docker container (run/create/compose/screenshot)
-<!--- Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container -->
-
-## Docker logs
-<!--- Provide a full docker log, output of "docker logs swag" -->
--- a/.github/ISSUE_TEMPLATE/issue.bug.yml
+++ b/.github/ISSUE_TEMPLATE/issue.bug.yml
@@ -0,0 +1,77 @@
+# Based on the issue template
+name: Bug report
+description: Create a report to help us improve
+title: "[BUG] <title>"
+labels: [Bug]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Current Behavior
+      description: Tell us what happens instead of the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: Tell us what should happen.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Steps To Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. In this environment...
+        2. With this config...
+        3. Run '...'
+        4. See error...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        examples:
+          - **OS**: Ubuntu 20.04
+          - **How docker service was installed**: distro's packagemanager
+      value: |
+        - OS:
+        - How docker service was installed:
+      render: markdown
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: CPU architecture
+      options:
+        - x86-64
+        - arm64
+        - armhf
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Docker creation
+      description: |
+        Command used to create docker container
+        Provide your docker create/run command or compose yaml snippet, or a screenshot of settings if using a gui to create the container
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      description: |
+        Provide a full docker log, output of "docker logs linuxserver.io"
+      label: Container logs
+      placeholder: |
+        Output of `docker logs linuxserver.io`
+      render: bash
+    validations:
+      required: true
--- a/.github/ISSUE_TEMPLATE/issue.feature.md
+++ b/.github/ISSUE_TEMPLATE/issue.feature.md
@@ -1,25 +0,0 @@
---
-name: Feature request
-about: Suggest an idea for this project
-
---
-[linuxserverurl]: https://linuxserver.io
-[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-
-<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
-
-<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
-<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
-
-<!--- Provide a general summary of the request in the Title above -->
-
------------------------------
-
-## Desired Behavior
-<!--- Tell us what should happen -->
-
-## Current Behavior
-<!--- Tell us what happens instead of the expected behavior -->
-
-## Alternatives Considered
-<!--- Tell us what other options you have tried or considered -->
--- a/.github/ISSUE_TEMPLATE/issue.feature.yml
+++ b/.github/ISSUE_TEMPLATE/issue.feature.yml
@@ -0,0 +1,31 @@
+# Based on the issue template
+name: Feature request
+description: Suggest an idea for this project
+title: "[FEAT] <title>"
+labels: [enhancement]
+body:
+  - type: checkboxes
+    attributes:
+      label: Is this a new feature request?
+      description: Please search to see if a feature request already exists.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Wanted change
+      description: Tell us what you want to happen.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reason for change
+      description: Justify your request, why do you want it, what is the benefit.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Proposed code change
+      description: Do you have a potential code change in mind?
+    validations:
+      required: false
--- a/.github/workflows/external_trigger.yml
+++ b/.github/workflows/external_trigger.yml
@@ -7,7 +7,7 @@ jobs:
  external-trigger-master:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v3.1.0

      - name: External Trigger
        if: github.ref == 'refs/heads/master'
@@ -18,7 +18,7 @@ jobs:
          fi
          echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\". ****"
          echo "**** Retrieving external version ****"
-          EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
+          EXT_RELEASE=$(echo '1.32.0')
          if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
            echo "**** Can't retrieve external version, exiting ****"
            FAILURE_REASON="Can't retrieve external version for swag branch master"
@@ -48,8 +48,12 @@ jobs:
              | jq -r '.config.digest')
          image_info=$(curl -sL \
            --header "Authorization: Bearer ${token}" \
-            "https://ghcr.io/v2/${image}/blobs/${digest}" \
-            | jq -r '.container_config')
+            "https://ghcr.io/v2/${image}/blobs/${digest}")
+          if [[ $(echo $image_info | jq -r '.container_config') == "null" ]]; then
+            image_info=$(echo $image_info | jq -r '.config')
+          else
+            image_info=$(echo $image_info | jq -r '.container_config')
+          fi
          IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
          IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
          if [ -z "${IMAGE_VERSION}" ]; then
--- a/.github/workflows/external_trigger_scheduler.yml
+++ b/.github/workflows/external_trigger_scheduler.yml
@@ -9,7 +9,7 @@ jobs:
  external-trigger-scheduler:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v3.1.0
        with:
          fetch-depth: '0'

--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v1
      with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.bug.md) or [feature](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.feature.md) issue templates!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.bug.yml) or [feature](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.feature.yml) issue templates!'
        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/package_trigger.yml
+++ b/.github/workflows/package_trigger.yml
@@ -7,7 +7,7 @@ jobs:
  package-trigger-master:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v3.1.0

      - name: Package Trigger
        if: github.ref == 'refs/heads/master'
--- a/.github/workflows/package_trigger_scheduler.yml
+++ b/.github/workflows/package_trigger_scheduler.yml
@@ -9,7 +9,7 @@ jobs:
  package-trigger-scheduler:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v2.3.3
+      - uses: actions/checkout@v3.1.0
        with:
          fetch-depth: '0'

--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -10,7 +10,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/stale@v3
+    - uses: actions/stale@v6.0.1
      with:
        stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
        stale-pr-message: "This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
--- a/1
+++ b/1
@@ -101,6 +101,7 @@ RUN \
  pip3 install -U \
    pip wheel && \
  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
+    acme==${CERTBOT_VERSION} \
    ${CERTBOT} \
    certbot-dns-acmedns \
    certbot-dns-aliyun \
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -101,6 +101,7 @@ RUN \
  pip3 install -U \
    pip wheel && \
  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
+    acme==${CERTBOT_VERSION} \
    ${CERTBOT} \
    certbot-dns-acmedns \
    certbot-dns-aliyun \
--- a/Dockerfile.armhf
+++ b/Dockerfile.armhf
@@ -101,6 +101,7 @@ RUN \
  pip3 install -U \
    pip wheel && \
  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
+    acme==${CERTBOT_VERSION} \
    ${CERTBOT} \
    certbot-dns-acmedns \
    certbot-dns-aliyun \
--- a/19
+++ b/19
@@ -57,7 +57,7 @@ pipeline {
          env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/commit/' + env.GIT_COMMIT
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
          env.PULL_REQUEST = env.CHANGE_ID
-          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE .editorconfig ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.md ./.github/ISSUE_TEMPLATE/issue.feature.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/external_trigger_scheduler.yml ./.github/workflows/greetings.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/stale.yml ./.github/workflows/external_trigger.yml ./.github/workflows/package_trigger.yml ./root/donate.txt'
+          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE .editorconfig ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.yml ./.github/ISSUE_TEMPLATE/issue.feature.yml ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/external_trigger_scheduler.yml ./.github/workflows/greetings.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/stale.yml ./.github/workflows/external_trigger.yml ./.github/workflows/package_trigger.yml ./root/donate.txt'
        }
        script{
          env.LS_RELEASE_NUMBER = sh(
@@ -100,17 +100,18 @@ pipeline {
    /* ########################
       External Release Tagging
       ######################## */
-    // If this is a pip release set the external tag to the pip version
-    stage("Set ENV pip_version"){
+    // If this is a custom command to determine version use that command
+    stage("Set tag custom bash"){
      steps{
        script{
          env.EXT_RELEASE = sh(
-            script: '''curl -sL  https://pypi.python.org/pypi/${EXT_PIP}/json |jq -r '. | .info.version' ''',
+            script: ''' echo '1.32.0' ''',
            returnStdout: true).trim()
-          env.RELEASE_LINK = 'https://pypi.python.org/pypi/' + env.EXT_PIP
+            env.RELEASE_LINK = 'custom_command'
        }
      }
-    }    // Sanitize the release tag and strip illegal docker or github characters
+    }
+    // Sanitize the release tag and strip illegal docker or github characters
    stage("Sanitize tag"){
      steps{
        script{
@@ -277,7 +278,7 @@ pipeline {
                echo "Jenkinsfile is up to date."
              fi
              # Stage 2 - Delete old templates
-              OLD_TEMPLATES=".github/ISSUE_TEMPLATE.md"
+              OLD_TEMPLATES=".github/ISSUE_TEMPLATE.md\n.github/ISSUE_TEMPLATE/issue.bug.md\n.github/ISSUE_TEMPLATE/issue.feature.md"
              for i in ${OLD_TEMPLATES}; do
                if [[ -f "${i}" ]]; then
                  TEMPLATES_TO_DELETE="${i} ${TEMPLATES_TO_DELETE}"
@@ -911,11 +912,11 @@ pipeline {
             "tagger": {"name": "LinuxServer Jenkins","email": "jenkins@linuxserver.io","date": "'${GITHUB_DATE}'"}}' '''
        echo "Pushing New release for Tag"
        sh '''#! /bin/bash
-              echo "Updating PIP version of ${EXT_PIP} to ${EXT_RELEASE_CLEAN}" > releasebody.json
+              echo "Updating to ${EXT_RELEASE_CLEAN}" > releasebody.json
              echo '{"tag_name":"'${META_TAG}'",\
                     "target_commitish": "master",\
                     "name": "'${META_TAG}'",\
-                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**PIP Changes:**\\n\\n' > start
+                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**Remote Changes:**\\n\\n' > start
              printf '","draft": false,"prerelease": false}' >> releasebody.json
              paste -d'\\0' start releasebody.json > releasebody.json.done
              curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases -d @releasebody.json.done'''
--- a/README.md
+++ b/README.md
@@ -335,6 +335,9 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

 ## Versions

+* **22.11.22:** - Pin acme to the same version as certbot.
+* **22.11.22:** - Pin certbot to 1.32.0 until plugin compatibility improves.
+* **05.11.22:** - Update acmedns plugin handling.
 * **06.10.22:** - Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic.
 * **05.10.22:** - Use certbot file hooks instead of command line hooks
 * **04.10.22:** - Add godaddy and porkbun dns plugins.
--- a/jenkins-vars.yml
+++ b/jenkins-vars.yml
@@ -2,7 +2,12 @@

 # jenkins variables
 project_name: docker-swag
-external_type: pip_version
+
+# Pin certbot to 1.32.0 until plugin compatibility improves
+external_type: na
+custom_version_command: "echo '1.32.0'"
+
+#external_type: pip_version
 release_type: stable
 release_tag: latest
 ls_branch: master
--- a/package_versions.txt
+++ b/package_versions.txt
@@ -12,13 +12,13 @@ c-client-2007f-r13
 ca-certificates-20220614-r0
 ca-certificates-bundle-20220614-r0
 coreutils-9.0-r2
-curl-7.80.0-r3
-expat-2.4.9-r0
+curl-7.80.0-r4
+expat-2.5.0-r0
 fail2ban-0.11.2-r1
 freetype-2.11.1-r2
 gdbm-1.22-r0
-git-2.34.4-r0
-git-perl-2.34.4-r0
+git-2.34.5-r0
+git-perl-2.34.5-r0
 gmp-6.2.1-r1
 gnupg-2.2.31-r2
 gnupg-dirmngr-2.2.31-r2
@@ -41,8 +41,8 @@ libbsd-0.11.3-r1
 libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
 libcap-2.61-r0
-libcrypto1.1-1.1.1q-r0
-libcurl-7.80.0-r3
+libcrypto1.1-1.1.1s-r1
+libcurl-7.80.0-r4
 libedit-20210910.3.1-r0
 libevent-2.1.12-r4
 libffi-3.4.2-r1
@@ -70,7 +70,7 @@ libsasl-2.1.28-r0
 libseccomp-2.5.2-r0
 libsm-1.2.3-r0
 libsodium-1.0.18-r0
-libssl1.1-1.1.1q-r0
+libssl1.1-1.1.1s-r1
 libstdc++-10.3.1_git20211027-r0
 libtasn1-4.18.0-r0
 libunistring-0.9.10-r1
@@ -81,7 +81,7 @@ libxau-1.0.9-r0
 libxcb-1.14-r2
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.14-r1
+libxml2-2.9.14-r2
 libxpm-3.5.13-r0
 libxslt-1.1.35-r0
 libxt-1.2.1-r0
@@ -120,41 +120,41 @@ nginx-mod-stream-geoip2-1.20.2-r1
 nginx-vim-1.20.2-r1
 npth-1.6-r1
 oniguruma-6.9.7.1-r0
-openssl-1.1.1q-r0
+openssl-1.1.1s-r1
 p11-kit-0.24.0-r1
 pcre-8.45-r1
 pcre2-10.40-r0
 perl-5.34.0-r1
 perl-error-0.17029-r1
-perl-git-2.34.4-r0
-php8-8.0.18-r0
-php8-bcmath-8.0.18-r0
-php8-bz2-8.0.18-r0
-php8-common-8.0.18-r0
-php8-ctype-8.0.18-r0
-php8-curl-8.0.18-r0
-php8-dom-8.0.18-r0
-php8-exif-8.0.18-r0
-php8-fileinfo-8.0.18-r0
-php8-fpm-8.0.18-r0
-php8-ftp-8.0.18-r0
-php8-gd-8.0.18-r0
-php8-gmp-8.0.18-r0
-php8-iconv-8.0.18-r0
-php8-imap-8.0.18-r0
-php8-intl-8.0.18-r0
-php8-ldap-8.0.18-r0
-php8-mbstring-8.0.18-r0
-php8-mysqli-8.0.18-r0
-php8-mysqlnd-8.0.18-r0
-php8-opcache-8.0.18-r0
-php8-openssl-8.0.18-r0
-php8-pdo-8.0.18-r0
-php8-pdo_mysql-8.0.18-r0
-php8-pdo_odbc-8.0.18-r0
-php8-pdo_pgsql-8.0.18-r0
-php8-pdo_sqlite-8.0.18-r0
-php8-pear-8.0.18-r0
+perl-git-2.34.5-r0
+php8-8.0.25-r0
+php8-bcmath-8.0.25-r0
+php8-bz2-8.0.25-r0
+php8-common-8.0.25-r0
+php8-ctype-8.0.25-r0
+php8-curl-8.0.25-r0
+php8-dom-8.0.25-r0
+php8-exif-8.0.25-r0
+php8-fileinfo-8.0.25-r0
+php8-fpm-8.0.25-r0
+php8-ftp-8.0.25-r0
+php8-gd-8.0.25-r0
+php8-gmp-8.0.25-r0
+php8-iconv-8.0.25-r0
+php8-imap-8.0.25-r0
+php8-intl-8.0.25-r0
+php8-ldap-8.0.25-r0
+php8-mbstring-8.0.25-r0
+php8-mysqli-8.0.25-r0
+php8-mysqlnd-8.0.25-r0
+php8-opcache-8.0.25-r0
+php8-openssl-8.0.25-r0
+php8-pdo-8.0.25-r0
+php8-pdo_mysql-8.0.25-r0
+php8-pdo_odbc-8.0.25-r0
+php8-pdo_pgsql-8.0.25-r0
+php8-pdo_sqlite-8.0.25-r0
+php8-pear-8.0.25-r0
 php8-pecl-apcu-5.1.21-r0
 php8-pecl-igbinary-3.2.6-r0
 php8-pecl-mailparse-3.1.3-r0
@@ -162,21 +162,21 @@ php8-pecl-mcrypt-1.0.4-r0
 php8-pecl-memcached-3.1.5-r1
 php8-pecl-redis-5.3.6-r0
 php8-pecl-xmlrpc-1.0.0_rc3-r0
-php8-pgsql-8.0.18-r0
-php8-phar-8.0.18-r0
-php8-posix-8.0.18-r0
-php8-session-8.0.18-r0
-php8-simplexml-8.0.18-r0
-php8-soap-8.0.18-r0
-php8-sockets-8.0.18-r0
-php8-sodium-8.0.18-r0
-php8-sqlite3-8.0.18-r0
-php8-tokenizer-8.0.18-r0
-php8-xml-8.0.18-r0
-php8-xmlreader-8.0.18-r0
-php8-xmlwriter-8.0.18-r0
-php8-xsl-8.0.18-r0
-php8-zip-8.0.18-r0
+php8-pgsql-8.0.25-r0
+php8-phar-8.0.25-r0
+php8-posix-8.0.25-r0
+php8-session-8.0.25-r0
+php8-simplexml-8.0.25-r0
+php8-soap-8.0.25-r0
+php8-sockets-8.0.25-r0
+php8-sodium-8.0.25-r0
+php8-sqlite3-8.0.25-r0
+php8-tokenizer-8.0.25-r0
+php8-xml-8.0.25-r0
+php8-xmlreader-8.0.25-r0
+php8-xmlwriter-8.0.25-r0
+php8-xsl-8.0.25-r0
+php8-zip-8.0.25-r0
 pinentry-1.2.0-r0
 popt-1.18-r0
 procps-3.3.17-r0
@@ -211,7 +211,7 @@ py3-toml-0.10.2-r2
 py3-tomli-1.2.2-r0
 py3-urllib3-1.26.7-r0
 py3-webencodings-0.5.1-r4
-python3-3.9.13-r1
+python3-3.9.15-r0
 readline-8.1.1-r0
 s6-ipcserver-2.11.0.0-r0
 scanelf-1.3.3-r0
@@ -219,7 +219,7 @@ shadow-4.8.1-r1
 skalibs-2.11.0.0-r0
 sqlite-libs-3.36.0-r0
 ssl_client-1.34.1-r7
-tzdata-2022c-r0
+tzdata-2022f-r1
 unixodbc-2.3.9-r1
 utmps-0.1.0.3-r0
 whois-5.5.10-r0
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -157,6 +157,9 @@ app_setup_nginx_reverse_proxy_block: ""

 # changelog
 changelogs:
+  - { date: "22.11.22:", desc: "Pin acme to the same version as certbot."}
+  - { date: "22.11.22:", desc: "Pin certbot to 1.32.0 until plugin compatibility improves."}
+  - { date: "05.11.22:", desc: "Update acmedns plugin handling."}
  - { date: "06.10.22:", desc: "Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic." }
  - { date: "05.10.22:", desc: "Use certbot file hooks instead of command line hooks" }
  - { date: "04.10.22:", desc: "Add godaddy and porkbun dns plugins." }
--- a/root/app/le-renew.sh
+++ b/root/app/le-renew.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 echo "<------------------------------------------------->"
 echo
--- a/root/defaults/etc/letsencrypt/renewal-hooks/deploy/10-default
+++ b/root/defaults/etc/letsencrypt/renewal-hooks/deploy/10-default
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 cd /config/keys/letsencrypt || exit 1
 openssl pkcs12 -export -out privkey.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -passout pass:
--- a/root/defaults/etc/letsencrypt/renewal-hooks/post/10-nginx
+++ b/root/defaults/etc/letsencrypt/renewal-hooks/post/10-nginx
@@ -1,13 +1,15 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

+# shellcheck source=/dev/null
 . /config/.donoteditthisfile.conf

-if [ ! "$ORIGVALIDATION" = "dns" ] && [ ! "$ORIGVALIDATION" = "duckdns" ]; then
-	if ps aux | grep 's6-supervise nginx' | grep -v grep >/dev/null; then
+if [[ ! "${ORIGVALIDATION}" = "dns" ]] && [[ ! "${ORIGVALIDATION}" = "duckdns" ]]; then
+	if pgrep -f "s6-supervise nginx" >/dev/null; then
 		s6-svc -u /run/service/nginx
 	fi
 else
-	if ps aux | grep [n]ginx: >/dev/null; then
+	if pgrep -f "nginx:" >/dev/null; then
 		s6-svc -h /run/service/nginx
 	fi
 fi
--- a/root/defaults/etc/letsencrypt/renewal-hooks/pre/10-nginx
+++ b/root/defaults/etc/letsencrypt/renewal-hooks/pre/10-nginx
@@ -1,9 +1,11 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

+# shellcheck source=/dev/null
 . /config/.donoteditthisfile.conf

-if [ ! "$ORIGVALIDATION" = "dns" ] && [ ! "$ORIGVALIDATION" = "duckdns" ]; then
-	if ps aux | grep [n]ginx: >/dev/null; then
+if [[ ! "${ORIGVALIDATION}" = "dns" ]] && [[ ! "${ORIGVALIDATION}" = "duckdns" ]]; then
+	if pgrep -f "nginx:" >/dev/null; then
 		s6-svc -d /run/service/nginx
 	fi
 fi
--- a/root/etc/cont-init.d/30-test-run
+++ b/root/etc/cont-init.d/30-test-run
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # Echo init finish for test runs
 if [[ -n "${TEST_RUN}" ]]; then
--- a/root/etc/cont-init.d/31-require-url
+++ b/root/etc/cont-init.d/31-require-url
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # check to make sure that the required variables are set
 if [[ -z "${URL}" ]]; then
--- a/root/etc/cont-init.d/40-folders
+++ b/root/etc/cont-init.d/40-folders
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # make our folders and links
 mkdir -p \
--- a/root/etc/cont-init.d/41-samples
+++ b/root/etc/cont-init.d/41-samples
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # samples are removed on init by the nginx base

--- a/root/etc/cont-init.d/42-fail2ban
+++ b/root/etc/cont-init.d/42-fail2ban
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # copy/update the fail2ban config defaults to/in /config
 cp -R /defaults/fail2ban/filter.d /config/fail2ban/
--- a/root/etc/cont-init.d/43-crontabs
+++ b/root/etc/cont-init.d/43-crontabs
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # copy crontabs if needed
 if [[ ! -f /config/crontabs/root ]]; then
--- a/root/etc/cont-init.d/45-nginx
+++ b/root/etc/cont-init.d/45-nginx
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # copy default config files if they don't exist
 if [[ ! -f /config/nginx/proxy.conf ]]; then
--- a/root/etc/cont-init.d/50-certbot
+++ b/root/etc/cont-init.d/50-certbot
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # Display variables for troubleshooting
 echo -e "Variables set:\\n\
@@ -18,12 +19,12 @@ STAGING=${STAGING}\\n"
 # Sanitize variables
 SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER)
 for i in "${SANED_VARS[@]}"; do
-    export echo "$i"="${!i//\"/}"
-    export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
+    export echo "${i}"="${!i//\"/}"
+    export echo "${i}"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
 done

 # check to make sure DNSPLUGIN is selected if dns validation is used
-if [[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(acmedns|aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|do|domeneshop|duckdns|dynu|gandi|gehirn|godaddy|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|porkbun|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]]; then
+if [[ "${VALIDATION}" = "dns" ]] && [[ ! "${DNSPLUGIN}" =~ ^(acmedns|aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|do|domeneshop|duckdns|dynu|gandi|gehirn|godaddy|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|porkbun|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]]; then
    echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details."
    sleep infinity
 fi
@@ -46,34 +47,34 @@ cp -nR /defaults/etc/letsencrypt/renewal-hooks/* /config/etc/letsencrypt/renewal
 chown -R abc:abc /config/etc/letsencrypt/renewal-hooks

 # create original config file if it doesn't exist, move non-hidden legacy file to hidden
-if [ -f "/config/donoteditthisfile.conf" ]; then
+if [[ -f "/config/donoteditthisfile.conf" ]]; then
    mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
 fi
-if [ ! -f "/config/.donoteditthisfile.conf" ]; then
-    echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" >/config/.donoteditthisfile.conf
+if [[ ! -f "/config/.donoteditthisfile.conf" ]]; then
+    echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf
    echo "Created .donoteditthisfile.conf"
 fi

 # load original config settings
-# shellcheck disable=SC1091
+# shellcheck source=/dev/null
 . /config/.donoteditthisfile.conf

 # set default validation to http
-if [ -z "$VALIDATION" ]; then
+if [[ -z "${VALIDATION}" ]]; then
    VALIDATION="http"
    echo "VALIDATION parameter not set; setting it to http"
 fi

 # set duckdns validation to dns
-if [ "$VALIDATION" = "duckdns" ]; then
+if [[ "${VALIDATION}" = "duckdns" ]]; then
    VALIDATION="dns"
    DNSPLUGIN="duckdns"
-    if [ -n "$DUCKDNSTOKEN" ] && ! grep -q "dns_duckdns_token=${DUCKDNSTOKEN}$" /config/dns-conf/duckdns.ini;then
+    if [[ -n "${DUCKDNSTOKEN}" ]] && ! grep -q "dns_duckdns_token=${DUCKDNSTOKEN}$" /config/dns-conf/duckdns.ini; then
        sed -i "s|^dns_duckdns_token=.*|dns_duckdns_token=${DUCKDNSTOKEN}|g" /config/dns-conf/duckdns.ini
    fi
 fi
-if [ "$VALIDATION" = "dns" ] && [ "$DNSPLUGIN" = "duckdns" ]; then
-    if [ "$SUBDOMAINS" = "wildcard" ]; then
+if [[ "${VALIDATION}" = "dns" ]] && [[ "${DNSPLUGIN}" = "duckdns" ]]; then
+    if [[ "${SUBDOMAINS}" = "wildcard" ]]; then
        echo "the resulting certificate will only cover the subdomains due to a limitation of duckdns, so it is advised to set the root location to use www.subdomain.duckdns.org"
        export ONLY_SUBDOMAINS=true
    else
@@ -84,16 +85,16 @@ if [ "$VALIDATION" = "dns" ] && [ "$DNSPLUGIN" = "duckdns" ]; then
 fi

 # if zerossl is selected or staging is set to true, use the relevant server
-if [ "$CERTPROVIDER" = "zerossl" ] && [ "$STAGING" = "true" ]; then
+if [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ "${STAGING}" = "true" ]]; then
    echo "ZeroSSL does not support staging mode, ignoring STAGING variable"
 fi
-if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
-    echo "ZeroSSL is selected as the cert provider, registering cert with $EMAIL"
+if [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ -n "${EMAIL}" ]]; then
+    echo "ZeroSSL is selected as the cert provider, registering cert with ${EMAIL}"
    ACMESERVER="https://acme.zerossl.com/v2/DV90"
-elif [ "$CERTPROVIDER" = "zerossl" ] && [ -z "$EMAIL" ]; then
+elif [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ -z "${EMAIL}" ]]; then
    echo "ZeroSSL is selected as the cert provider, but the e-mail address has not been entered. Please visit https://zerossl.com, register a new account and set the account e-mail address in the EMAIL environment variable"
    sleep infinity
-elif [ "$STAGING" = "true" ]; then
+elif [[ "${STAGING}" = "true" ]]; then
    echo "NOTICE: Staging is active"
    echo "Using Let's Encrypt as the cert provider"
    ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
@@ -103,46 +104,46 @@ else
 fi

 # figuring out url only vs url & subdomains vs subdomains only
-if [ -n "$SUBDOMAINS" ]; then
+if [[ -n "${SUBDOMAINS}" ]]; then
    echo "SUBDOMAINS entered, processing"
-    if [ "$SUBDOMAINS" = "wildcard" ]; then
-        if [ "$ONLY_SUBDOMAINS" = true ]; then
+    if [[ "${SUBDOMAINS}" = "wildcard" ]]; then
+        if [[ "${ONLY_SUBDOMAINS}" = true ]]; then
            export URL_REAL="-d *.${URL}"
-            echo "Wildcard cert for only the subdomains of $URL will be requested"
+            echo "Wildcard cert for only the subdomains of ${URL} will be requested"
        else
            export URL_REAL="-d *.${URL} -d ${URL}"
-            echo "Wildcard cert for $URL will be requested"
+            echo "Wildcard cert for ${URL} will be requested"
        fi
    else
        echo "SUBDOMAINS entered, processing"
-        for job in $(echo "$SUBDOMAINS" | tr "," " "); do
-            export SUBDOMAINS_REAL="$SUBDOMAINS_REAL -d ${job}.${URL}"
+        for job in $(echo "${SUBDOMAINS}" | tr "," " "); do
+            export SUBDOMAINS_REAL="${SUBDOMAINS_REAL} -d ${job}.${URL}"
        done
-        if [ "$ONLY_SUBDOMAINS" = true ]; then
-            URL_REAL="$SUBDOMAINS_REAL"
+        if [[ "${ONLY_SUBDOMAINS}" = true ]]; then
+            URL_REAL="${SUBDOMAINS_REAL}"
            echo "Only subdomains, no URL in cert"
        else
            URL_REAL="-d ${URL}${SUBDOMAINS_REAL}"
        fi
-        echo "Sub-domains processed are: $SUBDOMAINS_REAL"
+        echo "Sub-domains processed are: ${SUBDOMAINS_REAL}"
    fi
 else
    echo "No subdomains defined"
-    URL_REAL="-d $URL"
+    URL_REAL="-d ${URL}"
 fi

 # add extra domains
-if [ -n "$EXTRA_DOMAINS" ]; then
+if [[ -n "${EXTRA_DOMAINS}" ]]; then
    echo "EXTRA_DOMAINS entered, processing"
-    for job in $(echo "$EXTRA_DOMAINS" | tr "," " "); do
-        export EXTRA_DOMAINS_REAL="$EXTRA_DOMAINS_REAL -d ${job}"
+    for job in $(echo "${EXTRA_DOMAINS}" | tr "," " "); do
+        export EXTRA_DOMAINS_REAL="${EXTRA_DOMAINS_REAL} -d ${job}"
    done
-    echo "Extra domains processed are: $EXTRA_DOMAINS_REAL"
-    URL_REAL="$URL_REAL $EXTRA_DOMAINS_REAL"
+    echo "Extra domains processed are: ${EXTRA_DOMAINS_REAL}"
+    URL_REAL="${URL_REAL} ${EXTRA_DOMAINS_REAL}"
 fi

 # figuring out whether to use e-mail and which
-if [[ $EMAIL == *@* ]]; then
+if [[ ${EMAIL} == *@* ]]; then
    echo "E-mail address entered: ${EMAIL}"
    EMAILPARAM="-m ${EMAIL} --no-eff-email"
 else
@@ -151,31 +152,34 @@ else
 fi

 # setting the validation method to use
-if [ "$VALIDATION" = "dns" ]; then
-    if [ "$DNSPLUGIN" = "route53" ]; then
-        if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+if [[ "${VALIDATION}" = "dns" ]]; then
+    if [[ "${DNSPLUGIN}" = "route53" ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM}"
-    elif [[ "$DNSPLUGIN" =~ ^(azure|gandi)$ ]]; then
-        if [ -n "$PROPAGATION" ]; then echo "${DNSPLUGIN} dns plugin does not support setting propagation time"; fi
+    elif [[ "${DNSPLUGIN}" =~ ^(azure|gandi)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then echo "${DNSPLUGIN} dns plugin does not support setting propagation time"; fi
        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini"
-    elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
-        if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    elif [[ "${DNSPLUGIN}" =~ ^(duckdns)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini --dns-duckdns-no-txt-restore ${PROPAGATIONPARAM}"
+    elif [[ "${DNSPLUGIN}" =~ ^(google)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
-    elif [[ "$DNSPLUGIN" =~ ^(aliyun|cpanel|desec|dnspod|do|domeneshop|duckdns|dynu|godaddy|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|porkbun|transip|vultr)$ ]]; then
-        if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    elif [[ "${DNSPLUGIN}" =~ ^(acmedns|aliyun|cpanel|desec|dnspod|do|domeneshop|dynu|godaddy|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|porkbun|transip|vultr)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
-    elif [[ "$DNSPLUGIN" =~ ^(standalone)$ ]]; then
-        if [ -n "$PROPAGATION" ]; then echo "standalone dns plugin does not support setting propagation time"; fi
+    elif [[ "${DNSPLUGIN}" =~ ^(standalone)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then echo "standalone dns plugin does not support setting propagation time"; fi
        PREFCHAL="-a dns-${DNSPLUGIN}"
-    elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
-        if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    elif [[ "${DNSPLUGIN}" =~ ^(directadmin)$ ]]; then
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
    else
-        if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        if [[ -n "${PROPAGATION}" ]]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
    fi
    echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
-elif [ "$VALIDATION" = "tls-sni" ]; then
+elif [[ "${VALIDATION}" = "tls-sni" ]]; then
    PREFCHAL="--standalone --preferred-challenges http"
    echo "*****tls-sni validation has been deprecated, attempting http validation instead"
 else
@@ -185,73 +189,69 @@ fi

 # setting the symlink for key location
 rm -rf /config/keys/letsencrypt
-if [ "$ONLY_SUBDOMAINS" = "true" ] && [ ! "$SUBDOMAINS" = "wildcard" ]; then
-    DOMAIN="$(echo "$SUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${URL}"
-    ln -s ../etc/letsencrypt/live/"$DOMAIN" /config/keys/letsencrypt
+if [[ "${ONLY_SUBDOMAINS}" = "true" ]] && [[ ! "${SUBDOMAINS}" = "wildcard" ]]; then
+    DOMAIN="$(echo "${SUBDOMAINS}" | tr ',' ' ' | awk '{print $1}').${URL}"
+    ln -s ../etc/letsencrypt/live/"${DOMAIN}" /config/keys/letsencrypt
 else
-    ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
+    ln -s ../etc/letsencrypt/live/"${URL}" /config/keys/letsencrypt
 fi
-rm -rf /config/keys/cert.crt
-ln -s ./letsencrypt/fullchain.pem /config/keys/cert.crt
-rm -rf /config/keys/cert.key
-ln -s ./letsencrypt/privkey.pem /config/keys/cert.key

 # checking for changes in cert variables, revoking certs if necessary
-if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
+if [[ ! "${URL}" = "${ORIGURL}" ]] || [[ ! "${SUBDOMAINS}" = "${ORIGSUBDOMAINS}" ]] || [[ ! "${ONLY_SUBDOMAINS}" = "${ORIGONLY_SUBDOMAINS}" ]] || [[ ! "${EXTRA_DOMAINS}" = "${ORIGEXTRA_DOMAINS}" ]] || [[ ! "${VALIDATION}" = "${ORIGVALIDATION}" ]] || [[ ! "${DNSPLUGIN}" = "${ORIGDNSPLUGIN}" ]] || [[ ! "${PROPAGATION}" = "${ORIGPROPAGATION}" ]] || [[ ! "${STAGING}" = "${ORIGSTAGING}" ]] || [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]]; then
    echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
-    if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
-        ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
+    if [[ "${ORIGONLY_SUBDOMAINS}" = "true" ]] && [[ ! "${ORIGSUBDOMAINS}" = "wildcard" ]]; then
+        ORIGDOMAIN="$(echo "${ORIGSUBDOMAINS}" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
    else
-        ORIGDOMAIN="$ORIGURL"
+        ORIGDOMAIN="${ORIGURL}"
    fi
-    if [ "$ORIGCERTPROVIDER" = "zerossl" ] && [ -n "$ORIGEMAIL" ]; then
-        REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$ORIGEMAIL")
-        REV_ZEROSSL_EAB_KID=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
-        REV_ZEROSSL_EAB_HMAC_KEY=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
-        if [ -z "$REV_ZEROSSL_EAB_KID" ] || [ -z "$REV_ZEROSSL_EAB_HMAC_KEY" ]; then
+    if [[ "${ORIGCERTPROVIDER}" = "zerossl" ]] && [[ -n "${ORIGEMAIL}" ]]; then
+        REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=${ORIGEMAIL}")
+        REV_ZEROSSL_EAB_KID=$(echo "${REV_EAB_CREDS}" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+        REV_ZEROSSL_EAB_HMAC_KEY=$(echo "${REV_EAB_CREDS}" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+        if [[ -z "${REV_ZEROSSL_EAB_KID}" ]] || [[ -z "${REV_ZEROSSL_EAB_HMAC_KEY}" ]]; then
            echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
            sleep infinity
        fi
        REV_ACMESERVER="https://acme.zerossl.com/v2/DV90 --eab-kid ${REV_ZEROSSL_EAB_KID} --eab-hmac-key ${REV_ZEROSSL_EAB_HMAC_KEY}"
-    elif [ "$ORIGSTAGING" = "true" ]; then
+    elif [[ "${ORIGSTAGING}" = "true" ]]; then
        REV_ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
    else
        REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
    fi
-    if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
+    if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
+        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server ${REV_ACMESERVER}
    fi
    rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
 fi

 # saving new variables
-echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" >/config/.donoteditthisfile.conf
+echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf

 # alter extension for error message
-if [ "$DNSPLUGIN" = "google" ]; then
-    FILENAME="$DNSPLUGIN.json"
+if [[ "${DNSPLUGIN}" = "google" ]]; then
+    FILENAME="${DNSPLUGIN}.json"
 else
-    FILENAME="$DNSPLUGIN.ini"
+    FILENAME="${DNSPLUGIN}.ini"
 fi

 # Check if the cert is using the old LE root cert, revoke and regen if necessary
-if [ -f "/config/keys/letsencrypt/chain.pem" ] && { [ "${CERTPROVIDER}" == "letsencrypt" ] || [ "${CERTPROVIDER}" == "" ]; } && [ "${STAGING}" != "true" ] && ! openssl x509 -in /config/keys/letsencrypt/chain.pem -noout -issuer | grep -q "ISRG Root X"; then
+if [[ -f "/config/keys/letsencrypt/chain.pem" ]] && { [[ "${CERTPROVIDER}" == "letsencrypt" ]] || [[ "${CERTPROVIDER}" == "" ]]; } && [[ "${STAGING}" != "true" ]] && ! openssl x509 -in /config/keys/letsencrypt/chain.pem -noout -issuer | grep -q "ISRG Root X"; then
    echo "The cert seems to be using the old LE root cert, which is no longer valid. Deleting and revoking."
    REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
-    if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
+    if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
+        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server ${REV_ACMESERVER}
    fi
    rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
 fi

 # generating certs if necessary
-if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
-    if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+if [[ ! -f "/config/keys/letsencrypt/fullchain.pem" ]]; then
+    if [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ -n "${EMAIL}" ]]; then
        echo "Retrieving EAB from ZeroSSL"
-        EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$EMAIL")
-        ZEROSSL_EAB_KID=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
-        ZEROSSL_EAB_HMAC_KEY=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
-        if [ -z "$ZEROSSL_EAB_KID" ] || [ -z "$ZEROSSL_EAB_HMAC_KEY" ]; then
+        EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=${EMAIL}")
+        ZEROSSL_EAB_KID=$(echo "${EAB_CREDS}" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+        ZEROSSL_EAB_HMAC_KEY=$(echo "${EAB_CREDS}" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+        if [[ -z "${ZEROSSL_EAB_KID}" ]] || [[ -z "${ZEROSSL_EAB_HMAC_KEY}" ]]; then
            echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
            sleep infinity
        fi
@@ -259,9 +259,9 @@ if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
    fi
    echo "Generating new certificate"
    # shellcheck disable=SC2086
-    certbot certonly --non-interactive --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
-    if [ ! -d /config/keys/letsencrypt ]; then
-        if [ "$VALIDATION" = "dns" ]; then
+    certbot certonly --non-interactive --renew-by-default --server ${ACMESERVER} ${ZEROSSL_EAB} ${PREFCHAL} --rsa-key-size 4096 ${EMAILPARAM} --agree-tos ${URL_REAL}
+    if [[ ! -d /config/keys/letsencrypt ]]; then
+        if [[ "${VALIDATION}" = "dns" ]]; then
            echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the /config/dns-conf/${FILENAME} file."
        else
            echo "ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container"
@@ -273,3 +273,11 @@ if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
 else
    echo "Certificate exists; parameters unchanged; starting nginx"
 fi
+
+# if certbot generated key exists, remove self-signed cert and replace it with symlink to live cert
+if [[ -d /config/keys/letsencrypt ]]; then
+    rm -rf /config/keys/cert.crt
+    ln -s ./letsencrypt/fullchain.pem /config/keys/cert.crt
+    rm -rf /config/keys/cert.key
+    ln -s ./letsencrypt/privkey.pem /config/keys/cert.key
+fi
--- a/root/etc/cont-init.d/55-permissions
+++ b/root/etc/cont-init.d/55-permissions
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # permissions
 chown -R abc:abc \
--- a/root/etc/cont-init.d/60-renew
+++ b/root/etc/cont-init.d/60-renew
@@ -1,7 +1,8 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 # Check if the cert is expired or expires within a day, if so, renew
-if openssl x509 -in /config/keys/letsencrypt/fullchain.pem -noout -checkend 86400 >/dev/null; then 
+if openssl x509 -in /config/keys/letsencrypt/fullchain.pem -noout -checkend 86400 >/dev/null; then
    echo "The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am)."
 else
    echo "The cert is either expired or it expires within the next day. Attempting to renew. This could take up to 10 minutes."
--- a/root/etc/cont-init.d/70-outdated
+++ b/root/etc/cont-init.d/70-outdated
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 if [[ -f /config/nginx/geoip2.conf ]]; then
    echo "/config/nginx/geoip2.conf exists.
--- a/root/etc/services.d/fail2ban/run
+++ b/root/etc/services.d/fail2ban/run
@@ -1,4 +1,5 @@
 #!/usr/bin/with-contenv bash
+# shellcheck shell=bash

 exec \
    fail2ban-client -x -f start
Author	SHA1	Message	Date
Eric Nemchik	96fc59d975	Merge pull request #300 from linuxserver/shellcheck Shellcheck and formatting	2022-11-29 13:48:31 -06:00
Eric Nemchik	c5b8744d3b	Brace for impact	2022-11-29 15:18:56 +00:00
Eric Nemchik	a625256151	Merge remote-tracking branch 'origin/master' into shellcheck	2022-11-29 15:10:47 +00:00
LinuxServer-CI	003b5d4daf	Bot Updating Templated Files	2022-11-29 16:08:12 +01:00
LinuxServer-CI	29028b67f4	Bot Updating Templated Files	2022-11-29 09:06:43 -06:00
LinuxServer-CI	d51b7e1f3a	Bot Updating Templated Files	2022-11-29 16:05:21 +01:00
Eric Nemchik	ae58a9757d	Merge pull request #302 from linuxserver/sym-certs Relocate live cert symlink	2022-11-29 09:03:51 -06:00
Eric Nemchik	92092b79ea	Relocate live cert symlink	2022-11-23 14:39:22 +00:00
LinuxServer-CI	1dcec348c0	Bot Updating Templated Files	2022-11-22 16:37:41 -06:00
Adam	5e80d765da	Merge pull request #301 from linuxserver/pin-acme	2022-11-22 22:36:14 +00:00
TheSpad	9738646eef	Update changelog	2022-11-22 21:31:11 +00:00
TheSpad	820e040082	Pin acme to certbot version	2022-11-22 21:15:12 +00:00
Eric Nemchik	3db8f51eb0	Shellcheck and formatting	2022-11-22 20:55:25 +00:00
Eric Nemchik	588dde99ed	Merge pull request #299 from linuxserver/pin-certbot Pin certbot to 1.32.0 until plugin compatibility improves	2022-11-22 12:48:06 -06:00
Eric Nemchik	9f88c9343b	Pin certbot to 1.32.0 until plugin compatibility improves	2022-11-22 18:22:40 +00:00
LinuxServer-CI	47cb0bffe3	Bot Updating Package Versions	2022-11-14 08:49:55 -06:00
LinuxServer-CI	d159fde608	Bot Updating Templated Files	2022-11-14 08:42:48 -06:00
Eric Nemchik	263cceda4c	Merge pull request #293 from linuxserver/duckdns-no-restore Use --dns-duckdns-no-txt-restore flag	2022-11-14 08:41:15 -06:00
Eric Nemchik	631fe9ecc3	Use --dns-duckdns-no-txt-restore flag Should allow local DNS records with DuckDNS	2022-11-11 15:59:29 +00:00
LinuxServer-CI	f2bc6b05bc	Bot Updating Package Versions	2022-11-05 07:03:49 -05:00
LinuxServer-CI	3f8ac5552f	Bot Updating Templated Files	2022-11-05 12:55:39 +01:00
Eric Nemchik	a26528919c	Merge pull request #290 from darkorb/acmedns-fix Update handling of the `acmedns` provider	2022-11-05 06:54:06 -05:00
Alex Smith	14cc464d65	Update the readme docs	2022-11-05 18:32:26 +13:00
Alex Smith	4221059496	Add `acmedns` to the correct section for validation	2022-11-05 18:11:33 +13:00
LinuxServer-CI	d00d2dbe95	Bot Updating Package Versions	2022-11-03 06:27:30 +01:00
LinuxServer-CI	c07939aed0	Bot Updating Package Versions	2022-10-28 03:10:57 +02:00
LinuxServer-CI	8b1311c3f1	Bot Updating Package Versions	2022-10-27 07:32:16 +02:00
LinuxServer-CI	fcffe2b169	Bot Updating Package Versions	2022-10-20 07:44:58 +02:00