Bot Updating Package Versions

2026-03-02 08:23:34 +09:00 · 2021-04-01 06:13:59 +00:00 · 2021-03-27 13:13:15 +00:00 · 2021-03-25 07:22:56 +00:00 · 2021-03-18 01:44:51 -04:00 · 2021-03-14 13:55:30 +00:00
39 changed files with 1415 additions and 459 deletions
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -0,0 +1,122 @@
+# Contributing to swag
+
+## Gotchas
+
+* While contributing make sure to make all your changes before creating a Pull Request, as our pipeline builds each commit after the PR is open.
+* Read, and fill the Pull Request template
+  * If this is a fix for a typo in code or documentation in the README please file an issue
+  * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
+* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://discord.gg/YWrKVTn)
+
+## Common files
+
+| File | Use case |
+| :----: | --- |
+| `Dockerfile` | Dockerfile used to build amd64 images |
+| `Dockerfile.aarch64` | Dockerfile used to build 64bit ARM architectures |
+| `Dockerfile.armhf` | Dockerfile used to build 32bit ARM architectures |
+| `Jenkinsfile` | This file is a product of our builder and should not be edited directly. This is used to build the image |
+| `jenkins-vars.yml` | This file is used to generate the `Jenkinsfile` mentioned above, it only affects the build-process |
+| `package_versions.txt` | This file is generated as a part of the build-process and should not be edited directly. It lists all the installed packages and their versions |
+| `README.md` | This file is a product of our builder and should not be edited directly. This displays the readme for the repository and image registries |
+| `readme-vars.yml` | This file is used to generate the `README.md` |
+
+## Readme
+
+If you would like to change our readme, please __**do not**__ directly edit the readme, as it is auto-generated on each commit.
+Instead edit the [readme-vars.yml](https://github.com/linuxserver/docker-swag/edit/master/readme-vars.yml).
+
+These variables are used in a template for our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) as part of an ansible play.
+Most of these variables are also carried over to [docs.linuxserver.io](https://docs.linuxserver.io/images/docker-swag)
+
+### Fixing typos or clarify the text in the readme
+
+There are variables for multiple parts of the readme, the most common ones are:
+
+| Variable | Description |
+| :----: | --- |
+| `project_blurb` | This is the short excerpt shown above the project logo. |
+| `app_setup_block` | This is the text that shows up under "Application Setup" if enabled |
+
+### Parameters
+
+The compose and run examples are also generated from these variables.
+
+We have a [reference file](https://github.com/linuxserver/docker-jenkins-builder/blob/master/vars/_container-vars-blank) in our Jenkins Builder.
+
+These are prefixed with `param_` for required parameters, or `opt_param` for optional parameters, except for `cap_add`.
+Remember to enable param, if currently disabled. This differs between parameters, and can be seen in the reference file.
+
+Devices, environment variables, ports and volumes expects its variables in a certain way.
+
+### Devices
+
+```yml
+param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+opt_param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+```
+
+### Environment variables
+
+```yml
+param_env_vars:
+  - { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
+opt_param_env_vars:
+  - { env_var: "VERSION", env_value: "latest", desc: "Supported values are LATEST, PLEXPASS or a specific version number." }
+```
+
+### Ports
+
+```yml
+param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+opt_param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+```
+
+### Volumes
+
+```yml
+param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+opt_param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+```
+
+### Testing template changes
+
+After you make any changes to the templates, you can use our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) to have the files updated from the modified templates. Please use the command found under `Running Locally` [on this page](https://github.com/linuxserver/docker-jenkins-builder/blob/master/README.md) to generate them prior to submitting a PR.
+
+## Dockerfiles
+
+We use multiple Dockerfiles in our repos, this is because sometimes some CPU architectures needs different packages to work.
+If you are proposing additional packages to be added, ensure that you added the packages to all the Dockerfiles in alphabetical order.
+
+### Testing your changes
+
+```
+git clone https://github.com/linuxserver/docker-swag.git
+cd docker-swag
+docker build \
+  --no-cache \
+  --pull \
+  -t linuxserver/swag:latest .
+```
+
+The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+```
+docker run --rm --privileged multiarch/qemu-user-static:register --reset
+```
+
+Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
+
+## Update the chagelog
+
+If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-swag/tree/master/root), add an entry to the changelog
+
+```yml
+changelogs:
+  - { date: "DD.MM.YY:", desc: "Added some love to templates" }
+```
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord chat support
+    url: https://discord.gg/YWrKVTn
+    about: Realtime support / chat with the community and the team.
+
+  - name: Discourse discussion forum
+    url: https://discourse.linuxserver.io
+    about: Post on our community forum.
+
+  - name: Documentation
+    url: https://docs.linuxserver.io/images/docker-swag
+    about: Documentation - information about all of our containers.
--- a/.github/ISSUE_TEMPLATE/issue.bug.md
+++ b/.github/ISSUE_TEMPLATE/issue.bug.md
@@ -1,9 +1,14 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]

-If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support.
+<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->

-<!--- Provide a general summary of the issue in the Title above -->
+<!--- Provide a general summary of the bug in the Title above -->

 ------------------------------

@@ -22,9 +27,10 @@ If you are new to Docker or this application our issue tracker is **ONLY** used
 4.

 ## Environment
-**OS:**      
-**CPU architecture:** x86_64/arm32/arm64      
-**How docker service was installed:**      
+**OS:**
+**CPU architecture:** x86_64/arm32/arm64
+**How docker service was installed:**
+<!--- ie. from the official docker repo, from the distro repo, nas OS provided, etc. -->
 <!--- Providing context helps us come up with a solution that is most useful in the real world -->

 ## Command used to create docker container (run/create/compose/screenshot)
--- a/.github/ISSUE_TEMPLATE/issue.feature.md
+++ b/.github/ISSUE_TEMPLATE/issue.feature.md
@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+[linuxserverurl]: https://linuxserver.io
+[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
+
+<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
+
+<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
+<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
+
+<!--- Provide a general summary of the request in the Title above -->
+
+------------------------------
+
+## Desired Behavior
+<!--- Tell us what should happen -->
+
+## Current Behavior
+<!--- Tell us what happens instead of the expected behavior -->
+
+## Alternatives Considered
+<!--- Tell us what other options you have tried or considered -->
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -2,11 +2,11 @@

 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-	
+

 <!--- Before submitting a pull request please check the following -->

-<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  --> 
+<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  -->
 <!---  Ask yourself if this modification is something the whole userbase will benefit from, if this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
 <!---  That if the PR is addressing an existing issue include, closes #<issue number> , in the body of the PR commit message   -->
 <!---  You have included links to any files / patches etc your PR may be using in the body of the PR commit message -->
@@ -21,7 +21,11 @@

 ------------------------------

-We welcome all PR’s though this doesn’t guarantee it will be accepted.
+ - [ ] I have read the [contributing](https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md) guideline and understand that I have made the correct modifications
+
+------------------------------
+
+<!--- We welcome all PR’s though this doesn’t guarantee it will be accepted. -->

 ## Description:
 <!--- Describe your changes in detail -->
--- a/.github/workflows/external_trigger.yml
+++ b/.github/workflows/external_trigger.yml
@@ -0,0 +1,92 @@
+name: External Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  external-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: External Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\". ****"
+          echo "**** Retrieving external version ****"
+          EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
+          if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
+            echo "**** Can't retrieve external version, exiting ****"
+            FAILURE_REASON="Can't retrieve external version for swag branch master"
+            GHA_TRIGGER_URL="https://github.com/linuxserver/docker-swag/actions/runs/${{ github.run_id }}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n**Trigger URL:** '"${GHA_TRIGGER_URL}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "**** External version: ${EXT_RELEASE} ****"
+          echo "**** Retrieving last pushed version ****"
+          image="linuxserver/swag"
+          tag="latest"
+          token=$(curl -sX GET \
+            "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fswag%3Apull" \
+            | jq -r '.token')
+            multidigest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${tag}" \
+              | jq -r 'first(.manifests[].digest)')
+            digest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}" \
+              | jq -r '.config.digest')
+          image_info=$(curl -sL \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/blobs/${digest}" \
+            | jq -r '.container_config')
+          IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
+          IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "**** Can't retrieve last pushed version, exiting ****"
+            FAILURE_REASON="Can't retrieve last pushed version for swag tag latest"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          echo "**** Last pushed version: ${IMAGE_VERSION} ****"
+          if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
+            echo "**** Version ${EXT_RELEASE} already pushed, exiting ****"
+            exit 0
+          elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting ****"
+            exit 0
+          else
+            echo "**** New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build ****"
+            response=$(curl -iX POST \
+              https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=false \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+            echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+            echo "**** Sleeping 10 seconds until job starts ****"
+            sleep 10
+            buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+            buildurl="${buildurl%$'\r'}"
+            echo "**** Jenkins job build url: ${buildurl} ****"
+            echo "**** Attempting to change the Jenkins job description ****"
+            curl -iX POST \
+              "${buildurl}submitDescription" \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+              --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --data-urlencode "Submit=Submit"
+            echo "**** Notifying Discord ****"
+            TRIGGER_REASON="A version change was detected for swag tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+              "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          fi
--- a/.github/workflows/external_trigger_scheduler.yml
+++ b/.github/workflows/external_trigger_scheduler.yml
@@ -0,0 +1,43 @@
+name: External Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '50 * * * *'
+  workflow_dispatch:
+
+jobs:
+  external-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: External Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "$br" == "$ls_branch" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering external trigger workflow for branch ${br} ****."
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/external_trigger.yml/dispatches
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -1,6 +1,6 @@
 name: Greetings

-on: [pull_request, issues]
+on: [pull_request_target, issues]

 jobs:
  greeting:
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v1
      with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [issue template](https://github.com/linuxserver/docker-swag/.github/ISSUE_TEMPLATE.md)!'
-        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/.github/PULL_REQUEST_TEMPLATE.md)!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.bug.md) or [feature](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.feature.md) issue templates!'
+        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/package_trigger.yml
+++ b/.github/workflows/package_trigger.yml
@@ -0,0 +1,38 @@
+name: Package Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  package-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: Package Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_PACKAGE_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_PACKAGE_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          if [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** There already seems to be an active build on Jenkins; skipping package trigger ****"
+            exit 0
+          fi
+          echo "**** Package trigger running off of master branch. To disable, set a Github secret named \"PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\". ****"
+          response=$(curl -iX POST \
+            https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=true \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+          echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+          echo "**** Sleeping 10 seconds until job starts ****"
+          sleep 10
+          buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+          buildurl="${buildurl%$'\r'}"
+          echo "**** Jenkins job build url: ${buildurl} ****"
+          echo "**** Attempting to change the Jenkins job description ****"
+          curl -iX POST \
+            "${buildurl}submitDescription" \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+            --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --data-urlencode "Submit=Submit"
--- a/.github/workflows/package_trigger_scheduler.yml
+++ b/.github/workflows/package_trigger_scheduler.yml
@@ -0,0 +1,50 @@
+name: Package Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '03 5 * * 4'
+  workflow_dispatch:
+
+jobs:
+  package-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: Package Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "${br}" == "${ls_branch}" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/package_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering package trigger workflow for branch ${br}. ****"
+                triggered_branches="${triggered_branches}${br} "
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/package_trigger.yml/dispatches
+                sleep 30
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done
+          echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
+          echo "**** Notifying Discord ****"
+          curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+            "description": "**Package Check Build(s) Triggered for swag** \n**Branch(es):** '"${triggered_branches}"' \n**Build URL:** '"https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-swag/activity/"' \n"}],
+            "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+.jenkins-external
--- a/15
+++ b/15
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -79,6 +80,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \
@@ -99,13 +101,17 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
@@ -143,7 +149,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm64v8-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -79,6 +80,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \
@@ -99,13 +101,17 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
@@ -143,7 +149,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/Dockerfile.armhf
+++ b/Dockerfile.armhf
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm32v7-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -79,6 +80,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \
@@ -99,13 +101,17 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
@@ -143,7 +149,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/286
+++ b/286
@@ -42,7 +42,7 @@ pipeline {
        script{
          env.EXIT_STATUS = ''
          env.LS_RELEASE = sh(
-            script: '''docker run --rm alexeiled/skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
+            script: '''docker run --rm ghcr.io/linuxserver/alexeiled-skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
            returnStdout: true).trim()
          env.LS_RELEASE_NOTES = sh(
            script: '''cat readme-vars.yml | awk -F \\" '/date: "[0-9][0-9].[0-9][0-9].[0-9][0-9]:/ {print $4;exit;}' | sed -E ':a;N;$!ba;s/\\r{0,1}\\n/\\\\n/g' ''',
@@ -56,7 +56,7 @@ pipeline {
          env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/commit/' + env.GIT_COMMIT
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
          env.PULL_REQUEST = env.CHANGE_ID
-          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt'
+          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.md ./.github/ISSUE_TEMPLATE/issue.feature.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt ./.github/workflows/package_trigger.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/external_trigger.yml ./.github/workflows/external_trigger_scheduler.yml'
        }
        script{
          env.LS_RELEASE_NUMBER = sh(
@@ -128,14 +128,16 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
        }
      }
    }
@@ -148,14 +150,16 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.DEV_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lsiodev-' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DEV_DOCKERHUB_IMAGE + '/tags/'
        }
      }
@@ -168,14 +172,16 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.PR_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lspipepr-' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
          env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/pull/' + env.PULL_REQUEST
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.PR_DOCKERHUB_IMAGE + '/tags/'
        }
@@ -188,24 +194,24 @@ pipeline {
      }
      steps {
        withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key', variable: 'S3_SECRET')
        ]) {
          script{
-            env.SHELLCHECK_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
+            env.SHELLCHECK_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
          }
          sh '''curl -sL https://raw.githubusercontent.com/linuxserver/docker-shellcheck/master/checkrun.sh | /bin/bash'''
          sh '''#! /bin/bash
                set -e
-                docker pull lsiodev/spaces-file-upload:latest
+                docker pull ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest
                docker run --rm \
                -e DESTINATION=\"${IMAGE}/${META_TAG}/shellcheck-result.xml\" \
                -e FILE_NAME="shellcheck-result.xml" \
                -e MIMETYPE="text/xml" \
                -v ${WORKSPACE}:/mnt \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
-                -t lsiodev/spaces-file-upload:latest \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
+                -t ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest \
                python /upload.py'''
        }
      }
@@ -223,20 +229,68 @@ pipeline {
        sh '''#! /bin/bash
              set -e
              TEMPDIR=$(mktemp -d)
-              docker pull linuxserver/jenkins-builder:latest
-              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
+              docker pull ghcr.io/linuxserver/jenkins-builder:latest
+              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest 
+              # Stage 1 - Jenkinsfile update
+              if [[ "$(md5sum Jenkinsfile | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile | awk '{ print $1 }')" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile ${TEMPDIR}/repo/${LS_REPO}/
+                git add Jenkinsfile
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Updating Jenkinsfile"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "Jenkinsfile is up to date."
+              fi
+              # Stage 2 - Delete old templates
+              OLD_TEMPLATES=".github/ISSUE_TEMPLATE.md"
+              for i in ${OLD_TEMPLATES}; do
+                if [[ -f "${i}" ]]; then
+                  TEMPLATES_TO_DELETE="${i} ${TEMPLATES_TO_DELETE}"
+                fi
+              done
+              if [[ -n "${TEMPLATES_TO_DELETE}" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                cd ${TEMPDIR}/docker-${CONTAINER_NAME}
+                for i in ${TEMPLATES_TO_DELETE}; do
+                  git rm "${i}"
+                done
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Deleting old templates"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "No templates to delete"
+              fi
+              # Stage 3 - Update templates
              CURRENTHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
              cd ${TEMPDIR}/docker-${CONTAINER_NAME}
              NEWHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
-              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]]; then
+              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]] || ! grep -q '.jenkins-external' "${WORKSPACE}/.gitignore" 2>/dev/null; then
                mkdir -p ${TEMPDIR}/repo
                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
                cd ${TEMPDIR}/repo/${LS_REPO}
                git checkout -f master
                cd ${TEMPDIR}/docker-${CONTAINER_NAME}
                mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/workflows
-                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/
+                mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/ISSUE_TEMPLATE
+                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/ || :
                cd ${TEMPDIR}/repo/${LS_REPO}/
+                if ! grep -q '.jenkins-external' .gitignore 2>/dev/null; then
+                  echo ".jenkins-external" >> .gitignore
+                  git add .gitignore
+                fi
                git add ${TEMPLATED_FILES}
                git commit -m 'Bot Updating Templated Files'
                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
@@ -246,13 +300,30 @@ pipeline {
              fi
              mkdir -p ${TEMPDIR}/gitbook
              git clone https://github.com/linuxserver/docker-documentation.git ${TEMPDIR}/gitbook/docker-documentation
-              if [[ "${BRANCH_NAME}" == "master" ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
-                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
                cd ${TEMPDIR}/gitbook/docker-documentation/
                git add images/docker-${CONTAINER_NAME}.md
                git commit -m 'Bot Updating Documentation'
                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/docker-documentation.git --all
              fi
+              mkdir -p ${TEMPDIR}/unraid 
+              git clone https://github.com/linuxserver/docker-templates.git ${TEMPDIR}/unraid/docker-templates
+              git clone https://github.com/linuxserver/templates.git ${TEMPDIR}/unraid/templates
+              if [[ -f ${TEMPDIR}/unraid/docker-templates/linuxserver.io/img/${CONTAINER_NAME}-icon.png ]]; then
+                sed -i "s|master/linuxserver.io/img/linuxserver-ls-logo.png|master/linuxserver.io/img/${CONTAINER_NAME}-icon.png|" ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml
+              fi
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml) || ("$(md5sum ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml | awk '{ print $1 }')") ]]; then
+                if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
+                  echo "Image is on the ignore list, skipping Unraid template upload"
+                else
+                  cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
+                  cd ${TEMPDIR}/unraid/templates/
+                  git add unraid/${CONTAINER_NAME}.xml
+                  git commit -m 'Bot Updating Unraid Template'
+                  git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/templates.git --all
+                fi
+              fi
              rm -Rf ${TEMPDIR}'''
        script{
          env.FILES_UPDATED = sh(
@@ -307,8 +378,9 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
+        echo "Running on node: ${NODE_NAME}"
        sh "docker build --no-cache --pull -t ${IMAGE}:${META_TAG} \
-        --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+        --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
      }
    }
    // Build MultiArch Docker containers for push to LS Repo
@@ -320,8 +392,9 @@ pipeline {
      parallel {
        stage('Build X86') {
          steps {
+            echo "Running on node: ${NODE_NAME}"
            sh "docker build --no-cache --pull -t ${IMAGE}:amd64-${META_TAG} \
-            --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
          }
        }
        stage('Build ARMHF') {
@@ -329,28 +402,20 @@ pipeline {
            label 'ARMHF'
          }
          steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm32v7-${META_TAG} lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm32v7-${META_TAG} \
-                    lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
+                         --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm32v7-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
            }
+            sh '''docker rmi \
+                  ${IMAGE}:arm32v7-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
          }
        }
        stage('Build ARM64') {
@@ -358,28 +423,20 @@ pipeline {
            label 'ARM64'
          }
          steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm64v8-${META_TAG} lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm64v8-${META_TAG} \
-                    lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
+                         --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm64v8-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
            }
+            sh '''docker rmi \
+                  ${IMAGE}:arm64v8-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
          }
        }
      }
@@ -445,6 +502,13 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
+        sh '''#! /bin/bash
+              echo "Packages were updated. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
        script{
          env.EXIT_STATUS = 'ABORTED'
        }
@@ -462,6 +526,13 @@ pipeline {
        }
      }
      steps {
+        sh '''#! /bin/bash
+              echo "There are no package updates. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
        script{
          env.EXIT_STATUS = 'ABORTED'
        }
@@ -478,20 +549,20 @@ pipeline {
      }
      steps {
        withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key	', variable: 'S3_SECRET')
        ]) {
          script{
-            env.CI_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
+            env.CI_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
          }
          sh '''#! /bin/bash
                set -e
-                docker pull lsiodev/ci:latest
+                docker pull ghcr.io/linuxserver/ci:latest
                if [ "${MULTIARCH}" == "true" ]; then
-                  docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                  docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                fi
                docker run --rm \
                --shm-size=1gb \
@@ -503,15 +574,15 @@ pipeline {
                -e PORT=\"${CI_PORT}\" \
                -e SSL=\"${CI_SSL}\" \
                -e BASE=\"${DIST_IMAGE}\" \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
                -e DOCKER_ENV=\"${CI_DOCKERENV}\" \
                -e WEB_SCREENSHOT=\"${CI_WEB}\" \
                -e WEB_AUTH=\"${CI_AUTH}\" \
                -e WEB_PATH=\"${CI_WEBPATH}\" \
                -e DO_REGION="ams3" \
                -e DO_BUCKET="lsio-ci" \
-                -t lsiodev/ci:latest \
+                -t ghcr.io/linuxserver/ci:latest \
                python /ci/ci.py'''
        }
      }
@@ -538,20 +609,23 @@ pipeline {
            sh '''#! /bin/bash
                  set -e
                  echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                  echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                  for PUSHIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                    docker tag ${IMAGE}:${META_TAG} ${PUSHIMAGE}:${META_TAG}
                    docker tag ${PUSHIMAGE}:${META_TAG} ${PUSHIMAGE}:latest
+                    docker tag ${PUSHIMAGE}:${META_TAG} ${PUSHIMAGE}:${EXT_RELEASE_TAG}
                    docker push ${PUSHIMAGE}:latest
                    docker push ${PUSHIMAGE}:${META_TAG}
+                    docker push ${PUSHIMAGE}:${EXT_RELEASE_TAG}
                  done
               '''
          }
          sh '''#! /bin/bash
-                for DELETEIMAGE in "${GITHUBIMAGE}" "{GITLABIMAGE}" "${IMAGE}"; do
+                for DELETEIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                  docker rmi \
                  ${DELETEIMAGE}:${META_TAG} \
+                  ${DELETEIMAGE}:${EXT_RELEASE_TAG} \
                  ${DELETEIMAGE}:latest || :
                done
             '''
@@ -577,27 +651,33 @@ pipeline {
            sh '''#! /bin/bash
                  set -e
                  echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                  echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                  if [ "${CI}" == "false" ]; then
-                    docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                    docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                  fi
-                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}"; do
+                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}"; do
                    docker tag ${IMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG}
                    docker tag ${IMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG}
                    docker tag ${IMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                    docker tag ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-latest
                    docker tag ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-latest
                    docker tag ${MANIFESTIMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-latest
+                    docker tag ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
+                    docker tag ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                    docker tag ${MANIFESTIMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                    docker push ${MANIFESTIMAGE}:amd64-${META_TAG}
                    docker push ${MANIFESTIMAGE}:arm32v7-${META_TAG}
                    docker push ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                    docker push ${MANIFESTIMAGE}:amd64-latest
                    docker push ${MANIFESTIMAGE}:arm32v7-latest
                    docker push ${MANIFESTIMAGE}:arm64v8-latest
+                    docker push ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
+                    docker push ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                    docker push ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                    docker manifest push --purge ${MANIFESTIMAGE}:latest || :
                    docker manifest create ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm32v7-latest ${MANIFESTIMAGE}:arm64v8-latest
                    docker manifest annotate ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:arm32v7-latest --os linux --arch arm
@@ -606,23 +686,14 @@ pipeline {
                    docker manifest create ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                    docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} --os linux --arch arm
                    docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} --os linux --arch arm64 --variant v8
+                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} || :
+                    docker manifest create ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
+                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} --os linux --arch arm
+                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} --os linux --arch arm64 --variant v8
                    docker manifest push --purge ${MANIFESTIMAGE}:latest
                    docker manifest push --purge ${MANIFESTIMAGE}:${META_TAG} 
+                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} 
                  done
-                  docker tag ${IMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker tag ${IMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker tag ${IMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:latest
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${META_TAG}
-                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-latest
-                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-latest
-                  docker push ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker push ${GITHUBIMAGE}:latest
-                  docker push ${GITHUBIMAGE}:${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-latest
-                  docker push ${GITHUBIMAGE}:arm64v8-latest
               '''
          }
          sh '''#! /bin/bash
@@ -630,14 +701,17 @@ pipeline {
                  docker rmi \
                  ${DELETEIMAGE}:amd64-${META_TAG} \
                  ${DELETEIMAGE}:amd64-latest \
+                  ${DELETEIMAGE}:amd64-${EXT_RELEASE_TAG} \
                  ${DELETEIMAGE}:arm32v7-${META_TAG} \
                  ${DELETEIMAGE}:arm32v7-latest \
+                  ${DELETEIMAGE}:arm32v7-${EXT_RELEASE_TAG} \
                  ${DELETEIMAGE}:arm64v8-${META_TAG} \
-                  ${DELETEIMAGE}:arm64v8-latest || :
+                  ${DELETEIMAGE}:arm64v8-latest \
+                  ${DELETEIMAGE}:arm64v8-${EXT_RELEASE_TAG} || :
                done
                docker rmi \
-                lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
-                lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
+                ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
+                ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
             '''
        }
      }
@@ -653,9 +727,9 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
-        echo "Pushing New tag for current commit ${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}"
+        echo "Pushing New tag for current commit ${META_TAG}"
        sh '''curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/git/tags \
-        -d '{"tag":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+        -d '{"tag":"'${META_TAG}'",\
             "object": "'${COMMIT_SHA}'",\
             "message": "Tagging Release '${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}' to master",\
             "type": "commit",\
@@ -663,9 +737,9 @@ pipeline {
        echo "Pushing New release for Tag"
        sh '''#! /bin/bash
              echo "Updating PIP version of ${EXT_PIP} to ${EXT_RELEASE_CLEAN}" > releasebody.json
-              echo '{"tag_name":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+              echo '{"tag_name":"'${META_TAG}'",\
                     "target_commitish": "master",\
-                     "name": "'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+                     "name": "'${META_TAG}'",\
                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n**PIP Changes:**\\n\\n' > start
              printf '","draft": false,"prerelease": false}' >> releasebody.json
              paste -d'\\0' start releasebody.json > releasebody.json.done
@@ -690,9 +764,9 @@ pipeline {
          sh '''#! /bin/bash
                set -e
                TEMPDIR=$(mktemp -d)
-                docker pull linuxserver/jenkins-builder:latest
-                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
-                docker pull lsiodev/readme-sync
+                docker pull ghcr.io/linuxserver/jenkins-builder:latest
+                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest 
+                docker pull ghcr.io/linuxserver/readme-sync
                docker run --rm=true \
                  -e DOCKERHUB_USERNAME=$DOCKERUSER \
                  -e DOCKERHUB_PASSWORD=$DOCKERPASS \
@@ -700,7 +774,7 @@ pipeline {
                  -e DOCKER_REPOSITORY=${IMAGE} \
                  -e GIT_BRANCH=master \
                  -v ${TEMPDIR}/docker-${CONTAINER_NAME}:/mnt \
-                  lsiodev/readme-sync bash -c 'node sync' 
+                  ghcr.io/linuxserver/readme-sync bash -c 'node sync'
                rm -Rf ${TEMPDIR} '''
        }
      }
--- a/README.md
+++ b/README.md
@@ -1,3 +1,6 @@
+<!-- DO NOT EDIT THIS FILE MANUALLY  -->
+<!-- Please read the CONTRIBUTING.md -->
+
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)

 [![Blog](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
@@ -28,14 +31,14 @@ Find us at:
 [![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag)
 [![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag/releases)
 [![GitHub Package Repository](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub%20Package&logo=github)](https://github.com/linuxserver/docker-swag/packages)
-[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/Linuxserver.io/docker-swag/container_registry)
+[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/linuxserver.io/docker-swag/container_registry)
 [![MicroBadger Layers](https://img.shields.io/microbadger/layers/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge)](https://microbadger.com/images/linuxserver/swag "Get your own version badge on microbadger.com")
 [![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=pulls&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Docker Stars](https://img.shields.io/docker/stars/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=stars&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-swag%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/)
-[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Flsio-ci.ams3.digitaloceanspaces.com%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/swag/latest/index.html)
+[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Fci-tests.linuxserver.io%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://ci-tests.linuxserver.io/linuxserver/swag/latest/index.html)

-SWAG - Secure Web-server And Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.
+SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.

 [![swag](https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif)](https://linuxserver.io)

@@ -43,7 +46,7 @@ SWAG - Secure Web-server And Gateway (formerly known as letsencrypt, no relation

 Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).

-Simply pulling `linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
+Simply pulling `ghcr.io/linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.

 The architectures supported by this image are:

@@ -58,43 +61,16 @@ The architectures supported by this image are:

 Here are some example snippets to help you get started creating a container.

-### docker
-
-```
-docker create \
-  --name=swag \
-  --cap-add=NET_ADMIN \
-  -e PUID=1000 \
-  -e PGID=1000 \
-  -e TZ=Europe/London \
-  -e URL=yourdomain.url \
-  -e SUBDOMAINS=www, \
-  -e VALIDATION=http \
-  -e DNSPLUGIN=cloudflare `#optional` \
-  -e PROPAGATION= `#optional` \
-  -e DUCKDNSTOKEN= `#optional` \
-  -e EMAIL= `#optional` \
-  -e ONLY_SUBDOMAINS=false `#optional` \
-  -e EXTRA_DOMAINS= `#optional` \
-  -e STAGING=false `#optional` \
-  -p 443:443 \
-  -p 80:80 `#optional` \
-  -v /path/to/appdata/config:/config \
-  --restart unless-stopped \
-  linuxserver/swag
-```
-
-
-### docker-compose
+### docker-compose ([recommended](https://docs.linuxserver.io/general/docker-compose))

 Compatible with docker-compose v2 schemas.

-```
+```yaml
 ---
 version: "2.1"
 services:
  swag:
-    image: linuxserver/swag
+    image: ghcr.io/linuxserver/swag
    container_name: swag
    cap_add:
      - NET_ADMIN
@@ -105,6 +81,7 @@ services:
      - URL=yourdomain.url
      - SUBDOMAINS=www,
      - VALIDATION=http
+      - CERTPROVIDER= #optional
      - DNSPLUGIN=cloudflare #optional
      - PROPAGATION= #optional
      - DUCKDNSTOKEN= #optional
@@ -112,6 +89,7 @@ services:
      - ONLY_SUBDOMAINS=false #optional
      - EXTRA_DOMAINS= #optional
      - STAGING=false #optional
+      - MAXMINDDB_LICENSE_KEY= #optional
    volumes:
      - /path/to/appdata/config:/config
    ports:
@@ -120,6 +98,35 @@ services:
    restart: unless-stopped
 ```

+### docker cli
+
+```
+docker run -d \
+  --name=swag \
+  --cap-add=NET_ADMIN \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=Europe/London \
+  -e URL=yourdomain.url \
+  -e SUBDOMAINS=www, \
+  -e VALIDATION=http \
+  -e CERTPROVIDER= `#optional` \
+  -e DNSPLUGIN=cloudflare `#optional` \
+  -e PROPAGATION= `#optional` \
+  -e DUCKDNSTOKEN= `#optional` \
+  -e EMAIL= `#optional` \
+  -e ONLY_SUBDOMAINS=false `#optional` \
+  -e EXTRA_DOMAINS= `#optional` \
+  -e STAGING=false `#optional` \
+  -e MAXMINDDB_LICENSE_KEY= `#optional` \
+  -p 443:443 \
+  -p 80:80 `#optional` \
+  -v /path/to/appdata/config:/config \
+  --restart unless-stopped \
+  ghcr.io/linuxserver/swag
+```
+
+
 ## Parameters

 Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
@@ -134,13 +141,15 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
 | `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
 | `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
-| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
+| `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
+| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
 | `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
 | `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
-| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications. |
+| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
 | `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
 | `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
+| `-e MAXMINDDB_LICENSE_KEY=` | Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly. |
 | `-v /config` | All the config files including the webroot reside here. |

 ## Environment variables from files (Docker secrets)
@@ -177,13 +186,16 @@ In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as bel
 &nbsp;
 ## Application Setup

-### Migrating from the old `linuxserver/letsencrypt` image
-* If using docker cli:
-  * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
-  * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
-* If using docker compose:
-  * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
-  * Issue `docker-compose up -d --remove-orphans`
+> ### Migrating from the old `linuxserver/letsencrypt` image
+> * If using docker cli:
+>   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
+>   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
+> * If using docker compose:
+>   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
+>   * Issue `docker-compose up -d --remove-orphans`
+>   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
+
+> Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
 ### Validation and initial setup
 * Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
 * For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
@@ -214,26 +226,39 @@ This will *ask* Google et al not to index and list your site. Be careful with th
  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
  * These certs include:
-  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
+  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
  2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
  3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
 ### Using fail2ban
-* This container includes fail2ban set up with 3 jails by default:
+* This container includes fail2ban set up with 4 jails by default:
  1. nginx-http-auth
  2. nginx-badbots
  3. nginx-botsearch
+  4. nginx-deny
 * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
 * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
 * You can check which jails are active via `docker exec -it swag fail2ban-client status`
 * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
 * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
 * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+### Updating configs
+* This container creates a number of configs for nginx, proxy samples, etc.
+* Config updates are noted in the changelog but not automatically applied to your files.
+* If you have modified a file with noted changes in the changelog:
+  1. Keep your existing configs as is (not broken, don't fix)
+  2. Review our repository commits and apply the new changes yourself
+  3. Delete the modified config file with listed updates, restart the container, reapply your changes
+* If you have NOT modified a file with noted changes in the changelog:
+  1. Delete the config file with listed updates, restart the container
+* Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
+* Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
+* You can check the new sample and adjust your active config as needed.


 ## Docker Mods
-[![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=mods&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.")
+[![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=swag&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.") [![Docker Universal Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=universal&query=%24.mods%5B%27universal%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=universal "view available universal mods.")

-We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) can be accessed via the dynamic badge above.
+We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.


 ## Support Info
@@ -243,7 +268,7 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
 * container version number
  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' swag`
 * image version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' linuxserver/swag`
+  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' ghcr.io/linuxserver/swag`

 ## Updating Info

@@ -251,14 +276,6 @@ Most of our images are static, versioned, and require an image update and contai

 Below are the instructions for updating containers:

-### Via Docker Run/Create
-* Update the image: `docker pull linuxserver/swag`
-* Stop the running container: `docker stop swag`
-* Delete the container: `docker rm swag`
-* Recreate a new container with the same docker create parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
-* Start the new container: `docker start swag`
-* You can also remove the old dangling images: `docker image prune`
-
 ### Via Docker Compose
 * Update all images: `docker-compose pull`
  * or update a single image: `docker-compose pull swag`
@@ -266,7 +283,14 @@ Below are the instructions for updating containers:
  * or update a single container: `docker-compose up -d swag`
 * You can also remove the old dangling images: `docker image prune`

-### Via Watchtower auto-updater (especially useful if you don't remember the original parameters)
+### Via Docker Run
+* Update the image: `docker pull ghcr.io/linuxserver/swag`
+* Stop the running container: `docker stop swag`
+* Delete the container: `docker rm swag`
+* Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
+* You can also remove the old dangling images: `docker image prune`
+
+### Via Watchtower auto-updater (only use if you don't remember the original parameters)
 * Pull the latest image at its tag and replace it with the same env variables in one run:
  ```
  docker run --rm \
@@ -274,11 +298,13 @@ Below are the instructions for updating containers:
  containrrr/watchtower \
  --run-once swag
  ```
-
-**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using Docker Compose.
-
 * You can also remove the old dangling images: `docker image prune`

+**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using [Docker Compose](https://docs.linuxserver.io/general/docker-compose).
+
+### Image Update Notifications - Diun (Docker Image Update Notifier)
+* We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
+
 ## Building locally

 If you want to make local modifications to these images for development purposes or just to customize the logic:
@@ -288,7 +314,7 @@ cd docker-swag
 docker build \
  --no-cache \
  --pull \
-  -t linuxserver/swag:latest .
+  -t ghcr.io/linuxserver/swag:latest .
 ```

 The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
@@ -300,4 +326,20 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

 ## Versions

+* **14.03.21:** - Add support for directadmin dns validation.
+* **12.02.21:** - Clean up rust/cargo cache, which ballooned the image size in the last couple of builds.
+* **10.02.21:** - Fix aliyun, domeneshop, inwx and transip dns confs for existing users.
+* **09.02.21:** - Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years).
+* **26.01.21:** - Add support for hetzner dns validation.
+* **20.01.21:** - Add check for ZeroSSL EAB retrieval.
+* **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
+* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting
+* **10.12.20:** - Add support for njalla dns validation
+* **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
+* **01.11.20:** - Add support for netcup dns validation
+* **29.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy.
+* **04.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering.
+* **20.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme.
+* **08.09.20:** - Add php7-xsl.
+* **01.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs.
 * **03.08.20:** - Initial release.
--- a/package_versions.txt
+++ b/package_versions.txt
@@ -1,219 +1,223 @@
-alpine-baselayout-3.2.0-r7
+alpine-baselayout-3.2.0-r8
 alpine-keys-2.2-r0
-apache2-utils-2.4.43-r0
-apk-tools-2.10.5-r1
+apache2-utils-2.4.46-r3
+apk-tools-2.12.1-r0
 apr-1.7.0-r0
-apr-util-1.6.1-r6
+apr-util-1.6.1-r7
 argon2-libs-20190702-r1
-bash-5.0.17-r0
-brotli-libs-1.0.7-r5
-busybox-1.31.1-r19
+bash-5.1.0-r0
+brotli-libs-1.0.9-r3
+busybox-1.32.1-r5
 c-client-2007f-r11
-ca-certificates-20191127-r4
-ca-certificates-bundle-20191127-r4
-coreutils-8.32-r0
-curl-7.69.1-r0
-db-5.3.28-r1
-expat-2.2.9-r1
-fail2ban-0.11.1-r3
-freetype-2.10.2-r0
-gdbm-1.13-r1
-git-2.26.2-r0
-git-perl-2.26.2-r0
-glib-2.64.4-r0
-gmp-6.2.0-r0
-gnupg-2.2.20-r0
-gnutls-3.6.14-r0
-icu-libs-67.1-r0
-ip6tables-1.8.4-r1
-iptables-1.8.4-r1
+ca-certificates-20191127-r5
+ca-certificates-bundle-20191127-r5
+coreutils-8.32-r2
+curl-7.74.0-r1
+expat-2.2.10-r1
+fail2ban-0.11.1-r4
+freetype-2.10.4-r1
+gdbm-1.19-r0
+git-2.30.2-r0
+git-perl-2.30.2-r0
+glib-2.66.7-r1
+gmp-6.2.1-r0
+gnupg-2.2.27-r0
+gnutls-3.7.1-r0
+icu-libs-67.1-r2
+ip6tables-1.8.6-r0
+iptables-1.8.6-r0
 libacl-2.2.53-r0
-libassuan-2.5.3-r0
+libassuan-2.5.4-r0
 libattr-2.4.48-r0
-libblkid-2.35.2-r0
+libblkid-2.36.1-r1
 libbsd-0.10.0-r0
 libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
-libcap-2.27-r0
-libcrypto1.1-1.1.1g-r0
-libcurl-7.69.1-r0
-libedit-20191231.3.1-r0
-libevent-2.1.11-r1
+libcap-2.46-r0
+libcrypto1.1-1.1.1k-r0
+libcurl-7.74.0-r1
+libedit-20191231.3.1-r1
+libevent-2.1.12-r1
 libffi-3.3-r2
-libgcc-9.3.0-r2
-libgcrypt-1.8.5-r0
-libgd-2.3.0-r1
-libgpg-error-1.37-r0
+libgcc-10.2.1_pre1-r3
+libgcrypt-1.8.7-r0
+libgd-2.3.0-r2
+libgpg-error-1.41-r0
 libice-1.0.10-r0
 libidn-1.35-r0
-libintl-0.20.2-r0
-libjpeg-turbo-2.0.5-r0
-libksba-1.4.0-r0
-libldap-2.4.50-r0
-libmagic-5.38-r0
-libmaxminddb-1.4.2-r1
-libmcrypt-2.5.8-r8
+libintl-0.20.2-r2
+libjpeg-turbo-2.0.6-r0
+libksba-1.5.0-r0
+libldap-2.4.57-r1
+libmagic-5.39-r0
+libmaxminddb-1.5.0-r1
+libmcrypt-2.5.8-r9
 libmemcached-libs-1.0.18-r4
-libmnl-1.0.4-r0
-libmount-2.35.2-r0
-libnftnl-libs-1.1.6-r0
+libmnl-1.0.4-r1
+libmount-2.36.1-r1
+libnftnl-libs-1.1.8-r0
 libpng-1.6.37-r1
-libpq-12.3-r2
+libpq-13.2-r0
 libproc-3.3.16-r0
-libressl3.1-libcrypto-3.1.2-r0
-libressl3.1-libssl-3.1.2-r0
-libsasl-2.1.27-r6
-libseccomp-2.4.3-r0
-libsecret-0.20.3-r0
+libressl3.1-libcrypto-3.1.5-r0
+libressl3.1-libssl-3.1.5-r0
+libsasl-2.1.27-r10
+libseccomp-2.5.1-r1
+libsecret-0.20.4-r0
 libsm-1.2.3-r0
 libsodium-1.0.18-r0
-libssl1.1-1.1.1g-r0
-libstdc++-9.3.0-r2
+libssl1.1-1.1.1k-r0
+libstdc++-10.2.1_pre1-r3
 libtasn1-4.16.0-r1
 libtls-standalone-2.9.1-r1
 libunistring-0.9.10-r0
-libuuid-2.35.2-r0
+libuuid-2.36.1-r1
 libwebp-1.1.0-r0
-libx11-1.6.11-r0
+libx11-1.7.0-r0
 libxau-1.0.9-r0
 libxcb-1.14-r1
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.10-r4
+libxml2-2.9.10-r6
 libxpm-3.5.13-r0
 libxslt-1.1.34-r0
-libxt-1.2.0-r0
-libzip-1.6.1-r1
-linux-pam-1.3.1-r4
-logrotate-3.16.0-r0
-luajit-5.1.20190925-r0
-memcached-1.6.6-r0
-musl-1.1.24-r9
-musl-utils-1.1.24-r9
-nano-4.9.3-r0
-ncurses-libs-6.2_p20200523-r0
-ncurses-terminfo-base-6.2_p20200523-r0
-nettle-3.5.1-r1
-nghttp2-libs-1.41.0-r0
-nginx-1.18.0-r0
-nginx-mod-devel-kit-1.18.0-r0
-nginx-mod-http-echo-1.18.0-r0
-nginx-mod-http-fancyindex-1.18.0-r0
-nginx-mod-http-geoip2-1.18.0-r0
-nginx-mod-http-headers-more-1.18.0-r0
-nginx-mod-http-image-filter-1.18.0-r0
-nginx-mod-http-lua-1.18.0-r0
-nginx-mod-http-lua-upstream-1.18.0-r0
-nginx-mod-http-nchan-1.18.0-r0
-nginx-mod-http-perl-1.18.0-r0
-nginx-mod-http-redis2-1.18.0-r0
-nginx-mod-http-set-misc-1.18.0-r0
-nginx-mod-http-upload-progress-1.18.0-r0
-nginx-mod-http-xslt-filter-1.18.0-r0
-nginx-mod-mail-1.18.0-r0
-nginx-mod-rtmp-1.18.0-r0
-nginx-mod-stream-1.18.0-r0
-nginx-mod-stream-geoip2-1.18.0-r0
-nginx-vim-1.18.0-r0
+libxt-1.2.1-r0
+libzip-1.7.3-r2
+linux-pam-1.5.1-r0
+logrotate-3.18.0-r0
+lz4-libs-1.9.2-r0
+memcached-1.6.9-r0
+musl-1.2.2-r0
+musl-utils-1.2.2-r0
+nano-5.4-r1
+ncurses-libs-6.2_p20210109-r0
+ncurses-terminfo-base-6.2_p20210109-r0
+nettle-3.7-r0
+nghttp2-libs-1.42.0-r1
+nginx-1.18.0-r13
+nginx-mod-devel-kit-1.18.0-r13
+nginx-mod-http-brotli-1.18.0-r13
+nginx-mod-http-dav-ext-1.18.0-r13
+nginx-mod-http-echo-1.18.0-r13
+nginx-mod-http-fancyindex-1.18.0-r13
+nginx-mod-http-geoip2-1.18.0-r13
+nginx-mod-http-headers-more-1.18.0-r13
+nginx-mod-http-image-filter-1.18.0-r13
+nginx-mod-http-nchan-1.18.0-r13
+nginx-mod-http-perl-1.18.0-r13
+nginx-mod-http-redis2-1.18.0-r13
+nginx-mod-http-set-misc-1.18.0-r13
+nginx-mod-http-upload-progress-1.18.0-r13
+nginx-mod-http-xslt-filter-1.18.0-r13
+nginx-mod-mail-1.18.0-r13
+nginx-mod-rtmp-1.18.0-r13
+nginx-mod-stream-1.18.0-r13
+nginx-mod-stream-geoip2-1.18.0-r13
+nginx-vim-1.18.0-r13
 npth-1.6-r0
-openssl-1.1.1g-r0
-p11-kit-0.23.20-r5
+oniguruma-6.9.6-r0
+openssl-1.1.1k-r0
+p11-kit-0.23.22-r0
 pcre-8.44-r0
-pcre2-10.35-r0
-perl-5.30.3-r0
-perl-error-0.17029-r0
-perl-git-2.26.2-r0
-php7-7.3.21-r0
-php7-bcmath-7.3.21-r0
-php7-bz2-7.3.21-r0
-php7-common-7.3.21-r0
-php7-ctype-7.3.21-r0
-php7-curl-7.3.21-r0
-php7-dom-7.3.21-r0
-php7-exif-7.3.21-r0
-php7-fileinfo-7.3.20-r0
-php7-fpm-7.3.20-r0
-php7-ftp-7.3.21-r0
-php7-gd-7.3.21-r0
-php7-iconv-7.3.21-r0
-php7-imap-7.3.21-r0
-php7-intl-7.3.21-r0
-php7-json-7.3.21-r0
-php7-ldap-7.3.21-r0
-php7-mbstring-7.3.21-r0
-php7-mysqli-7.3.21-r0
-php7-mysqlnd-7.3.21-r0
-php7-opcache-7.3.21-r0
-php7-openssl-7.3.21-r0
-php7-pdo-7.3.21-r0
-php7-pdo_mysql-7.3.21-r0
-php7-pdo_odbc-7.3.21-r0
-php7-pdo_pgsql-7.3.21-r0
-php7-pdo_sqlite-7.3.21-r0
-php7-pear-7.3.21-r0
-php7-pecl-apcu-5.1.18-r0
-php7-pecl-igbinary-3.1.4-r0
-php7-pecl-mcrypt-1.0.3-r0
-php7-pecl-memcached-3.1.5-r0
-php7-pecl-redis-5.2.2-r1
-php7-pgsql-7.3.21-r0
-php7-phar-7.3.21-r0
-php7-posix-7.3.21-r0
-php7-session-7.3.21-r0
-php7-simplexml-7.3.20-r0
-php7-soap-7.3.21-r0
-php7-sockets-7.3.21-r0
-php7-sodium-7.3.21-r0
-php7-sqlite3-7.3.21-r0
-php7-tokenizer-7.3.21-r0
-php7-xml-7.3.21-r0
-php7-xmlreader-7.3.21-r0
-php7-xmlrpc-7.3.21-r0
-php7-xmlwriter-7.3.20-r0
-php7-zip-7.3.21-r0
-pinentry-1.1.0-r2
-popt-1.16-r7
+pcre2-10.36-r0
+perl-5.32.0-r0
+perl-error-0.17029-r1
+perl-git-2.30.2-r0
+php7-7.4.15-r0
+php7-bcmath-7.4.15-r0
+php7-bz2-7.4.15-r0
+php7-common-7.4.15-r0
+php7-ctype-7.4.15-r0
+php7-curl-7.4.15-r0
+php7-dom-7.4.15-r0
+php7-exif-7.4.15-r0
+php7-fileinfo-7.4.15-r0
+php7-fpm-7.4.15-r0
+php7-ftp-7.4.15-r0
+php7-gd-7.4.15-r0
+php7-iconv-7.4.15-r0
+php7-imap-7.4.15-r0
+php7-intl-7.4.15-r0
+php7-json-7.4.15-r0
+php7-ldap-7.4.15-r0
+php7-mbstring-7.4.15-r0
+php7-mysqli-7.4.15-r0
+php7-mysqlnd-7.4.15-r0
+php7-opcache-7.4.15-r0
+php7-openssl-7.4.15-r0
+php7-pdo-7.4.15-r0
+php7-pdo_mysql-7.4.15-r0
+php7-pdo_odbc-7.4.15-r0
+php7-pdo_pgsql-7.4.15-r0
+php7-pdo_sqlite-7.4.15-r0
+php7-pear-7.4.15-r0
+php7-pecl-apcu-5.1.20-r0
+php7-pecl-igbinary-3.2.2_rc1-r0
+php7-pecl-mcrypt-1.0.4-r0
+php7-pecl-memcached-3.1.5-r2
+php7-pecl-redis-5.3.4-r0
+php7-pgsql-7.4.15-r0
+php7-phar-7.4.15-r0
+php7-posix-7.4.15-r0
+php7-session-7.4.15-r0
+php7-simplexml-7.4.15-r0
+php7-soap-7.4.15-r0
+php7-sockets-7.4.15-r0
+php7-sodium-7.4.15-r0
+php7-sqlite3-7.4.15-r0
+php7-tokenizer-7.4.15-r0
+php7-xml-7.4.15-r0
+php7-xmlreader-7.4.15-r0
+php7-xmlrpc-7.4.15-r0
+php7-xmlwriter-7.4.15-r0
+php7-xsl-7.4.15-r0
+php7-zip-7.4.15-r0
+pinentry-1.1.1-r0
+popt-1.18-r0
 procps-3.3.16-r0
 py3-appdirs-1.4.4-r1
-py3-asn1crypto-1.3.0-r0
+py3-asn1crypto-1.4.0-r0
 py3-cachecontrol-0.12.6-r0
-py3-certifi-2020.4.5.1-r0
-py3-cffi-1.14.0-r2
-py3-chardet-3.0.4-r4
-py3-colorama-0.4.3-r0
+py3-cffi-1.14.4-r0
+py3-chardet-4.0.0-r0
+py3-colorama-0.4.4-r0
 py3-contextlib2-0.6.0-r0
 py3-cparser-2.20-r0
-py3-cryptography-2.9.2-r0
-py3-distlib-0.3.0-r0
+py3-cryptography-3.3.2-r0
+py3-distlib-0.3.1-r1
 py3-distro-1.5.0-r1
 py3-future-0.18.2-r1
-py3-html5lib-1.0.1-r4
-py3-idna-2.9-r0
+py3-html5lib-1.1-r0
+py3-idna-3.1-r0
 py3-lockfile-0.12.2-r3
-py3-msgpack-1.0.0-r0
-py3-ordered-set-4.0.1-r0
-py3-packaging-20.4-r0
-py3-parsing-2.4.7-r0
-py3-pep517-0.8.2-r0
-py3-pip-20.1.1-r0
+py3-msgpack-1.0.2-r0
+py3-ordered-set-4.0.2-r0
+py3-packaging-20.9-r0
+py3-parsing-2.4.7-r1
+py3-pep517-0.9.1-r0
+py3-pip-20.3.4-r0
 py3-progress-1.5-r0
 py3-pytoml-0.1.21-r0
-py3-requests-2.23.0-r0
+py3-requests-2.25.1-r1
 py3-retrying-1.3.3-r0
-py3-setuptools-47.0.0-r0
+py3-setuptools-51.3.3-r0
 py3-six-1.15.0-r0
-py3-toml-0.10.1-r0
-py3-urllib3-1.25.9-r0
+py3-toml-0.10.2-r0
+py3-urllib3-1.26.2-r1
 py3-webencodings-0.5.1-r3
-python3-3.8.5-r0
-readline-8.0.4-r0
-scanelf-1.2.6-r0
+python3-3.8.8-r0
+readline-8.1.0-r0
+s6-ipcserver-2.10.0.0-r0
+scanelf-1.2.8-r0
 shadow-4.8.1-r0
-sqlite-libs-3.32.1-r0
-ssl_client-1.31.1-r19
-tzdata-2020a-r0
-unixodbc-2.3.7-r2
-whois-5.5.6-r0
+skalibs-2.10.0.0-r0
+sqlite-libs-3.34.1-r0
+ssl_client-1.32.1-r5
+tzdata-2021a-r0
+unixodbc-2.3.9-r1
+utmps-0.1.0.0-r0
+whois-5.5.7-r1
 xz-5.2.5-r0
 xz-libs-5.2.5-r0
 zlib-1.2.11-r3
+zstd-libs-1.4.5-r3
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -4,7 +4,7 @@
 project_name: swag
 project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
-project_blurb: "SWAG - Secure Web-server And Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention."
+project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"

 project_blurb_optional_extras_enabled: false
@@ -50,13 +50,15 @@ cap_add_param_vars:
 # optional container parameters
 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
+  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
+  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
  - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
  - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
-  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications." }
+  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
  - { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
  - { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
  - { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
+  - { env_var: "MAXMINDDB_LICENSE_KEY", env_value: "", desc: "Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly."}
 opt_param_usage_include_vols: false
 opt_param_volumes:
  - { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "Configuration files." }
@@ -76,13 +78,16 @@ optional_block_1_items: ""
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
-  ### Migrating from the old `linuxserver/letsencrypt` image
-  * If using docker cli:
-    * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
-    * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
-  * If using docker compose:
-    * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
-    * Issue `docker-compose up -d --remove-orphans`
+  > ### Migrating from the old `linuxserver/letsencrypt` image
+  > * If using docker cli:
+  >   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
+  >   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
+  > * If using docker compose:
+  >   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
+  >   * Issue `docker-compose up -d --remove-orphans`
+  >   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
+
+  > Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
  ### Validation and initial setup
  * Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
  * For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
@@ -113,24 +118,53 @@ app_setup_block: |
    1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
    2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
    * These certs include:
-    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
+    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
    2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
    3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
  ### Using fail2ban
-  * This container includes fail2ban set up with 3 jails by default:
+  * This container includes fail2ban set up with 4 jails by default:
    1. nginx-http-auth
    2. nginx-badbots
    3. nginx-botsearch
+    4. nginx-deny
  * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
  * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
  * You can check which jails are active via `docker exec -it swag fail2ban-client status`
  * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
  * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
  * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+  ### Updating configs
+  * This container creates a number of configs for nginx, proxy samples, etc.
+  * Config updates are noted in the changelog but not automatically applied to your files.
+  * If you have modified a file with noted changes in the changelog:
+    1. Keep your existing configs as is (not broken, don't fix)
+    2. Review our repository commits and apply the new changes yourself
+    3. Delete the modified config file with listed updates, restart the container, reapply your changes
+  * If you have NOT modified a file with noted changes in the changelog:
+    1. Delete the config file with listed updates, restart the container
+  * Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
+  * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
+  * You can check the new sample and adjust your active config as needed.

 app_setup_nginx_reverse_proxy_snippet: false
 app_setup_nginx_reverse_proxy_block: ""

 # changelog
 changelogs:
-  - { date: "03.08.20:", desc: "Initial release." }
+  - { date: "14.03.21:", desc: "Add support for directadmin dns validation." }
+  - { date: "12.02.21:", desc: "Clean up rust/cargo cache, which ballooned the image size in the last couple of builds." }
+  - { date: "10.02.21:", desc: "Fix aliyun, domeneshop, inwx and transip dns confs for existing users." }
+  - { date: "09.02.21:", desc: "Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years)." }
+  - { date: "26.01.21:", desc: "Add support for hetzner dns validation." }
+  - { date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval." }
+  - { date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled." }
+  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting" }
+  - { date: "10.12.20:", desc: "Add support for njalla dns validation" }
+  - { date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation." }
+  - { date: "01.11.20:", desc: "Add support for netcup dns validation" }
+  - { date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy." }
+  - { date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering." }
+  - { date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
+  - { date: "08.09.20:", desc: "Add php7-xsl." }
+  - { date: "01.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs." }
+  - { date: "03.08.20:", desc: "Initial release." }
--- a/root/app/duckdns-txt
+++ b/root/app/duckdns-txt
@@ -1,6 +1,6 @@
 #!/bin/bash

-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 curl https://www.duckdns.org/update?domains=${CERTBOT_DOMAIN}\&token=${ORIGDUCKDNSTOKEN}\&txt=${CERTBOT_VALIDATION}

--- a/root/app/le-renew.sh
+++ b/root/app/le-renew.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/with-contenv bash

-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 echo "<------------------------------------------------->"
 echo
--- a/root/defaults/502.html
+++ b/root/defaults/502.html
@@ -0,0 +1,44 @@
+<html>
+    <head>
+        <title>502</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+            background-color: #961313;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 28px;
+            line-height: 26px;
+        }
+        h2{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>502</h1>
+            <h2>Nginx can not connect to the application</h2>
+            <p>Some common reasons are listed here: <a target="_blank" href="https://docs.linuxserver.io/general/swag#502">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>
--- a/root/defaults/default
+++ b/root/defaults/default
@@ -1,4 +1,6 @@
-## Version 2020/05/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+## Version 2021/01/03 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+
+error_page 502 /502.html;

 # redirect all traffic to https
 server {
@@ -30,6 +32,12 @@ server {
 	# enable for Authelia
 	#include /config/nginx/authelia-server.conf;

+	# enable for geo blocking
+	# See /config/nginx/geoip2.conf for more information.
+	#if ($allowed_country = no) {
+	#return 444;
+	#}
+
 	client_max_body_size 0;

 	location / {
--- a/root/defaults/dns-conf/aliyun.ini
+++ b/root/defaults/dns-conf/aliyun.ini
@@ -2,5 +2,5 @@
 # https://ram.console.aliyun.com/
 # And ensure your RAM account has AliyunDNSFullAccess permission.

-certbot_dns_aliyun:dns_aliyun_access_key = 12345678
-certbot_dns_aliyun:dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef
+dns_aliyun_access_key = 12345678
+dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef
--- a/root/defaults/dns-conf/directadmin.ini
+++ b/root/defaults/dns-conf/directadmin.ini
@@ -0,0 +1,21 @@
+# Instructions: https://github.com/cybercinch/certbot-dns-directadmin/blob/master/certbot_dns_directadmin/__init__.py
+
+# It is recommended to create a login key in the DirectAdmin control panel to be used as value for directadmin_password.
+# Instructions on how to create such key can be found at https://help.directadmin.com/item.php?id=523.
+#
+# Make sure to grant the following permissions:
+# - CMD_API_LOGIN_TEST
+# - CMD_API_DNS_CONTROL
+# - CMD_API_SHOW_DOMAINS
+#
+# Username and password can also be used in case your DirectAdmin instance has no support for login keys.
+
+# The DirectAdmin Server url
+# include the scheme and the port number (Normally 2222)
+directadmin_url = https://my.directadminserver.com:2222
+
+# The DirectAdmin username
+directadmin_username = username
+
+# The DirectAdmin password
+directadmin_password = aSuperStrongPassword
--- a/root/defaults/dns-conf/domeneshop.ini
+++ b/root/defaults/dns-conf/domeneshop.ini
@@ -1,4 +1,4 @@
 # Instructions: https://github.com/domeneshop/certbot-dns-domeneshop#credentials
 # Replace with your values
-certbot_dns_domeneshop:dns_domeneshop_client_token=1234567890abcdef
-certbot_dns_domeneshop:dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs
+dns_domeneshop_client_token=1234567890abcdef
+dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs
--- a/root/defaults/dns-conf/gehirn.ini
+++ b/root/defaults/dns-conf/gehirn.ini
@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-gehirn.readthedocs.io/en/stable/
+# Replace with your values
+dns_gehirn_api_token  = 00000000-0000-0000-0000-000000000000
+dns_gehirn_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
--- a/root/defaults/dns-conf/hetzner.ini
+++ b/root/defaults/dns-conf/hetzner.ini
@@ -0,0 +1,3 @@
+# Instructions: https://github.com/ctrlaltcoop/certbot-dns-hetzner
+# Replace with your values
+dns_hetzner_api_token = nohnah4zoo9Kiejee9aGh0thoopee2sa
--- a/root/defaults/dns-conf/inwx.ini
+++ b/root/defaults/dns-conf/inwx.ini
@@ -1,6 +1,6 @@
 # Instructions: https://github.com/oGGy990/certbot-dns-inwx
 # Replace with your values
-certbot_dns_inwx:dns_inwx_url           = https://api.domrobot.com/xmlrpc/
-certbot_dns_inwx:dns_inwx_username      = your_username
-certbot_dns_inwx:dns_inwx_password      = your_password
-certbot_dns_inwx:dns_inwx_shared_secret = your_shared_secret optional
+dns_inwx_url           = https://api.domrobot.com/xmlrpc/
+dns_inwx_username      = your_username
+dns_inwx_password      = your_password
+dns_inwx_shared_secret = your_shared_secret optional
--- a/root/defaults/dns-conf/netcup.ini
+++ b/root/defaults/dns-conf/netcup.ini
@@ -0,0 +1,3 @@
+dns_netcup_customer_id  = 123456
+dns_netcup_api_key      = 0123456789abcdef0123456789abcdef01234567
+dns_netcup_api_password = abcdef0123456789abcdef01234567abcdef0123
--- a/root/defaults/dns-conf/njalla.ini
+++ b/root/defaults/dns-conf/njalla.ini
@@ -0,0 +1,2 @@
+# Generate your API token here: https://njal.la/settings/api/
+dns_njalla_token=0000000000000000000000000000000000000000
--- a/root/defaults/dns-conf/sakuracloud.ini
+++ b/root/defaults/dns-conf/sakuracloud.ini
@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-sakuracloud.readthedocs.io/en/stable/
+# Replace with your values
+dns_sakuracloud_api_token  = 00000000-0000-0000-0000-000000000000
+dns_sakuracloud_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
--- a/root/defaults/dns-conf/transip.ini
+++ b/root/defaults/dns-conf/transip.ini
@@ -1,6 +1,30 @@
 # Instructions: https://readthedocs.org/projects/certbot-dns-transip/
-# Convert the key to an RSA key (openssl rsa -in transip.key -out transip-rsa.key)
-# Place .key-file in the same directory as this file. Location "/config/dns-conf" is from within the container
+#
+# This DNS plugin can be used to generate SSL wildcard certificates via TransIP DNS TXT records
+#
+# Login with your TransIP account and go to My Account | API:
+# 1. API-settings: On
+#
+# 2. IP-address/ranges whitelist: Add a new authorized IP address (Swag Docker) to use the API
+#
+# 3. Generate a new Key Pair and copy the private key to a new transip.key file in the format:
+#    -----BEGIN PRIVATE KEY-----
+#    ...
+#    -----END PRIVATE KEY-----
+#
+# 4. Convert the key to an RSA key with command:
+#     openssl rsa -in transip.key -out /config/dns-conf/transip-rsa.key
+#
+# 5. Set permission
+#     chmod 600 /config/dns-conf/transip-rsa.key
+#
+# 6. Replace <transip_username> below with your TransIP username
+#
+# 7. Create wildcard certificate with Swag environment variables:
+#      SUBDOMAINS=wildcard
+#      VALIDATION=dns
+#      DNSPLUGIN=transip
+
+dns_transip_username = <transip_username>
+dns_transip_key_file = /config/dns-conf/transip-rsa.key

-certbot_dns_transip:dns_transip_username = <transip_username>
-certbot_dns_transip:dns_transip_key_file = /config/dns-conf/transip-rsa.key
--- a/root/defaults/geoip2.conf
+++ b/root/defaults/geoip2.conf
@@ -0,0 +1,123 @@
+## Version 2020/10/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
+# To enable, uncommment the Geoip2 config line in nginx.conf
+# Add the -e MAXMINDDB_LICENSE_KEY=<licensekey> to automatically download the Geolite2 database.
+# A Maxmind license key can be acquired here: https://www.maxmind.com/en/geolite2/signup
+
+geoip2 /config/geoip2db/GeoLite2-City.mmdb {
+    auto_reload 1w;
+    $geoip2_data_city_name   city names en;
+    $geoip2_data_postal_code postal code;
+    $geoip2_data_latitude    location latitude;
+    $geoip2_data_longitude   location longitude;
+    $geoip2_data_state_name  subdivisions 0 names en;
+    $geoip2_data_state_code  subdivisions 0 iso_code;
+    $geoip2_data_continent_code   continent code;
+    $geoip2_data_country_iso_code country iso_code;
+}
+
+# GEOIP2 COUNTRY CONFIG
+map $geoip2_data_country_iso_code $allowed_country {
+    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
+    default yes;
+
+    # Below you will setup conditions with yes or no
+    # ex: <condition> <yes/no>;
+
+    # allow United Kingdom.
+    #GB yes;
+}
+
+# GEOIP2 CITY CONFIG
+map $geoip2_data_city_name $allowed_city {
+    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
+    default yes;
+
+    # Below you will setup conditions with yes or no
+    # ex: <condition> <yes/no>;
+
+    # allow Inverness.
+    #Inverness yes;
+}
+
+# ALLOW LOCAL ACCESS
+geo $allow_list {
+    default yes; # Set this to no if $allowed_country or $allowed_city default is no. 
+    # IP/CIDR yes; # e.g. 192.168.1.0/24 yes;
+}
+
+# Server config example:
+# Add the following if statements inside any server context where you want to geo block countries.
+
+########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#	if ($allowed_country = no) {
+#	return 444;
+#	}
+#########################################
+
+# Add the following if statements inside any server context where you want to geo block cities.
+########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#	if ($allowed_city = no) {
+#	return 444;
+#	}
+#########################################
+
+# Example using a config from proxy-confs
+
+#server {
+#    listen 443 ssl;
+#    listen [::]:443 ssl;
+#
+#    server_name unifi.*;
+#
+#    include /config/nginx/ssl.conf;
+#
+#    client_max_body_size 0;
+#
+#    # enable for ldap auth, fill in ldap details in ldap.conf
+#    #include /config/nginx/ldap.conf;
+#
+#    # enable for Authelia
+#    #include /config/nginx/authelia-server.conf;
+
+
+#   # Allow lan access if default is set to no
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#    # Country geo block
+#    if ($allowed_country = no) {
+#       return 444;
+#    }
+
+
+#
+#    location / {
+#        # enable the next two lines for http auth
+#        #auth_basic "Restricted";
+#        #auth_basic_user_file /config/nginx/.htpasswd;
+#
+#        # enable the next two lines for ldap auth
+#        #auth_request /auth;
+#        #error_page 401 =200 /ldaplogin;
+#
+#        # enable for Authelia
+#        #include /config/nginx/authelia-location.conf;
+#
+#        include /config/nginx/proxy.conf;
+#        resolver 127.0.0.11 valid=30s;
+#        set $upstream_app unifi-controller;
+#        set $upstream_port 8443;
+#        set $upstream_proto https;
+#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+#
+#        proxy_buffering off;
+#    }
+#}
--- a/root/defaults/index.html
+++ b/root/defaults/index.html
@@ -0,0 +1,39 @@
+<html>
+    <head>
+        <title>Welcome to your SWAG instance</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>Welcome to your <a target="_blank" href="https://github.com/linuxserver/docker-swag">SWAG</a> instance</h1>
+            <p>A webserver and reverse proxy solution brought to you by <a target="_blank" href="https://www.linuxserver.io/">linuxserver.io</a> with php support and a built-in Certbot client.</p>
+            <p>We have an article on how to use swag here: <a target="_blank" href="https://docs.linuxserver.io/general/swag">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>
--- a/root/defaults/nginx.conf
+++ b/root/defaults/nginx.conf
@@ -1,4 +1,4 @@
-## Version 2019/12/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
+## Version 2021/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf

 user abc;
 worker_processes 4;
@@ -16,21 +16,21 @@ http {
 	# Basic Settings
 	##

-	sendfile on;
-	tcp_nopush on;
-	tcp_nodelay on;
+	client_body_buffer_size 128k;
+	client_max_body_size 0;
 	keepalive_timeout 65;
+	large_client_header_buffers 4 16k;
+	send_timeout 5m;
+	sendfile on;
+	tcp_nodelay on;
+	tcp_nopush on;
 	types_hash_max_size 2048;
 	variables_hash_max_size 2048;
-	large_client_header_buffers 4 16k;
-	
-	# server_tokens off;

+	# server_tokens off;
 	# server_names_hash_bucket_size 64;
 	# server_name_in_redirect off;

-	client_max_body_size 0;
-
 	include /etc/nginx/mime.types;
 	default_type application/octet-stream;

@@ -72,13 +72,28 @@ http {
 	#passenger_root /usr;
 	#passenger_ruby /usr/bin/ruby;

+	##
+	# WebSocket proxying
+	##
+	map $http_upgrade $connection_upgrade {
+		default upgrade;
+		''      close;
+	}
+
 	##
 	# Virtual Host Configs
 	##
 	include /etc/nginx/conf.d/*.conf;
 	include /config/nginx/site-confs/*;
-	lua_load_resty_core off;
+	#Removed lua. Do not remove this comment

+	##
+	# Geoip2 config
+	##
+	# Uncomment to add the Geoip2 configs needed to geo block countries/cities.
+	##
+
+	#include /config/nginx/geoip2.conf;
 }


--- a/root/defaults/proxy.conf
+++ b/root/defaults/proxy.conf
@@ -1,32 +1,30 @@
-## Version 2019/10/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
+## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf

-client_body_buffer_size 128k;
-
-#Timeout if the real server is dead
+# Timeout if the real server is dead
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

-# Advanced Proxy Config
-send_timeout 5m;
-proxy_read_timeout 240;
-proxy_send_timeout 240;
-proxy_connect_timeout 240;
-
-# TLS 1.3 early data
-proxy_set_header Early-Data $ssl_early_data;
-
-# Basic Proxy Config
-proxy_set_header Host $host;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto https;
-proxy_set_header X-Forwarded-Host $host;
-proxy_set_header X-Forwarded-Ssl on;
-proxy_redirect  http://  $scheme://;
-proxy_http_version 1.1;
-proxy_set_header Connection "";
-#proxy_cookie_path / "/; HTTPOnly; Secure"; # enable at your own risk, may break certain apps
-proxy_cache_bypass $cookie_session;
-proxy_no_cache $cookie_session;
+# Proxy Connection Settings
 proxy_buffers 32 4k;
+proxy_connect_timeout 240;
 proxy_headers_hash_bucket_size 128;
 proxy_headers_hash_max_size 1024;
+proxy_http_version 1.1;
+proxy_read_timeout 240;
+proxy_redirect  http://  $scheme://;
+proxy_send_timeout 240;
+
+# Proxy Cache and Cookie Settings
+proxy_cache_bypass $cookie_session;
+#proxy_cookie_path / "/; Secure"; # enable at your own risk, may break certain apps
+proxy_no_cache $cookie_session;
+
+# Proxy Header Settings
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Early-Data $ssl_early_data;
+proxy_set_header Host $host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Proto https;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Real-IP $remote_addr;
--- a/root/defaults/ssl.conf
+++ b/root/defaults/ssl.conf
@@ -1,4 +1,4 @@
-## Version 2020/06/17 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
+## Version 2020/10/29 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf

 ### Mozilla Recommendations
 # generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
@@ -39,10 +39,10 @@ ssl_early_data on;
 #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

 # Optional additional headers
-#add_header Content-Security-Policy "upgrade-insecure-requests";
-#add_header X-Frame-Options "SAMEORIGIN" always;
-#add_header X-XSS-Protection "1; mode=block" always;
-#add_header X-Content-Type-Options "nosniff" always;
-#add_header X-UA-Compatible "IE=Edge" always;
 #add_header Cache-Control "no-transform" always;
+#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
 #add_header Referrer-Policy "same-origin" always;
+#add_header X-Content-Type-Options "nosniff" always;
+#add_header X-Frame-Options "SAMEORIGIN" always;
+#add_header X-UA-Compatible "IE=Edge" always;
+#add_header X-XSS-Protection "1; mode=block" always;
--- a/root/etc/cont-init.d/50-config
+++ b/root/etc/cont-init.d/50-config
@@ -10,6 +10,7 @@ SUBDOMAINS=${SUBDOMAINS}\\n\
 EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
 ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
 VALIDATION=${VALIDATION}\\n\
+CERTPROVIDER=${CERTPROVIDER}\\n\
 DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
 STAGING=${STAGING}\\n"
@@ -20,7 +21,7 @@ if [ -n "${TEST_RUN}" ]; then
 fi

 # Sanitize variables
-SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION )
+SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER )
 for i in "${SANED_VARS[@]}"
 do
  export echo "$i"="${!i//\"/}"
@@ -45,8 +46,6 @@ chown -R abc:abc /config/dns-conf

 # copy reverse proxy configs
 cp -R /defaults/proxy-confs /config/nginx/
-# remove outdated files (remove this action after 2020/10/17)
-rm -f /config/nginx/proxy-confs/seafile.subdomain.config.sample /config/nginx/proxy-confs/librespeed.subdomain.com.sample

 # copy/update the fail2ban config defaults to/in /config
 cp -R /defaults/fail2ban/filter.d /config/fail2ban/
@@ -77,6 +76,16 @@ cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
 	cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
 [[ ! -f /config/nginx/authelia-location.conf ]] && \
 	cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
+[[ ! -f /config/nginx/geoip2.conf ]] && \
+	cp /defaults/geoip2.conf /config/nginx/geoip2.conf
+[[ ! -f /config/www/502.html ]] &&
+	cp /defaults/502.html /config/www/502.html
+
+# remove lua bits from nginx.conf if not done before
+if ! grep -q '#Removed lua' /config/nginx/nginx.conf; then 
+  echo "Removing lua specific info from nginx.conf"
+  sed -i 's|\tlua_load_resty_core off;|\t#Removed lua. Do not remove this comment|g' /config/nginx/nginx.conf
+fi

 # copy pre-generated dhparams or generate if needed
 [[ ! -f /config/nginx/dhparams.pem ]] && \
@@ -90,7 +99,7 @@ if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
 fi

 # check to make sure DNSPLUGIN is selected if dns validation is used
-[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|dnsimple|dnsmadeeasy|domeneshop|gandi|google|inwx|linode|luadns|nsone|ovh|rfc2136|route53|transip)$ ]] && \
+[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|directadmin|dnsimple|dnsmadeeasy|domeneshop|gandi|gehirn|google|hetzner|inwx|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip)$ ]] && \
  echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
  sleep infinity

@@ -98,15 +107,18 @@ fi
 rm /etc/crontabs/*
 cp /config/crontabs/* /etc/crontabs/

-# create original config file if it doesn't exist
-if [ ! -f "/config/donoteditthisfile.conf" ]; then
-  echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
-  echo "Created donoteditthisfile.conf"
+# create original config file if it doesn't exist, move non-hidden legacy file to hidden
+if [ -f "/config/donoteditthisfile.conf" ]; then
+  mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
+fi
+if [ ! -f "/config/.donoteditthisfile.conf" ]; then
+  echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
+  echo "Created .donoteditthisfile.conf"
 fi

 # load original config settings
 # shellcheck disable=SC1091
-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 # set default validation to http
 if [ -z "$VALIDATION" ]; then
@@ -114,11 +126,22 @@ if [ -z "$VALIDATION" ]; then
  echo "VALIDATION parameter not set; setting it to http"
 fi

-# if staging is set to true, use the staging server
-if [ "$STAGING" = "true" ]; then
+# if zerossl is selected or staging is set to true, use the relevant server
+if [ "$CERTPROVIDER" = "zerossl" ] && [ "$STAGING" = "true" ]; then
+  echo "ZeroSSL does not support staging mode, ignoring STAGING variable"
+fi
+if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+  echo "ZeroSSL is selected as the cert provider, registering cert with $EMAIL"
+  ACMESERVER="https://acme.zerossl.com/v2/DV90"
+elif [ "$CERTPROVIDER" = "zerossl" ] && [ -z "$EMAIL" ]; then
+  echo "ZeroSSL is selected as the cert provider, but the e-mail address has not been entered. Please visit https://zerossl.com, register a new account and set the account e-mail address in the EMAIL environment variable"
+  sleep infinity
+elif [ "$STAGING" = "true" ]; then
  echo "NOTICE: Staging is active"
+  echo "Using Let's Encrypt as the cert provider"
  ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
 else
+  echo "Using Let's Encrypt as the cert provider"
  ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
 fi

@@ -170,33 +193,42 @@ else
  EMAILPARAM="--register-unsafely-without-email"
 fi

+# update plugin names in dns conf inis
+sed -i 's|^certbot_dns_aliyun:||g' /config/dns-conf/aliyun.ini
+sed -i 's|^certbot_dns_domeneshop:||g' /config/dns-conf/domeneshop.ini
+sed -i 's|^certbot_dns_inwx:||g' /config/dns-conf/inwx.ini
+sed -i 's|^certbot_dns_transip:||g' /config/dns-conf/transip.ini
+
 # setting the validation method to use
 if [ "$VALIDATION" = "dns" ]; then
  if [ "$DNSPLUGIN" = "route53" ]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM}"
  elif [[ "$DNSPLUGIN" =~ ^(cpanel)$ ]]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  elif [[ "$DNSPLUGIN" =~ ^(gandi)$ ]]; then
    if [ -n "$PROPAGATION" ];then echo "Gandi dns plugin does not support setting propagation time"; fi
-    PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini --manual-public-ip-logging-ok"
+    PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini"
  elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|inwx|transip)$ ]]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
+  elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|hetzner|inwx|netcup|njalla|transip)$ ]]; then
+    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+  elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
+    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  else
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  fi
  echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
 elif [ "$VALIDATION" = "tls-sni" ]; then
  PREFCHAL="--non-interactive --standalone --preferred-challenges http"
  echo "*****tls-sni validation has been deprecated, attempting http validation instead"
 elif [ "$VALIDATION" = "duckdns" ]; then
-  PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-public-ip-logging-ok --manual-auth-hook /app/duckdns-txt"
+  PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-auth-hook /app/duckdns-txt"
  chmod +x /app/duckdns-txt
  echo "duckdns validation is selected"
  if [ "$SUBDOMAINS" = "wildcard" ]; then
@@ -221,20 +253,34 @@ else
 fi

 # checking for changes in cert variables, revoking certs if necessary
-if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ]; then
+if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
  echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
  if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
    ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
-    [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem
  else
-    [[ -f /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem
+    ORIGDOMAIN="$ORIGURL"
  fi
+  if [ "$ORIGCERTPROVIDER" = "zerossl" ] && [ -n "$ORIGEMAIL" ]; then
+    REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$ORIGEMAIL")
+    REV_ZEROSSL_EAB_KID=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+    REV_ZEROSSL_EAB_HMAC_KEY=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+    if [ -z "$REV_ZEROSSL_EAB_KID" ] || [ -z "$REV_ZEROSSL_EAB_HMAC_KEY" ]; then
+      echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+      sleep infinity
+    fi
+    REV_ACMESERVER="https://acme.zerossl.com/v2/DV90 --eab-kid ${REV_ZEROSSL_EAB_KID} --eab-hmac-key ${REV_ZEROSSL_EAB_HMAC_KEY}"
+  elif [ "$ORIGSTAGING" = "true" ]; then
+    REV_ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
+  else
+    REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
+  fi
+  [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
  rm -rf /config/etc/letsencrypt
  mkdir -p /config/etc/letsencrypt
 fi

 # saving new variables
-echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
+echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf

 # alter extension for error message
 if [ "$DNSPLUGIN" = "google" ]; then
@@ -245,9 +291,20 @@ fi

 # generating certs if necessary
 if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
+  if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+    echo "Retrieving EAB from ZeroSSL"
+    EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$EMAIL")
+    ZEROSSL_EAB_KID=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+    ZEROSSL_EAB_HMAC_KEY=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+    if [ -z "$ZEROSSL_EAB_KID" ] || [ -z "$ZEROSSL_EAB_HMAC_KEY" ]; then
+      echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+      sleep infinity
+    fi
+    ZEROSSL_EAB="--eab-kid ${ZEROSSL_EAB_KID} --eab-hmac-key ${ZEROSSL_EAB_HMAC_KEY}"
+  fi
  echo "Generating new certificate"
- # shellcheck disable=SC2086
- certbot certonly --renew-by-default --server $ACMESERVER $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
+  # shellcheck disable=SC2086
+  certbot certonly --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
  if [ -d /config/keys/letsencrypt ]; then
    cd /config/keys/letsencrypt || exit
  else
--- a/root/etc/cont-init.d/70-templates
+++ b/root/etc/cont-init.d/70-templates
@@ -0,0 +1,42 @@
+#!/usr/bin/with-contenv bash
+
+nginx_confs=( \
+    authelia-location.conf \
+    authelia-server.conf \
+    geoip2.conf \
+    ldap.conf \
+    nginx.conf \
+    proxy.conf \
+    site-confs/default \
+    ssl.conf )
+
+for i in ${nginx_confs[@]}; do
+    if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /config/nginx/${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /defaults/$(basename ${i}))" ]; then
+        nginx_confs_changed="/config/nginx/${i}\n${nginx_confs_changed}"
+    fi
+done
+
+if [ -n "$nginx_confs_changed" ]; then
+    echo "**** The following nginx confs have different version dates than the defaults that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the defaults. ****"
+    echo "**** To update them to the latest defaults shipped within the image, delete these files and restart the container. ****"
+    echo "**** If they are user customized, check the date version at the top and compare to the upstream changelog via the link. ****"
+    echo -e "${nginx_confs_changed}"
+fi
+
+proxy_confs=$(ls /config/nginx/proxy-confs/*.conf 2>/dev/null)
+
+for i in $proxy_confs; do
+    if [ -f "${i}.sample" ]; then
+        if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i}.sample)" ]; then
+            proxy_confs_changed="${i}\n${proxy_confs_changed}"
+        fi
+    fi
+done
+
+if [ -n "$proxy_confs_changed" ]; then
+    echo "**** The following reverse proxy confs have different version dates than the samples that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the samples. ****"
+    echo "**** You should compare them to the samples in the same folder to make sure you have the latest updates. ****"
+    echo -e "${proxy_confs_changed}"
+fi
Author	SHA1	Message	Date
LinuxServer-CI	36495ea204	Bot Updating Package Versions	2021-04-01 06:13:59 +00:00
LinuxServer-CI	a9be9a304f	Bot Updating Package Versions	2021-03-27 13:13:15 +00:00
LinuxServer-CI	867da78277	Bot Updating Package Versions	2021-03-25 07:22:56 +00:00
LinuxServer-CI	c0f8b3a8b2	Bot Updating Package Versions	2021-03-18 01:44:51 -04:00
LinuxServer-CI	9463ffdc73	Bot Updating Package Versions	2021-03-14 13:55:30 +00:00
LinuxServer-CI	4a43425d74	Bot Updating Templated Files	2021-03-14 13:30:21 +00:00
aptalca	7f0a3bfa80	Merge pull request #99 from Platzii/directadmin Add support for DirectAdmin DNS validation	2021-03-14 09:28:50 -04:00
Simon Lepla	6f8101e9b1	add support for directadmin dns validation	2021-03-14 11:53:29 +01:00
LinuxServer-CI	1a16a7c415	Bot Updating Package Versions	2021-03-11 05:43:28 +00:00
LinuxServer-CI	a134aa0d41	Bot Updating Package Versions	2021-03-03 16:09:33 -05:00
LinuxServer-CI	30d407e922	Bot Updating Package Versions	2021-02-25 05:41:47 +00:00
LinuxServer-CI	79d8ff0378	Bot Updating Package Versions	2021-02-18 05:34:37 +00:00
LinuxServer-CI	2988ac4a5f	Bot Updating Package Versions	2021-02-15 08:52:22 -05:00
LinuxServer-CI	a158c34ab9	Bot Updating Package Versions	2021-02-12 14:33:29 +00:00
LinuxServer-CI	ed57a1038e	Bot Updating Templated Files	2021-02-12 14:10:06 +00:00
Roxedus	a8c55b455a	Merge pull request #87 from linuxserver/cleanup cleanup cargo/rust crud	2021-02-12 15:08:36 +01:00
aptalca	f0be12bcda	cleanup cargo/rust crud	2021-02-12 08:39:08 -05:00
Eric Nemchik	adfe04cedb	Merge pull request #83 from linuxserver/sed fix the right inis	2021-02-10 18:11:22 -06:00
Eric Nemchik	d075d3e2c3	Merge pull request #69 from Erriez/transip-documentation Add documentation TransIP DNS TXT usage	2021-02-10 18:11:15 -06:00
aptalca	a84c6883a6	fix the right inis	2021-02-10 13:35:55 -05:00
LinuxServer-CI	61a5c40902	Bot Updating Package Versions	2021-02-10 15:54:58 +00:00
aptalca	0a32a84d8a	Merge pull request #80 from linuxserver/master-3.13 Rebase to 3.13, add brotli and dav-ext, remove lua	2021-02-10 10:35:03 -05:00
aptalca	e7b5816304	enable rust for py crypto	2021-02-10 09:52:09 -05:00
aptalca	b71f99cb7b	Merge branch 'master' into master-3.13	2021-02-10 09:51:11 -05:00
Erriez	dbd8fd4bd0	Add comments TransIP DNS TXT usage	2021-02-09 19:47:20 +01:00
aptalca	9074cf2d44	I like to copy pasta	2021-02-09 11:23:08 -05:00
aptalca	479ee5eac1	add brotli and dav-ext, remove lua	2021-02-09 10:50:54 -05:00
LinuxServer-CI	d7ce59b839	Bot Updating Package Versions	2021-02-09 05:59:41 -05:00
Roxedus	69fdcc1ff3	Merge pull request #79 from linuxserver/crypt avoid rust for py crypto	2021-02-09 11:48:06 +01:00
aptalca	00484f51d8	avoid rust for py crypto	2021-02-08 21:57:15 -05:00
aptalca	363ba433cc	Merge branch 'master' into master-3.13	2021-02-08 17:14:52 -05:00
aptalca	de98308c70	add cargo/rust to fix cryptography builds	2021-02-08 16:06:12 -05:00
aptalca	db657fa06a	Merge pull request #67 from linuxserver/hetzner add support for hetzner dns validation	2021-01-27 10:29:09 -05:00
aptalca	6f25f82996	add support for hetzner dns validation	2021-01-26 18:11:44 -05:00
thelamer	ea8b193858	Rebasing to Alpine 3.13	2021-01-23 15:13:00 -08:00
aptalca	d5c8106aac	Merge pull request #61 from linuxserver/typo fix typo	2021-01-23 17:22:09 -05:00
aptalca	cd5f29a8b0	fix typo	2021-01-23 15:49:03 -05:00
LinuxServer-CI	693da376b7	Bot Updating Package Versions	2021-01-20 10:56:21 -05:00
aptalca	d9f3a34a42	Merge pull request #60 from linuxserver/zerocheck Add check for ZeroSSL EAB retrieval	2021-01-20 10:41:21 -05:00
aptalca	8ac274550f	fix var name	2021-01-20 09:34:20 -05:00
aptalca	07e1ab096c	Add check for ZeroSSL EAB retrieval	2021-01-20 08:43:55 -05:00
LinuxServer-CI	99a4c55dcb	Bot Updating Package Versions	2021-01-13 09:08:27 -05:00
LinuxServer-CI	9a09573590	Bot Updating Templated Files	2021-01-13 08:53:18 -05:00
aptalca	00511ebb7a	Merge pull request #48 from linuxserver/zerossl Add ZeroSSL support via CERTPROVIDER var	2021-01-13 08:51:48 -05:00
aptalca	71747b2a6f	add more info to changelog	2021-01-08 18:21:28 -05:00
aptalca	af548a0966	Merge branch 'master' into zerossl	2021-01-08 18:16:07 -05:00
LinuxServer-CI	bb53d24b40	Bot Updating Templated Files	2021-01-08 15:13:54 +00:00
aptalca	f0fd8e67fd	Merge pull request #54 from Roxedus/master Added helpers	2021-01-08 10:12:18 -05:00
Roxedus	77a82f7163	Fix issues from review	2021-01-08 15:47:36 +01:00
LinuxServer-CI	0c7bc26fc2	Bot Updating Package Versions	2021-01-08 09:19:46 -05:00
Roxedus	6ebfdc1e87	Update dates	2021-01-03 20:23:48 +01:00
LinuxServer-CI	df74c02b4d	Bot Updating Package Versions	2021-01-01 09:13:46 -05:00
Roxedus	76f0a8c34c	Added helpers Replaced index.html with page with some info, including a the swag documentation. Added http502 helper page, also linking to our docs. UI suggestions welcome	2020-12-30 22:58:59 +01:00
aptalca	87cdcfdb18	update dns conf inis	2020-12-27 16:48:09 -05:00
aptalca	71397b40fd	update dns plugin names	2020-12-20 18:17:29 -05:00
aptalca	832dde3b35	remove unnecessary eab retrieval also suppress error when no proxy confs are activated	2020-12-20 16:55:11 -05:00
LinuxServer-CI	236553d119	Bot Updating Package Versions	2020-12-18 14:17:25 +00:00
LinuxServer-CI	b91ce7bd1a	Bot Updating Templated Files	2020-12-18 14:01:54 +00:00
LinuxServer-CI	0a1b8cf801	Bot Updating Templated Files	2020-12-18 14:00:19 +00:00
aptalca	21e9d7298a	fix typo	2020-12-10 16:43:54 -05:00
aptalca	1f85492fd5	save EMAIL value for later reuse	2020-12-10 16:04:10 -05:00
aptalca	3844b7f660	add zerossl support cert revokes	2020-12-10 14:32:15 -05:00
aptalca	7f6840373a	update conf name in scripts	2020-12-10 13:37:53 -05:00
aptalca	371b7d49ec	Add ZeroSSL support via CERTPROVIDER var and make donoteditthisfile.conf hidden	2020-12-10 11:58:52 -05:00
LinuxServer-CI	42e0e7452b	Bot Updating Templated Files	2020-12-10 10:21:34 -05:00
aptalca	471b018126	Merge pull request #41 from netthier/master Add Njalla DNS validation support	2020-12-10 10:20:23 -05:00
LinuxServer-CI	7c5bf4269c	Bot Updating Package Versions	2020-12-10 14:44:15 +00:00
aptalca	ffd9b806f9	Merge branch 'master' into master	2020-12-10 09:38:27 -05:00
aptalca	1a7bdec09b	Merge pull request #46 from linuxserver/defaults add new dns methods, check confs, add workflows	2020-12-10 09:31:23 -05:00
aptalca	1bdf9a98e2	add new dns methods, check confs, add workflows add gehirn and sakuracloud dns validation add conf checker add trigger workflows remove deprecated certbot option for public ip logging	2020-12-09 15:43:05 -05:00
LinuxServer-CI	7232890186	Bot Updating Package Versions	2020-12-08 11:09:05 +00:00
LinuxServer-CI	536c903fe2	Bot Updating Package Versions	2020-12-01 11:06:37 +00:00
nett_hier	1769aad85f	Update njalla.ini	2020-11-25 23:27:57 +01:00
netthier	dc55d77965	Update readme-vars.yml	2020-11-25 22:18:24 +01:00
netthier	8de14f3790	Create njalla.ini	2020-11-25 22:09:46 +01:00
netthier	1831bbbbcf	Update 50-config	2020-11-25 21:47:06 +01:00
netthier	b884e4181e	Update Dockerfile.armhf	2020-11-25 21:46:12 +01:00
netthier	cd57dff765	Update Dockerfile	2020-11-25 21:45:52 +01:00
netthier	5538ef6736	Update Dockerfile.aarch64	2020-11-25 21:45:22 +01:00
netthier	68e91b2870	Update Dockerfile	2020-11-25 21:45:00 +01:00
LinuxServer-CI	0bebcbed52	Bot Updating Package Versions	2020-11-22 17:39:23 -05:00
LinuxServer-CI	64b676eb06	Bot Updating Templated Files	2020-11-22 17:27:13 -05:00
aptalca	46c804c696	Merge pull request #40 from JohnMaguire/update-readme Update README with nginx-deny jail	2020-11-22 17:26:03 -05:00
John Maguire	cf74fe7a39	Update README with nginx-deny jail	2020-11-22 17:00:00 -05:00
LinuxServer-CI	177ba1b378	Bot Updating Package Versions	2020-11-02 15:15:03 +00:00
LinuxServer-CI	aded96c0a4	Bot Updating Templated Files	2020-11-02 15:01:28 +00:00
thelamer	8bcf64041a	update baseimages	2020-11-02 06:57:55 -08:00
LinuxServer-CI	04745dcf1f	Bot Updating Package Versions	2020-11-01 08:59:24 -05:00
LinuxServer-CI	0a4cac7f35	Bot Updating Templated Files	2020-11-01 08:48:28 -05:00
aptalca	95e7ef9db3	Merge pull request #31 from reey/master Add support for using provider netcup for DNS validation	2020-11-01 08:47:15 -05:00
Tristan Bastian	515addf76e	add changelog entry for supporting netcup	2020-11-01 13:40:09 +01:00
Tristan Bastian	046fb5447a	put netcup in correct order within DNSPLUGIN validation	2020-11-01 09:22:58 +01:00
Tristan Bastian	f23595d0b9	reorder netcup plugin to sort plugin list alphabetically	2020-11-01 00:22:39 +01:00
Tristan Bastian	812f2d3df5	add netcup as additional dns provider in readme	2020-11-01 00:20:11 +01:00
Tristan Bastian	71734a4e49	reduce to just netcup as option	2020-10-31 23:58:45 +01:00
Tristan Bastian	4d9439c899	add sample netcup.ini file	2020-10-31 23:54:11 +01:00
Tristan Bastian	a910da2633	configure parameters for netcup correctly	2020-10-31 23:41:13 +01:00
Tristan Bastian	35fa03e01c	add netcup as a valid dns validation method	2020-10-31 23:20:53 +01:00
Tristan Bastian	9de23713ca	add netcup dns plugin	2020-10-31 22:51:15 +01:00
aptalca	3e3dccd836	Merge pull request #30 from linuxserver/frame-ancestors Set frame-ancestors in Content-Security-Policy	2020-10-29 12:07:07 -04:00
Eric Nemchik	1d08b6f2e1	Update changelog	2020-10-29 10:38:32 -05:00
Eric Nemchik	01dd12f567	Set frame-ancestors in Content-Security-Policy https://infosec.mozilla.org/guidelines/web_security#x-frame-options	2020-10-29 10:13:55 -05:00
aptalca	50371fea4f	Merge pull request #26 from gilbN/geoip2-lan-fix adds an allow LAN ip list if geoip2 default is no.	2020-10-27 09:06:21 -04:00
LinuxServer-CI	3b927f6857	Bot Updating Package Versions	2020-10-27 07:06:26 -04:00
GilbN	a81ab8bcf1	update version	2020-10-27 09:37:00 +01:00
gilbN	38fa575e1e	adds a lan allow list if default is no.	2020-10-26 22:51:04 +01:00
LinuxServer-CI	f105551398	Bot Updating Package Versions	2020-10-20 10:06:02 +00:00
LinuxServer-CI	02310836df	Bot Updating Package Versions	2020-10-13 06:05:28 -04:00
LinuxServer-CI	34c2a6243e	Bot Updating Package Versions	2020-10-06 10:05:56 +00:00
LinuxServer-CI	bd2913b084	Bot Updating Templated Files	2020-10-04 16:05:36 +00:00
aptalca	c230a05837	Merge pull request #15 from linuxserver/sorting Cleanups and reordering	2020-10-04 12:04:09 -04:00
Eric Nemchik	2c78490f28	Fix dates	2020-10-04 10:00:32 -05:00
LinuxServer-CI	6d8b490e76	Bot Updating Package Versions	2020-10-04 16:00:30 +01:00
Eric Nemchik	8d5f6e56b8	Cleanups and reordering	2020-10-04 09:56:14 -05:00
Eric Nemchik	692600c1dc	Update changelog	2020-10-04 09:54:33 -05:00
aptalca	27d9d961ac	Merge pull request #18 from linuxserver/readme-typo fix readme typo, update templates	2020-10-04 10:44:21 -04:00
aptalca	58565590b0	fix readme typo, update tempates	2020-10-04 10:16:33 -04:00
aptalca	e2e9662983	Merge pull request #14 from linuxserver/geoip2-instructions Geoip2 instructions	2020-10-04 10:06:55 -04:00
Eric Nemchik	f626c5f0d4	Update geoip2.conf	2020-09-22 20:08:00 -05:00
Eric Nemchik	b58ee45818	Adjust geoip2 instructions	2020-09-22 19:53:40 -05:00
Marius	891aa6bc71	added suggested changes	2020-09-22 17:16:01 +02:00
LinuxServer-CI	9b39eaea1f	Bot Updating Package Versions	2020-09-22 10:05:57 +00:00
gilbN	3ac3035efd	typo	2020-09-21 00:39:13 +02:00
gilbN	b3af27456a	nginx.conf version update	2020-09-21 00:01:15 +02:00
gilbN	9299466506	added geoip2 cp in 50-config	2020-09-20 23:52:36 +02:00
gilbN	57b70d654b	added geoip2 configs	2020-09-20 23:30:06 +02:00
LinuxServer-CI	e7ee9431b5	Bot Updating Package Versions	2020-09-14 03:55:13 +01:00
Eric Nemchik	68206cda11	Merge pull request #9 from linuxserver/xsl Add php7-xsl	2020-09-13 21:44:32 -05:00
aptalca	1b58f469a3	Add php7-xsl	2020-09-08 08:15:34 -04:00
LinuxServer-CI	3601dfbe81	Bot Updating Package Versions	2020-09-08 05:12:24 +00:00
aptalca	4a043060a6	Merge pull request #7 from linuxserver/websocket-proxying WebSocket proxying	2020-09-08 01:01:17 -04:00
Eric Nemchik	c67946115a	Update nginx.conf Fix indentation	2020-09-07 22:20:57 -05:00
Eric Nemchik	596acd2d7a	Version dates on confs	2020-09-01 13:16:31 -05:00
Eric Nemchik	93c259ee2f	Update readme and changelog	2020-09-01 12:24:36 -05:00
Eric Nemchik	9f1cc323b1	WebSocket proxying http://nginx.org/en/docs/http/websocket.html	2020-09-01 09:02:42 -05:00
LinuxServer-CI	055801b05b	Bot Updating Package Versions	2020-09-01 06:06:07 -04:00
LinuxServer-CI	16f4b226a3	Bot Updating Package Versions	2020-08-27 20:24:50 +00:00
LinuxServer-CI	91497c3479	Bot Updating Package Versions	2020-08-25 10:09:54 +00:00
Eric Nemchik	a7b3cab778	Merge pull request #5 from linuxserver/name update readme	2020-08-22 16:03:29 -05:00
aptalca	203451a696	update readme	2020-08-22 14:29:14 -04:00
Eric Nemchik	5727a9260c	Merge pull request #4 from linuxserver/patch quick readme update on migration info	2020-08-21 12:37:19 -05:00
aptalca	aee7dcf14a	quick readme update on migration info	2020-08-21 13:00:30 -04:00
aptalca	5080db685b	Merge pull request #3 from linuxserver/migrate update migration info	2020-08-21 10:57:26 -04:00
aptalca	8ddeee5d3d	update migration info	2020-08-21 10:32:00 -04:00
LinuxServer-CI	dae80a988d	Bot Updating Package Versions	2020-08-18 10:06:18 +00:00
LinuxServer-CI	82ab2597b9	Bot Updating Package Versions	2020-08-11 10:06:25 +00:00