Bot Updating Package Versions

Format app_setup_block

.editorconfig

@@ -0,0 +1,20 @@
+# This file is globally distributed to all container image projects from
+# https://github.com/linuxserver/docker-jenkins-builder/blob/master/.editorconfig
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+# trim_trailing_whitespace may cause unintended issues and should not be globally set true
+trim_trailing_whitespace = false
+
+[{Dockerfile*,**.yml}]
+indent_style = space
+indent_size = 2
+
+[{**.sh,root/etc/cont-init.d/**,root/etc/services.d/**}]
+indent_style = space
+indent_size = 4

.github/CONTRIBUTING.md

@@ -4,7 +4,7 @@
 
 * While contributing make sure to make all your changes before creating a Pull Request, as our pipeline builds each commit after the PR is open.
 * Read, and fill the Pull Request template
-  * If this is a fix for a typo in code or documentation in the README please file an issue
+  * If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR
   * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
 * If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://discord.gg/YWrKVTn)
 
@@ -96,7 +96,7 @@ If you are proposing additional packages to be added, ensure that you added the
 
 ### Testing your changes
 
-```
+```bash
 git clone https://github.com/linuxserver/docker-swag.git
 cd docker-swag
 docker build \
@@ -106,13 +106,14 @@ docker build \
 ```
 
 The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
-```
+
+```bash
 docker run --rm --privileged multiarch/qemu-user-static:register --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
 
-## Update the chagelog
+## Update the changelog
 
 If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-swag/tree/master/root), add an entry to the changelog
 

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord chat support
+    url: https://discord.gg/YWrKVTn
+    about: Realtime support / chat with the community and the team.
+
+  - name: Discourse discussion forum
+    url: https://discourse.linuxserver.io
+    about: Post on our community forum.
+
+  - name: Documentation
+    url: https://docs.linuxserver.io/images/docker-swag
+    about: Documentation - information about all of our containers.

.github/ISSUE_TEMPLATE/issue.bug.md

@@ -1,12 +1,14 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
 
 <!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
 
-<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
-<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
-
-<!--- Provide a general summary of the issue in the Title above -->
+<!--- Provide a general summary of the bug in the Title above -->
 
 ------------------------------
 

.github/ISSUE_TEMPLATE/issue.feature.md

@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+[linuxserverurl]: https://linuxserver.io
+[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
+
+<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
+
+<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
+<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
+
+<!--- Provide a general summary of the request in the Title above -->
+
+------------------------------
+
+## Desired Behavior
+<!--- Tell us what should happen -->
+
+## Current Behavior
+<!--- Tell us what happens instead of the expected behavior -->
+
+## Alternatives Considered
+<!--- Tell us what other options you have tried or considered -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,7 +6,7 @@
 
 <!--- Before submitting a pull request please check the following -->
 
-<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  -->
+<!---  If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR  -->
 <!---  Ask yourself if this modification is something the whole userbase will benefit from, if this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
 <!---  That if the PR is addressing an existing issue include, closes #<issue number> , in the body of the PR commit message   -->
 <!---  You have included links to any files / patches etc your PR may be using in the body of the PR commit message -->

.github/workflows/external_trigger.yml

@@ -0,0 +1,92 @@
+name: External Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  external-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: External Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\". ****"
+          echo "**** Retrieving external version ****"
+          EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
+          if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
+            echo "**** Can't retrieve external version, exiting ****"
+            FAILURE_REASON="Can't retrieve external version for swag branch master"
+            GHA_TRIGGER_URL="https://github.com/linuxserver/docker-swag/actions/runs/${{ github.run_id }}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n**Trigger URL:** '"${GHA_TRIGGER_URL}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "**** External version: ${EXT_RELEASE} ****"
+          echo "**** Retrieving last pushed version ****"
+          image="linuxserver/swag"
+          tag="latest"
+          token=$(curl -sX GET \
+            "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fswag%3Apull" \
+            | jq -r '.token')
+            multidigest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${tag}" \
+              | jq -r 'first(.manifests[].digest)')
+            digest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}" \
+              | jq -r '.config.digest')
+          image_info=$(curl -sL \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/blobs/${digest}" \
+            | jq -r '.container_config')
+          IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
+          IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "**** Can't retrieve last pushed version, exiting ****"
+            FAILURE_REASON="Can't retrieve last pushed version for swag tag latest"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          echo "**** Last pushed version: ${IMAGE_VERSION} ****"
+          if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
+            echo "**** Version ${EXT_RELEASE} already pushed, exiting ****"
+            exit 0
+          elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting ****"
+            exit 0
+          else
+            echo "**** New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build ****"
+            response=$(curl -iX POST \
+              https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=false \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+            echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+            echo "**** Sleeping 10 seconds until job starts ****"
+            sleep 10
+            buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+            buildurl="${buildurl%$'\r'}"
+            echo "**** Jenkins job build url: ${buildurl} ****"
+            echo "**** Attempting to change the Jenkins job description ****"
+            curl -iX POST \
+              "${buildurl}submitDescription" \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+              --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --data-urlencode "Submit=Submit"
+            echo "**** Notifying Discord ****"
+            TRIGGER_REASON="A version change was detected for swag tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+              "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          fi

.github/workflows/external_trigger_scheduler.yml

@@ -0,0 +1,43 @@
+name: External Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '50 * * * *'
+  workflow_dispatch:
+
+jobs:
+  external-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: External Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "$br" == "$ls_branch" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering external trigger workflow for branch ${br} ****."
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/external_trigger.yml/dispatches
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done

.github/workflows/greetings.yml

@@ -8,6 +8,6 @@ jobs:
     steps:
     - uses: actions/first-interaction@v1
       with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [issue template](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE.md)!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.bug.md) or [feature](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.feature.md) issue templates!'
         pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
         repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package_trigger.yml

@@ -0,0 +1,38 @@
+name: Package Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  package-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: Package Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_PACKAGE_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_PACKAGE_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          if [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** There already seems to be an active build on Jenkins; skipping package trigger ****"
+            exit 0
+          fi
+          echo "**** Package trigger running off of master branch. To disable, set a Github secret named \"PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\". ****"
+          response=$(curl -iX POST \
+            https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=true \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+          echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+          echo "**** Sleeping 10 seconds until job starts ****"
+          sleep 10
+          buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+          buildurl="${buildurl%$'\r'}"
+          echo "**** Jenkins job build url: ${buildurl} ****"
+          echo "**** Attempting to change the Jenkins job description ****"
+          curl -iX POST \
+            "${buildurl}submitDescription" \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+            --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --data-urlencode "Submit=Submit"

.github/workflows/package_trigger_scheduler.yml

@@ -0,0 +1,50 @@
+name: Package Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '03 5 * * 4'
+  workflow_dispatch:
+
+jobs:
+  package-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: Package Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "${br}" == "${ls_branch}" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/package_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering package trigger workflow for branch ${br}. ****"
+                triggered_branches="${triggered_branches}${br} "
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/package_trigger.yml/dispatches
+                sleep 30
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done
+          echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
+          echo "**** Notifying Discord ****"
+          curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+            "description": "**Package Check Build(s) Triggered for swag** \n**Branch(es):** '"${triggered_branches}"' \n**Build URL:** '"https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-swag/activity/"' \n"}],
+            "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/stale.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/stale@v1
+    - uses: actions/stale@v3
       with:
         stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
         stale-pr-message: "This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."

.gitignore

@@ -0,0 +1 @@
+.jenkins-external

Dockerfile

@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.14
 
 # set version label
 ARG BUILD_DATE
@@ -12,139 +12,146 @@ ENV DHLEVEL=2048 ONLY_SUBDOMAINS=false AWS_CONFIG_FILE=/config/dns-conf/route53.
 ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 RUN \
- echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
-	g++ \
-	gcc \
-	libffi-dev \
-	openssl-dev \
-	python3-dev && \
- echo "**** install runtime packages ****" && \
- apk add --no-cache --upgrade \
-	curl \
-	fail2ban \
-	gnupg \
-	memcached \
-	nginx \
-	nginx-mod-http-echo \
-	nginx-mod-http-fancyindex \
-	nginx-mod-http-geoip2 \
-	nginx-mod-http-headers-more \
-	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
-	nginx-mod-http-nchan \
-	nginx-mod-http-perl \
-	nginx-mod-http-redis2 \
-	nginx-mod-http-set-misc \
-	nginx-mod-http-upload-progress \
-	nginx-mod-http-xslt-filter \
-	nginx-mod-mail \
-	nginx-mod-rtmp \
-	nginx-mod-stream \
-	nginx-mod-stream-geoip2 \
-	nginx-vim \
-	php7-bcmath \
-	php7-bz2 \
-	php7-ctype \
-	php7-curl \
-	php7-dom \
-	php7-exif \
-	php7-ftp \
-	php7-gd \
-	php7-iconv \
-	php7-imap \
-	php7-intl \
-	php7-ldap \
-	php7-mcrypt \
-	php7-memcached \
-	php7-mysqli \
-	php7-mysqlnd \
-	php7-opcache \
-	php7-pdo_mysql \
-	php7-pdo_odbc \
-	php7-pdo_pgsql \
-	php7-pdo_sqlite \
-	php7-pear \
-	php7-pecl-apcu \
-	php7-pecl-redis \
-	php7-pgsql \
-	php7-phar \
-	php7-posix \
-	php7-soap \
-	php7-sockets \
-	php7-sodium \
-	php7-sqlite3 \
-	php7-tokenizer \
-	php7-xml \
-	php7-xmlreader \
-	php7-xmlrpc \
-	php7-xsl \
-	php7-zip \
-	py3-cryptography \
-	py3-future \
-	py3-pip \
-	whois && \
- echo "**** install certbot plugins ****" && \
- if [ -z ${CERTBOT_VERSION+x} ]; then \
-        CERTBOT="certbot"; \
- else \
-        CERTBOT="certbot==${CERTBOT_VERSION}"; \
- fi && \
- pip3 install -U \
-	pip && \
- pip3 install -U \
-	${CERTBOT} \
-	certbot-dns-aliyun \
-	certbot-dns-cloudflare \
-	certbot-dns-cloudxns \
-	certbot-dns-cpanel \
-	certbot-dns-digitalocean \
-	certbot-dns-dnsimple \
-	certbot-dns-dnsmadeeasy \
-	certbot-dns-domeneshop \
-	certbot-dns-google \
-	certbot-dns-inwx \
-	certbot-dns-linode \
-	certbot-dns-luadns \
-	certbot-dns-nsone \
-	certbot-dns-ovh \
-	certbot-dns-rfc2136 \
-	certbot-dns-route53 \
-	certbot-dns-transip \
-	certbot-plugin-gandi \
-	cryptography \
-	requests && \
- echo "**** remove unnecessary fail2ban filters ****" && \
- rm \
-	/etc/fail2ban/jail.d/alpine-ssh.conf && \
- echo "**** copy fail2ban default action and filter to /default ****" && \
- mkdir -p /defaults/fail2ban && \
- mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
- mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
- echo "**** copy proxy confs to /default ****" && \
- mkdir -p /defaults/proxy-confs && \
- curl -o \
-	/tmp/proxy.tar.gz -L \
-	"https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
- tar xf \
-	/tmp/proxy.tar.gz -C \
-	/defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
- echo "**** configure nginx ****" && \
- rm -f /etc/nginx/conf.d/default.conf && \
- curl -o \
-	/defaults/dhparams.pem -L \
-	"https://lsio.ams3.digitaloceanspaces.com/dhparams.pem" && \
- echo "**** cleanup ****" && \
- apk del --purge \
-	build-dependencies && \
- for cleanfiles in *.pyc *.pyo; \
-	do \
-	find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
-	; done && \
- rm -rf \
-	/tmp/* \
-	/root/.cache
+  echo "**** install build packages ****" && \
+  apk add --no-cache --virtual=build-dependencies \
+    cargo \
+    g++ \
+    gcc \
+    libffi-dev \
+    openssl-dev \
+    python3-dev && \
+  echo "**** install runtime packages ****" && \
+  apk add --no-cache --upgrade \
+    curl \
+    fail2ban \
+    gnupg \
+    memcached \
+    nginx \
+    nginx-mod-http-brotli \
+    nginx-mod-http-dav-ext \
+    nginx-mod-http-echo \
+    nginx-mod-http-fancyindex \
+    nginx-mod-http-geoip2 \
+    nginx-mod-http-headers-more \
+    nginx-mod-http-image-filter \
+    nginx-mod-http-nchan \
+    nginx-mod-http-perl \
+    nginx-mod-http-redis2 \
+    nginx-mod-http-set-misc \
+    nginx-mod-http-upload-progress \
+    nginx-mod-http-xslt-filter \
+    nginx-mod-mail \
+    nginx-mod-rtmp \
+    nginx-mod-stream \
+    nginx-mod-stream-geoip2 \
+    nginx-vim \
+    php7-bcmath \
+    php7-bz2 \
+    php7-ctype \
+    php7-curl \
+    php7-dom \
+    php7-exif \
+    php7-ftp \
+    php7-gd \
+    php7-gmp \
+    php7-iconv \
+    php7-imap \
+    php7-intl \
+    php7-ldap \
+    php7-mcrypt \
+    php7-memcached \
+    php7-mysqli \
+    php7-mysqlnd \
+    php7-opcache \
+    php7-pdo_mysql \
+    php7-pdo_odbc \
+    php7-pdo_pgsql \
+    php7-pdo_sqlite \
+    php7-pear \
+    php7-pecl-apcu \
+    php7-pecl-mailparse \
+    php7-pecl-redis \
+    php7-pgsql \
+    php7-phar \
+    php7-posix \
+    php7-soap \
+    php7-sockets \
+    php7-sodium \
+    php7-sqlite3 \
+    php7-tokenizer \
+    php7-xml \
+    php7-xmlreader \
+    php7-xmlrpc \
+    php7-xsl \
+    php7-zip \
+    py3-cryptography \
+    py3-future \
+    py3-pip \
+    whois && \
+  echo "**** install certbot plugins ****" && \
+  if [ -z ${CERTBOT_VERSION+x} ]; then \
+    CERTBOT="certbot"; \
+  else \
+    CERTBOT="certbot==${CERTBOT_VERSION}"; \
+  fi && \
+  pip3 install -U \
+    pip && \
+  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    ${CERTBOT} \
+    certbot-dns-aliyun \
+    certbot-dns-cloudflare \
+    certbot-dns-cloudxns \
+    certbot-dns-cpanel \
+    certbot-dns-digitalocean \
+    certbot-dns-directadmin \
+    certbot-dns-dnsimple \
+    certbot-dns-dnsmadeeasy \
+    certbot-dns-domeneshop \
+    certbot-dns-google \
+    certbot-dns-hetzner \
+    certbot-dns-inwx \
+    certbot-dns-ionos \
+    certbot-dns-linode \
+    certbot-dns-luadns \
+    certbot-dns-netcup \
+    certbot-dns-njalla \
+    certbot-dns-nsone \
+    certbot-dns-ovh \
+    certbot-dns-rfc2136 \
+    certbot-dns-route53 \
+    certbot-dns-transip \
+    certbot-dns-vultr \
+    certbot-plugin-gandi \
+    cryptography \
+    requests && \
+  echo "**** remove unnecessary fail2ban filters ****" && \
+  rm \
+    /etc/fail2ban/jail.d/alpine-ssh.conf && \
+  echo "**** copy fail2ban default action and filter to /default ****" && \
+  mkdir -p /defaults/fail2ban && \
+  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
+  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
+  echo "**** copy proxy confs to /default ****" && \
+  mkdir -p /defaults/proxy-confs && \
+  curl -o \
+    /tmp/proxy.tar.gz -L \
+    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
+  tar xf \
+    /tmp/proxy.tar.gz -C \
+    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
+  echo "**** configure nginx ****" && \
+  rm -f /etc/nginx/http.d/default.conf && \
+  echo "**** cleanup ****" && \
+  apk del --purge \
+    build-dependencies && \
+  for cleanfiles in *.pyc *.pyo; \
+    do \
+    find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
+    ; done && \
+  rm -rf \
+    /tmp/* \
+    /root/.cache \
+    /root/.cargo
 
 # add local files
 COPY root/ /

Dockerfile.aarch64

@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm64v8-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.14
 
 # set version label
 ARG BUILD_DATE
@@ -12,139 +12,146 @@ ENV DHLEVEL=2048 ONLY_SUBDOMAINS=false AWS_CONFIG_FILE=/config/dns-conf/route53.
 ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 RUN \
- echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
-	g++ \
-	gcc \
-	libffi-dev \
-	openssl-dev \
-	python3-dev && \
- echo "**** install runtime packages ****" && \
- apk add --no-cache --upgrade \
-	curl \
-	fail2ban \
-	gnupg \
-	memcached \
-	nginx \
-	nginx-mod-http-echo \
-	nginx-mod-http-fancyindex \
-	nginx-mod-http-geoip2 \
-	nginx-mod-http-headers-more \
-	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
-	nginx-mod-http-nchan \
-	nginx-mod-http-perl \
-	nginx-mod-http-redis2 \
-	nginx-mod-http-set-misc \
-	nginx-mod-http-upload-progress \
-	nginx-mod-http-xslt-filter \
-	nginx-mod-mail \
-	nginx-mod-rtmp \
-	nginx-mod-stream \
-	nginx-mod-stream-geoip2 \
-	nginx-vim \
-	php7-bcmath \
-	php7-bz2 \
-	php7-ctype \
-	php7-curl \
-	php7-dom \
-	php7-exif \
-	php7-ftp \
-	php7-gd \
-	php7-iconv \
-	php7-imap \
-	php7-intl \
-	php7-ldap \
-	php7-mcrypt \
-	php7-memcached \
-	php7-mysqli \
-	php7-mysqlnd \
-	php7-opcache \
-	php7-pdo_mysql \
-	php7-pdo_odbc \
-	php7-pdo_pgsql \
-	php7-pdo_sqlite \
-	php7-pear \
-	php7-pecl-apcu \
-	php7-pecl-redis \
-	php7-pgsql \
-	php7-phar \
-	php7-posix \
-	php7-soap \
-	php7-sockets \
-	php7-sodium \
-	php7-sqlite3 \
-	php7-tokenizer \
-	php7-xml \
-	php7-xmlreader \
-	php7-xmlrpc \
-	php7-xsl \
-	php7-zip \
-	py3-cryptography \
-	py3-future \
-	py3-pip \
-	whois && \
- echo "**** install certbot plugins ****" && \
- if [ -z ${CERTBOT_VERSION+x} ]; then \
-        CERTBOT="certbot"; \
- else \
-        CERTBOT="certbot==${CERTBOT_VERSION}"; \
- fi && \
- pip3 install -U \
-	pip && \
- pip3 install -U \
-	${CERTBOT} \
-	certbot-dns-aliyun \
-	certbot-dns-cloudflare \
-	certbot-dns-cloudxns \
-	certbot-dns-cpanel \
-	certbot-dns-digitalocean \
-	certbot-dns-dnsimple \
-	certbot-dns-dnsmadeeasy \
-	certbot-dns-domeneshop \
-	certbot-dns-google \
-	certbot-dns-inwx \
-	certbot-dns-linode \
-	certbot-dns-luadns \
-	certbot-dns-nsone \
-	certbot-dns-ovh \
-	certbot-dns-rfc2136 \
-	certbot-dns-route53 \
-	certbot-dns-transip \
-	certbot-plugin-gandi \
-	cryptography \
-	requests && \
- echo "**** remove unnecessary fail2ban filters ****" && \
- rm \
-	/etc/fail2ban/jail.d/alpine-ssh.conf && \
- echo "**** copy fail2ban default action and filter to /default ****" && \
- mkdir -p /defaults/fail2ban && \
- mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
- mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
- echo "**** copy proxy confs to /default ****" && \
- mkdir -p /defaults/proxy-confs && \
- curl -o \
-	/tmp/proxy.tar.gz -L \
-	"https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
- tar xf \
-	/tmp/proxy.tar.gz -C \
-	/defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
- echo "**** configure nginx ****" && \
- rm -f /etc/nginx/conf.d/default.conf && \
- curl -o \
-	/defaults/dhparams.pem -L \
-	"https://lsio.ams3.digitaloceanspaces.com/dhparams.pem" && \
- echo "**** cleanup ****" && \
- apk del --purge \
-	build-dependencies && \
- for cleanfiles in *.pyc *.pyo; \
-	do \
-	find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
-	; done && \
- rm -rf \
-	/tmp/* \
-	/root/.cache
+  echo "**** install build packages ****" && \
+  apk add --no-cache --virtual=build-dependencies \
+    cargo \
+    g++ \
+    gcc \
+    libffi-dev \
+    openssl-dev \
+    python3-dev && \
+  echo "**** install runtime packages ****" && \
+  apk add --no-cache --upgrade \
+    curl \
+    fail2ban \
+    gnupg \
+    memcached \
+    nginx \
+    nginx-mod-http-brotli \
+    nginx-mod-http-dav-ext \
+    nginx-mod-http-echo \
+    nginx-mod-http-fancyindex \
+    nginx-mod-http-geoip2 \
+    nginx-mod-http-headers-more \
+    nginx-mod-http-image-filter \
+    nginx-mod-http-nchan \
+    nginx-mod-http-perl \
+    nginx-mod-http-redis2 \
+    nginx-mod-http-set-misc \
+    nginx-mod-http-upload-progress \
+    nginx-mod-http-xslt-filter \
+    nginx-mod-mail \
+    nginx-mod-rtmp \
+    nginx-mod-stream \
+    nginx-mod-stream-geoip2 \
+    nginx-vim \
+    php7-bcmath \
+    php7-bz2 \
+    php7-ctype \
+    php7-curl \
+    php7-dom \
+    php7-exif \
+    php7-ftp \
+    php7-gd \
+    php7-gmp \
+    php7-iconv \
+    php7-imap \
+    php7-intl \
+    php7-ldap \
+    php7-mcrypt \
+    php7-memcached \
+    php7-mysqli \
+    php7-mysqlnd \
+    php7-opcache \
+    php7-pdo_mysql \
+    php7-pdo_odbc \
+    php7-pdo_pgsql \
+    php7-pdo_sqlite \
+    php7-pear \
+    php7-pecl-apcu \
+    php7-pecl-mailparse \
+    php7-pecl-redis \
+    php7-pgsql \
+    php7-phar \
+    php7-posix \
+    php7-soap \
+    php7-sockets \
+    php7-sodium \
+    php7-sqlite3 \
+    php7-tokenizer \
+    php7-xml \
+    php7-xmlreader \
+    php7-xmlrpc \
+    php7-xsl \
+    php7-zip \
+    py3-cryptography \
+    py3-future \
+    py3-pip \
+    whois && \
+  echo "**** install certbot plugins ****" && \
+  if [ -z ${CERTBOT_VERSION+x} ]; then \
+    CERTBOT="certbot"; \
+  else \
+    CERTBOT="certbot==${CERTBOT_VERSION}"; \
+  fi && \
+  pip3 install -U \
+    pip && \
+  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    ${CERTBOT} \
+    certbot-dns-aliyun \
+    certbot-dns-cloudflare \
+    certbot-dns-cloudxns \
+    certbot-dns-cpanel \
+    certbot-dns-digitalocean \
+    certbot-dns-directadmin \
+    certbot-dns-dnsimple \
+    certbot-dns-dnsmadeeasy \
+    certbot-dns-domeneshop \
+    certbot-dns-google \
+    certbot-dns-hetzner \
+    certbot-dns-inwx \
+    certbot-dns-ionos \
+    certbot-dns-linode \
+    certbot-dns-luadns \
+    certbot-dns-netcup \
+    certbot-dns-njalla \
+    certbot-dns-nsone \
+    certbot-dns-ovh \
+    certbot-dns-rfc2136 \
+    certbot-dns-route53 \
+    certbot-dns-transip \
+    certbot-dns-vultr \
+    certbot-plugin-gandi \
+    cryptography \
+    requests && \
+  echo "**** remove unnecessary fail2ban filters ****" && \
+  rm \
+    /etc/fail2ban/jail.d/alpine-ssh.conf && \
+  echo "**** copy fail2ban default action and filter to /default ****" && \
+  mkdir -p /defaults/fail2ban && \
+  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
+  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
+  echo "**** copy proxy confs to /default ****" && \
+  mkdir -p /defaults/proxy-confs && \
+  curl -o \
+    /tmp/proxy.tar.gz -L \
+    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
+  tar xf \
+    /tmp/proxy.tar.gz -C \
+    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
+  echo "**** configure nginx ****" && \
+  rm -f /etc/nginx/http.d/default.conf && \
+  echo "**** cleanup ****" && \
+  apk del --purge \
+    build-dependencies && \
+  for cleanfiles in *.pyc *.pyo; \
+    do \
+    find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
+    ; done && \
+  rm -rf \
+    /tmp/* \
+    /root/.cache \
+    /root/.cargo
 
 # add local files
 COPY root/ /

Dockerfile.armhf

@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm32v7-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.14
 
 # set version label
 ARG BUILD_DATE
@@ -12,139 +12,146 @@ ENV DHLEVEL=2048 ONLY_SUBDOMAINS=false AWS_CONFIG_FILE=/config/dns-conf/route53.
 ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 RUN \
- echo "**** install build packages ****" && \
- apk add --no-cache --virtual=build-dependencies \
-	g++ \
-	gcc \
-	libffi-dev \
-	openssl-dev \
-	python3-dev && \
- echo "**** install runtime packages ****" && \
- apk add --no-cache --upgrade \
-	curl \
-	fail2ban \
-	gnupg \
-	memcached \
-	nginx \
-	nginx-mod-http-echo \
-	nginx-mod-http-fancyindex \
-	nginx-mod-http-geoip2 \
-	nginx-mod-http-headers-more \
-	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
-	nginx-mod-http-nchan \
-	nginx-mod-http-perl \
-	nginx-mod-http-redis2 \
-	nginx-mod-http-set-misc \
-	nginx-mod-http-upload-progress \
-	nginx-mod-http-xslt-filter \
-	nginx-mod-mail \
-	nginx-mod-rtmp \
-	nginx-mod-stream \
-	nginx-mod-stream-geoip2 \
-	nginx-vim \
-	php7-bcmath \
-	php7-bz2 \
-	php7-ctype \
-	php7-curl \
-	php7-dom \
-	php7-exif \
-	php7-ftp \
-	php7-gd \
-	php7-iconv \
-	php7-imap \
-	php7-intl \
-	php7-ldap \
-	php7-mcrypt \
-	php7-memcached \
-	php7-mysqli \
-	php7-mysqlnd \
-	php7-opcache \
-	php7-pdo_mysql \
-	php7-pdo_odbc \
-	php7-pdo_pgsql \
-	php7-pdo_sqlite \
-	php7-pear \
-	php7-pecl-apcu \
-	php7-pecl-redis \
-	php7-pgsql \
-	php7-phar \
-	php7-posix \
-	php7-soap \
-	php7-sockets \
-	php7-sodium \
-	php7-sqlite3 \
-	php7-tokenizer \
-	php7-xml \
-	php7-xmlreader \
-	php7-xmlrpc \
-	php7-xsl \
-	php7-zip \
-	py3-cryptography \
-	py3-future \
-	py3-pip \
-	whois && \
- echo "**** install certbot plugins ****" && \
- if [ -z ${CERTBOT_VERSION+x} ]; then \
-        CERTBOT="certbot"; \
- else \
-        CERTBOT="certbot==${CERTBOT_VERSION}"; \
- fi && \
- pip3 install -U \
-	pip && \
- pip3 install -U \
-	${CERTBOT} \
-	certbot-dns-aliyun \
-	certbot-dns-cloudflare \
-	certbot-dns-cloudxns \
-	certbot-dns-cpanel \
-	certbot-dns-digitalocean \
-	certbot-dns-dnsimple \
-	certbot-dns-dnsmadeeasy \
-	certbot-dns-domeneshop \
-	certbot-dns-google \
-	certbot-dns-inwx \
-	certbot-dns-linode \
-	certbot-dns-luadns \
-	certbot-dns-nsone \
-	certbot-dns-ovh \
-	certbot-dns-rfc2136 \
-	certbot-dns-route53 \
-	certbot-dns-transip \
-	certbot-plugin-gandi \
-	cryptography \
-	requests && \
- echo "**** remove unnecessary fail2ban filters ****" && \
- rm \
-	/etc/fail2ban/jail.d/alpine-ssh.conf && \
- echo "**** copy fail2ban default action and filter to /default ****" && \
- mkdir -p /defaults/fail2ban && \
- mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
- mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
- echo "**** copy proxy confs to /default ****" && \
- mkdir -p /defaults/proxy-confs && \
- curl -o \
-	/tmp/proxy.tar.gz -L \
-	"https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
- tar xf \
-	/tmp/proxy.tar.gz -C \
-	/defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
- echo "**** configure nginx ****" && \
- rm -f /etc/nginx/conf.d/default.conf && \
- curl -o \
-	/defaults/dhparams.pem -L \
-	"https://lsio.ams3.digitaloceanspaces.com/dhparams.pem" && \
- echo "**** cleanup ****" && \
- apk del --purge \
-	build-dependencies && \
- for cleanfiles in *.pyc *.pyo; \
-	do \
-	find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
-	; done && \
- rm -rf \
-	/tmp/* \
-	/root/.cache
+  echo "**** install build packages ****" && \
+  apk add --no-cache --virtual=build-dependencies \
+    cargo \
+    g++ \
+    gcc \
+    libffi-dev \
+    openssl-dev \
+    python3-dev && \
+  echo "**** install runtime packages ****" && \
+  apk add --no-cache --upgrade \
+    curl \
+    fail2ban \
+    gnupg \
+    memcached \
+    nginx \
+    nginx-mod-http-brotli \
+    nginx-mod-http-dav-ext \
+    nginx-mod-http-echo \
+    nginx-mod-http-fancyindex \
+    nginx-mod-http-geoip2 \
+    nginx-mod-http-headers-more \
+    nginx-mod-http-image-filter \
+    nginx-mod-http-nchan \
+    nginx-mod-http-perl \
+    nginx-mod-http-redis2 \
+    nginx-mod-http-set-misc \
+    nginx-mod-http-upload-progress \
+    nginx-mod-http-xslt-filter \
+    nginx-mod-mail \
+    nginx-mod-rtmp \
+    nginx-mod-stream \
+    nginx-mod-stream-geoip2 \
+    nginx-vim \
+    php7-bcmath \
+    php7-bz2 \
+    php7-ctype \
+    php7-curl \
+    php7-dom \
+    php7-exif \
+    php7-ftp \
+    php7-gd \
+    php7-gmp \
+    php7-iconv \
+    php7-imap \
+    php7-intl \
+    php7-ldap \
+    php7-mcrypt \
+    php7-memcached \
+    php7-mysqli \
+    php7-mysqlnd \
+    php7-opcache \
+    php7-pdo_mysql \
+    php7-pdo_odbc \
+    php7-pdo_pgsql \
+    php7-pdo_sqlite \
+    php7-pear \
+    php7-pecl-apcu \
+    php7-pecl-mailparse \
+    php7-pecl-redis \
+    php7-pgsql \
+    php7-phar \
+    php7-posix \
+    php7-soap \
+    php7-sockets \
+    php7-sodium \
+    php7-sqlite3 \
+    php7-tokenizer \
+    php7-xml \
+    php7-xmlreader \
+    php7-xmlrpc \
+    php7-xsl \
+    php7-zip \
+    py3-cryptography \
+    py3-future \
+    py3-pip \
+    whois && \
+  echo "**** install certbot plugins ****" && \
+  if [ -z ${CERTBOT_VERSION+x} ]; then \
+    CERTBOT="certbot"; \
+  else \
+    CERTBOT="certbot==${CERTBOT_VERSION}"; \
+  fi && \
+  pip3 install -U \
+    pip && \
+  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    ${CERTBOT} \
+    certbot-dns-aliyun \
+    certbot-dns-cloudflare \
+    certbot-dns-cloudxns \
+    certbot-dns-cpanel \
+    certbot-dns-digitalocean \
+    certbot-dns-directadmin \
+    certbot-dns-dnsimple \
+    certbot-dns-dnsmadeeasy \
+    certbot-dns-domeneshop \
+    certbot-dns-google \
+    certbot-dns-hetzner \
+    certbot-dns-inwx \
+    certbot-dns-ionos \
+    certbot-dns-linode \
+    certbot-dns-luadns \
+    certbot-dns-netcup \
+    certbot-dns-njalla \
+    certbot-dns-nsone \
+    certbot-dns-ovh \
+    certbot-dns-rfc2136 \
+    certbot-dns-route53 \
+    certbot-dns-transip \
+    certbot-dns-vultr \
+    certbot-plugin-gandi \
+    cryptography \
+    requests && \
+  echo "**** remove unnecessary fail2ban filters ****" && \
+  rm \
+    /etc/fail2ban/jail.d/alpine-ssh.conf && \
+  echo "**** copy fail2ban default action and filter to /default ****" && \
+  mkdir -p /defaults/fail2ban && \
+  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
+  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
+  echo "**** copy proxy confs to /default ****" && \
+  mkdir -p /defaults/proxy-confs && \
+  curl -o \
+    /tmp/proxy.tar.gz -L \
+    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
+  tar xf \
+    /tmp/proxy.tar.gz -C \
+    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
+  echo "**** configure nginx ****" && \
+  rm -f /etc/nginx/http.d/default.conf && \
+  echo "**** cleanup ****" && \
+  apk del --purge \
+    build-dependencies && \
+  for cleanfiles in *.pyc *.pyo; \
+    do \
+    find /usr/lib/python3.*  -iname "${cleanfiles}" -exec rm -f '{}' + \
+    ; done && \
+  rm -rf \
+    /tmp/* \
+    /root/.cache \
+    /root/.cargo
 
 # add local files
 COPY root/ /

Jenkinsfile

@@ -42,7 +42,7 @@ pipeline {
         script{
           env.EXIT_STATUS = ''
           env.LS_RELEASE = sh(
-            script: '''docker run --rm alexeiled/skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
+            script: '''docker run --rm ghcr.io/linuxserver/alexeiled-skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
             returnStdout: true).trim()
           env.LS_RELEASE_NOTES = sh(
             script: '''cat readme-vars.yml | awk -F \\" '/date: "[0-9][0-9].[0-9][0-9].[0-9][0-9]:/ {print $4;exit;}' | sed -E ':a;N;$!ba;s/\\r{0,1}\\n/\\\\n/g' ''',
@@ -56,7 +56,7 @@ pipeline {
           env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/commit/' + env.GIT_COMMIT
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
           env.PULL_REQUEST = env.CHANGE_ID
-          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt'
+          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE .editorconfig ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.md ./.github/ISSUE_TEMPLATE/issue.feature.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/external_trigger_scheduler.yml ./.github/workflows/greetings.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/stale.yml ./.github/workflows/external_trigger.yml ./.github/workflows/package_trigger.yml ./root/donate.txt'
         }
         script{
           env.LS_RELEASE_NUMBER = sh(
@@ -128,13 +128,14 @@ pipeline {
       steps {
         script{
           env.IMAGE = env.DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/' + env.CONTAINER_NAME
           env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/' + env.CONTAINER_NAME
           if (env.MULTIARCH == 'true') {
             env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           } else {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
         }
@@ -149,13 +150,14 @@ pipeline {
       steps {
         script{
           env.IMAGE = env.DEV_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lsiodev-' + env.CONTAINER_NAME
           env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
           if (env.MULTIARCH == 'true') {
             env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
           } else {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
           }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
           env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DEV_DOCKERHUB_IMAGE + '/tags/'
@@ -170,13 +172,14 @@ pipeline {
       steps {
         script{
           env.IMAGE = env.PR_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lspipepr-' + env.CONTAINER_NAME
           env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
           if (env.MULTIARCH == 'true') {
             env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
           } else {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
           }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
           env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
           env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/pull/' + env.PULL_REQUEST
@@ -191,24 +194,24 @@ pipeline {
       }
       steps {
         withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key', variable: 'S3_SECRET')
         ]) {
           script{
-            env.SHELLCHECK_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
+            env.SHELLCHECK_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
           }
           sh '''curl -sL https://raw.githubusercontent.com/linuxserver/docker-shellcheck/master/checkrun.sh | /bin/bash'''
           sh '''#! /bin/bash
                 set -e
-                docker pull lsiodev/spaces-file-upload:latest
+                docker pull ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest
                 docker run --rm \
                 -e DESTINATION=\"${IMAGE}/${META_TAG}/shellcheck-result.xml\" \
                 -e FILE_NAME="shellcheck-result.xml" \
                 -e MIMETYPE="text/xml" \
                 -v ${WORKSPACE}:/mnt \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
-                -t lsiodev/spaces-file-upload:latest \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
+                -t ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest \
                 python /upload.py'''
         }
       }
@@ -226,20 +229,67 @@ pipeline {
         sh '''#! /bin/bash
               set -e
               TEMPDIR=$(mktemp -d)
-              docker pull linuxserver/jenkins-builder:latest
-              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
+              docker pull ghcr.io/linuxserver/jenkins-builder:latest
+              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest 
+              # Stage 1 - Jenkinsfile update
+              if [[ "$(md5sum Jenkinsfile | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile | awk '{ print $1 }')" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile ${TEMPDIR}/repo/${LS_REPO}/
+                git add Jenkinsfile
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Updating Jenkinsfile"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "Jenkinsfile is up to date."
+              fi
+              # Stage 2 - Delete old templates
+              OLD_TEMPLATES=".github/ISSUE_TEMPLATE.md"
+              for i in ${OLD_TEMPLATES}; do
+                if [[ -f "${i}" ]]; then
+                  TEMPLATES_TO_DELETE="${i} ${TEMPLATES_TO_DELETE}"
+                fi
+              done
+              if [[ -n "${TEMPLATES_TO_DELETE}" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                for i in ${TEMPLATES_TO_DELETE}; do
+                  git rm "${i}"
+                done
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Deleting old templates"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "No templates to delete"
+              fi
+              # Stage 3 - Update templates
               CURRENTHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
               cd ${TEMPDIR}/docker-${CONTAINER_NAME}
               NEWHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
-              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]]; then
+              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]] || ! grep -q '.jenkins-external' "${WORKSPACE}/.gitignore" 2>/dev/null; then
                 mkdir -p ${TEMPDIR}/repo
                 git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
                 cd ${TEMPDIR}/repo/${LS_REPO}
                 git checkout -f master
                 cd ${TEMPDIR}/docker-${CONTAINER_NAME}
                 mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/workflows
-                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/
+                mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/ISSUE_TEMPLATE
+                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/ || :
                 cd ${TEMPDIR}/repo/${LS_REPO}/
+                if ! grep -q '.jenkins-external' .gitignore 2>/dev/null; then
+                  echo ".jenkins-external" >> .gitignore
+                  git add .gitignore
+                fi
                 git add ${TEMPLATED_FILES}
                 git commit -m 'Bot Updating Templated Files'
                 git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
@@ -249,13 +299,32 @@ pipeline {
               fi
               mkdir -p ${TEMPDIR}/gitbook
               git clone https://github.com/linuxserver/docker-documentation.git ${TEMPDIR}/gitbook/docker-documentation
-              if [[ "${BRANCH_NAME}" == "master" ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
-                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
                 cd ${TEMPDIR}/gitbook/docker-documentation/
                 git add images/docker-${CONTAINER_NAME}.md
                 git commit -m 'Bot Updating Documentation'
                 git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/docker-documentation.git --all
               fi
+              mkdir -p ${TEMPDIR}/unraid
+              git clone https://github.com/linuxserver/docker-templates.git ${TEMPDIR}/unraid/docker-templates
+              git clone https://github.com/linuxserver/templates.git ${TEMPDIR}/unraid/templates
+              if [[ -f ${TEMPDIR}/unraid/docker-templates/linuxserver.io/img/${CONTAINER_NAME}-logo.png ]]; then
+                sed -i "s|master/linuxserver.io/img/linuxserver-ls-logo.png|master/linuxserver.io/img/${CONTAINER_NAME}-logo.png|" ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml
+              fi
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml) || ("$(md5sum ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml | awk '{ print $1 }')") ]]; then
+                cd ${TEMPDIR}/unraid/templates/
+                if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
+                  echo "Image is on the ignore list, removing Unraid template"
+                  git rm unraid/${CONTAINER_NAME}.xml || :
+                  git commit -m 'Bot Removing Deprecated Unraid Template' || :
+                else
+                  cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
+                  git add unraid/${CONTAINER_NAME}.xml
+                  git commit -m 'Bot Updating Unraid Template'
+                fi
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/templates.git --all
+              fi
               rm -Rf ${TEMPDIR}'''
         script{
           env.FILES_UPDATED = sh(
@@ -306,25 +375,58 @@ pipeline {
     // Build Docker container for push to LS Repo
     stage('Build-Single') {
       when {
-        environment name: 'MULTIARCH', value: 'false'
+        expression {
+          env.MULTIARCH == 'false' || params.PACKAGE_CHECK == 'true' 
+        }
         environment name: 'EXIT_STATUS', value: ''
       }
       steps {
-        sh "docker build --no-cache --pull -t ${IMAGE}:${META_TAG} \
-        --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+        echo "Running on node: ${NODE_NAME}"
+        sh "docker build \
+          --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+          --label \"org.opencontainers.image.authors=linuxserver.io\" \
+          --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+          --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+          --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+          --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+          --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+          --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+          --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+          --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+          --label \"org.opencontainers.image.title=Swag\" \
+          --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+          --no-cache --pull -t ${IMAGE}:${META_TAG} \
+          --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
       }
     }
     // Build MultiArch Docker containers for push to LS Repo
     stage('Build-Multi') {
       when {
-        environment name: 'MULTIARCH', value: 'true'
+        allOf {
+          environment name: 'MULTIARCH', value: 'true'
+          expression { params.PACKAGE_CHECK == 'false' }
+        }
         environment name: 'EXIT_STATUS', value: ''
       }
       parallel {
         stage('Build X86') {
           steps {
-            sh "docker build --no-cache --pull -t ${IMAGE}:amd64-${META_TAG} \
-            --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            echo "Running on node: ${NODE_NAME}"
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -t ${IMAGE}:amd64-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
           }
         }
         stage('Build ARMHF') {
@@ -332,28 +434,33 @@ pipeline {
             label 'ARMHF'
           }
           steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm32v7-${META_TAG} lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm32v7-${META_TAG} \
-                    lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm32v7-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
             }
+            sh '''docker rmi \
+                  ${IMAGE}:arm32v7-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
           }
         }
         stage('Build ARM64') {
@@ -361,28 +468,33 @@ pipeline {
             label 'ARM64'
           }
           steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm64v8-${META_TAG} lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm64v8-${META_TAG} \
-                    lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm64v8-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
             }
+            sh '''docker rmi \
+                  ${IMAGE}:arm64v8-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
           }
         }
       }
@@ -398,7 +510,7 @@ pipeline {
         sh '''#! /bin/bash
               set -e
               TEMPDIR=$(mktemp -d)
-              if [ "${MULTIARCH}" == "true" ]; then
+              if [ "${MULTIARCH}" == "true" ] && [ "${PACKAGE_CHECK}" == "false" ]; then
                 LOCAL_CONTAINER=${IMAGE}:amd64-${META_TAG}
               else
                 LOCAL_CONTAINER=${IMAGE}:${META_TAG}
@@ -413,6 +525,15 @@ pipeline {
                   apt list -qq --installed | sed "s#/.*now ##g" | cut -d" " -f1 > /tmp/package_versions.txt && \
                   sort -o /tmp/package_versions.txt  /tmp/package_versions.txt && \
                   chmod 777 /tmp/package_versions.txt'
+              elif [ "${DIST_IMAGE}" == "fedora" ]; then
+                docker run --rm --entrypoint '/bin/sh' -v ${TEMPDIR}:/tmp ${LOCAL_CONTAINER} -c '\
+                  rpm -qa > /tmp/package_versions.txt && \
+                  sort -o /tmp/package_versions.txt  /tmp/package_versions.txt && \
+                  chmod 777 /tmp/package_versions.txt'
+              elif [ "${DIST_IMAGE}" == "arch" ]; then
+                docker run --rm --entrypoint '/bin/sh' -v ${TEMPDIR}:/tmp ${LOCAL_CONTAINER} -c '\
+                  pacman -Q > /tmp/package_versions.txt && \
+                  chmod 777 /tmp/package_versions.txt'
               fi
               NEW_PACKAGE_TAG=$(md5sum ${TEMPDIR}/package_versions.txt | cut -c1-8 )
               echo "Package tag sha from current packages in buit container is ${NEW_PACKAGE_TAG} comparing to old ${PACKAGE_TAG} from github"
@@ -448,6 +569,13 @@ pipeline {
         environment name: 'EXIT_STATUS', value: ''
       }
       steps {
+        sh '''#! /bin/bash
+              echo "Packages were updated. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ] && [ "${PACKAGE_CHECK}" == "false" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
         script{
           env.EXIT_STATUS = 'ABORTED'
         }
@@ -465,6 +593,13 @@ pipeline {
         }
       }
       steps {
+        sh '''#! /bin/bash
+              echo "There are no package updates. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ] && [ "${PACKAGE_CHECK}" == "false" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
         script{
           env.EXIT_STATUS = 'ABORTED'
         }
@@ -481,20 +616,20 @@ pipeline {
       }
       steps {
         withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key	', variable: 'S3_SECRET')
         ]) {
           script{
-            env.CI_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
+            env.CI_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
           }
           sh '''#! /bin/bash
                 set -e
-                docker pull lsiodev/ci:latest
+                docker pull ghcr.io/linuxserver/ci:latest
                 if [ "${MULTIARCH}" == "true" ]; then
-                  docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                  docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                 fi
                 docker run --rm \
                 --shm-size=1gb \
@@ -506,15 +641,15 @@ pipeline {
                 -e PORT=\"${CI_PORT}\" \
                 -e SSL=\"${CI_SSL}\" \
                 -e BASE=\"${DIST_IMAGE}\" \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
                 -e DOCKER_ENV=\"${CI_DOCKERENV}\" \
                 -e WEB_SCREENSHOT=\"${CI_WEB}\" \
                 -e WEB_AUTH=\"${CI_AUTH}\" \
                 -e WEB_PATH=\"${CI_WEBPATH}\" \
                 -e DO_REGION="ams3" \
                 -e DO_BUCKET="lsio-ci" \
-                -t lsiodev/ci:latest \
+                -t ghcr.io/linuxserver/ci:latest \
                 python /ci/ci.py'''
         }
       }
@@ -541,7 +676,7 @@ pipeline {
             sh '''#! /bin/bash
                   set -e
                   echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                   echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                   for PUSHIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                     docker tag ${IMAGE}:${META_TAG} ${PUSHIMAGE}:${META_TAG}
@@ -554,7 +689,7 @@ pipeline {
                '''
           }
           sh '''#! /bin/bash
-                for DELETEIMAGE in "${GITHUBIMAGE}" "{GITLABIMAGE}" "${IMAGE}"; do
+                for DELETEIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                   docker rmi \
                   ${DELETEIMAGE}:${META_TAG} \
                   ${DELETEIMAGE}:${EXT_RELEASE_TAG} \
@@ -583,15 +718,15 @@ pipeline {
             sh '''#! /bin/bash
                   set -e
                   echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                   echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                   if [ "${CI}" == "false" ]; then
-                    docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                    docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                   fi
-                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}"; do
+                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}"; do
                     docker tag ${IMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG}
                     docker tag ${IMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG}
                     docker tag ${IMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
@@ -618,6 +753,7 @@ pipeline {
                     docker manifest create ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                     docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} --os linux --arch arm
                     docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} --os linux --arch arm64 --variant v8
+                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} || :
                     docker manifest create ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                     docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} --os linux --arch arm
                     docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} --os linux --arch arm64 --variant v8
@@ -625,28 +761,6 @@ pipeline {
                     docker manifest push --purge ${MANIFESTIMAGE}:${META_TAG} 
                     docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} 
                   done
-                  docker tag ${IMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker tag ${IMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker tag ${IMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:latest
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${META_TAG}
-                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-latest
-                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-latest
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker push ${GITHUBIMAGE}:latest
-                  docker push ${GITHUBIMAGE}:${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-latest
-                  docker push ${GITHUBIMAGE}:arm64v8-latest
-                  docker push ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                '''
           }
           sh '''#! /bin/bash
@@ -654,14 +768,17 @@ pipeline {
                   docker rmi \
                   ${DELETEIMAGE}:amd64-${META_TAG} \
                   ${DELETEIMAGE}:amd64-latest \
+                  ${DELETEIMAGE}:amd64-${EXT_RELEASE_TAG} \
                   ${DELETEIMAGE}:arm32v7-${META_TAG} \
                   ${DELETEIMAGE}:arm32v7-latest \
+                  ${DELETEIMAGE}:arm32v7-${EXT_RELEASE_TAG} \
                   ${DELETEIMAGE}:arm64v8-${META_TAG} \
-                  ${DELETEIMAGE}:arm64v8-latest || :
+                  ${DELETEIMAGE}:arm64v8-latest \
+                  ${DELETEIMAGE}:arm64v8-${EXT_RELEASE_TAG} || :
                 done
                 docker rmi \
-                lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
-                lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
+                ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
+                ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
              '''
         }
       }
@@ -677,9 +794,9 @@ pipeline {
         environment name: 'EXIT_STATUS', value: ''
       }
       steps {
-        echo "Pushing New tag for current commit ${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}"
+        echo "Pushing New tag for current commit ${META_TAG}"
         sh '''curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/git/tags \
-        -d '{"tag":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+        -d '{"tag":"'${META_TAG}'",\
              "object": "'${COMMIT_SHA}'",\
              "message": "Tagging Release '${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}' to master",\
              "type": "commit",\
@@ -687,10 +804,10 @@ pipeline {
         echo "Pushing New release for Tag"
         sh '''#! /bin/bash
               echo "Updating PIP version of ${EXT_PIP} to ${EXT_RELEASE_CLEAN}" > releasebody.json
-              echo '{"tag_name":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+              echo '{"tag_name":"'${META_TAG}'",\
                      "target_commitish": "master",\
-                     "name": "'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
-                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n**PIP Changes:**\\n\\n' > start
+                     "name": "'${META_TAG}'",\
+                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**PIP Changes:**\\n\\n' > start
               printf '","draft": false,"prerelease": false}' >> releasebody.json
               paste -d'\\0' start releasebody.json > releasebody.json.done
               curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases -d @releasebody.json.done'''
@@ -714,9 +831,9 @@ pipeline {
           sh '''#! /bin/bash
                 set -e
                 TEMPDIR=$(mktemp -d)
-                docker pull linuxserver/jenkins-builder:latest
-                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
-                docker pull lsiodev/readme-sync
+                docker pull ghcr.io/linuxserver/jenkins-builder:latest
+                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest
+                docker pull ghcr.io/linuxserver/readme-sync
                 docker run --rm=true \
                   -e DOCKERHUB_USERNAME=$DOCKERUSER \
                   -e DOCKERHUB_PASSWORD=$DOCKERPASS \
@@ -724,7 +841,7 @@ pipeline {
                   -e DOCKER_REPOSITORY=${IMAGE} \
                   -e GIT_BRANCH=master \
                   -v ${TEMPDIR}/docker-${CONTAINER_NAME}:/mnt \
-                  lsiodev/readme-sync bash -c 'node sync' 
+                  ghcr.io/linuxserver/readme-sync bash -c 'node sync'
                 rm -Rf ${TEMPDIR} '''
         }
       }

README.md

@@ -1,5 +1,5 @@
 <!-- DO NOT EDIT THIS FILE MANUALLY  -->
-<!-- Please read the CONTRIBUTING.md -->
+<!-- Please read the https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md -->
 
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)
 
@@ -12,13 +12,14 @@
 
 The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring:
 
- * regular and timely application updates
- * easy user mappings (PGID, PUID)
- * custom base image with s6 overlay
- * weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
- * regular security updates
+* regular and timely application updates
+* easy user mappings (PGID, PUID)
+* custom base image with s6 overlay
+* weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
+* regular security updates
 
 Find us at:
+
 * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
 * [Discord](https://discord.gg/YWrKVTn) - realtime support / chat with the community and the team.
 * [Discourse](https://discourse.linuxserver.io) - post on our community forum.
@@ -31,14 +32,13 @@ Find us at:
 [![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag)
 [![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag/releases)
 [![GitHub Package Repository](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub%20Package&logo=github)](https://github.com/linuxserver/docker-swag/packages)
-[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/Linuxserver.io/docker-swag/container_registry)
-[![MicroBadger Layers](https://img.shields.io/microbadger/layers/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge)](https://microbadger.com/images/linuxserver/swag "Get your own version badge on microbadger.com")
+[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/linuxserver.io/docker-swag/container_registry)
 [![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=pulls&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Docker Stars](https://img.shields.io/docker/stars/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=stars&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-swag%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/)
-[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Flsio-ci.ams3.digitaloceanspaces.com%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/swag/latest/index.html)
+[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Fci-tests.linuxserver.io%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://ci-tests.linuxserver.io/linuxserver/swag/latest/index.html)
 
-SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.
+SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.
 
 [![swag](https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif)](https://linuxserver.io)
 
@@ -46,7 +46,7 @@ SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relatio
 
 Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
 
-Simply pulling `linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
+Simply pulling `ghcr.io/linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
 
 The architectures supported by this image are:
 
@@ -56,21 +56,100 @@ The architectures supported by this image are:
 | arm64 | arm64v8-latest |
 | armhf | arm32v7-latest |
 
+## Application Setup
+
+> ### Migrating from the old `linuxserver/letsencrypt` image
+> * If using docker cli:
+>   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
+>   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
+> * If using docker compose:
+>   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
+>   * Issue `docker-compose up -d --remove-orphans`
+>   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
+
+> Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
+
+### Validation and initial setup
+
+* Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
+* For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
+* For `dns` validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`
+  * Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
+  * Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
+* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
+* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
+* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
+* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
+* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
+
+### Security and password protection
+
+* The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.
+* Per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919), the container is shipping [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) as the `dhparams.pem`.
+* If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file `docker exec -it swag htpasswd -c /config/nginx/.htpasswd <username>`
+* You can add multiple user:pass to `.htpasswd`. For the first user, use the above command, for others, use the above command without the `-c` flag, as it will force deletion of the existing `.htpasswd` and creation of a new one
+* You can also use ldap auth for security and access control. A sample, user configurable ldap.conf is provided, and it requires the separate image [linuxserver/ldap-auth](https://hub.docker.com/r/linuxserver/ldap-auth/) to communicate with an ldap server.
+
+### Site config and reverse proxy
+
+* The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
+* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
+* If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
+`add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
+This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
+* If you wish to redirect http to https, you must expose port 80
+
+### Using certs in other containers
+
+* This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
+  * To use these certs in other containers, do either of the following:
+  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
+  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
+  * These certs include:
+  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
+  2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
+  3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
+
+### Using fail2ban
+
+* This container includes fail2ban set up with 4 jails by default:
+  1. nginx-http-auth
+  2. nginx-badbots
+  3. nginx-botsearch
+  4. nginx-deny
+* To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
+* To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
+* You can check which jails are active via `docker exec -it swag fail2ban-client status`
+* You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
+* You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
+* A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+
+### Updating configs
+
+* This container creates a number of configs for nginx, proxy samples, etc.
+* Config updates are noted in the changelog but not automatically applied to your files.
+* If you have modified a file with noted changes in the changelog:
+  1. Keep your existing configs as is (not broken, don't fix)
+  2. Review our repository commits and apply the new changes yourself
+  3. Delete the modified config file with listed updates, restart the container, reapply your changes
+* If you have NOT modified a file with noted changes in the changelog:
+  1. Delete the config file with listed updates, restart the container
+* Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
+* Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
+* You can check the new sample and adjust your active config as needed.
 
 ## Usage
 
 Here are some example snippets to help you get started creating a container.
 
-### docker-compose ([recommended](https://docs.linuxserver.io/general/docker-compose))
-
-Compatible with docker-compose v2 schemas.
+### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 
 ```yaml
 ---
 version: "2.1"
 services:
   swag:
-    image: linuxserver/swag
+    image: ghcr.io/linuxserver/swag
     container_name: swag
     cap_add:
       - NET_ADMIN
@@ -81,6 +160,7 @@ services:
       - URL=yourdomain.url
       - SUBDOMAINS=www,
       - VALIDATION=http
+      - CERTPROVIDER= #optional
       - DNSPLUGIN=cloudflare #optional
       - PROPAGATION= #optional
       - DUCKDNSTOKEN= #optional
@@ -97,9 +177,9 @@ services:
     restart: unless-stopped
 ```
 
-### docker cli
+### docker cli ([click here for more info](https://docs.docker.com/engine/reference/commandline/cli/))
 
-```
+```bash
 docker run -d \
   --name=swag \
   --cap-add=NET_ADMIN \
@@ -109,6 +189,7 @@ docker run -d \
   -e URL=yourdomain.url \
   -e SUBDOMAINS=www, \
   -e VALIDATION=http \
+  -e CERTPROVIDER= `#optional` \
   -e DNSPLUGIN=cloudflare `#optional` \
   -e PROPAGATION= `#optional` \
   -e DUCKDNSTOKEN= `#optional` \
@@ -121,10 +202,9 @@ docker run -d \
   -p 80:80 `#optional` \
   -v /path/to/appdata/config:/config \
   --restart unless-stopped \
-  linuxserver/swag
+  ghcr.io/linuxserver/swag
 ```
 
-
 ## Parameters
 
 Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
@@ -139,10 +219,11 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
 | `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
 | `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
-| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
+| `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
+| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
 | `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
 | `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
-| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications. |
+| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
 | `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
 | `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
@@ -155,7 +236,7 @@ You can set any environment variable from a file by using a special prepend `FIL
 
 As an example:
 
-```
+```bash
 -e FILE__PASSWORD=/run/secrets/mysecretpassword
 ```
 
@@ -174,89 +255,17 @@ Ensure any volume directories on the host are owned by the same user you specify
 
 In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
 
-```
+```bash
   $ id username
     uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
 ```
 
-
-&nbsp;
-## Application Setup
-
-> ### Migrating from the old `linuxserver/letsencrypt` image
-> * If using docker cli:
->   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
->   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
-> * If using docker compose:
->   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
->   * Issue `docker-compose up -d --remove-orphans`
->   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
-
-> Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
-### Validation and initial setup
-* Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
-* For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
-* For `dns` validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`
-  * Cloudflare provides free accounts for managing dns and is very easy to use with this image. Make sure that it is set up for "dns only" instead of "dns + proxy"
-  * Google dns plugin is meant to be used with "Google Cloud DNS", a paid enterprise product, and not for "Google Domains DNS"
-* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
-* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
-* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
-* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
-* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
-### Security and password protection
-* The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.
-* The container provides a pre-generated 4096-bit dhparams.pem (rotated weekly via [Jenkins job](https://ci.linuxserver.io/blue/organizations/jenkins/Xtras-Builders-Etc%2Fdhparams-uploader/activity)) for new instances, however you may generate your own by running `docker exec swag openssl dhparam -out /config/nginx/dhparams.pem 4096` WARNING: This takes a very long time
-* If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file `docker exec -it swag htpasswd -c /config/nginx/.htpasswd <username>`
-* You can add multiple user:pass to `.htpasswd`. For the first user, use the above command, for others, use the above command without the `-c` flag, as it will force deletion of the existing `.htpasswd` and creation of a new one
-* You can also use ldap auth for security and access control. A sample, user configurable ldap.conf is provided, and it requires the separate image [linuxserver/ldap-auth](https://hub.docker.com/r/linuxserver/ldap-auth/) to communicate with an ldap server.
-### Site config and reverse proxy
-* The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
-* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
-* If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
-`add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
-This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
-* If you wish to redirect http to https, you must expose port 80
-### Using certs in other containers
-* This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
-  * To use these certs in other containers, do either of the following:
-  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
-  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
-  * These certs include:
-  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
-  2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
-  3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
-### Using fail2ban
-* This container includes fail2ban set up with 3 jails by default:
-  1. nginx-http-auth
-  2. nginx-badbots
-  3. nginx-botsearch
-* To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
-* To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
-* You can check which jails are active via `docker exec -it swag fail2ban-client status`
-* You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
-* You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
-* A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
-### Updating configs
-* This container creates a number of configs for nginx, proxy samples, etc.
-* Config updates are noted in the changelog but not automatically applied to your files.
-* If you have modified a file with noted changes in the changelog:
-  1. Keep your existing configs as is (not broken, don't fix)
-  2. Review our repository commits and apply the new changes yourself
-  3. Delete the modified config file with listed updates, restart the container, reapply your changes
-* If you have NOT modified a file with noted changes in the changelog:
-  1. Delete the config file with listed updates, restart the container
-* Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
-* Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
-* You can check the new sample and adjust your active config as needed.
-
-
 ## Docker Mods
+
 [![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=swag&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.") [![Docker Universal Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=universal&query=%24.mods%5B%27universal%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=universal "view available universal mods.")
 
 We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.
 
-
 ## Support Info
 
 * Shell access whilst the container is running: `docker exec -it swag /bin/bash`
@@ -264,7 +273,7 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
 * container version number
   * `docker inspect -f '{{ index .Config.Labels "build_version" }}' swag`
 * image version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' linuxserver/swag`
+  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' ghcr.io/linuxserver/swag`
 
 ## Updating Info
 
@@ -273,6 +282,7 @@ Most of our images are static, versioned, and require an image update and contai
 Below are the instructions for updating containers:
 
 ### Via Docker Compose
+
 * Update all images: `docker-compose pull`
   * or update a single image: `docker-compose pull swag`
 * Let compose update all containers as necessary: `docker-compose up -d`
@@ -280,41 +290,48 @@ Below are the instructions for updating containers:
 * You can also remove the old dangling images: `docker image prune`
 
 ### Via Docker Run
-* Update the image: `docker pull linuxserver/swag`
+
+* Update the image: `docker pull ghcr.io/linuxserver/swag`
 * Stop the running container: `docker stop swag`
 * Delete the container: `docker rm swag`
 * Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
 * You can also remove the old dangling images: `docker image prune`
 
 ### Via Watchtower auto-updater (only use if you don't remember the original parameters)
+
 * Pull the latest image at its tag and replace it with the same env variables in one run:
-  ```
+
+  ```bash
   docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
   containrrr/watchtower \
   --run-once swag
   ```
+
 * You can also remove the old dangling images: `docker image prune`
 
 **Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using [Docker Compose](https://docs.linuxserver.io/general/docker-compose).
 
 ### Image Update Notifications - Diun (Docker Image Update Notifier)
+
 * We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
 
 ## Building locally
 
 If you want to make local modifications to these images for development purposes or just to customize the logic:
-```
+
+```bash
 git clone https://github.com/linuxserver/docker-swag.git
 cd docker-swag
 docker build \
   --no-cache \
   --pull \
-  -t linuxserver/swag:latest .
+  -t ghcr.io/linuxserver/swag:latest .
 ```
 
 The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
-```
+
+```bash
 docker run --rm --privileged multiarch/qemu-user-static:register --reset
 ```
 
@@ -322,6 +339,28 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **01.08.21:** - Add support for ionos dns validation.
+* **15.07.21:** - Fix libmaxminddb issue due to upstream change.
+* **07.07.21:** - Rebase to alpine 3.14.
+* **24.06.21:** - Update default nginx conf folder.
+* **28.05.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf - Use `resolver.conf` and patch for `CVE-2021-32637`.
+* **20.05.21:** - Modify resolver.conf generation to detect and ignore ipv6.
+* **14.05.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use linuxserver.io wheel index for pip packages. Switch to using [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) for `dhparams.pem` per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919). Added `worker_processes.conf`, which sets the number of nginx workers, and `resolver.conf`, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later.
+* **21.04.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method.
+* **12.04.21:** - Add php7-gmp and php7-pecl-mailparse.
+* **12.04.21:** - Add support for vultr dns validation.
+* **14.03.21:** - Add support for directadmin dns validation.
+* **12.02.21:** - Clean up rust/cargo cache, which ballooned the image size in the last couple of builds.
+* **10.02.21:** - Fix aliyun, domeneshop, inwx and transip dns confs for existing users.
+* **09.02.21:** - Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years).
+* **26.01.21:** - Add support for hetzner dns validation.
+* **20.01.21:** - Add check for ZeroSSL EAB retrieval.
+* **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
+* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting
+* **10.12.20:** - Add support for njalla dns validation
+* **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
+* **01.11.20:** - Add support for netcup dns validation
+* **29.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy.
 * **04.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering.
 * **20.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme.
 * **08.09.20:** - Add php7-xsl.

package_versions.txt

@@ -1,220 +1,227 @@
-alpine-baselayout-3.2.0-r7
-alpine-keys-2.2-r0
-apache2-utils-2.4.46-r0
-apk-tools-2.10.5-r1
+alpine-baselayout-3.2.0-r16
+alpine-keys-2.3-r1
+apache2-utils-2.4.48-r0
+apk-tools-2.12.7-r0
 apr-1.7.0-r0
-apr-util-1.6.1-r6
+apr-util-1.6.1-r7
 argon2-libs-20190702-r1
-bash-5.0.17-r0
-brotli-libs-1.0.7-r5
-busybox-1.31.1-r19
+bash-5.1.4-r0
+brotli-libs-1.0.9-r5
+busybox-1.33.1-r3
 c-client-2007f-r11
-ca-certificates-20191127-r4
-ca-certificates-bundle-20191127-r4
-coreutils-8.32-r0
-curl-7.69.1-r1
-db-5.3.28-r1
-expat-2.2.9-r1
-fail2ban-0.11.1-r3
-freetype-2.10.2-r0
-gdbm-1.13-r1
-git-2.26.2-r0
-git-perl-2.26.2-r0
-glib-2.64.6-r0
-gmp-6.2.0-r0
-gnupg-2.2.23-r0
-gnutls-3.6.15-r0
-icu-libs-67.1-r0
-ip6tables-1.8.4-r2
-iptables-1.8.4-r2
+ca-certificates-20191127-r5
+ca-certificates-bundle-20191127-r5
+coreutils-8.32-r2
+curl-7.78.0-r0
+expat-2.4.1-r0
+fail2ban-0.11.2-r0
+freetype-2.10.4-r1
+gdbm-1.19-r0
+git-2.32.0-r0
+git-perl-2.32.0-r0
+glib-2.68.3-r0
+gmp-6.2.1-r0
+gnupg-2.2.27-r0
+gnutls-3.7.1-r0
+icu-libs-67.1-r2
+ip6tables-1.8.7-r1
+iptables-1.8.7-r1
 libacl-2.2.53-r0
-libassuan-2.5.3-r0
-libattr-2.4.48-r0
-libblkid-2.35.2-r0
-libbsd-0.10.0-r0
+libassuan-2.5.5-r0
+libattr-2.5.1-r0
+libblkid-2.37-r0
+libbsd-0.11.3-r0
 libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
-libcap-2.27-r0
-libcrypto1.1-1.1.1g-r0
-libcurl-7.69.1-r1
-libedit-20191231.3.1-r0
-libevent-2.1.11-r1
+libcap-2.50-r0
+libcrypto1.1-1.1.1l-r0
+libcurl-7.78.0-r0
+libedit-20210216.3.1-r0
+libevent-2.1.12-r2
 libffi-3.3-r2
-libgcc-9.3.0-r2
-libgcrypt-1.8.5-r0
-libgd-2.3.0-r1
-libgpg-error-1.37-r0
+libgcc-10.3.1_git20210424-r2
+libgcrypt-1.9.4-r0
+libgd-2.3.2-r1
+libgpg-error-1.42-r0
 libice-1.0.10-r0
-libidn-1.35-r0
-libintl-0.20.2-r0
-libjpeg-turbo-2.0.5-r0
-libksba-1.4.0-r0
-libldap-2.4.50-r0
-libmagic-5.38-r0
-libmaxminddb-1.4.2-r1
-libmcrypt-2.5.8-r8
+libidn-1.37-r0
+libintl-0.21-r0
+libjpeg-turbo-2.1.0-r0
+libksba-1.5.1-r0
+libldap-2.4.58-r0
+libmagic-5.40-r1
+libmaxminddb-1.5.2-r0
+libmcrypt-2.5.8-r9
+libmd-1.0.3-r0
 libmemcached-libs-1.0.18-r4
-libmnl-1.0.4-r0
-libmount-2.35.2-r0
-libnftnl-libs-1.1.6-r0
+libmnl-1.0.4-r1
+libmount-2.37-r0
+libnftnl-libs-1.2.0-r0
 libpng-1.6.37-r1
-libpq-12.4-r0
-libproc-3.3.16-r0
-libressl3.1-libcrypto-3.1.2-r0
-libressl3.1-libssl-3.1.2-r0
-libsasl-2.1.27-r6
-libseccomp-2.4.3-r0
-libsecret-0.20.3-r0
+libpq-13.4-r0
+libproc-3.3.17-r0
+libressl3.3-libcrypto-3.3.3-r0
+libressl3.3-libssl-3.3.3-r0
+libretls-3.3.3p1-r2
+libsasl-2.1.27-r12
+libseccomp-2.5.1-r2
+libsecret-0.20.4-r1
 libsm-1.2.3-r0
 libsodium-1.0.18-r0
-libssl1.1-1.1.1g-r0
-libstdc++-9.3.0-r2
-libtasn1-4.16.0-r1
-libtls-standalone-2.9.1-r1
-libunistring-0.9.10-r0
-libuuid-2.35.2-r0
-libwebp-1.1.0-r0
-libx11-1.6.12-r0
+libssl1.1-1.1.1l-r0
+libstdc++-10.3.1_git20210424-r2
+libtasn1-4.17.0-r0
+libunistring-0.9.10-r1
+libuuid-2.37-r0
+libwebp-1.2.0-r2
+libx11-1.7.2-r0
 libxau-1.0.9-r0
-libxcb-1.14-r1
+libxcb-1.14-r2
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.10-r5
+libxml2-2.9.12-r1
 libxpm-3.5.13-r0
-libxslt-1.1.34-r0
-libxt-1.2.0-r0
-libzip-1.6.1-r1
-linux-pam-1.3.1-r4
-logrotate-3.16.0-r0
-luajit-5.1.20190925-r0
-memcached-1.6.6-r0
-musl-1.1.24-r9
-musl-utils-1.1.24-r9
-nano-4.9.3-r0
-ncurses-libs-6.2_p20200523-r0
-ncurses-terminfo-base-6.2_p20200523-r0
-nettle-3.5.1-r1
-nghttp2-libs-1.41.0-r0
-nginx-1.18.0-r0
-nginx-mod-devel-kit-1.18.0-r0
-nginx-mod-http-echo-1.18.0-r0
-nginx-mod-http-fancyindex-1.18.0-r0
-nginx-mod-http-geoip2-1.18.0-r0
-nginx-mod-http-headers-more-1.18.0-r0
-nginx-mod-http-image-filter-1.18.0-r0
-nginx-mod-http-lua-1.18.0-r0
-nginx-mod-http-lua-upstream-1.18.0-r0
-nginx-mod-http-nchan-1.18.0-r0
-nginx-mod-http-perl-1.18.0-r0
-nginx-mod-http-redis2-1.18.0-r0
-nginx-mod-http-set-misc-1.18.0-r0
-nginx-mod-http-upload-progress-1.18.0-r0
-nginx-mod-http-xslt-filter-1.18.0-r0
-nginx-mod-mail-1.18.0-r0
-nginx-mod-rtmp-1.18.0-r0
-nginx-mod-stream-1.18.0-r0
-nginx-mod-stream-geoip2-1.18.0-r0
-nginx-vim-1.18.0-r0
+libxslt-1.1.34-r1
+libxt-1.2.1-r0
+libzip-1.7.3-r2
+linux-pam-1.5.1-r1
+logrotate-3.18.1-r0
+lz4-libs-1.9.3-r0
+memcached-1.6.9-r0
+mpdecimal-2.5.1-r1
+musl-1.2.2-r3
+musl-utils-1.2.2-r3
+nano-5.7-r2
+ncurses-libs-6.2_p20210612-r0
+ncurses-terminfo-base-6.2_p20210612-r0
+nettle-3.7.2-r0
+nghttp2-libs-1.43.0-r0
+nginx-1.20.1-r3
+nginx-mod-devel-kit-1.20.1-r3
+nginx-mod-http-brotli-1.20.1-r3
+nginx-mod-http-dav-ext-1.20.1-r3
+nginx-mod-http-echo-1.20.1-r3
+nginx-mod-http-fancyindex-1.20.1-r3
+nginx-mod-http-geoip2-1.20.1-r3
+nginx-mod-http-headers-more-1.20.1-r3
+nginx-mod-http-image-filter-1.20.1-r3
+nginx-mod-http-nchan-1.20.1-r3
+nginx-mod-http-perl-1.20.1-r3
+nginx-mod-http-redis2-1.20.1-r3
+nginx-mod-http-set-misc-1.20.1-r3
+nginx-mod-http-upload-progress-1.20.1-r3
+nginx-mod-http-xslt-filter-1.20.1-r3
+nginx-mod-mail-1.20.1-r3
+nginx-mod-rtmp-1.20.1-r3
+nginx-mod-stream-1.20.1-r3
+nginx-mod-stream-geoip2-1.20.1-r3
+nginx-vim-1.20.1-r3
 npth-1.6-r0
-openssl-1.1.1g-r0
-p11-kit-0.23.20-r5
+oniguruma-6.9.7.1-r0
+openssl-1.1.1l-r0
+p11-kit-0.23.22-r0
 pcre-8.44-r0
-pcre2-10.35-r0
-perl-5.30.3-r0
-perl-error-0.17029-r0
-perl-git-2.26.2-r0
-php7-7.3.23-r0
-php7-bcmath-7.3.23-r0
-php7-bz2-7.3.23-r0
-php7-common-7.3.23-r0
-php7-ctype-7.3.23-r0
-php7-curl-7.3.23-r0
-php7-dom-7.3.23-r0
-php7-exif-7.3.23-r0
-php7-fileinfo-7.3.23-r0
-php7-fpm-7.3.23-r0
-php7-ftp-7.3.23-r0
-php7-gd-7.3.23-r0
-php7-iconv-7.3.23-r0
-php7-imap-7.3.23-r0
-php7-intl-7.3.23-r0
-php7-json-7.3.23-r0
-php7-ldap-7.3.23-r0
-php7-mbstring-7.3.23-r0
-php7-mysqli-7.3.23-r0
-php7-mysqlnd-7.3.23-r0
-php7-opcache-7.3.23-r0
-php7-openssl-7.3.23-r0
-php7-pdo-7.3.23-r0
-php7-pdo_mysql-7.3.23-r0
-php7-pdo_odbc-7.3.23-r0
-php7-pdo_pgsql-7.3.23-r0
-php7-pdo_sqlite-7.3.23-r0
-php7-pear-7.3.23-r0
-php7-pecl-apcu-5.1.18-r0
-php7-pecl-igbinary-3.1.4-r0
-php7-pecl-mcrypt-1.0.3-r0
-php7-pecl-memcached-3.1.5-r0
-php7-pecl-redis-5.2.2-r1
-php7-pgsql-7.3.23-r0
-php7-phar-7.3.23-r0
-php7-posix-7.3.23-r0
-php7-session-7.3.23-r0
-php7-simplexml-7.3.23-r0
-php7-soap-7.3.23-r0
-php7-sockets-7.3.23-r0
-php7-sodium-7.3.23-r0
-php7-sqlite3-7.3.23-r0
-php7-tokenizer-7.3.23-r0
-php7-xml-7.3.23-r0
-php7-xmlreader-7.3.23-r0
-php7-xmlrpc-7.3.23-r0
-php7-xmlwriter-7.3.23-r0
-php7-xsl-7.3.23-r0
-php7-zip-7.3.23-r0
-pinentry-1.1.0-r2
-popt-1.16-r7
-procps-3.3.16-r0
-py3-appdirs-1.4.4-r1
-py3-asn1crypto-1.3.0-r0
-py3-cachecontrol-0.12.6-r0
-py3-certifi-2020.4.5.1-r0
-py3-cffi-1.14.0-r2
-py3-chardet-3.0.4-r4
-py3-colorama-0.4.3-r0
-py3-contextlib2-0.6.0-r0
-py3-cparser-2.20-r0
-py3-cryptography-2.9.2-r0
-py3-distlib-0.3.0-r0
-py3-distro-1.5.0-r1
-py3-future-0.18.2-r1
-py3-html5lib-1.0.1-r4
-py3-idna-2.9-r0
-py3-lockfile-0.12.2-r3
-py3-msgpack-1.0.0-r0
-py3-ordered-set-4.0.1-r0
-py3-packaging-20.4-r0
-py3-parsing-2.4.7-r0
-py3-pep517-0.8.2-r0
-py3-pip-20.1.1-r0
-py3-progress-1.5-r0
-py3-pytoml-0.1.21-r0
-py3-requests-2.23.0-r0
-py3-retrying-1.3.3-r0
-py3-setuptools-47.0.0-r0
-py3-six-1.15.0-r0
-py3-toml-0.10.1-r0
-py3-urllib3-1.25.9-r0
-py3-webencodings-0.5.1-r3
-python3-3.8.5-r0
-readline-8.0.4-r0
-scanelf-1.2.6-r0
+pcre2-10.36-r0
+perl-5.32.1-r0
+perl-error-0.17029-r1
+perl-git-2.32.0-r0
+php7-7.4.23-r0
+php7-bcmath-7.4.23-r0
+php7-bz2-7.4.23-r0
+php7-common-7.4.23-r0
+php7-ctype-7.4.23-r0
+php7-curl-7.4.23-r0
+php7-dom-7.4.23-r0
+php7-exif-7.4.23-r0
+php7-fileinfo-7.4.23-r0
+php7-fpm-7.4.23-r0
+php7-ftp-7.4.23-r0
+php7-gd-7.4.23-r0
+php7-gmp-7.4.23-r0
+php7-iconv-7.4.23-r0
+php7-imap-7.4.23-r0
+php7-intl-7.4.23-r0
+php7-json-7.4.23-r0
+php7-ldap-7.4.23-r0
+php7-mbstring-7.4.23-r0
+php7-mysqli-7.4.23-r0
+php7-mysqlnd-7.4.23-r0
+php7-opcache-7.4.23-r0
+php7-openssl-7.4.23-r0
+php7-pdo-7.4.23-r0
+php7-pdo_mysql-7.4.23-r0
+php7-pdo_odbc-7.4.23-r0
+php7-pdo_pgsql-7.4.23-r0
+php7-pdo_sqlite-7.4.23-r0
+php7-pear-7.4.23-r0
+php7-pecl-apcu-5.1.20-r0
+php7-pecl-igbinary-3.2.4-r0
+php7-pecl-mailparse-3.1.1-r1
+php7-pecl-mcrypt-1.0.4-r0
+php7-pecl-memcached-3.1.5-r2
+php7-pecl-redis-5.3.4-r0
+php7-pgsql-7.4.23-r0
+php7-phar-7.4.23-r0
+php7-posix-7.4.23-r0
+php7-session-7.4.23-r0
+php7-simplexml-7.4.23-r0
+php7-soap-7.4.23-r0
+php7-sockets-7.4.23-r0
+php7-sodium-7.4.23-r0
+php7-sqlite3-7.4.23-r0
+php7-tokenizer-7.4.23-r0
+php7-xml-7.4.23-r0
+php7-xmlreader-7.4.23-r0
+php7-xmlrpc-7.4.23-r0
+php7-xmlwriter-7.4.23-r0
+php7-xsl-7.4.23-r0
+php7-zip-7.4.23-r0
+pinentry-1.1.1-r0
+popt-1.18-r0
+procps-3.3.17-r0
+py3-appdirs-1.4.4-r2
+py3-asn1crypto-1.4.0-r1
+py3-cachecontrol-0.12.6-r1
+py3-certifi-2020.12.5-r1
+py3-cffi-1.14.5-r1
+py3-chardet-4.0.0-r2
+py3-colorama-0.4.4-r1
+py3-contextlib2-0.6.0-r1
+py3-cparser-2.20-r1
+py3-cryptography-3.3.2-r1
+py3-distlib-0.3.1-r3
+py3-distro-1.5.0-r3
+py3-future-0.18.2-r3
+py3-html5lib-1.1-r1
+py3-idna-3.2-r0
+py3-lockfile-0.12.2-r4
+py3-msgpack-1.0.2-r1
+py3-ordered-set-4.0.2-r1
+py3-packaging-20.9-r1
+py3-parsing-2.4.7-r2
+py3-pep517-0.10.0-r2
+py3-pip-20.3.4-r1
+py3-progress-1.5-r2
+py3-requests-2.25.1-r4
+py3-retrying-1.3.3-r1
+py3-setuptools-52.0.0-r3
+py3-six-1.15.0-r1
+py3-toml-0.10.2-r2
+py3-urllib3-1.26.5-r0
+py3-webencodings-0.5.1-r4
+python3-3.9.5-r1
+readline-8.1.0-r0
+s6-ipcserver-2.10.0.3-r0
+scanelf-1.3.2-r0
 shadow-4.8.1-r0
-sqlite-libs-3.32.1-r0
-ssl_client-1.31.1-r19
-tzdata-2020a-r0
-unixodbc-2.3.7-r2
-whois-5.5.6-r0
+skalibs-2.10.0.3-r0
+sqlite-libs-3.35.5-r0
+ssl_client-1.33.1-r3
+tzdata-2021a-r0
+unixodbc-2.3.9-r1
+utmps-0.1.0.2-r0
+whois-5.5.10-r0
 xz-5.2.5-r0
 xz-libs-5.2.5-r0
 zlib-1.2.11-r3
+zstd-libs-1.4.9-r1

readme-vars.yml

@@ -4,7 +4,7 @@
 project_name: swag
 project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
-project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention."
+project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
 
 project_blurb_optional_extras_enabled: false
@@ -50,10 +50,11 @@ cap_add_param_vars:
 # optional container parameters
 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
+  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
+  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
   - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
   - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
-  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications." }
+  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
   - { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
   - { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
   - { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
@@ -87,7 +88,9 @@ app_setup_block: |
   >   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
 
   > Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
+
   ### Validation and initial setup
+
   * Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
   * For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
   * For `dns` validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`
@@ -98,40 +101,51 @@ app_setup_block: |
   * If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
   * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
   * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
+
   ### Security and password protection
+
   * The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.
-  * The container provides a pre-generated 4096-bit dhparams.pem (rotated weekly via [Jenkins job](https://ci.linuxserver.io/blue/organizations/jenkins/Xtras-Builders-Etc%2Fdhparams-uploader/activity)) for new instances, however you may generate your own by running `docker exec swag openssl dhparam -out /config/nginx/dhparams.pem 4096` WARNING: This takes a very long time
+  * Per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919), the container is shipping [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) as the `dhparams.pem`.
   * If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file `docker exec -it swag htpasswd -c /config/nginx/.htpasswd <username>`
   * You can add multiple user:pass to `.htpasswd`. For the first user, use the above command, for others, use the above command without the `-c` flag, as it will force deletion of the existing `.htpasswd` and creation of a new one
   * You can also use ldap auth for security and access control. A sample, user configurable ldap.conf is provided, and it requires the separate image [linuxserver/ldap-auth](https://hub.docker.com/r/linuxserver/ldap-auth/) to communicate with an ldap server.
+
   ### Site config and reverse proxy
+
   * The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
   * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
   * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
   `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
   This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
   * If you wish to redirect http to https, you must expose port 80
+
   ### Using certs in other containers
+
   * This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
     * To use these certs in other containers, do either of the following:
     1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
     2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
     * These certs include:
-    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
+    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
     2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
     3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
+
   ### Using fail2ban
-  * This container includes fail2ban set up with 3 jails by default:
+
+  * This container includes fail2ban set up with 4 jails by default:
     1. nginx-http-auth
     2. nginx-badbots
     3. nginx-botsearch
+    4. nginx-deny
   * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
   * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
   * You can check which jails are active via `docker exec -it swag fail2ban-client status`
   * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
   * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
   * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+
   ### Updating configs
+
   * This container creates a number of configs for nginx, proxy samples, etc.
   * Config updates are noted in the changelog but not automatically applied to your files.
   * If you have modified a file with noted changes in the changelog:
@@ -149,6 +163,28 @@ app_setup_nginx_reverse_proxy_block: ""
 
 # changelog
 changelogs:
+  - { date: "01.08.21:", desc: "Add support for ionos dns validation." }
+  - { date: "15.07.21:", desc: "Fix libmaxminddb issue due to upstream change." }
+  - { date: "07.07.21:", desc: "Rebase to alpine 3.14." }
+  - { date: "24.06.21:", desc: "Update default nginx conf folder." }
+  - { date: "28.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf - Use `resolver.conf` and patch for `CVE-2021-32637`." }
+  - { date: "20.05.21:", desc: "Modify resolver.conf generation to detect and ignore ipv6." }
+  - { date: "14.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use linuxserver.io wheel index for pip packages. Switch to using [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) for `dhparams.pem` per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919). Added `worker_processes.conf`, which sets the number of nginx workers, and `resolver.conf`, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later." }
+  - { date: "21.04.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method." }
+  - { date: "12.04.21:", desc: "Add php7-gmp and php7-pecl-mailparse." }
+  - { date: "12.04.21:", desc: "Add support for vultr dns validation." }
+  - { date: "14.03.21:", desc: "Add support for directadmin dns validation." }
+  - { date: "12.02.21:", desc: "Clean up rust/cargo cache, which ballooned the image size in the last couple of builds." }
+  - { date: "10.02.21:", desc: "Fix aliyun, domeneshop, inwx and transip dns confs for existing users." }
+  - { date: "09.02.21:", desc: "Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years)." }
+  - { date: "26.01.21:", desc: "Add support for hetzner dns validation." }
+  - { date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval." }
+  - { date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled." }
+  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting" }
+  - { date: "10.12.20:", desc: "Add support for njalla dns validation" }
+  - { date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation." }
+  - { date: "01.11.20:", desc: "Add support for netcup dns validation" }
+  - { date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy." }
   - { date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering." }
   - { date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
   - { date: "08.09.20:", desc: "Add php7-xsl." }

root/app/duckdns-txt

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf
 
 curl https://www.duckdns.org/update?domains=${CERTBOT_DOMAIN}\&token=${ORIGDUCKDNSTOKEN}\&txt=${CERTBOT_VALIDATION}
 

root/app/le-renew.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/with-contenv bash
 
-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf
 
 echo "<------------------------------------------------->"
 echo

root/defaults/502.html

@@ -0,0 +1,44 @@
+<html>
+    <head>
+        <title>502</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+            background-color: #961313;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 28px;
+            line-height: 26px;
+        }
+        h2{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>502</h1>
+            <h2>Nginx can not connect to the application</h2>
+            <p>Some common reasons are listed here: <a target="_blank" href="https://docs.linuxserver.io/general/swag#502">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>

root/defaults/authelia-location.conf

@@ -1,4 +1,4 @@
-## Version 2020/05/31 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
+## Version 2021/04/21 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Make sure that the authelia configuration.yml has 'path: "authelia"' defined
 
@@ -6,6 +6,10 @@ auth_request /authelia/api/verify;
 auth_request_set $target_url $scheme://$http_host$request_uri;
 auth_request_set $user $upstream_http_remote_user;
 auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
 proxy_set_header Remote-User $user;
 proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Name $name;
+proxy_set_header Remote-Email $email;
 error_page 401 =302 https://$http_host/authelia/?rd=$target_url;

root/defaults/authelia-server.conf

@@ -1,16 +1,19 @@
-## Version 2020/05/31 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
+## Version 2021/05/28 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 
 location ^~ /authelia {
     include /config/nginx/proxy.conf;
-    resolver 127.0.0.11 valid=30s;
+    include /config/nginx/resolver.conf;
     set $upstream_authelia authelia;
     proxy_pass http://$upstream_authelia:9091;
 }
 
 location = /authelia/api/verify {
     internal;
-    resolver 127.0.0.11 valid=30s;
+    if ($request_uri ~ [^a-zA-Z0-9_+-=\!@$%&*?~.:#'\;\(\)\[\]]) {
+        return 401;
+    }
+    include /config/nginx/resolver.conf;
     set $upstream_authelia authelia;
     proxy_pass_request_body off;
     proxy_pass http://$upstream_authelia:9091;
@@ -28,7 +31,8 @@ location = /authelia/api/verify {
     proxy_set_header Host $host;
     proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
     proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $remote_addr; 
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Method $request_method;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-Host $http_host;
     proxy_set_header X-Forwarded-Uri $request_uri;

root/defaults/default

@@ -1,150 +1,163 @@
-## Version 2020/05/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+
+error_page 502 /502.html;
 
 # redirect all traffic to https
 server {
-	listen 80 default_server;
-	listen [::]:80 default_server;
-	server_name _;
-	return 301 https://$host$request_uri;
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
 }
 
 # main server block
 server {
-	listen 443 ssl http2 default_server;
-	listen [::]:443 ssl http2 default_server;
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
 
-	root /config/www;
-	index index.html index.htm index.php;
+    root /config/www;
+    index index.html index.htm index.php;
 
-	server_name _;
+    server_name _;
 
-	# enable subfolder method reverse proxy confs
-	include /config/nginx/proxy-confs/*.subfolder.conf;
+    # enable subfolder method reverse proxy confs
+    include /config/nginx/proxy-confs/*.subfolder.conf;
 
-	# all ssl related config moved to ssl.conf
-	include /config/nginx/ssl.conf;
+    # all ssl related config moved to ssl.conf
+    include /config/nginx/ssl.conf;
 
-	# enable for ldap auth
-	#include /config/nginx/ldap.conf;
+    # enable for ldap auth
+    #include /config/nginx/ldap.conf;
 
-	# enable for Authelia
-	#include /config/nginx/authelia-server.conf;
+    # enable for Authelia
+    #include /config/nginx/authelia-server.conf;
 
-	# enable for geo blocking
-	# See /config/nginx/geoip2.conf for more information.
-	#if ($allowed_country = no) {
-	#return 444;
-	#}
+    # enable for geo blocking
+    # See /config/nginx/geoip2.conf for more information.
+    #if ($allowed_country = no) {
+    #return 444;
+    #}
 
-	client_max_body_size 0;
+    client_max_body_size 0;
 
-	location / {
-		try_files $uri $uri/ /index.html /index.php?$args =404;
-	}
+    location / {
+        # enable the next two lines for http auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
 
-	location ~ \.php$ {
-		fastcgi_split_path_info ^(.+\.php)(/.+)$;
-		fastcgi_pass 127.0.0.1:9000;
-		fastcgi_index index.php;
-		include /etc/nginx/fastcgi_params;
-	}
+        # enable the next two lines for ldap auth
+        #auth_request /auth;
+        #error_page 401 =200 /ldaplogin;
+
+        # enable for Authelia
+        #include /config/nginx/authelia-location.conf;
+
+        try_files $uri $uri/ /index.html /index.php?$args =404;
+    }
+
+    location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        include /etc/nginx/fastcgi_params;
+    }
 
 # sample reverse proxy config for password protected couchpotato running at IP 192.168.1.50 port 5050 with base url "cp"
 # notice this is within the same server block as the base
 # don't forget to generate the .htpasswd file as described on docker hub
-#	location ^~ /cp {
-#		auth_basic "Restricted";
-#		auth_basic_user_file /config/nginx/.htpasswd;
-#		include /config/nginx/proxy.conf;
-#		proxy_pass http://192.168.1.50:5050/cp;
-#	}
+#    location ^~ /cp {
+#        auth_basic "Restricted";
+#        auth_basic_user_file /config/nginx/.htpasswd;
+#        include /config/nginx/proxy.conf;
+#        proxy_pass http://192.168.1.50:5050/cp;
+#    }
 
 }
 
 # sample reverse proxy config without url base, but as a subdomain "cp", ip and port same as above
 # notice this is a new server block, you need a new server block for each subdomain
 #server {
-#	listen 443 ssl http2;
-#	listen [::]:443 ssl http2;
+#    listen 443 ssl http2;
+#    listen [::]:443 ssl http2;
 #
-#	root /config/www;
-#	index index.html index.htm index.php;
+#    root /config/www;
+#    index index.html index.htm index.php;
 #
-#	server_name cp.*;
+#    server_name cp.*;
 #
-#	include /config/nginx/ssl.conf;
+#    include /config/nginx/ssl.conf;
 #
-#	client_max_body_size 0;
+#    client_max_body_size 0;
 #
-#	location / {
-#		auth_basic "Restricted";
-#		auth_basic_user_file /config/nginx/.htpasswd;
-#		include /config/nginx/proxy.conf;
-#		proxy_pass http://192.168.1.50:5050;
-#	}
+#    location / {
+#        auth_basic "Restricted";
+#        auth_basic_user_file /config/nginx/.htpasswd;
+#        include /config/nginx/proxy.conf;
+#        proxy_pass http://192.168.1.50:5050;
+#    }
 #}
 
 # sample reverse proxy config for "heimdall" via subdomain, with ldap authentication
 # ldap-auth container has to be running and the /config/nginx/ldap.conf file should be filled with ldap info
 # notice this is a new server block, you need a new server block for each subdomain
 #server {
-#	listen 443 ssl http2;
-#	listen [::]:443 ssl http2;
+#    listen 443 ssl http2;
+#    listen [::]:443 ssl http2;
 #
-#	root /config/www;
-#	index index.html index.htm index.php;
+#    root /config/www;
+#    index index.html index.htm index.php;
 #
-#	server_name heimdall.*;
+#    server_name heimdall.*;
 #
-#	include /config/nginx/ssl.conf;
+#    include /config/nginx/ssl.conf;
 #
-#	include /config/nginx/ldap.conf;
+#    include /config/nginx/ldap.conf;
 #
-#	client_max_body_size 0;
+#    client_max_body_size 0;
 #
-#	location / {
-#		# the next two lines will enable ldap auth along with the included ldap.conf in the server block
-#		auth_request /auth;
-#		error_page 401 =200 /ldaplogin;
+#    location / {
+#        # the next two lines will enable ldap auth along with the included ldap.conf in the server block
+#        auth_request /auth;
+#        error_page 401 =200 /ldaplogin;
 #
-#		include /config/nginx/proxy.conf;
-#		resolver 127.0.0.11 valid=30s;
-#		set $upstream_app heimdall;
-#		set $upstream_port 443;
-#		set $upstream_proto https;
-#		proxy_pass $upstream_proto://$upstream_app:$upstream_port;
-#	}
+#        include /config/nginx/proxy.conf;
+#        resolver 127.0.0.11 valid=30s;
+#        set $upstream_app heimdall;
+#        set $upstream_port 443;
+#        set $upstream_proto https;
+#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+#    }
 #}
 
 # sample reverse proxy config for "heimdall" via subdomain, with Authelia
 # Authelia container has to be running in the same user defined bridge network, with container name "authelia", and with 'path: "authelia"' set in its configuration.yml
 # notice this is a new server block, you need a new server block for each subdomain
 #server {
-#	listen 443 ssl http2;
-#	listen [::]:443 ssl http2;
+#    listen 443 ssl http2;
+#    listen [::]:443 ssl http2;
 #
-#	root /config/www;
-#	index index.html index.htm index.php;
+#    root /config/www;
+#    index index.html index.htm index.php;
 #
-#	server_name heimdall.*;
+#    server_name heimdall.*;
 #
-#	include /config/nginx/ssl.conf;
+#    include /config/nginx/ssl.conf;
 #
-#	include /config/nginx/authelia-server.conf;
+#    include /config/nginx/authelia-server.conf;
 #
-#	client_max_body_size 0;
+#    client_max_body_size 0;
 #
-#	location / {
-#		# the next line will enable Authelia along with the included authelia-server.conf in the server block
-#		include /config/nginx/authelia-location.conf;
+#    location / {
+#        # the next line will enable Authelia along with the included authelia-server.conf in the server block
+#        include /config/nginx/authelia-location.conf;
 #
-#		include /config/nginx/proxy.conf;
-#		resolver 127.0.0.11 valid=30s;
-#		set $upstream_app heimdall;
-#		set $upstream_port 443;
-#		set $upstream_proto https;
-#		proxy_pass $upstream_proto://$upstream_app:$upstream_port;
-#	}
+#        include /config/nginx/proxy.conf;
+#        resolver 127.0.0.11 valid=30s;
+#        set $upstream_app heimdall;
+#        set $upstream_port 443;
+#        set $upstream_proto https;
+#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+#    }
 #}
 
 # enable subdomain method reverse proxy confs

root/defaults/dhparams.pem

@@ -0,0 +1,13 @@
+-----BEGIN DH PARAMETERS-----
+MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
+7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
+nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
+8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
+iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
+zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
+-----END DH PARAMETERS-----

root/defaults/dns-conf/aliyun.ini

@@ -2,5 +2,5 @@
 # https://ram.console.aliyun.com/
 # And ensure your RAM account has AliyunDNSFullAccess permission.
 
-certbot_dns_aliyun:dns_aliyun_access_key = 12345678
-certbot_dns_aliyun:dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef
+dns_aliyun_access_key = 12345678
+dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef

root/defaults/dns-conf/cloudflare.ini

@@ -6,4 +6,4 @@ dns_cloudflare_email = cloudflare@example.com
 dns_cloudflare_api_key = 0123456789abcdef0123456789abcdef01234567
 
 # With token (comment out both lines above and uncomment below):
-#dns_cloudflare_api_token = 0123456789abcdef0123456789abcdef01234567
+#dns_cloudflare_api_token = 0123456789abcdef0123456789abcdef01234567

root/defaults/dns-conf/cpanel.ini

@@ -3,4 +3,4 @@
 # include the scheme and the port number (usually 2083 for https)
 certbot_dns_cpanel:cpanel_url = https://cpanel.example.com:2083
 certbot_dns_cpanel:cpanel_username = username
-certbot_dns_cpanel:cpanel_password = 1234567890abcdef
+certbot_dns_cpanel:cpanel_password = 1234567890abcdef

root/defaults/dns-conf/directadmin.ini

@@ -0,0 +1,21 @@
+# Instructions: https://github.com/cybercinch/certbot-dns-directadmin/blob/master/certbot_dns_directadmin/__init__.py
+
+# It is recommended to create a login key in the DirectAdmin control panel to be used as value for directadmin_password.
+# Instructions on how to create such key can be found at https://help.directadmin.com/item.php?id=523.
+#
+# Make sure to grant the following permissions:
+# - CMD_API_LOGIN_TEST
+# - CMD_API_DNS_CONTROL
+# - CMD_API_SHOW_DOMAINS
+#
+# Username and password can also be used in case your DirectAdmin instance has no support for login keys.
+
+# The DirectAdmin Server url
+# include the scheme and the port number (Normally 2222)
+directadmin_url = https://my.directadminserver.com:2222
+
+# The DirectAdmin username
+directadmin_username = username
+
+# The DirectAdmin password
+directadmin_password = aSuperStrongPassword

root/defaults/dns-conf/domeneshop.ini

@@ -1,4 +1,4 @@
 # Instructions: https://github.com/domeneshop/certbot-dns-domeneshop#credentials
 # Replace with your values
-certbot_dns_domeneshop:dns_domeneshop_client_token=1234567890abcdef
-certbot_dns_domeneshop:dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs
+dns_domeneshop_client_token=1234567890abcdef
+dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs

root/defaults/dns-conf/gehirn.ini

@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-gehirn.readthedocs.io/en/stable/
+# Replace with your values
+dns_gehirn_api_token  = 00000000-0000-0000-0000-000000000000
+dns_gehirn_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw

root/defaults/dns-conf/google.json

@@ -3,4 +3,4 @@
   "_comment": "Replace with your values",
   "type": "service_account",
   "rest": "..."
-}
+}

root/defaults/dns-conf/hetzner.ini

@@ -0,0 +1,3 @@
+# Instructions: https://github.com/ctrlaltcoop/certbot-dns-hetzner
+# Replace with your values
+dns_hetzner_api_token = nohnah4zoo9Kiejee9aGh0thoopee2sa

root/defaults/dns-conf/inwx.ini

@@ -1,6 +1,6 @@
 # Instructions: https://github.com/oGGy990/certbot-dns-inwx
 # Replace with your values
-certbot_dns_inwx:dns_inwx_url           = https://api.domrobot.com/xmlrpc/
-certbot_dns_inwx:dns_inwx_username      = your_username
-certbot_dns_inwx:dns_inwx_password      = your_password
-certbot_dns_inwx:dns_inwx_shared_secret = your_shared_secret optional
+dns_inwx_url           = https://api.domrobot.com/xmlrpc/
+dns_inwx_username      = your_username
+dns_inwx_password      = your_password
+dns_inwx_shared_secret = your_shared_secret optional

root/defaults/dns-conf/ionos.ini

@@ -0,0 +1,5 @@
+# Instructions: https://github.com/helgeerbe/certbot-dns-ionos
+# Replace with your values
+dns_ionos_prefix = myapikeyprefix
+dns_ionos_secret = verysecureapikeysecret
+dns_ionos_endpoint = https://api.hosting.ionos.com

root/defaults/dns-conf/netcup.ini

@@ -0,0 +1,3 @@
+dns_netcup_customer_id  = 123456
+dns_netcup_api_key      = 0123456789abcdef0123456789abcdef01234567
+dns_netcup_api_password = abcdef0123456789abcdef01234567abcdef0123

root/defaults/dns-conf/njalla.ini

@@ -0,0 +1,2 @@
+# Generate your API token here: https://njal.la/settings/api/
+dns_njalla_token=0000000000000000000000000000000000000000

root/defaults/dns-conf/sakuracloud.ini

@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-sakuracloud.readthedocs.io/en/stable/
+# Replace with your values
+dns_sakuracloud_api_token  = 00000000-0000-0000-0000-000000000000
+dns_sakuracloud_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw

root/defaults/dns-conf/transip.ini

@@ -1,6 +1,30 @@
 # Instructions: https://readthedocs.org/projects/certbot-dns-transip/
-# Convert the key to an RSA key (openssl rsa -in transip.key -out transip-rsa.key)
-# Place .key-file in the same directory as this file. Location "/config/dns-conf" is from within the container
+#
+# This DNS plugin can be used to generate SSL wildcard certificates via TransIP DNS TXT records
+#
+# Login with your TransIP account and go to My Account | API:
+# 1. API-settings: On
+#
+# 2. IP-address/ranges whitelist: Add a new authorized IP address (Swag Docker) to use the API
+#
+# 3. Generate a new Key Pair and copy the private key to a new transip.key file in the format:
+#    -----BEGIN PRIVATE KEY-----
+#    ...
+#    -----END PRIVATE KEY-----
+#
+# 4. Convert the key to an RSA key with command:
+#     openssl rsa -in transip.key -out /config/dns-conf/transip-rsa.key
+#
+# 5. Set permission
+#     chmod 600 /config/dns-conf/transip-rsa.key
+#
+# 6. Replace <transip_username> below with your TransIP username
+#
+# 7. Create wildcard certificate with Swag environment variables:
+#      SUBDOMAINS=wildcard
+#      VALIDATION=dns
+#      DNSPLUGIN=transip
+
+dns_transip_username = <transip_username>
+dns_transip_key_file = /config/dns-conf/transip-rsa.key
 
-certbot_dns_transip:dns_transip_username = <transip_username>
-certbot_dns_transip:dns_transip_key_file = /config/dns-conf/transip-rsa.key

root/defaults/dns-conf/vultr.ini

@@ -0,0 +1,3 @@
+# Instructions: https://github.com/lezgomatt/certbot-dns-vultr
+# Replace with your vultr Personal Access Token (see https://www.vultr.com/docs/how-to-setup-dynamic-dns).
+dns_vultr_key = YOUR_VULTR_API_KEY

root/defaults/geoip2.conf

@@ -1,4 +1,4 @@
-## Version 2020/09/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
+## Version 2020/10/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
 # To enable, uncommment the Geoip2 config line in nginx.conf
 # Add the -e MAXMINDDB_LICENSE_KEY=<licensekey> to automatically download the Geolite2 database.
 # A Maxmind license key can be acquired here: https://www.maxmind.com/en/geolite2/signup
@@ -18,51 +18,55 @@ geoip2 /config/geoip2db/GeoLite2-City.mmdb {
 # GEOIP2 COUNTRY CONFIG
 map $geoip2_data_country_iso_code $allowed_country {
     # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
     default yes;
 
     # Below you will setup conditions with yes or no
     # ex: <condition> <yes/no>;
-    # If your default is set to yes you can setup conditions that would set it to no (and vice versa)
-    # Conditions are either network address (CIDR notation) or country code
 
     # allow United Kingdom.
     #GB yes;
-
-    # allow local access.
-    #192.168.1.0/24 yes;
 }
 
 # GEOIP2 CITY CONFIG
 map $geoip2_data_city_name $allowed_city {
     # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
     default yes;
 
     # Below you will setup conditions with yes or no
     # ex: <condition> <yes/no>;
-    # If your default is set to yes you can setup conditions that would set it to no (and vice versa)
-    # Conditions are either network address (CIDR notation) or city name
 
     # allow Inverness.
     #Inverness yes;
+}
 
-    # allow local access.
-    #192.168.1.0/24 yes;
+# ALLOW LOCAL ACCESS
+geo $allow_list {
+    default yes; # Set this to no if $allowed_country or $allowed_city default is no. 
+    # IP/CIDR yes; # e.g. 192.168.1.0/24 yes;
 }
 
 # Server config example:
-# Add the following if statement inside any server context where you want to geo block countries.
+# Add the following if statements inside any server context where you want to geo block countries.
 
 ########################################
-#	if ($allowed_country = no) {
-#	return 444;
-#	}
+#    if ($allow_list = yes) {
+#       set $allowed_country yes;
+#    }
+#    if ($allowed_country = no) {
+#       return 444;
+#    }
 #########################################
 
-# Add the following if statement inside any server context where you want to geo block cities.
+# Add the following if statements inside any server context where you want to geo block cities.
 ########################################
-#	if ($allowed_city = no) {
-#	return 444;
-#	}
+#    if ($allow_list = yes) {
+#       set $allowed_country yes;
+#    }
+#    if ($allowed_city = no) {
+#       return 444;
+#    }
 #########################################
 
 # Example using a config from proxy-confs
@@ -84,10 +88,14 @@ map $geoip2_data_city_name $allowed_city {
 #    #include /config/nginx/authelia-server.conf;
 
 
-#    # Country geo block
-#    if ($allowed_country = no) {
+#   # Allow lan access if default is set to no
+#   if ($allow_list = yes) {
+#       set $allowed_country yes;
+#   }
+#   # Country geo block
+#   if ($allowed_country = no) {
 #       return 444;
-#    }
+#   }
 
 
 #

root/defaults/index.html

@@ -0,0 +1,39 @@
+<html>
+    <head>
+        <title>Welcome to your SWAG instance</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>Welcome to your <a target="_blank" href="https://github.com/linuxserver/docker-swag">SWAG</a> instance</h1>
+            <p>A webserver and reverse proxy solution brought to you by <a target="_blank" href="https://www.linuxserver.io/">linuxserver.io</a> with php support and a built-in Certbot client.</p>
+            <p>We have an article on how to use swag here: <a target="_blank" href="https://docs.linuxserver.io/general/swag">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>

root/defaults/nginx.conf

@@ -1,120 +1,150 @@
-## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
+## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
 
 user abc;
-worker_processes 4;
-pid /run/nginx.pid;
+
+# Set number of worker processes automatically based on number of CPU cores.
+include /config/nginx/worker_processes.conf;
+
+# Enables the use of JIT for regular expressions to speed-up their processing.
+pcre_jit on;
+
+# Configures default error logger.
+error_log /config/log/nginx/error.log;
+
+# Includes files with directives to load dynamic modules.
 include /etc/nginx/modules/*.conf;
 
 events {
-	worker_connections 768;
-	# multi_accept on;
+    # The maximum number of simultaneous connections that can be opened by
+    # a worker process.
+    worker_connections 1024;
+    # multi_accept on;
 }
 
 http {
+    # Includes mapping of file name extensions to MIME types of responses
+    # and defines the default type.
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
 
-	##
-	# Basic Settings
-	##
+    # Name servers used to resolve names of upstream servers into addresses.
+    # It's also needed when using tcpsocket and udpsocket in Lua modules.
+    #resolver 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001;
+    include /config/nginx/resolver.conf;
 
-	client_body_buffer_size 128k;
-	client_max_body_size 0;
-	keepalive_timeout 65;
-	large_client_header_buffers 4 16k;
-	send_timeout 5m;
-	sendfile on;
-	tcp_nodelay on;
-	tcp_nopush on;
-	types_hash_max_size 2048;
-	variables_hash_max_size 2048;
+    # Don't tell nginx version to the clients. Default is 'on'.
+    server_tokens off;
 
-	# server_tokens off;
-	# server_names_hash_bucket_size 64;
-	# server_name_in_redirect off;
+    # Specifies the maximum accepted body size of a client request, as
+    # indicated by the request header Content-Length. If the stated content
+    # length is greater than this size, then the client receives the HTTP
+    # error code 413. Set to 0 to disable. Default is '1m'.
+    client_max_body_size 0;
 
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
+    # Sendfile copies data between one FD and other from within the kernel,
+    # which is more efficient than read() + write(). Default is off.
+    sendfile on;
 
-	##
-	# Logging Settings
-	##
+    # Causes nginx to attempt to send its HTTP response head in one packet,
+    # instead of using partial frames. Default is 'off'.
+    tcp_nopush on;
 
-	access_log /config/log/nginx/access.log;
-	error_log /config/log/nginx/error.log;
+    # Helper variable for proxying websockets.
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
 
-	##
-	# Gzip Settings
-	##
+    # Sets the path, format, and configuration for a buffered log write.
+    access_log /config/log/nginx/access.log;
 
-	gzip on;
-	gzip_disable "msie6";
+    # Includes virtual hosts configs.
+    #include /etc/nginx/http.d/*.conf;
 
-	# gzip_vary on;
-	# gzip_proxied any;
-	# gzip_comp_level 6;
-	# gzip_buffers 16 8k;
-	# gzip_http_version 1.1;
-	# gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+    # WARNING: Don't use this directory for virtual hosts anymore.
+    # This include will be moved to the root context in Alpine 3.14.
+    #include /etc/nginx/conf.d/*.conf;
 
-	##
-	# nginx-naxsi config
-	##
-	# Uncomment it if you installed nginx-naxsi
-	##
 
-	#include /etc/nginx/naxsi_core.rules;
+    ##
+    # Basic Settings
+    ##
 
-	##
-	# nginx-passenger config
-	##
-	# Uncomment it if you installed nginx-passenger
-	##
+    client_body_buffer_size 128k;
+    keepalive_timeout 65;
+    large_client_header_buffers 4 16k;
+    send_timeout 5m;
+    tcp_nodelay on;
+    types_hash_max_size 2048;
+    variables_hash_max_size 2048;
+    # server_names_hash_bucket_size 64;
+    # server_name_in_redirect off;
 
-	#passenger_root /usr;
-	#passenger_ruby /usr/bin/ruby;
+    ##
+    # Gzip Settings
+    ##
 
-	##
-	# WebSocket proxying
-	##
-	map $http_upgrade $connection_upgrade {
-		default upgrade;
-		''      close;
-	}
+    gzip on;
+    gzip_disable "msie6";
+    # gzip_vary on;
+    # gzip_proxied any;
+    # gzip_comp_level 6;
+    # gzip_buffers 16 8k;
+    # gzip_http_version 1.1;
+    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
 
-	##
-	# Virtual Host Configs
-	##
-	include /etc/nginx/conf.d/*.conf;
-	include /config/nginx/site-confs/*;
-	lua_load_resty_core off;
+    ##
+    # nginx-naxsi config
+    ##
+    # Uncomment it if you installed nginx-naxsi
+    ##
 
-	##
-	# Geoip2 config
-	##
-	# Uncomment to add the Geoip2 configs needed to geo block countries/cities.
-	##
+    #include /etc/nginx/naxsi_core.rules;
 
-	#include /config/nginx/geoip2.conf;
+    ##
+    # nginx-passenger config
+    ##
+    # Uncomment it if you installed nginx-passenger
+    ##
+
+    #passenger_root /usr;
+    #passenger_ruby /usr/bin/ruby;
+
+    ##
+    # Virtual Host Configs
+    ##
+    include /config/nginx/site-confs/*;
+    #Removed lua. Do not remove this comment
+
+    ##
+    # Geoip2 config
+    ##
+    # Uncomment to add the Geoip2 configs needed to geo block countries/cities.
+    ##
+
+    #include /config/nginx/geoip2.conf;
 }
 
-
 #mail {
-#	# See sample authentication script at:
-#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+#    # See sample authentication script at:
+#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
 #
-#	# auth_http localhost/auth.php;
-#	# pop3_capabilities "TOP" "USER";
-#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+#    # auth_http localhost/auth.php;
+#    # pop3_capabilities "TOP" "USER";
+#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
 #
-#	server {
-#		listen     localhost:110;
-#		protocol   pop3;
-#		proxy      on;
-#	}
+#    server {
+#        listen     localhost:110;
+#        protocol   pop3;
+#        proxy      on;
+#    }
 #
-#	server {
-#		listen     localhost:143;
-#		protocol   imap;
-#		proxy      on;
-#	}
+#    server {
+#        listen     localhost:143;
+#        protocol   imap;
+#        proxy      on;
+#    }
 #}
+
 daemon off;
+pid /run/nginx.pid;

root/defaults/proxy.conf

@@ -1,4 +1,4 @@
-## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
+## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
 
 # Timeout if the real server is dead
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

root/defaults/ssl.conf

@@ -1,4 +1,4 @@
-## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
+## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
 
 ### Mozilla Recommendations
 # generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
@@ -29,9 +29,6 @@ ssl_trusted_certificate /config/keys/letsencrypt/fullchain.pem;
 # Diffie-Hellman Parameters
 ssl_dhparam /config/nginx/dhparams.pem;
 
-# Resolver
-resolver 127.0.0.11 valid=30s; # Docker DNS Server
-
 # Enable TLS 1.3 early data
 ssl_early_data on;
 
@@ -40,7 +37,7 @@ ssl_early_data on;
 
 # Optional additional headers
 #add_header Cache-Control "no-transform" always;
-#add_header Content-Security-Policy "upgrade-insecure-requests";
+#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
 #add_header Referrer-Policy "same-origin" always;
 #add_header X-Content-Type-Options "nosniff" always;
 #add_header X-Frame-Options "SAMEORIGIN" always;

root/etc/cont-init.d/50-config

@@ -10,32 +10,33 @@ SUBDOMAINS=${SUBDOMAINS}\\n\
 EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
 ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
 VALIDATION=${VALIDATION}\\n\
+CERTPROVIDER=${CERTPROVIDER}\\n\
 DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
 STAGING=${STAGING}\\n"
 
 # Echo init finish for test runs
 if [ -n "${TEST_RUN}" ]; then
-	echo '[services.d] done.'
+    echo '[services.d] done.'
 fi
 
 # Sanitize variables
-SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION )
+SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER )
 for i in "${SANED_VARS[@]}"
 do
-  export echo "$i"="${!i//\"/}"
-  export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
+    export echo "$i"="${!i//\"/}"
+    export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
 done
 
 # check to make sure that the required variables are set
 [[ -z "$URL" ]] && \
-  echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details." && \
-  sleep infinity
+    echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details." && \
+    sleep infinity
 
 # make our folders and links
 mkdir -p \
-	/config/{log/letsencrypt,log/fail2ban,etc/letsencrypt,fail2ban,crontabs,dns-conf,geoip2db} \
-	/var/run/fail2ban
+    /config/{log/letsencrypt,log/fail2ban,etc/letsencrypt,fail2ban,crontabs,dns-conf,geoip2db} \
+    /var/run/fail2ban
 rm -rf /etc/letsencrypt
 ln -s /config/etc/letsencrypt /etc/letsencrypt
 
@@ -45,20 +46,18 @@ chown -R abc:abc /config/dns-conf
 
 # copy reverse proxy configs
 cp -R /defaults/proxy-confs /config/nginx/
-# remove outdated files (remove this action after 2020/10/17)
-rm -f /config/nginx/proxy-confs/seafile.subdomain.config.sample /config/nginx/proxy-confs/librespeed.subdomain.com.sample
 
 # copy/update the fail2ban config defaults to/in /config
 cp -R /defaults/fail2ban/filter.d /config/fail2ban/
 cp -R /defaults/fail2ban/action.d /config/fail2ban/
 # if jail.local is missing in /config, copy default
 [[ ! -f /config/fail2ban/jail.local ]] && \
-	cp /defaults/jail.local /config/fail2ban/jail.local
+    cp /defaults/jail.local /config/fail2ban/jail.local
 # Replace fail2ban config with user config
 [[ -d /etc/fail2ban/filter.d ]] && \
-	rm -rf /etc/fail2ban/filter.d
+    rm -rf /etc/fail2ban/filter.d
 [[ -d /etc/fail2ban/action.d ]] && \
-	rm -rf /etc/fail2ban/action.d
+    rm -rf /etc/fail2ban/action.d
 cp -R /config/fail2ban/filter.d /etc/fail2ban/
 cp -R /config/fail2ban/action.d /etc/fail2ban/
 cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
@@ -66,237 +65,316 @@ cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
 
 # copy crontab and proxy defaults if needed
 [[ ! -f /config/crontabs/root ]] && \
-	cp /etc/crontabs/root /config/crontabs/
+    cp /etc/crontabs/root /config/crontabs/
 [[ ! -f /config/nginx/proxy.conf ]] && \
-	cp /defaults/proxy.conf /config/nginx/proxy.conf
+    cp /defaults/proxy.conf /config/nginx/proxy.conf
 [[ ! -f /config/nginx/ssl.conf ]] && \
-	cp /defaults/ssl.conf /config/nginx/ssl.conf
+    cp /defaults/ssl.conf /config/nginx/ssl.conf
 [[ ! -f /config/nginx/ldap.conf ]] && \
-	cp /defaults/ldap.conf /config/nginx/ldap.conf
+    cp /defaults/ldap.conf /config/nginx/ldap.conf
 [[ ! -f /config/nginx/authelia-server.conf ]] && \
-	cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
+    cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
 [[ ! -f /config/nginx/authelia-location.conf ]] && \
-	cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
+    cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
 [[ ! -f /config/nginx/geoip2.conf ]] && \
-	cp /defaults/geoip2.conf /config/nginx/geoip2.conf
+    cp /defaults/geoip2.conf /config/nginx/geoip2.conf
+[[ ! -f /config/www/502.html ]] &&
+    cp /defaults/502.html /config/www/502.html
+
+# Set resolver, ignore ipv6 addresses
+if ! grep -q 'resolver' /config/nginx/resolver.conf; then
+    RESOLVERRAW=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
+    for i in ${RESOLVERRAW}; do
+        if [ $(awk -F ':' '{print NF-1}' <<< ${i}) -le 2 ]; then
+            RESOLVER="${RESOLVER} ${i}"
+        fi
+    done
+    if [ -z "${RESOLVER}" ]; then
+        RESOLVER="127.0.0.11"
+    fi
+    echo "Setting resolver to ${RESOLVER}"
+    echo -e "# This file is auto-generated only on first start, based on the container's /etc/resolv.conf file. Feel free to modify it as you wish.\n\nresolver ${RESOLVER} valid=30s;" > /config/nginx/resolver.conf
+fi
+
+# Set worker_processes
+if ! grep -q 'worker_processes' /config/nginx/worker_processes.conf; then
+    WORKER_PROCESSES=$(nproc)
+    echo "Setting worker_processes to ${WORKER_PROCESSES}"
+    echo -e "# This file is auto-generated only on first start, based on the cpu cores detected. Feel free to change it to any other number or to auto to let nginx handle it automatically.\n\nworker_processes ${WORKER_PROCESSES};" > /config/nginx/worker_processes.conf
+fi
+
+# remove lua bits from nginx.conf if not done before
+if ! grep -q '#Removed lua' /config/nginx/nginx.conf; then
+    echo "Removing lua specific info from nginx.conf"
+    sed -i 's|\tlua_load_resty_core off;|\t#Removed lua. Do not remove this comment|g' /config/nginx/nginx.conf
+fi
+
+# patch authelia-server.conf for CVE-2021-32637
+if ! grep -q 'if ($request_uri ~' /config/nginx/authelia-server.conf; then
+    sed -i '/internal;/a \ \ \ \ if ($request_uri ~ [^a-zA-Z0-9_+-=\\!@$%&*?~.:#'\''\\;\\(\\)\\[\\]]) { return 401; }' /config/nginx/authelia-server.conf
+fi
 
 # copy pre-generated dhparams or generate if needed
 [[ ! -f /config/nginx/dhparams.pem ]] && \
-  cp /defaults/dhparams.pem /config/nginx/dhparams.pem
+    cp /defaults/dhparams.pem /config/nginx/dhparams.pem
 if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
-  curl -o /config/nginx/dhparams.pem -L "https://lsio.ams3.digitaloceanspaces.com/dhparams.pem"
-fi
-if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
-  echo "Generating dhparams.pem. This will take a long time. Do not stop the container until this process is completed."
-  openssl dhparam -out /config/nginx/dhparams.pem 4096
+    curl -o /config/nginx/dhparams.pem -L "https://ssl-config.mozilla.org/ffdhe4096.txt"
 fi
 
 # check to make sure DNSPLUGIN is selected if dns validation is used
-[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|dnsimple|dnsmadeeasy|domeneshop|gandi|google|inwx|linode|luadns|nsone|ovh|rfc2136|route53|transip)$ ]] && \
-  echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
-  sleep infinity
+[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|directadmin|dnsimple|dnsmadeeasy|domeneshop|gandi|gehirn|google|hetzner|inwx|ionos|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \
+    echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
+    sleep infinity
 
 # import user crontabs
 rm /etc/crontabs/*
 cp /config/crontabs/* /etc/crontabs/
 
-# create original config file if it doesn't exist
-if [ ! -f "/config/donoteditthisfile.conf" ]; then
-  echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
-  echo "Created donoteditthisfile.conf"
+# create original config file if it doesn't exist, move non-hidden legacy file to hidden
+if [ -f "/config/donoteditthisfile.conf" ]; then
+    mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
+fi
+if [ ! -f "/config/.donoteditthisfile.conf" ]; then
+    echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
+    echo "Created .donoteditthisfile.conf"
 fi
 
 # load original config settings
 # shellcheck disable=SC1091
-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf
 
 # set default validation to http
 if [ -z "$VALIDATION" ]; then
-  VALIDATION="http"
-  echo "VALIDATION parameter not set; setting it to http"
+    VALIDATION="http"
+    echo "VALIDATION parameter not set; setting it to http"
 fi
 
-# if staging is set to true, use the staging server
-if [ "$STAGING" = "true" ]; then
-  echo "NOTICE: Staging is active"
-  ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
+# if zerossl is selected or staging is set to true, use the relevant server
+if [ "$CERTPROVIDER" = "zerossl" ] && [ "$STAGING" = "true" ]; then
+    echo "ZeroSSL does not support staging mode, ignoring STAGING variable"
+fi
+if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+    echo "ZeroSSL is selected as the cert provider, registering cert with $EMAIL"
+    ACMESERVER="https://acme.zerossl.com/v2/DV90"
+elif [ "$CERTPROVIDER" = "zerossl" ] && [ -z "$EMAIL" ]; then
+    echo "ZeroSSL is selected as the cert provider, but the e-mail address has not been entered. Please visit https://zerossl.com, register a new account and set the account e-mail address in the EMAIL environment variable"
+    sleep infinity
+elif [ "$STAGING" = "true" ]; then
+    echo "NOTICE: Staging is active"
+    echo "Using Let's Encrypt as the cert provider"
+    ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
 else
-  ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
+    echo "Using Let's Encrypt as the cert provider"
+    ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
 fi
 
 # figuring out url only vs url & subdomains vs subdomains only
 if [ -n "$SUBDOMAINS" ]; then
-  echo "SUBDOMAINS entered, processing"
-  if [ "$SUBDOMAINS" = "wildcard" ]; then
-    if [ "$ONLY_SUBDOMAINS" = true ]; then
-      export URL_REAL="-d *.${URL}"
-      echo "Wildcard cert for only the subdomains of $URL will be requested"
-    else
-      export URL_REAL="-d *.${URL} -d ${URL}"
-      echo "Wildcard cert for $URL will be requested"
-    fi
-  else
     echo "SUBDOMAINS entered, processing"
-    for job in $(echo "$SUBDOMAINS" | tr "," " "); do
-      export SUBDOMAINS_REAL="$SUBDOMAINS_REAL -d ${job}.${URL}"
-    done
-    if [ "$ONLY_SUBDOMAINS" = true ]; then
-      URL_REAL="$SUBDOMAINS_REAL"
-      echo "Only subdomains, no URL in cert"
+    if [ "$SUBDOMAINS" = "wildcard" ]; then
+        if [ "$ONLY_SUBDOMAINS" = true ]; then
+            export URL_REAL="-d *.${URL}"
+            echo "Wildcard cert for only the subdomains of $URL will be requested"
+        else
+            export URL_REAL="-d *.${URL} -d ${URL}"
+            echo "Wildcard cert for $URL will be requested"
+        fi
     else
-      URL_REAL="-d ${URL}${SUBDOMAINS_REAL}"
+        echo "SUBDOMAINS entered, processing"
+        for job in $(echo "$SUBDOMAINS" | tr "," " "); do
+            export SUBDOMAINS_REAL="$SUBDOMAINS_REAL -d ${job}.${URL}"
+        done
+        if [ "$ONLY_SUBDOMAINS" = true ]; then
+            URL_REAL="$SUBDOMAINS_REAL"
+            echo "Only subdomains, no URL in cert"
+        else
+            URL_REAL="-d ${URL}${SUBDOMAINS_REAL}"
+        fi
+        echo "Sub-domains processed are: $SUBDOMAINS_REAL"
     fi
-    echo "Sub-domains processed are: $SUBDOMAINS_REAL"
-  fi
 else
-  echo "No subdomains defined"
-  URL_REAL="-d $URL"
+    echo "No subdomains defined"
+    URL_REAL="-d $URL"
 fi
 
 # add extra domains
 if [ -n "$EXTRA_DOMAINS" ]; then
-  echo "EXTRA_DOMAINS entered, processing"
-  for job in $(echo "$EXTRA_DOMAINS" | tr "," " "); do
-    export EXTRA_DOMAINS_REAL="$EXTRA_DOMAINS_REAL -d ${job}"
-  done
-  echo "Extra domains processed are: $EXTRA_DOMAINS_REAL"
-  URL_REAL="$URL_REAL $EXTRA_DOMAINS_REAL"
+    echo "EXTRA_DOMAINS entered, processing"
+    for job in $(echo "$EXTRA_DOMAINS" | tr "," " "); do
+        export EXTRA_DOMAINS_REAL="$EXTRA_DOMAINS_REAL -d ${job}"
+    done
+    echo "Extra domains processed are: $EXTRA_DOMAINS_REAL"
+    URL_REAL="$URL_REAL $EXTRA_DOMAINS_REAL"
 fi
 
 # figuring out whether to use e-mail and which
 if [[ $EMAIL == *@* ]]; then
-  echo "E-mail address entered: ${EMAIL}"
-  EMAILPARAM="-m ${EMAIL} --no-eff-email"
+    echo "E-mail address entered: ${EMAIL}"
+    EMAILPARAM="-m ${EMAIL} --no-eff-email"
 else
-  echo "No e-mail address entered or address invalid"
-  EMAILPARAM="--register-unsafely-without-email"
+    echo "No e-mail address entered or address invalid"
+    EMAILPARAM="--register-unsafely-without-email"
 fi
 
+# update plugin names in dns conf inis
+sed -i 's|^certbot_dns_aliyun:||g' /config/dns-conf/aliyun.ini
+sed -i 's|^certbot_dns_domeneshop:||g' /config/dns-conf/domeneshop.ini
+sed -i 's|^certbot_dns_inwx:||g' /config/dns-conf/inwx.ini
+sed -i 's|^certbot_dns_transip:||g' /config/dns-conf/transip.ini
+
 # setting the validation method to use
 if [ "$VALIDATION" = "dns" ]; then
-  if [ "$DNSPLUGIN" = "route53" ]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(cpanel)$ ]]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(gandi)$ ]]; then
-    if [ -n "$PROPAGATION" ];then echo "Gandi dns plugin does not support setting propagation time"; fi
-    PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|inwx|transip)$ ]]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  else
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  fi
-  echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
+    if [ "$DNSPLUGIN" = "route53" ]; then
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(cpanel)$ ]]; then
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(gandi)$ ]]; then
+        if [ -n "$PROPAGATION" ];then echo "Gandi dns plugin does not support setting propagation time"; fi
+        PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini"
+    elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|hetzner|inwx|ionos|netcup|njalla|transip|vultr)$ ]]; then
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    else
+        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    fi
+    echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
 elif [ "$VALIDATION" = "tls-sni" ]; then
-  PREFCHAL="--non-interactive --standalone --preferred-challenges http"
-  echo "*****tls-sni validation has been deprecated, attempting http validation instead"
+    PREFCHAL="--non-interactive --standalone --preferred-challenges http"
+    echo "*****tls-sni validation has been deprecated, attempting http validation instead"
 elif [ "$VALIDATION" = "duckdns" ]; then
-  PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-public-ip-logging-ok --manual-auth-hook /app/duckdns-txt"
-  chmod +x /app/duckdns-txt
-  echo "duckdns validation is selected"
-  if [ "$SUBDOMAINS" = "wildcard" ]; then
-    echo "the resulting certificate will only cover the subdomains due to a limitation of duckdns, so it is advised to set the root location to use www.subdomain.duckdns.org"
-    export URL_REAL="-d *.${URL}"
-  else
-    echo "the resulting certificate will only cover the main domain due to a limitation of duckdns, ie. subdomain.duckdns.org"
-    export URL_REAL="-d ${URL}"
-  fi
+    PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-auth-hook /app/duckdns-txt"
+    chmod +x /app/duckdns-txt
+    echo "duckdns validation is selected"
+    if [ "$SUBDOMAINS" = "wildcard" ]; then
+        echo "the resulting certificate will only cover the subdomains due to a limitation of duckdns, so it is advised to set the root location to use www.subdomain.duckdns.org"
+        export URL_REAL="-d *.${URL}"
+    else
+        echo "the resulting certificate will only cover the main domain due to a limitation of duckdns, ie. subdomain.duckdns.org"
+        export URL_REAL="-d ${URL}"
+    fi
 else
-  PREFCHAL="--non-interactive --standalone --preferred-challenges http"
-  echo "http validation is selected"
+    PREFCHAL="--non-interactive --standalone --preferred-challenges http"
+    echo "http validation is selected"
 fi
 
 # setting the symlink for key location
 rm -rf /config/keys/letsencrypt
 if [ "$ONLY_SUBDOMAINS" = "true" ] && [ ! "$SUBDOMAINS" = "wildcard" ] ; then
-  DOMAIN="$(echo "$SUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${URL}"
-  ln -s ../etc/letsencrypt/live/"$DOMAIN" /config/keys/letsencrypt
+    DOMAIN="$(echo "$SUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${URL}"
+    ln -s ../etc/letsencrypt/live/"$DOMAIN" /config/keys/letsencrypt
 else
-  ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
+    ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
 fi
 
 # checking for changes in cert variables, revoking certs if necessary
-if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ]; then
-  echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
-  if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
-    ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
-    [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem
-  else
-    [[ -f /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem
-  fi
-  rm -rf /config/etc/letsencrypt
-  mkdir -p /config/etc/letsencrypt
+if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
+    echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
+    if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
+        ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
+    else
+        ORIGDOMAIN="$ORIGURL"
+    fi
+    if [ "$ORIGCERTPROVIDER" = "zerossl" ] && [ -n "$ORIGEMAIL" ]; then
+        REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$ORIGEMAIL")
+        REV_ZEROSSL_EAB_KID=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+        REV_ZEROSSL_EAB_HMAC_KEY=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+        if [ -z "$REV_ZEROSSL_EAB_KID" ] || [ -z "$REV_ZEROSSL_EAB_HMAC_KEY" ]; then
+            echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+            sleep infinity
+        fi
+        REV_ACMESERVER="https://acme.zerossl.com/v2/DV90 --eab-kid ${REV_ZEROSSL_EAB_KID} --eab-hmac-key ${REV_ZEROSSL_EAB_HMAC_KEY}"
+    elif [ "$ORIGSTAGING" = "true" ]; then
+        REV_ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
+    else
+        REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
+    fi
+    [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
+    rm -rf /config/etc/letsencrypt
+    mkdir -p /config/etc/letsencrypt
 fi
 
 # saving new variables
-echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
+echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
 
 # alter extension for error message
 if [ "$DNSPLUGIN" = "google" ]; then
-  FILENAME="$DNSPLUGIN.json"
+    FILENAME="$DNSPLUGIN.json"
 else
-  FILENAME="$DNSPLUGIN.ini"
+    FILENAME="$DNSPLUGIN.ini"
 fi
 
 # generating certs if necessary
 if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
-  echo "Generating new certificate"
- # shellcheck disable=SC2086
- certbot certonly --renew-by-default --server $ACMESERVER $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
-  if [ -d /config/keys/letsencrypt ]; then
-    cd /config/keys/letsencrypt || exit
-  else
-    if [ "$VALIDATION" = "dns" ]; then
-      echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the /config/dns-conf/${FILENAME} file."
-    elif [ "$VALIDATION" = "duckdns" ]; then
-      echo "ERROR: Cert does not exist! Please see the validation error above. Make sure your DUCKDNSTOKEN is correct."
-    else
-      echo "ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container"
+    if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+        echo "Retrieving EAB from ZeroSSL"
+        EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$EMAIL")
+        ZEROSSL_EAB_KID=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+        ZEROSSL_EAB_HMAC_KEY=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+        if [ -z "$ZEROSSL_EAB_KID" ] || [ -z "$ZEROSSL_EAB_HMAC_KEY" ]; then
+            echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+            sleep infinity
+        fi
+        ZEROSSL_EAB="--eab-kid ${ZEROSSL_EAB_KID} --eab-hmac-key ${ZEROSSL_EAB_HMAC_KEY}"
     fi
-    sleep infinity
-  fi
-  openssl pkcs12 -export -out privkey.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -passout pass:
-  sleep 1
-  cat {privkey,fullchain}.pem > priv-fullchain-bundle.pem
-  echo "New certificate generated; starting nginx"
+    echo "Generating new certificate"
+    # shellcheck disable=SC2086
+    certbot certonly --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
+    if [ -d /config/keys/letsencrypt ]; then
+        cd /config/keys/letsencrypt || exit
+    else
+        if [ "$VALIDATION" = "dns" ]; then
+            echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the /config/dns-conf/${FILENAME} file."
+        elif [ "$VALIDATION" = "duckdns" ]; then
+            echo "ERROR: Cert does not exist! Please see the validation error above. Make sure your DUCKDNSTOKEN is correct."
+        else
+            echo "ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container"
+        fi
+        sleep infinity
+    fi
+    openssl pkcs12 -export -out privkey.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -passout pass:
+    sleep 1
+    cat {privkey,fullchain}.pem > priv-fullchain-bundle.pem
+    echo "New certificate generated; starting nginx"
 else
-  echo "Certificate exists; parameters unchanged; starting nginx"
+    echo "Certificate exists; parameters unchanged; starting nginx"
 fi
 
 # create GeoIP2 folder symlink
 [[ -d /var/lib/libmaxminddb ]] && [[ ! -L /var/lib/libmaxminddb ]] && \
-  rm -rf /var/lib/libmaxminddb
+    rm -rf /var/lib/libmaxminddb
 [[ ! -d /var/lib/libmaxminddb ]] && \
-  ln -s /config/geoip2db /var/lib/libmaxminddb
+    ln -s /config/geoip2db /var/lib/libmaxminddb
 # check GeoIP2 database
 if [ -n "$MAXMINDDB_LICENSE_KEY" ]; then
-  sed -i "s|.*MAXMINDDB_LICENSE_KEY.*|MAXMINDDB_LICENSE_KEY=\"${MAXMINDDB_LICENSE_KEY}\"|g" /etc/conf.d/libmaxminddb
-  if [ ! -f /var/lib/libmaxminddb/GeoLite2-City.mmdb ]; then
-    echo "Downloading GeoIP2 City database."
-    /etc/periodic/weekly/libmaxminddb
-  fi
+    sed -i "s|.*MAXMINDDB_LICENSE_KEY.*|MAXMINDDB_LICENSE_KEY=\"${MAXMINDDB_LICENSE_KEY}\"|g" /etc/libmaxminddb.cron.conf
+    if [ ! -f /var/lib/libmaxminddb/GeoLite2-City.mmdb ]; then
+        echo "Downloading GeoIP2 City database."
+        /etc/periodic/weekly/libmaxminddb
+    fi
 elif [ -f /var/lib/libmaxminddb/GeoLite2-City.mmdb ]; then
-  echo -e "Currently using the user provided GeoLite2-City.mmdb.\nIf you want to enable weekly auto-updates of the database, retrieve a free license key from MaxMind,\nand add a new env variable \"MAXMINDDB_LICENSE_KEY\", set to your license key."
+    echo -e "Currently using the user provided GeoLite2-City.mmdb.\nIf you want to enable weekly auto-updates of the database, retrieve a free license key from MaxMind,\nand add a new env variable \"MAXMINDDB_LICENSE_KEY\", set to your license key."
 else
-  echo -e "Starting 2019/12/30, GeoIP2 databases require personal license key to download. Please retrieve a free license key from MaxMind,\nand add a new env variable \"MAXMINDDB_LICENSE_KEY\", set to your license key."
+    echo -e "Starting 2019/12/30, GeoIP2 databases require personal license key to download. Please retrieve a free license key from MaxMind,\nand add a new env variable \"MAXMINDDB_LICENSE_KEY\", set to your license key."
 fi
 
 # logfiles needed by fail2ban
 [[ ! -f /config/log/nginx/error.log ]] && \
-	touch /config/log/nginx/error.log
+    touch /config/log/nginx/error.log
 [[ ! -f /config/log/nginx/access.log ]] && \
-	touch /config/log/nginx/access.log
+    touch /config/log/nginx/access.log
 
 # permissions
 chown -R abc:abc \
-	/config
+    /config
 chmod -R 0644 /etc/logrotate.d
 chmod -R +r /config/log
 chmod +x /app/le-renew.sh

root/etc/cont-init.d/60-renew

@@ -7,4 +7,4 @@ else
     echo "The cert is either expired or it expires within the next day. Attempting to renew. This could take up to 10 minutes."
     /app/le-renew.sh
     sleep 1
-fi
+fi

root/etc/cont-init.d/70-templates

@@ -0,0 +1,42 @@
+#!/usr/bin/with-contenv bash
+
+nginx_confs=( \
+    authelia-location.conf \
+    authelia-server.conf \
+    geoip2.conf \
+    ldap.conf \
+    nginx.conf \
+    proxy.conf \
+    site-confs/default \
+    ssl.conf )
+
+for i in ${nginx_confs[@]}; do
+    if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /config/nginx/${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /defaults/$(basename ${i}))" ]; then
+        nginx_confs_changed="/config/nginx/${i}\n${nginx_confs_changed}"
+    fi
+done
+
+if [ -n "$nginx_confs_changed" ]; then
+    echo "**** The following nginx confs have different version dates than the defaults that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the defaults. ****"
+    echo "**** To update them to the latest defaults shipped within the image, delete these files and restart the container. ****"
+    echo "**** If they are user customized, check the date version at the top and compare to the upstream changelog via the link. ****"
+    echo -e "${nginx_confs_changed}"
+fi
+
+proxy_confs=$(ls /config/nginx/proxy-confs/*.conf 2>/dev/null)
+
+for i in $proxy_confs; do
+    if [ -f "${i}.sample" ]; then
+        if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i}.sample)" ]; then
+            proxy_confs_changed="${i}\n${proxy_confs_changed}"
+        fi
+    fi
+done
+
+if [ -n "$proxy_confs_changed" ]; then
+    echo "**** The following reverse proxy confs have different version dates than the samples that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the samples. ****"
+    echo "**** You should compare them to the samples in the same folder to make sure you have the latest updates. ****"
+    echo -e "${proxy_confs_changed}"
+fi

root/etc/logrotate.d/lerotate

@@ -1,11 +1,11 @@
 /config/log/letsencrypt/*.log {
- weekly
- rotate 52
- compress
- delaycompress
- nodateext
- missingok
- notifempty
- sharedscripts
- su abc abc
+    weekly
+    rotate 52
+    compress
+    delaycompress
+    nodateext
+    missingok
+    notifempty
+    sharedscripts
+    su abc abc
 }

root/etc/services.d/fail2ban/run

@@ -1,4 +1,4 @@
 #!/usr/bin/with-contenv bash
 
-  exec \
-        fail2ban-client -x -f start
+exec \
+    fail2ban-client -x -f start