Bot Updating Package Versions

Bot Updating Templated Files
Merge pull request #114 from authelia/feat/update-authelia-headers
2026-03-03 00:43:34 +09:00 · 2021-04-29 06:46:29 +01:00 · 2021-04-23 00:29:16 +00:00 · 2021-04-22 20:26:55 -04:00 · 2021-04-23 07:43:44 +10:00 · 2021-04-22 06:00:31 +00:00
40 changed files with 1219 additions and 519 deletions
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -96,7 +96,7 @@ If you are proposing additional packages to be added, ensure that you added the

 ### Testing your changes

-```
+```bash
 git clone https://github.com/linuxserver/docker-swag.git
 cd docker-swag
 docker build \
@@ -106,13 +106,14 @@ docker build \
 ```

 The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
-```
+
+```bash
 docker run --rm --privileged multiarch/qemu-user-static:register --reset
 ```

 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.

-## Update the chagelog
+## Update the changelog

 If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-swag/tree/master/root), add an entry to the changelog

--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord chat support
+    url: https://discord.gg/YWrKVTn
+    about: Realtime support / chat with the community and the team.
+
+  - name: Discourse discussion forum
+    url: https://discourse.linuxserver.io
+    about: Post on our community forum.
+
+  - name: Documentation
+    url: https://docs.linuxserver.io/images/docker-swag
+    about: Documentation - information about all of our containers.
--- a/.github/ISSUE_TEMPLATE/issue.bug.md
+++ b/.github/ISSUE_TEMPLATE/issue.bug.md
@@ -1,12 +1,14 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]

 <!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->

-<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
-<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
-
-<!--- Provide a general summary of the issue in the Title above -->
+<!--- Provide a general summary of the bug in the Title above -->

 ------------------------------

--- a/.github/ISSUE_TEMPLATE/issue.feature.md
+++ b/.github/ISSUE_TEMPLATE/issue.feature.md
@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+[linuxserverurl]: https://linuxserver.io
+[![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
+
+<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
+
+<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
+<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
+
+<!--- Provide a general summary of the request in the Title above -->
+
+------------------------------
+
+## Desired Behavior
+<!--- Tell us what should happen -->
+
+## Current Behavior
+<!--- Tell us what happens instead of the expected behavior -->
+
+## Alternatives Considered
+<!--- Tell us what other options you have tried or considered -->
--- a/.github/workflows/external_trigger.yml
+++ b/.github/workflows/external_trigger.yml
@@ -0,0 +1,92 @@
+name: External Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  external-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: External Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\". ****"
+          echo "**** Retrieving external version ****"
+          EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
+          if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
+            echo "**** Can't retrieve external version, exiting ****"
+            FAILURE_REASON="Can't retrieve external version for swag branch master"
+            GHA_TRIGGER_URL="https://github.com/linuxserver/docker-swag/actions/runs/${{ github.run_id }}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n**Trigger URL:** '"${GHA_TRIGGER_URL}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "**** External version: ${EXT_RELEASE} ****"
+          echo "**** Retrieving last pushed version ****"
+          image="linuxserver/swag"
+          tag="latest"
+          token=$(curl -sX GET \
+            "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fswag%3Apull" \
+            | jq -r '.token')
+            multidigest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${tag}" \
+              | jq -r 'first(.manifests[].digest)')
+            digest=$(curl -s \
+              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Authorization: Bearer ${token}" \
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}" \
+              | jq -r '.config.digest')
+          image_info=$(curl -sL \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/blobs/${digest}" \
+            | jq -r '.container_config')
+          IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
+          IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "**** Can't retrieve last pushed version, exiting ****"
+            FAILURE_REASON="Can't retrieve last pushed version for swag tag latest"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
+              "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+            exit 1
+          fi
+          echo "**** Last pushed version: ${IMAGE_VERSION} ****"
+          if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
+            echo "**** Version ${EXT_RELEASE} already pushed, exiting ****"
+            exit 0
+          elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting ****"
+            exit 0
+          else
+            echo "**** New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build ****"
+            response=$(curl -iX POST \
+              https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=false \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+            echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+            echo "**** Sleeping 10 seconds until job starts ****"
+            sleep 10
+            buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+            buildurl="${buildurl%$'\r'}"
+            echo "**** Jenkins job build url: ${buildurl} ****"
+            echo "**** Attempting to change the Jenkins job description ****"
+            curl -iX POST \
+              "${buildurl}submitDescription" \
+              --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+              --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --data-urlencode "Submit=Submit"
+            echo "**** Notifying Discord ****"
+            TRIGGER_REASON="A version change was detected for swag tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE}"
+            curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+              "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
+              "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
+          fi
--- a/.github/workflows/external_trigger_scheduler.yml
+++ b/.github/workflows/external_trigger_scheduler.yml
@@ -0,0 +1,43 @@
+name: External Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '50 * * * *'
+  workflow_dispatch:
+
+jobs:
+  external-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: External Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "$br" == "$ls_branch" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering external trigger workflow for branch ${br} ****."
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/external_trigger.yml/dispatches
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v1
      with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [issue template](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE.md)!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [bug](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.bug.md) or [feature](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE/issue.feature.md) issue templates!'
        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/package_trigger.yml
+++ b/.github/workflows/package_trigger.yml
@@ -0,0 +1,38 @@
+name: Package Trigger Main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  package-trigger-master:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+
+      - name: Package Trigger
+        if: github.ref == 'refs/heads/master'
+        run: |
+          if [ -n "${{ secrets.PAUSE_PACKAGE_TRIGGER_SWAG_MASTER }}" ]; then
+            echo "**** Github secret PAUSE_PACKAGE_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            exit 0
+          fi
+          if [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
+            echo "**** There already seems to be an active build on Jenkins; skipping package trigger ****"
+            exit 0
+          fi
+          echo "**** Package trigger running off of master branch. To disable, set a Github secret named \"PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\". ****"
+          response=$(curl -iX POST \
+            https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=true \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+          echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+          echo "**** Sleeping 10 seconds until job starts ****"
+          sleep 10
+          buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
+          buildurl="${buildurl%$'\r'}"
+          echo "**** Jenkins job build url: ${buildurl} ****"
+          echo "**** Attempting to change the Jenkins job description ****"
+          curl -iX POST \
+            "${buildurl}submitDescription" \
+            --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
+            --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --data-urlencode "Submit=Submit"
--- a/.github/workflows/package_trigger_scheduler.yml
+++ b/.github/workflows/package_trigger_scheduler.yml
@@ -0,0 +1,50 @@
+name: Package Trigger Scheduler
+
+on:
+  schedule:
+    - cron:  '03 5 * * 4'
+  workflow_dispatch:
+
+jobs:
+  package-trigger-scheduler:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.3.3
+        with:
+          fetch-depth: '0'
+
+      - name: Package Trigger Scheduler
+        run: |
+          echo "**** Branches found: ****"
+          git for-each-ref --format='%(refname:short)' refs/remotes
+          echo "**** Pulling the yq docker image ****"
+          docker pull ghcr.io/linuxserver/yq
+          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          do
+            br=$(echo "$br" | sed 's|origin/||g')
+            echo "**** Evaluating branch ${br} ****"
+            ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml \
+              | docker run --rm -i --entrypoint yq ghcr.io/linuxserver/yq -r .ls_branch)
+            if [ "${br}" == "${ls_branch}" ]; then
+              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/package_trigger.yml > /dev/null 2>&1; then
+                echo "**** Workflow exists. Triggering package trigger workflow for branch ${br}. ****"
+                triggered_branches="${triggered_branches}${br} "
+                curl -iX POST \
+                  -H "Authorization: token ${{ secrets.CR_PAT }}" \
+                  -H "Accept: application/vnd.github.v3+json" \
+                  -d "{\"ref\":\"refs/heads/${br}\"}" \
+                  https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/package_trigger.yml/dispatches
+                sleep 30
+              else
+                echo "**** Workflow doesn't exist; skipping trigger. ****"
+              fi
+            else
+              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
+            fi
+          done
+          echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
+          echo "**** Notifying Discord ****"
+          curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
+            "description": "**Package Check Build(s) Triggered for swag** \n**Branch(es):** '"${triggered_branches}"' \n**Build URL:** '"https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-swag/activity/"' \n"}],
+            "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+.jenkins-external
--- a/17
+++ b/17
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -52,6 +53,7 @@ RUN \
 	php7-exif \
 	php7-ftp \
 	php7-gd \
+	php7-gmp \
 	php7-iconv \
 	php7-imap \
 	php7-intl \
@@ -67,6 +69,7 @@ RUN \
 	php7-pdo_sqlite \
 	php7-pear \
 	php7-pecl-apcu \
+	php7-pecl-mailparse \
 	php7-pecl-redis \
 	php7-pgsql \
 	php7-phar \
@@ -100,18 +103,23 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
 	certbot-dns-route53 \
 	certbot-dns-transip \
+	certbot-dns-vultr \
 	certbot-plugin-gandi \
 	cryptography \
 	requests && \
@@ -144,7 +152,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm64v8-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -52,6 +53,7 @@ RUN \
 	php7-exif \
 	php7-ftp \
 	php7-gd \
+	php7-gmp \
 	php7-iconv \
 	php7-imap \
 	php7-intl \
@@ -67,6 +69,7 @@ RUN \
 	php7-pdo_sqlite \
 	php7-pear \
 	php7-pecl-apcu \
+	php7-pecl-mailparse \
 	php7-pecl-redis \
 	php7-pgsql \
 	php7-phar \
@@ -100,18 +103,23 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
 	certbot-dns-route53 \
 	certbot-dns-transip \
+	certbot-dns-vultr \
 	certbot-plugin-gandi \
 	cryptography \
 	requests && \
@@ -144,7 +152,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/Dockerfile.armhf
+++ b/Dockerfile.armhf
@@ -1,4 +1,4 @@
-FROM lsiobase/nginx:arm32v7-3.12
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.13

 # set version label
 ARG BUILD_DATE
@@ -14,6 +14,7 @@ ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 RUN \
 echo "**** install build packages ****" && \
 apk add --no-cache --virtual=build-dependencies \
+	cargo \
 	g++ \
 	gcc \
 	libffi-dev \
@@ -26,13 +27,13 @@ RUN \
 	gnupg \
 	memcached \
 	nginx \
+	nginx-mod-http-brotli \
+	nginx-mod-http-dav-ext \
 	nginx-mod-http-echo \
 	nginx-mod-http-fancyindex \
 	nginx-mod-http-geoip2 \
 	nginx-mod-http-headers-more \
 	nginx-mod-http-image-filter \
-	nginx-mod-http-lua \
-	nginx-mod-http-lua-upstream \
 	nginx-mod-http-nchan \
 	nginx-mod-http-perl \
 	nginx-mod-http-redis2 \
@@ -52,6 +53,7 @@ RUN \
 	php7-exif \
 	php7-ftp \
 	php7-gd \
+	php7-gmp \
 	php7-iconv \
 	php7-imap \
 	php7-intl \
@@ -67,6 +69,7 @@ RUN \
 	php7-pdo_sqlite \
 	php7-pear \
 	php7-pecl-apcu \
+	php7-pecl-mailparse \
 	php7-pecl-redis \
 	php7-pgsql \
 	php7-phar \
@@ -100,18 +103,23 @@ RUN \
 	certbot-dns-cloudxns \
 	certbot-dns-cpanel \
 	certbot-dns-digitalocean \
+	certbot-dns-directadmin \
 	certbot-dns-dnsimple \
 	certbot-dns-dnsmadeeasy \
 	certbot-dns-domeneshop \
 	certbot-dns-google \
+	certbot-dns-hetzner \
 	certbot-dns-inwx \
 	certbot-dns-linode \
 	certbot-dns-luadns \
+	certbot-dns-netcup \
+	certbot-dns-njalla \
 	certbot-dns-nsone \
 	certbot-dns-ovh \
 	certbot-dns-rfc2136 \
 	certbot-dns-route53 \
 	certbot-dns-transip \
+	certbot-dns-vultr \
 	certbot-plugin-gandi \
 	cryptography \
 	requests && \
@@ -144,7 +152,8 @@ RUN \
 	; done && \
 rm -rf \
 	/tmp/* \
-	/root/.cache
+	/root/.cache \
+	/root/.cargo

 # add local files
 COPY root/ /
--- a/336
+++ b/336
@@ -42,7 +42,7 @@ pipeline {
        script{
          env.EXIT_STATUS = ''
          env.LS_RELEASE = sh(
-            script: '''docker run --rm alexeiled/skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
+            script: '''docker run --rm ghcr.io/linuxserver/alexeiled-skopeo sh -c 'skopeo inspect docker://docker.io/'${DOCKERHUB_IMAGE}':latest 2>/dev/null' | jq -r '.Labels.build_version' | awk '{print $3}' | grep '\\-ls' || : ''',
            returnStdout: true).trim()
          env.LS_RELEASE_NOTES = sh(
            script: '''cat readme-vars.yml | awk -F \\" '/date: "[0-9][0-9].[0-9][0-9].[0-9][0-9]:/ {print $4;exit;}' | sed -E ':a;N;$!ba;s/\\r{0,1}\\n/\\\\n/g' ''',
@@ -56,7 +56,7 @@ pipeline {
          env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/commit/' + env.GIT_COMMIT
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
          env.PULL_REQUEST = env.CHANGE_ID
-          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt'
+          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.md ./.github/ISSUE_TEMPLATE/issue.feature.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/external_trigger_scheduler.yml ./.github/workflows/greetings.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/stale.yml ./.github/workflows/external_trigger.yml ./.github/workflows/package_trigger.yml ./root/donate.txt'
        }
        script{
          env.LS_RELEASE_NUMBER = sh(
@@ -128,13 +128,14 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
        }
@@ -149,13 +150,14 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.DEV_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lsiodev-' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lsiodev-' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
          env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DEV_DOCKERHUB_IMAGE + '/tags/'
@@ -170,13 +172,14 @@ pipeline {
      steps {
        script{
          env.IMAGE = env.PR_DOCKERHUB_IMAGE
-          env.GITHUBIMAGE = 'docker.pkg.github.com/' + env.LS_USER + '/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
+          env.GITHUBIMAGE = 'ghcr.io/' + env.LS_USER + '/lspipepr-' + env.CONTAINER_NAME
          env.GITLABIMAGE = 'registry.gitlab.com/linuxserver.io/' + env.LS_REPO + '/lspipepr-' + env.CONTAINER_NAME
          if (env.MULTIARCH == 'true') {
            env.CI_TAGS = 'amd64-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm32v7-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST + '|arm64v8-' + env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          } else {
            env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          }
+          env.VERSION_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
          env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/pull/' + env.PULL_REQUEST
@@ -191,24 +194,24 @@ pipeline {
      }
      steps {
        withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key', variable: 'S3_SECRET')
        ]) {
          script{
-            env.SHELLCHECK_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
+            env.SHELLCHECK_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/shellcheck-result.xml'
          }
          sh '''curl -sL https://raw.githubusercontent.com/linuxserver/docker-shellcheck/master/checkrun.sh | /bin/bash'''
          sh '''#! /bin/bash
                set -e
-                docker pull lsiodev/spaces-file-upload:latest
+                docker pull ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest
                docker run --rm \
                -e DESTINATION=\"${IMAGE}/${META_TAG}/shellcheck-result.xml\" \
                -e FILE_NAME="shellcheck-result.xml" \
                -e MIMETYPE="text/xml" \
                -v ${WORKSPACE}:/mnt \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
-                -t lsiodev/spaces-file-upload:latest \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
+                -t ghcr.io/linuxserver/lsiodev-spaces-file-upload:latest \
                python /upload.py'''
        }
      }
@@ -226,20 +229,68 @@ pipeline {
        sh '''#! /bin/bash
              set -e
              TEMPDIR=$(mktemp -d)
-              docker pull linuxserver/jenkins-builder:latest
-              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
+              docker pull ghcr.io/linuxserver/jenkins-builder:latest
+              docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest 
+              # Stage 1 - Jenkinsfile update
+              if [[ "$(md5sum Jenkinsfile | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile | awk '{ print $1 }')" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/Jenkinsfile ${TEMPDIR}/repo/${LS_REPO}/
+                git add Jenkinsfile
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Updating Jenkinsfile"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "Jenkinsfile is up to date."
+              fi
+              # Stage 2 - Delete old templates
+              OLD_TEMPLATES=".github/ISSUE_TEMPLATE.md"
+              for i in ${OLD_TEMPLATES}; do
+                if [[ -f "${i}" ]]; then
+                  TEMPLATES_TO_DELETE="${i} ${TEMPLATES_TO_DELETE}"
+                fi
+              done
+              if [[ -n "${TEMPLATES_TO_DELETE}" ]]; then
+                mkdir -p ${TEMPDIR}/repo
+                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
+                cd ${TEMPDIR}/repo/${LS_REPO}
+                git checkout -f master
+                cd ${TEMPDIR}/docker-${CONTAINER_NAME}
+                for i in ${TEMPLATES_TO_DELETE}; do
+                  git rm "${i}"
+                done
+                git commit -m 'Bot Updating Templated Files'
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
+                echo "true" > /tmp/${COMMIT_SHA}-${BUILD_NUMBER}
+                echo "Deleting old templates"
+                rm -Rf ${TEMPDIR}
+                exit 0
+              else
+                echo "No templates to delete"
+              fi
+              # Stage 3 - Update templates
              CURRENTHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
              cd ${TEMPDIR}/docker-${CONTAINER_NAME}
              NEWHASH=$(grep -hs ^ ${TEMPLATED_FILES} | md5sum | cut -c1-8)
-              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]]; then
+              if [[ "${CURRENTHASH}" != "${NEWHASH}" ]] || ! grep -q '.jenkins-external' "${WORKSPACE}/.gitignore" 2>/dev/null; then
                mkdir -p ${TEMPDIR}/repo
                git clone https://github.com/${LS_USER}/${LS_REPO}.git ${TEMPDIR}/repo/${LS_REPO}
                cd ${TEMPDIR}/repo/${LS_REPO}
                git checkout -f master
                cd ${TEMPDIR}/docker-${CONTAINER_NAME}
                mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/workflows
-                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/
+                mkdir -p ${TEMPDIR}/repo/${LS_REPO}/.github/ISSUE_TEMPLATE
+                cp --parents ${TEMPLATED_FILES} ${TEMPDIR}/repo/${LS_REPO}/ || :
                cd ${TEMPDIR}/repo/${LS_REPO}/
+                if ! grep -q '.jenkins-external' .gitignore 2>/dev/null; then
+                  echo ".jenkins-external" >> .gitignore
+                  git add .gitignore
+                fi
                git add ${TEMPLATED_FILES}
                git commit -m 'Bot Updating Templated Files'
                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/${LS_USER}/${LS_REPO}.git --all
@@ -249,13 +300,32 @@ pipeline {
              fi
              mkdir -p ${TEMPDIR}/gitbook
              git clone https://github.com/linuxserver/docker-documentation.git ${TEMPDIR}/gitbook/docker-documentation
-              if [[ "${BRANCH_NAME}" == "master" ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
-                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md) || ("$(md5sum ${TEMPDIR}/gitbook/docker-documentation/images/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md | awk '{ print $1 }')") ]]; then
+                cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/docker-${CONTAINER_NAME}.md ${TEMPDIR}/gitbook/docker-documentation/images/
                cd ${TEMPDIR}/gitbook/docker-documentation/
                git add images/docker-${CONTAINER_NAME}.md
                git commit -m 'Bot Updating Documentation'
                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/docker-documentation.git --all
              fi
+              mkdir -p ${TEMPDIR}/unraid
+              git clone https://github.com/linuxserver/docker-templates.git ${TEMPDIR}/unraid/docker-templates
+              git clone https://github.com/linuxserver/templates.git ${TEMPDIR}/unraid/templates
+              if [[ -f ${TEMPDIR}/unraid/docker-templates/linuxserver.io/img/${CONTAINER_NAME}-logo.png ]]; then
+                sed -i "s|master/linuxserver.io/img/linuxserver-ls-logo.png|master/linuxserver.io/img/${CONTAINER_NAME}-logo.png|" ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml
+              fi
+              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml) || ("$(md5sum ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml | awk '{ print $1 }')") ]]; then
+                cd ${TEMPDIR}/unraid/templates/
+                if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
+                  echo "Image is on the ignore list, removing Unraid template"
+                  git rm unraid/${CONTAINER_NAME}.xml || :
+                  git commit -m 'Bot Removing Deprecated Unraid Template' || :
+                else
+                  cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
+                  git add unraid/${CONTAINER_NAME}.xml
+                  git commit -m 'Bot Updating Unraid Template'
+                fi
+                git push https://LinuxServer-CI:${GITHUB_TOKEN}@github.com/linuxserver/templates.git --all
+              fi
              rm -Rf ${TEMPDIR}'''
        script{
          env.FILES_UPDATED = sh(
@@ -310,8 +380,22 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
-        sh "docker build --no-cache --pull -t ${IMAGE}:${META_TAG} \
-        --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+        echo "Running on node: ${NODE_NAME}"
+        sh "docker build \
+          --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+          --label \"org.opencontainers.image.authors=linuxserver.io\" \
+          --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+          --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+          --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+          --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+          --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+          --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+          --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+          --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+          --label \"org.opencontainers.image.title=Swag\" \
+          --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+          --no-cache --pull -t ${IMAGE}:${META_TAG} \
+          --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
      }
    }
    // Build MultiArch Docker containers for push to LS Repo
@@ -323,8 +407,22 @@ pipeline {
      parallel {
        stage('Build X86') {
          steps {
-            sh "docker build --no-cache --pull -t ${IMAGE}:amd64-${META_TAG} \
-            --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            echo "Running on node: ${NODE_NAME}"
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -t ${IMAGE}:amd64-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
          }
        }
        stage('Build ARMHF') {
@@ -332,28 +430,33 @@ pipeline {
            label 'ARMHF'
          }
          steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm32v7-${META_TAG} lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm32v7-${META_TAG} \
-                    lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -f Dockerfile.armhf -t ${IMAGE}:arm32v7-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm32v7-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}"
            }
+            sh '''docker rmi \
+                  ${IMAGE}:arm32v7-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
          }
        }
        stage('Build ARM64') {
@@ -361,28 +464,33 @@ pipeline {
            label 'ARM64'
          }
          steps {
-            withCredentials([
-              [
-                $class: 'UsernamePasswordMultiBinding',
-                credentialsId: '3f9ba4d5-100d-45b0-a3c4-633fd6061207',
-                usernameVariable: 'DOCKERUSER',
-                passwordVariable: 'DOCKERPASS'
-              ]
-            ]) {
-              echo 'Logging into DockerHub'
-              sh '''#! /bin/bash
-                 echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                 '''
-              sh "docker build --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
-                           --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${META_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
-              sh "docker tag ${IMAGE}:arm64v8-${META_TAG} lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              retry(5) {
-                sh "docker push lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-              }
-              sh '''docker rmi \
-                    ${IMAGE}:arm64v8-${META_TAG} \
-                    lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
+            echo "Running on node: ${NODE_NAME}"
+            echo 'Logging into Github'
+            sh '''#! /bin/bash
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
+               '''
+            sh "docker build \
+              --label \"org.opencontainers.image.created=${GITHUB_DATE}\" \
+              --label \"org.opencontainers.image.authors=linuxserver.io\" \
+              --label \"org.opencontainers.image.url=https://github.com/linuxserver/docker-swag/packages\" \
+              --label \"org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-swag\" \
+              --label \"org.opencontainers.image.source=https://github.com/linuxserver/docker-swag\" \
+              --label \"org.opencontainers.image.version=${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}\" \
+              --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.vendor=linuxserver.io\" \
+              --label \"org.opencontainers.image.licenses=GPL-3.0-only\" \
+              --label \"org.opencontainers.image.ref.name=${COMMIT_SHA}\" \
+              --label \"org.opencontainers.image.title=Swag\" \
+              --label \"org.opencontainers.image.description=SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.\" \
+              --no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} \
+              --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
+            sh "docker tag ${IMAGE}:arm64v8-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
+            retry(5) {
+              sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
            }
+            sh '''docker rmi \
+                  ${IMAGE}:arm64v8-${META_TAG} \
+                  ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :'''
          }
        }
      }
@@ -448,6 +556,13 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
+        sh '''#! /bin/bash
+              echo "Packages were updated. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
        script{
          env.EXIT_STATUS = 'ABORTED'
        }
@@ -465,6 +580,13 @@ pipeline {
        }
      }
      steps {
+        sh '''#! /bin/bash
+              echo "There are no package updates. Cleaning up the image and exiting."
+              if [ "${MULTIARCH}" == "true" ]; then
+                docker rmi ${IMAGE}:amd64-${META_TAG}
+              else
+                docker rmi ${IMAGE}:${META_TAG}
+              fi'''
        script{
          env.EXIT_STATUS = 'ABORTED'
        }
@@ -481,20 +603,20 @@ pipeline {
      }
      steps {
        withCredentials([
-          string(credentialsId: 'spaces-key', variable: 'DO_KEY'),
-          string(credentialsId: 'spaces-secret', variable: 'DO_SECRET')
+          string(credentialsId: 'ci-tests-s3-key-id', variable: 'S3_KEY'),
+          string(credentialsId: 'ci-tests-s3-secret-access-key	', variable: 'S3_SECRET')
        ]) {
          script{
-            env.CI_URL = 'https://lsio-ci.ams3.digitaloceanspaces.com/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
+            env.CI_URL = 'https://ci-tests.linuxserver.io/' + env.IMAGE + '/' + env.META_TAG + '/index.html'
          }
          sh '''#! /bin/bash
                set -e
-                docker pull lsiodev/ci:latest
+                docker pull ghcr.io/linuxserver/ci:latest
                if [ "${MULTIARCH}" == "true" ]; then
-                  docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                  docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                  docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                  docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                fi
                docker run --rm \
                --shm-size=1gb \
@@ -506,15 +628,15 @@ pipeline {
                -e PORT=\"${CI_PORT}\" \
                -e SSL=\"${CI_SSL}\" \
                -e BASE=\"${DIST_IMAGE}\" \
-                -e SECRET_KEY=\"${DO_SECRET}\" \
-                -e ACCESS_KEY=\"${DO_KEY}\" \
+                -e SECRET_KEY=\"${S3_SECRET}\" \
+                -e ACCESS_KEY=\"${S3_KEY}\" \
                -e DOCKER_ENV=\"${CI_DOCKERENV}\" \
                -e WEB_SCREENSHOT=\"${CI_WEB}\" \
                -e WEB_AUTH=\"${CI_AUTH}\" \
                -e WEB_PATH=\"${CI_WEBPATH}\" \
                -e DO_REGION="ams3" \
                -e DO_BUCKET="lsio-ci" \
-                -t lsiodev/ci:latest \
+                -t ghcr.io/linuxserver/ci:latest \
                python /ci/ci.py'''
        }
      }
@@ -541,7 +663,7 @@ pipeline {
            sh '''#! /bin/bash
                  set -e
                  echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                  echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                  for PUSHIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                    docker tag ${IMAGE}:${META_TAG} ${PUSHIMAGE}:${META_TAG}
@@ -554,7 +676,7 @@ pipeline {
               '''
          }
          sh '''#! /bin/bash
-                for DELETEIMAGE in "${GITHUBIMAGE}" "{GITLABIMAGE}" "${IMAGE}"; do
+                for DELETEIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                  docker rmi \
                  ${DELETEIMAGE}:${META_TAG} \
                  ${DELETEIMAGE}:${EXT_RELEASE_TAG} \
@@ -583,15 +705,15 @@ pipeline {
            sh '''#! /bin/bash
                  set -e
                  echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin
-                  echo $GITHUB_TOKEN | docker login docker.pkg.github.com -u LinuxServer-CI --password-stdin
+                  echo $GITHUB_TOKEN | docker login ghcr.io -u LinuxServer-CI --password-stdin
                  echo $GITLAB_TOKEN | docker login registry.gitlab.com -u LinuxServer.io --password-stdin
                  if [ "${CI}" == "false" ]; then
-                    docker pull lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker pull lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
-                    docker tag lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
-                    docker tag lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker pull ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm32v7-${META_TAG}
+                    docker tag ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} ${IMAGE}:arm64v8-${META_TAG}
                  fi
-                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}"; do
+                  for MANIFESTIMAGE in "${IMAGE}" "${GITLABIMAGE}" "${GITHUBIMAGE}"; do
                    docker tag ${IMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG}
                    docker tag ${IMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG}
                    docker tag ${IMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
@@ -618,6 +740,7 @@ pipeline {
                    docker manifest create ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                    docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} --os linux --arch arm
                    docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} --os linux --arch arm64 --variant v8
+                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} || :
                    docker manifest create ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} --os linux --arch arm
                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} --os linux --arch arm64 --variant v8
@@ -625,28 +748,6 @@ pipeline {
                    docker manifest push --purge ${MANIFESTIMAGE}:${META_TAG} 
                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} 
                  done
-                  docker tag ${IMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker tag ${IMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker tag ${IMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:latest
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${META_TAG}
-                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-latest
-                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-latest
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
-                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:amd64-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm64v8-${META_TAG}
-                  docker push ${GITHUBIMAGE}:latest
-                  docker push ${GITHUBIMAGE}:${META_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-latest
-                  docker push ${GITHUBIMAGE}:arm64v8-latest
-                  docker push ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
-                  docker push ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
               '''
          }
          sh '''#! /bin/bash
@@ -654,14 +755,17 @@ pipeline {
                  docker rmi \
                  ${DELETEIMAGE}:amd64-${META_TAG} \
                  ${DELETEIMAGE}:amd64-latest \
+                  ${DELETEIMAGE}:amd64-${EXT_RELEASE_TAG} \
                  ${DELETEIMAGE}:arm32v7-${META_TAG} \
                  ${DELETEIMAGE}:arm32v7-latest \
+                  ${DELETEIMAGE}:arm32v7-${EXT_RELEASE_TAG} \
                  ${DELETEIMAGE}:arm64v8-${META_TAG} \
-                  ${DELETEIMAGE}:arm64v8-latest || :
+                  ${DELETEIMAGE}:arm64v8-latest \
+                  ${DELETEIMAGE}:arm64v8-${EXT_RELEASE_TAG} || :
                done
                docker rmi \
-                lsiodev/buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
-                lsiodev/buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
+                ghcr.io/linuxserver/lsiodev-buildcache:arm32v7-${COMMIT_SHA}-${BUILD_NUMBER} \
+                ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} || :
             '''
        }
      }
@@ -677,9 +781,9 @@ pipeline {
        environment name: 'EXIT_STATUS', value: ''
      }
      steps {
-        echo "Pushing New tag for current commit ${EXT_RELEASE_CLEAN}-ls${LS_TAG_NUMBER}"
+        echo "Pushing New tag for current commit ${META_TAG}"
        sh '''curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/git/tags \
-        -d '{"tag":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+        -d '{"tag":"'${META_TAG}'",\
             "object": "'${COMMIT_SHA}'",\
             "message": "Tagging Release '${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}' to master",\
             "type": "commit",\
@@ -687,9 +791,9 @@ pipeline {
        echo "Pushing New release for Tag"
        sh '''#! /bin/bash
              echo "Updating PIP version of ${EXT_PIP} to ${EXT_RELEASE_CLEAN}" > releasebody.json
-              echo '{"tag_name":"'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+              echo '{"tag_name":"'${META_TAG}'",\
                     "target_commitish": "master",\
-                     "name": "'${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}'",\
+                     "name": "'${META_TAG}'",\
                     "body": "**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n**PIP Changes:**\\n\\n' > start
              printf '","draft": false,"prerelease": false}' >> releasebody.json
              paste -d'\\0' start releasebody.json > releasebody.json.done
@@ -714,9 +818,9 @@ pipeline {
          sh '''#! /bin/bash
                set -e
                TEMPDIR=$(mktemp -d)
-                docker pull linuxserver/jenkins-builder:latest
-                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
-                docker pull lsiodev/readme-sync
+                docker pull ghcr.io/linuxserver/jenkins-builder:latest
+                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins ghcr.io/linuxserver/jenkins-builder:latest
+                docker pull ghcr.io/linuxserver/readme-sync
                docker run --rm=true \
                  -e DOCKERHUB_USERNAME=$DOCKERUSER \
                  -e DOCKERHUB_PASSWORD=$DOCKERPASS \
@@ -724,7 +828,7 @@ pipeline {
                  -e DOCKER_REPOSITORY=${IMAGE} \
                  -e GIT_BRANCH=master \
                  -v ${TEMPDIR}/docker-${CONTAINER_NAME}:/mnt \
-                  lsiodev/readme-sync bash -c 'node sync' 
+                  ghcr.io/linuxserver/readme-sync bash -c 'node sync'
                rm -Rf ${TEMPDIR} '''
        }
      }
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 <!-- DO NOT EDIT THIS FILE MANUALLY  -->
-<!-- Please read the CONTRIBUTING.md -->
+<!-- Please read the https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md -->

 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)

@@ -12,13 +12,14 @@

 The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring:

- * regular and timely application updates
- * easy user mappings (PGID, PUID)
- * custom base image with s6 overlay
- * weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
- * regular security updates
+* regular and timely application updates
+* easy user mappings (PGID, PUID)
+* custom base image with s6 overlay
+* weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
+* regular security updates

 Find us at:
+
 * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
 * [Discord](https://discord.gg/YWrKVTn) - realtime support / chat with the community and the team.
 * [Discourse](https://discourse.linuxserver.io) - post on our community forum.
@@ -31,14 +32,14 @@ Find us at:
 [![GitHub Stars](https://img.shields.io/github/stars/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag)
 [![GitHub Release](https://img.shields.io/github/release/linuxserver/docker-swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/linuxserver/docker-swag/releases)
 [![GitHub Package Repository](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub%20Package&logo=github)](https://github.com/linuxserver/docker-swag/packages)
-[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/Linuxserver.io/docker-swag/container_registry)
+[![GitLab Container Registry](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitLab%20Registry&logo=gitlab)](https://gitlab.com/linuxserver.io/docker-swag/container_registry)
 [![MicroBadger Layers](https://img.shields.io/microbadger/layers/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge)](https://microbadger.com/images/linuxserver/swag "Get your own version badge on microbadger.com")
 [![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=pulls&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Docker Stars](https://img.shields.io/docker/stars/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=stars&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-swag%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/)
-[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Flsio-ci.ams3.digitaloceanspaces.com%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/swag/latest/index.html)
+[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Fci-tests.linuxserver.io%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://ci-tests.linuxserver.io/linuxserver/swag/latest/index.html)

-SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.
+SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.

 [![swag](https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif)](https://linuxserver.io)

@@ -46,7 +47,7 @@ SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relatio

 Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).

-Simply pulling `linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
+Simply pulling `ghcr.io/linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.

 The architectures supported by this image are:

@@ -56,131 +57,6 @@ The architectures supported by this image are:
 | arm64 | arm64v8-latest |
 | armhf | arm32v7-latest |

-
-## Usage
-
-Here are some example snippets to help you get started creating a container.
-
-### docker-compose ([recommended](https://docs.linuxserver.io/general/docker-compose))
-
-Compatible with docker-compose v2 schemas.
-
-```yaml
---
-version: "2.1"
-services:
-  swag:
-    image: linuxserver/swag
-    container_name: swag
-    cap_add:
-      - NET_ADMIN
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Europe/London
-      - URL=yourdomain.url
-      - SUBDOMAINS=www,
-      - VALIDATION=http
-      - DNSPLUGIN=cloudflare #optional
-      - PROPAGATION= #optional
-      - DUCKDNSTOKEN= #optional
-      - EMAIL= #optional
-      - ONLY_SUBDOMAINS=false #optional
-      - EXTRA_DOMAINS= #optional
-      - STAGING=false #optional
-      - MAXMINDDB_LICENSE_KEY= #optional
-    volumes:
-      - /path/to/appdata/config:/config
-    ports:
-      - 443:443
-      - 80:80 #optional
-    restart: unless-stopped
-```
-
-### docker cli
-
-```
-docker run -d \
-  --name=swag \
-  --cap-add=NET_ADMIN \
-  -e PUID=1000 \
-  -e PGID=1000 \
-  -e TZ=Europe/London \
-  -e URL=yourdomain.url \
-  -e SUBDOMAINS=www, \
-  -e VALIDATION=http \
-  -e DNSPLUGIN=cloudflare `#optional` \
-  -e PROPAGATION= `#optional` \
-  -e DUCKDNSTOKEN= `#optional` \
-  -e EMAIL= `#optional` \
-  -e ONLY_SUBDOMAINS=false `#optional` \
-  -e EXTRA_DOMAINS= `#optional` \
-  -e STAGING=false `#optional` \
-  -e MAXMINDDB_LICENSE_KEY= `#optional` \
-  -p 443:443 \
-  -p 80:80 `#optional` \
-  -v /path/to/appdata/config:/config \
-  --restart unless-stopped \
-  linuxserver/swag
-```
-
-
-## Parameters
-
-Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
-
-| Parameter | Function |
-| :----: | --- |
-| `-p 443` | Https port |
-| `-p 80` | Http port (required for http validation and http -> https redirect) |
-| `-e PUID=1000` | for UserID - see below for explanation |
-| `-e PGID=1000` | for GroupID - see below for explanation |
-| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London. |
-| `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
-| `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
-| `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
-| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
-| `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
-| `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
-| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications. |
-| `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
-| `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
-| `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
-| `-e MAXMINDDB_LICENSE_KEY=` | Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly. |
-| `-v /config` | All the config files including the webroot reside here. |
-
-## Environment variables from files (Docker secrets)
-
-You can set any environment variable from a file by using a special prepend `FILE__`.
-
-As an example:
-
-```
-e FILE__PASSWORD=/run/secrets/mysecretpassword
-```
-
-Will set the environment variable `PASSWORD` based on the contents of the `/run/secrets/mysecretpassword` file.
-
-## Umask for running applications
-
-For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional `-e UMASK=022` setting.
-Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up [here](https://en.wikipedia.org/wiki/Umask) before asking for support.
-
-## User / Group Identifiers
-
-When using volumes (`-v` flags) permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
-
-Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
-
-In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
-
-```
-  $ id username
-    uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
-```
-
-
-&nbsp;
 ## Application Setup

 > ### Migrating from the old `linuxserver/letsencrypt` image
@@ -223,14 +99,15 @@ This will *ask* Google et al not to index and list your site. Be careful with th
  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
  * These certs include:
-  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
+  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
  2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
  3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
 ### Using fail2ban
-* This container includes fail2ban set up with 3 jails by default:
+* This container includes fail2ban set up with 4 jails by default:
  1. nginx-http-auth
  2. nginx-badbots
  3. nginx-botsearch
+  4. nginx-deny
 * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
 * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
 * You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -250,13 +127,136 @@ This will *ask* Google et al not to index and list your site. Be careful with th
 * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
 * You can check the new sample and adjust your active config as needed.

+## Usage
+
+Here are some example snippets to help you get started creating a container.
+
+### docker-compose ([recommended](https://docs.linuxserver.io/general/docker-compose))
+
+Compatible with docker-compose v2 schemas.
+
+```yaml
+---
+version: "2.1"
+services:
+  swag:
+    image: ghcr.io/linuxserver/swag
+    container_name: swag
+    cap_add:
+      - NET_ADMIN
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/London
+      - URL=yourdomain.url
+      - SUBDOMAINS=www,
+      - VALIDATION=http
+      - CERTPROVIDER= #optional
+      - DNSPLUGIN=cloudflare #optional
+      - PROPAGATION= #optional
+      - DUCKDNSTOKEN= #optional
+      - EMAIL= #optional
+      - ONLY_SUBDOMAINS=false #optional
+      - EXTRA_DOMAINS= #optional
+      - STAGING=false #optional
+      - MAXMINDDB_LICENSE_KEY= #optional
+    volumes:
+      - /path/to/appdata/config:/config
+    ports:
+      - 443:443
+      - 80:80 #optional
+    restart: unless-stopped
+```
+
+### docker cli
+
+```bash
+docker run -d \
+  --name=swag \
+  --cap-add=NET_ADMIN \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=Europe/London \
+  -e URL=yourdomain.url \
+  -e SUBDOMAINS=www, \
+  -e VALIDATION=http \
+  -e CERTPROVIDER= `#optional` \
+  -e DNSPLUGIN=cloudflare `#optional` \
+  -e PROPAGATION= `#optional` \
+  -e DUCKDNSTOKEN= `#optional` \
+  -e EMAIL= `#optional` \
+  -e ONLY_SUBDOMAINS=false `#optional` \
+  -e EXTRA_DOMAINS= `#optional` \
+  -e STAGING=false `#optional` \
+  -e MAXMINDDB_LICENSE_KEY= `#optional` \
+  -p 443:443 \
+  -p 80:80 `#optional` \
+  -v /path/to/appdata/config:/config \
+  --restart unless-stopped \
+  ghcr.io/linuxserver/swag
+```
+
+## Parameters
+
+Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
+
+| Parameter | Function |
+| :----: | --- |
+| `-p 443` | Https port |
+| `-p 80` | Http port (required for http validation and http -> https redirect) |
+| `-e PUID=1000` | for UserID - see below for explanation |
+| `-e PGID=1000` | for GroupID - see below for explanation |
+| `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London. |
+| `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
+| `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
+| `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
+| `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
+| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
+| `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
+| `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
+| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
+| `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
+| `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
+| `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
+| `-e MAXMINDDB_LICENSE_KEY=` | Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly. |
+| `-v /config` | All the config files including the webroot reside here. |
+
+## Environment variables from files (Docker secrets)
+
+You can set any environment variable from a file by using a special prepend `FILE__`.
+
+As an example:
+
+```bash
+-e FILE__PASSWORD=/run/secrets/mysecretpassword
+```
+
+Will set the environment variable `PASSWORD` based on the contents of the `/run/secrets/mysecretpassword` file.
+
+## Umask for running applications
+
+For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional `-e UMASK=022` setting.
+Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up [here](https://en.wikipedia.org/wiki/Umask) before asking for support.
+
+## User / Group Identifiers
+
+When using volumes (`-v` flags) permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
+
+Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
+
+In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
+
+```bash
+  $ id username
+    uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
+```

 ## Docker Mods
+
 [![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=swag&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.") [![Docker Universal Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=universal&query=%24.mods%5B%27universal%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=universal "view available universal mods.")

 We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.

-
 ## Support Info

 * Shell access whilst the container is running: `docker exec -it swag /bin/bash`
@@ -264,7 +264,7 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
 * container version number
  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' swag`
 * image version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' linuxserver/swag`
+  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' ghcr.io/linuxserver/swag`

 ## Updating Info

@@ -273,6 +273,7 @@ Most of our images are static, versioned, and require an image update and contai
 Below are the instructions for updating containers:

 ### Via Docker Compose
+
 * Update all images: `docker-compose pull`
  * or update a single image: `docker-compose pull swag`
 * Let compose update all containers as necessary: `docker-compose up -d`
@@ -280,41 +281,48 @@ Below are the instructions for updating containers:
 * You can also remove the old dangling images: `docker image prune`

 ### Via Docker Run
-* Update the image: `docker pull linuxserver/swag`
+
+* Update the image: `docker pull ghcr.io/linuxserver/swag`
 * Stop the running container: `docker stop swag`
 * Delete the container: `docker rm swag`
 * Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
 * You can also remove the old dangling images: `docker image prune`

 ### Via Watchtower auto-updater (only use if you don't remember the original parameters)
+
 * Pull the latest image at its tag and replace it with the same env variables in one run:
-  ```
+
+  ```bash
  docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower \
  --run-once swag
  ```
+
 * You can also remove the old dangling images: `docker image prune`

 **Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using [Docker Compose](https://docs.linuxserver.io/general/docker-compose).

 ### Image Update Notifications - Diun (Docker Image Update Notifier)
+
 * We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.

 ## Building locally

 If you want to make local modifications to these images for development purposes or just to customize the logic:
-```
+
+```bash
 git clone https://github.com/linuxserver/docker-swag.git
 cd docker-swag
 docker build \
  --no-cache \
  --pull \
-  -t linuxserver/swag:latest .
+  -t ghcr.io/linuxserver/swag:latest .
 ```

 The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
-```
+
+```bash
 docker run --rm --privileged multiarch/qemu-user-static:register --reset
 ```

@@ -322,6 +330,21 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

 ## Versions

+* **21.04.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method.
+* **12.04.21:** - Add php7-gmp and php7-pecl-mailparse.
+* **12.04.21:** - Add support for vultr dns validation.
+* **14.03.21:** - Add support for directadmin dns validation.
+* **12.02.21:** - Clean up rust/cargo cache, which ballooned the image size in the last couple of builds.
+* **10.02.21:** - Fix aliyun, domeneshop, inwx and transip dns confs for existing users.
+* **09.02.21:** - Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years).
+* **26.01.21:** - Add support for hetzner dns validation.
+* **20.01.21:** - Add check for ZeroSSL EAB retrieval.
+* **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
+* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting
+* **10.12.20:** - Add support for njalla dns validation
+* **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
+* **01.11.20:** - Add support for netcup dns validation
+* **29.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy.
 * **04.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering.
 * **20.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme.
 * **08.09.20:** - Add php7-xsl.
--- a/package_versions.txt
+++ b/package_versions.txt
@@ -1,220 +1,225 @@
-alpine-baselayout-3.2.0-r7
+alpine-baselayout-3.2.0-r8
 alpine-keys-2.2-r0
-apache2-utils-2.4.46-r0
-apk-tools-2.10.5-r1
+apache2-utils-2.4.46-r3
+apk-tools-2.12.5-r0
 apr-1.7.0-r0
-apr-util-1.6.1-r6
+apr-util-1.6.1-r7
 argon2-libs-20190702-r1
-bash-5.0.17-r0
-brotli-libs-1.0.9-r1
-busybox-1.31.1-r19
+bash-5.1.0-r0
+brotli-libs-1.0.9-r3
+busybox-1.32.1-r6
 c-client-2007f-r11
-ca-certificates-20191127-r4
-ca-certificates-bundle-20191127-r4
-coreutils-8.32-r0
-curl-7.69.1-r1
-db-5.3.28-r1
-expat-2.2.9-r1
-fail2ban-0.11.1-r3
-freetype-2.10.4-r0
-gdbm-1.13-r1
-git-2.26.2-r0
-git-perl-2.26.2-r0
-glib-2.64.6-r0
-gmp-6.2.0-r0
-gnupg-2.2.23-r0
-gnutls-3.6.15-r0
-icu-libs-67.1-r0
-ip6tables-1.8.4-r2
-iptables-1.8.4-r2
+ca-certificates-20191127-r5
+ca-certificates-bundle-20191127-r5
+coreutils-8.32-r2
+curl-7.76.1-r0
+expat-2.2.10-r1
+fail2ban-0.11.1-r4
+freetype-2.10.4-r1
+gdbm-1.19-r0
+git-2.30.2-r0
+git-perl-2.30.2-r0
+glib-2.66.8-r0
+gmp-6.2.1-r0
+gnupg-2.2.27-r0
+gnutls-3.7.1-r0
+icu-libs-67.1-r2
+ip6tables-1.8.6-r0
+iptables-1.8.6-r0
 libacl-2.2.53-r0
-libassuan-2.5.3-r0
+libassuan-2.5.4-r0
 libattr-2.4.48-r0
-libblkid-2.35.2-r0
+libblkid-2.36.1-r1
 libbsd-0.10.0-r0
 libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
-libcap-2.27-r0
-libcrypto1.1-1.1.1g-r0
-libcurl-7.69.1-r1
-libedit-20191231.3.1-r0
-libevent-2.1.11-r1
+libcap-2.46-r0
+libcrypto1.1-1.1.1k-r0
+libcurl-7.76.1-r0
+libedit-20191231.3.1-r1
+libevent-2.1.12-r1
 libffi-3.3-r2
-libgcc-9.3.0-r2
-libgcrypt-1.8.5-r0
-libgd-2.3.0-r1
-libgpg-error-1.37-r0
+libgcc-10.2.1_pre1-r3
+libgcrypt-1.8.7-r0
+libgd-2.3.0-r2
+libgpg-error-1.41-r0
 libice-1.0.10-r0
 libidn-1.35-r0
-libintl-0.20.2-r0
-libjpeg-turbo-2.0.5-r0
-libksba-1.4.0-r0
-libldap-2.4.50-r0
-libmagic-5.38-r0
-libmaxminddb-1.4.2-r1
-libmcrypt-2.5.8-r8
+libintl-0.20.2-r2
+libjpeg-turbo-2.1.0-r0
+libksba-1.5.0-r0
+libldap-2.4.57-r1
+libmagic-5.39-r0
+libmaxminddb-1.5.0-r1
+libmcrypt-2.5.8-r9
 libmemcached-libs-1.0.18-r4
-libmnl-1.0.4-r0
-libmount-2.35.2-r0
-libnftnl-libs-1.1.6-r0
+libmnl-1.0.4-r1
+libmount-2.36.1-r1
+libnftnl-libs-1.1.8-r0
 libpng-1.6.37-r1
-libpq-12.4-r0
+libpq-13.2-r0
 libproc-3.3.16-r0
-libressl3.1-libcrypto-3.1.2-r0
-libressl3.1-libssl-3.1.2-r0
-libsasl-2.1.27-r6
-libseccomp-2.4.3-r0
-libsecret-0.20.3-r0
+libressl3.1-libcrypto-3.1.5-r0
+libressl3.1-libssl-3.1.5-r0
+libsasl-2.1.27-r10
+libseccomp-2.5.1-r1
+libsecret-0.20.4-r0
 libsm-1.2.3-r0
 libsodium-1.0.18-r0
-libssl1.1-1.1.1g-r0
-libstdc++-9.3.0-r2
+libssl1.1-1.1.1k-r0
+libstdc++-10.2.1_pre1-r3
 libtasn1-4.16.0-r1
 libtls-standalone-2.9.1-r1
 libunistring-0.9.10-r0
-libuuid-2.35.2-r0
+libuuid-2.36.1-r1
 libwebp-1.1.0-r0
-libx11-1.6.12-r0
+libx11-1.7.0-r0
 libxau-1.0.9-r0
 libxcb-1.14-r1
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.10-r5
+libxml2-2.9.10-r6
 libxpm-3.5.13-r0
 libxslt-1.1.34-r0
-libxt-1.2.0-r0
-libzip-1.6.1-r1
-linux-pam-1.3.1-r4
-logrotate-3.16.0-r0
-luajit-5.1.20190925-r0
-memcached-1.6.6-r0
-musl-1.1.24-r9
-musl-utils-1.1.24-r9
-nano-4.9.3-r0
-ncurses-libs-6.2_p20200523-r0
-ncurses-terminfo-base-6.2_p20200523-r0
-nettle-3.5.1-r1
-nghttp2-libs-1.41.0-r0
-nginx-1.18.0-r1
-nginx-mod-devel-kit-1.18.0-r1
-nginx-mod-http-echo-1.18.0-r1
-nginx-mod-http-fancyindex-1.18.0-r1
-nginx-mod-http-geoip2-1.18.0-r1
-nginx-mod-http-headers-more-1.18.0-r1
-nginx-mod-http-image-filter-1.18.0-r1
-nginx-mod-http-lua-1.18.0-r1
-nginx-mod-http-lua-upstream-1.18.0-r1
-nginx-mod-http-nchan-1.18.0-r1
-nginx-mod-http-perl-1.18.0-r1
-nginx-mod-http-redis2-1.18.0-r1
-nginx-mod-http-set-misc-1.18.0-r1
-nginx-mod-http-upload-progress-1.18.0-r1
-nginx-mod-http-xslt-filter-1.18.0-r1
-nginx-mod-mail-1.18.0-r1
-nginx-mod-rtmp-1.18.0-r1
-nginx-mod-stream-1.18.0-r1
-nginx-mod-stream-geoip2-1.18.0-r1
-nginx-vim-1.18.0-r1
+libxt-1.2.1-r0
+libzip-1.7.3-r2
+linux-pam-1.5.1-r0
+logrotate-3.18.0-r0
+lz4-libs-1.9.2-r0
+memcached-1.6.9-r0
+musl-1.2.2-r0
+musl-utils-1.2.2-r0
+nano-5.4-r1
+ncurses-libs-6.2_p20210109-r0
+ncurses-terminfo-base-6.2_p20210109-r0
+nettle-3.7.2-r0
+nghttp2-libs-1.42.0-r1
+nginx-1.18.0-r13
+nginx-mod-devel-kit-1.18.0-r13
+nginx-mod-http-brotli-1.18.0-r13
+nginx-mod-http-dav-ext-1.18.0-r13
+nginx-mod-http-echo-1.18.0-r13
+nginx-mod-http-fancyindex-1.18.0-r13
+nginx-mod-http-geoip2-1.18.0-r13
+nginx-mod-http-headers-more-1.18.0-r13
+nginx-mod-http-image-filter-1.18.0-r13
+nginx-mod-http-nchan-1.18.0-r13
+nginx-mod-http-perl-1.18.0-r13
+nginx-mod-http-redis2-1.18.0-r13
+nginx-mod-http-set-misc-1.18.0-r13
+nginx-mod-http-upload-progress-1.18.0-r13
+nginx-mod-http-xslt-filter-1.18.0-r13
+nginx-mod-mail-1.18.0-r13
+nginx-mod-rtmp-1.18.0-r13
+nginx-mod-stream-1.18.0-r13
+nginx-mod-stream-geoip2-1.18.0-r13
+nginx-vim-1.18.0-r13
 npth-1.6-r0
-openssl-1.1.1g-r0
-p11-kit-0.23.20-r5
+oniguruma-6.9.6-r0
+openssl-1.1.1k-r0
+p11-kit-0.23.22-r0
 pcre-8.44-r0
-pcre2-10.35-r0
-perl-5.30.3-r0
-perl-error-0.17029-r0
-perl-git-2.26.2-r0
-php7-7.3.23-r0
-php7-bcmath-7.3.23-r0
-php7-bz2-7.3.23-r0
-php7-common-7.3.23-r0
-php7-ctype-7.3.23-r0
-php7-curl-7.3.23-r0
-php7-dom-7.3.23-r0
-php7-exif-7.3.23-r0
-php7-fileinfo-7.3.23-r0
-php7-fpm-7.3.23-r0
-php7-ftp-7.3.23-r0
-php7-gd-7.3.23-r0
-php7-iconv-7.3.23-r0
-php7-imap-7.3.23-r0
-php7-intl-7.3.23-r0
-php7-json-7.3.23-r0
-php7-ldap-7.3.23-r0
-php7-mbstring-7.3.23-r0
-php7-mysqli-7.3.23-r0
-php7-mysqlnd-7.3.23-r0
-php7-opcache-7.3.23-r0
-php7-openssl-7.3.23-r0
-php7-pdo-7.3.23-r0
-php7-pdo_mysql-7.3.23-r0
-php7-pdo_odbc-7.3.23-r0
-php7-pdo_pgsql-7.3.23-r0
-php7-pdo_sqlite-7.3.23-r0
-php7-pear-7.3.23-r0
-php7-pecl-apcu-5.1.19-r0
-php7-pecl-igbinary-3.1.6-r0
-php7-pecl-mcrypt-1.0.3-r0
-php7-pecl-memcached-3.1.5-r0
-php7-pecl-redis-5.2.2-r1
-php7-pgsql-7.3.23-r0
-php7-phar-7.3.23-r0
-php7-posix-7.3.23-r0
-php7-session-7.3.23-r0
-php7-simplexml-7.3.23-r0
-php7-soap-7.3.23-r0
-php7-sockets-7.3.23-r0
-php7-sodium-7.3.23-r0
-php7-sqlite3-7.3.23-r0
-php7-tokenizer-7.3.23-r0
-php7-xml-7.3.23-r0
-php7-xmlreader-7.3.23-r0
-php7-xmlrpc-7.3.23-r0
-php7-xmlwriter-7.3.23-r0
-php7-xsl-7.3.23-r0
-php7-zip-7.3.23-r0
-pinentry-1.1.0-r2
-popt-1.16-r7
+pcre2-10.36-r0
+perl-5.32.0-r0
+perl-error-0.17029-r1
+perl-git-2.30.2-r0
+php7-7.4.15-r0
+php7-bcmath-7.4.15-r0
+php7-bz2-7.4.15-r0
+php7-common-7.4.15-r0
+php7-ctype-7.4.15-r0
+php7-curl-7.4.15-r0
+php7-dom-7.4.15-r0
+php7-exif-7.4.15-r0
+php7-fileinfo-7.4.15-r0
+php7-fpm-7.4.15-r0
+php7-ftp-7.4.15-r0
+php7-gd-7.4.15-r0
+php7-gmp-7.4.15-r0
+php7-iconv-7.4.15-r0
+php7-imap-7.4.15-r0
+php7-intl-7.4.15-r0
+php7-json-7.4.15-r0
+php7-ldap-7.4.15-r0
+php7-mbstring-7.4.15-r0
+php7-mysqli-7.4.15-r0
+php7-mysqlnd-7.4.15-r0
+php7-opcache-7.4.15-r0
+php7-openssl-7.4.15-r0
+php7-pdo-7.4.15-r0
+php7-pdo_mysql-7.4.15-r0
+php7-pdo_odbc-7.4.15-r0
+php7-pdo_pgsql-7.4.15-r0
+php7-pdo_sqlite-7.4.15-r0
+php7-pear-7.4.15-r0
+php7-pecl-apcu-5.1.20-r0
+php7-pecl-igbinary-3.2.2-r0
+php7-pecl-mailparse-3.1.1-r1
+php7-pecl-mcrypt-1.0.4-r0
+php7-pecl-memcached-3.1.5-r2
+php7-pecl-redis-5.3.4-r0
+php7-pgsql-7.4.15-r0
+php7-phar-7.4.15-r0
+php7-posix-7.4.15-r0
+php7-session-7.4.15-r0
+php7-simplexml-7.4.15-r0
+php7-soap-7.4.15-r0
+php7-sockets-7.4.15-r0
+php7-sodium-7.4.15-r0
+php7-sqlite3-7.4.15-r0
+php7-tokenizer-7.4.15-r0
+php7-xml-7.4.15-r0
+php7-xmlreader-7.4.15-r0
+php7-xmlrpc-7.4.15-r0
+php7-xmlwriter-7.4.15-r0
+php7-xsl-7.4.15-r0
+php7-zip-7.4.15-r0
+pinentry-1.1.1-r0
+popt-1.18-r0
 procps-3.3.16-r0
 py3-appdirs-1.4.4-r1
-py3-asn1crypto-1.3.0-r0
+py3-asn1crypto-1.4.0-r0
 py3-cachecontrol-0.12.6-r0
-py3-certifi-2020.4.5.1-r0
-py3-cffi-1.14.0-r2
-py3-chardet-3.0.4-r4
-py3-colorama-0.4.3-r0
+py3-cffi-1.14.4-r0
+py3-chardet-4.0.0-r0
+py3-colorama-0.4.4-r0
 py3-contextlib2-0.6.0-r0
 py3-cparser-2.20-r0
-py3-cryptography-2.9.2-r0
-py3-distlib-0.3.0-r0
+py3-cryptography-3.3.2-r0
+py3-distlib-0.3.1-r1
 py3-distro-1.5.0-r1
 py3-future-0.18.2-r1
-py3-html5lib-1.0.1-r4
-py3-idna-2.9-r0
+py3-html5lib-1.1-r0
+py3-idna-3.1-r0
 py3-lockfile-0.12.2-r3
-py3-msgpack-1.0.0-r0
-py3-ordered-set-4.0.1-r0
-py3-packaging-20.4-r0
-py3-parsing-2.4.7-r0
-py3-pep517-0.8.2-r0
-py3-pip-20.1.1-r0
+py3-msgpack-1.0.2-r0
+py3-ordered-set-4.0.2-r0
+py3-packaging-20.9-r0
+py3-parsing-2.4.7-r1
+py3-pep517-0.9.1-r0
+py3-pip-20.3.4-r0
 py3-progress-1.5-r0
 py3-pytoml-0.1.21-r0
-py3-requests-2.23.0-r0
+py3-requests-2.25.1-r1
 py3-retrying-1.3.3-r0
-py3-setuptools-47.0.0-r0
+py3-setuptools-51.3.3-r0
 py3-six-1.15.0-r0
-py3-toml-0.10.1-r0
-py3-urllib3-1.25.9-r0
+py3-toml-0.10.2-r0
+py3-urllib3-1.26.2-r1
 py3-webencodings-0.5.1-r3
-python3-3.8.5-r0
-readline-8.0.4-r0
-scanelf-1.2.6-r0
+python3-3.8.8-r0
+readline-8.1.0-r0
+s6-ipcserver-2.10.0.0-r0
+scanelf-1.2.8-r0
 shadow-4.8.1-r0
-sqlite-libs-3.32.1-r0
-ssl_client-1.31.1-r19
-tzdata-2020a-r0
-unixodbc-2.3.7-r2
-whois-5.5.6-r0
+skalibs-2.10.0.0-r0
+sqlite-libs-3.34.1-r0
+ssl_client-1.32.1-r6
+tzdata-2021a-r0
+unixodbc-2.3.9-r1
+utmps-0.1.0.0-r0
+whois-5.5.7-r1
 xz-5.2.5-r0
 xz-libs-5.2.5-r0
 zlib-1.2.11-r3
+zstd-libs-1.4.5-r3
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -4,7 +4,7 @@
 project_name: swag
 project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
-project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention."
+project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"

 project_blurb_optional_extras_enabled: false
@@ -50,10 +50,11 @@ cap_add_param_vars:
 # optional container parameters
 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `google`, `inwx`, `linode`, `luadns`, `nsone`, `ovh`, `rfc2136`, `route53` and `transip`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
+  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
+  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `domeneshop`, `gandi`, `gehirn`, `google`, `hetzner`, `inwx`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
  - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
  - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
-  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications." }
+  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
  - { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
  - { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
  - { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
@@ -117,14 +118,15 @@ app_setup_block: |
    1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
    2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
    * These certs include:
-    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Let's Encrypt and used by nginx and various other apps
+    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
    2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
    3. `priv-fullchain-bundle.pem`, a pem cert that bundles the private key and the fullchain, used by apps like ZNC
  ### Using fail2ban
-  * This container includes fail2ban set up with 3 jails by default:
+  * This container includes fail2ban set up with 4 jails by default:
    1. nginx-http-auth
    2. nginx-badbots
    3. nginx-botsearch
+    4. nginx-deny
  * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
  * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
  * You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -149,6 +151,21 @@ app_setup_nginx_reverse_proxy_block: ""

 # changelog
 changelogs:
+  - { date: "21.04.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method." }
+  - { date: "12.04.21:", desc: "Add php7-gmp and php7-pecl-mailparse." }
+  - { date: "12.04.21:", desc: "Add support for vultr dns validation." }
+  - { date: "14.03.21:", desc: "Add support for directadmin dns validation." }
+  - { date: "12.02.21:", desc: "Clean up rust/cargo cache, which ballooned the image size in the last couple of builds." }
+  - { date: "10.02.21:", desc: "Fix aliyun, domeneshop, inwx and transip dns confs for existing users." }
+  - { date: "09.02.21:", desc: "Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years)." }
+  - { date: "26.01.21:", desc: "Add support for hetzner dns validation." }
+  - { date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval." }
+  - { date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled." }
+  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting" }
+  - { date: "10.12.20:", desc: "Add support for njalla dns validation" }
+  - { date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation." }
+  - { date: "01.11.20:", desc: "Add support for netcup dns validation" }
+  - { date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy." }
  - { date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering." }
  - { date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
  - { date: "08.09.20:", desc: "Add php7-xsl." }
--- a/root/app/duckdns-txt
+++ b/root/app/duckdns-txt
@@ -1,6 +1,6 @@
 #!/bin/bash

-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 curl https://www.duckdns.org/update?domains=${CERTBOT_DOMAIN}\&token=${ORIGDUCKDNSTOKEN}\&txt=${CERTBOT_VALIDATION}

--- a/root/app/le-renew.sh
+++ b/root/app/le-renew.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/with-contenv bash

-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 echo "<------------------------------------------------->"
 echo
--- a/root/defaults/502.html
+++ b/root/defaults/502.html
@@ -0,0 +1,44 @@
+<html>
+    <head>
+        <title>502</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+            background-color: #961313;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 28px;
+            line-height: 26px;
+        }
+        h2{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>502</h1>
+            <h2>Nginx can not connect to the application</h2>
+            <p>Some common reasons are listed here: <a target="_blank" href="https://docs.linuxserver.io/general/swag#502">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>
--- a/root/defaults/authelia-location.conf
+++ b/root/defaults/authelia-location.conf
@@ -1,4 +1,4 @@
-## Version 2020/05/31 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
+## Version 2021/04/21 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Make sure that the authelia configuration.yml has 'path: "authelia"' defined

@@ -6,6 +6,10 @@ auth_request /authelia/api/verify;
 auth_request_set $target_url $scheme://$http_host$request_uri;
 auth_request_set $user $upstream_http_remote_user;
 auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
 proxy_set_header Remote-User $user;
 proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Name $name;
+proxy_set_header Remote-Email $email;
 error_page 401 =302 https://$http_host/authelia/?rd=$target_url;
--- a/root/defaults/authelia-server.conf
+++ b/root/defaults/authelia-server.conf
@@ -1,4 +1,4 @@
-## Version 2020/05/31 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
+## Version 2021/04/21 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia

 location ^~ /authelia {
@@ -28,7 +28,8 @@ location = /authelia/api/verify {
    proxy_set_header Host $host;
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $remote_addr; 
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Method $request_method;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Uri $request_uri;
--- a/root/defaults/default
+++ b/root/defaults/default
@@ -1,4 +1,6 @@
-## Version 2020/05/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+## Version 2021/01/03 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
+
+error_page 502 /502.html;

 # redirect all traffic to https
 server {
--- a/root/defaults/dns-conf/aliyun.ini
+++ b/root/defaults/dns-conf/aliyun.ini
@@ -2,5 +2,5 @@
 # https://ram.console.aliyun.com/
 # And ensure your RAM account has AliyunDNSFullAccess permission.

-certbot_dns_aliyun:dns_aliyun_access_key = 12345678
-certbot_dns_aliyun:dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef
+dns_aliyun_access_key = 12345678
+dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef
--- a/root/defaults/dns-conf/directadmin.ini
+++ b/root/defaults/dns-conf/directadmin.ini
@@ -0,0 +1,21 @@
+# Instructions: https://github.com/cybercinch/certbot-dns-directadmin/blob/master/certbot_dns_directadmin/__init__.py
+
+# It is recommended to create a login key in the DirectAdmin control panel to be used as value for directadmin_password.
+# Instructions on how to create such key can be found at https://help.directadmin.com/item.php?id=523.
+#
+# Make sure to grant the following permissions:
+# - CMD_API_LOGIN_TEST
+# - CMD_API_DNS_CONTROL
+# - CMD_API_SHOW_DOMAINS
+#
+# Username and password can also be used in case your DirectAdmin instance has no support for login keys.
+
+# The DirectAdmin Server url
+# include the scheme and the port number (Normally 2222)
+directadmin_url = https://my.directadminserver.com:2222
+
+# The DirectAdmin username
+directadmin_username = username
+
+# The DirectAdmin password
+directadmin_password = aSuperStrongPassword
--- a/root/defaults/dns-conf/domeneshop.ini
+++ b/root/defaults/dns-conf/domeneshop.ini
@@ -1,4 +1,4 @@
 # Instructions: https://github.com/domeneshop/certbot-dns-domeneshop#credentials
 # Replace with your values
-certbot_dns_domeneshop:dns_domeneshop_client_token=1234567890abcdef
-certbot_dns_domeneshop:dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs
+dns_domeneshop_client_token=1234567890abcdef
+dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs
--- a/root/defaults/dns-conf/gehirn.ini
+++ b/root/defaults/dns-conf/gehirn.ini
@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-gehirn.readthedocs.io/en/stable/
+# Replace with your values
+dns_gehirn_api_token  = 00000000-0000-0000-0000-000000000000
+dns_gehirn_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
--- a/root/defaults/dns-conf/hetzner.ini
+++ b/root/defaults/dns-conf/hetzner.ini
@@ -0,0 +1,3 @@
+# Instructions: https://github.com/ctrlaltcoop/certbot-dns-hetzner
+# Replace with your values
+dns_hetzner_api_token = nohnah4zoo9Kiejee9aGh0thoopee2sa
--- a/root/defaults/dns-conf/inwx.ini
+++ b/root/defaults/dns-conf/inwx.ini
@@ -1,6 +1,6 @@
 # Instructions: https://github.com/oGGy990/certbot-dns-inwx
 # Replace with your values
-certbot_dns_inwx:dns_inwx_url           = https://api.domrobot.com/xmlrpc/
-certbot_dns_inwx:dns_inwx_username      = your_username
-certbot_dns_inwx:dns_inwx_password      = your_password
-certbot_dns_inwx:dns_inwx_shared_secret = your_shared_secret optional
+dns_inwx_url           = https://api.domrobot.com/xmlrpc/
+dns_inwx_username      = your_username
+dns_inwx_password      = your_password
+dns_inwx_shared_secret = your_shared_secret optional
--- a/root/defaults/dns-conf/netcup.ini
+++ b/root/defaults/dns-conf/netcup.ini
@@ -0,0 +1,3 @@
+dns_netcup_customer_id  = 123456
+dns_netcup_api_key      = 0123456789abcdef0123456789abcdef01234567
+dns_netcup_api_password = abcdef0123456789abcdef01234567abcdef0123
--- a/root/defaults/dns-conf/njalla.ini
+++ b/root/defaults/dns-conf/njalla.ini
@@ -0,0 +1,2 @@
+# Generate your API token here: https://njal.la/settings/api/
+dns_njalla_token=0000000000000000000000000000000000000000
--- a/root/defaults/dns-conf/sakuracloud.ini
+++ b/root/defaults/dns-conf/sakuracloud.ini
@@ -0,0 +1,4 @@
+# Instructions: https://certbot-dns-sakuracloud.readthedocs.io/en/stable/
+# Replace with your values
+dns_sakuracloud_api_token  = 00000000-0000-0000-0000-000000000000
+dns_sakuracloud_api_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
--- a/root/defaults/dns-conf/transip.ini
+++ b/root/defaults/dns-conf/transip.ini
@@ -1,6 +1,30 @@
 # Instructions: https://readthedocs.org/projects/certbot-dns-transip/
-# Convert the key to an RSA key (openssl rsa -in transip.key -out transip-rsa.key)
-# Place .key-file in the same directory as this file. Location "/config/dns-conf" is from within the container
+#
+# This DNS plugin can be used to generate SSL wildcard certificates via TransIP DNS TXT records
+#
+# Login with your TransIP account and go to My Account | API:
+# 1. API-settings: On
+#
+# 2. IP-address/ranges whitelist: Add a new authorized IP address (Swag Docker) to use the API
+#
+# 3. Generate a new Key Pair and copy the private key to a new transip.key file in the format:
+#    -----BEGIN PRIVATE KEY-----
+#    ...
+#    -----END PRIVATE KEY-----
+#
+# 4. Convert the key to an RSA key with command:
+#     openssl rsa -in transip.key -out /config/dns-conf/transip-rsa.key
+#
+# 5. Set permission
+#     chmod 600 /config/dns-conf/transip-rsa.key
+#
+# 6. Replace <transip_username> below with your TransIP username
+#
+# 7. Create wildcard certificate with Swag environment variables:
+#      SUBDOMAINS=wildcard
+#      VALIDATION=dns
+#      DNSPLUGIN=transip
+
+dns_transip_username = <transip_username>
+dns_transip_key_file = /config/dns-conf/transip-rsa.key

-certbot_dns_transip:dns_transip_username = <transip_username>
-certbot_dns_transip:dns_transip_key_file = /config/dns-conf/transip-rsa.key
--- a/root/defaults/dns-conf/vultr.ini
+++ b/root/defaults/dns-conf/vultr.ini
@@ -0,0 +1,3 @@
+# Instructions: https://github.com/lezgomatt/certbot-dns-vultr
+# Replace with your vultr Personal Access Token (see https://www.vultr.com/docs/how-to-setup-dynamic-dns).
+dns_vultr_key = YOUR_VULTR_API_KEY
--- a/root/defaults/geoip2.conf
+++ b/root/defaults/geoip2.conf
@@ -1,4 +1,4 @@
-## Version 2020/09/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
+## Version 2020/10/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
 # To enable, uncommment the Geoip2 config line in nginx.conf
 # Add the -e MAXMINDDB_LICENSE_KEY=<licensekey> to automatically download the Geolite2 database.
 # A Maxmind license key can be acquired here: https://www.maxmind.com/en/geolite2/signup
@@ -18,48 +18,52 @@ geoip2 /config/geoip2db/GeoLite2-City.mmdb {
 # GEOIP2 COUNTRY CONFIG
 map $geoip2_data_country_iso_code $allowed_country {
    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
    default yes;

    # Below you will setup conditions with yes or no
    # ex: <condition> <yes/no>;
-    # If your default is set to yes you can setup conditions that would set it to no (and vice versa)
-    # Conditions are either network address (CIDR notation) or country code

    # allow United Kingdom.
    #GB yes;
-
-    # allow local access.
-    #192.168.1.0/24 yes;
 }

 # GEOIP2 CITY CONFIG
 map $geoip2_data_city_name $allowed_city {
    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
    default yes;

    # Below you will setup conditions with yes or no
    # ex: <condition> <yes/no>;
-    # If your default is set to yes you can setup conditions that would set it to no (and vice versa)
-    # Conditions are either network address (CIDR notation) or city name

    # allow Inverness.
    #Inverness yes;
+}

-    # allow local access.
-    #192.168.1.0/24 yes;
+# ALLOW LOCAL ACCESS
+geo $allow_list {
+    default yes; # Set this to no if $allowed_country or $allowed_city default is no. 
+    # IP/CIDR yes; # e.g. 192.168.1.0/24 yes;
 }

 # Server config example:
-# Add the following if statement inside any server context where you want to geo block countries.
+# Add the following if statements inside any server context where you want to geo block countries.

 ########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
 #	if ($allowed_country = no) {
 #	return 444;
 #	}
 #########################################

-# Add the following if statement inside any server context where you want to geo block cities.
+# Add the following if statements inside any server context where you want to geo block cities.
 ########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
 #	if ($allowed_city = no) {
 #	return 444;
 #	}
@@ -84,6 +88,10 @@ map $geoip2_data_city_name $allowed_city {
 #    #include /config/nginx/authelia-server.conf;


+#   # Allow lan access if default is set to no
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
 #    # Country geo block
 #    if ($allowed_country = no) {
 #       return 444;
--- a/root/defaults/index.html
+++ b/root/defaults/index.html
@@ -0,0 +1,39 @@
+<html>
+    <head>
+        <title>Welcome to your SWAG instance</title>
+        <style>
+        body{
+            font-family: Helvetica, Arial, sans-serif;
+        }
+        .message{
+            width:440px;
+            padding:20px 40px;
+            margin:0 auto;
+            background-color:#f9f9f9;
+            border:1px solid #ddd;
+            color: #1e3d62;
+        }
+        center{
+            margin:40px 0;
+        }
+        h1{
+            font-size: 18px;
+            line-height: 26px;
+        }
+        p{
+            font-size: 12px;
+        }
+        a{
+            color: rgb(207, 48, 139);
+        }
+        </style>
+    </head>
+    <body>
+        <div class="message">
+            <h1>Welcome to your <a target="_blank" href="https://github.com/linuxserver/docker-swag">SWAG</a> instance</h1>
+            <p>A webserver and reverse proxy solution brought to you by <a target="_blank" href="https://www.linuxserver.io/">linuxserver.io</a> with php support and a built-in Certbot client.</p>
+            <p>We have an article on how to use swag here: <a target="_blank" href="https://docs.linuxserver.io/general/swag">docs.linuxserver.io</a></p>
+            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
+        </div>
+    </body>
+</html>
--- a/root/defaults/nginx.conf
+++ b/root/defaults/nginx.conf
@@ -1,4 +1,4 @@
-## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
+## Version 2021/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf

 user abc;
 worker_processes 4;
@@ -85,7 +85,7 @@ http {
 	##
 	include /etc/nginx/conf.d/*.conf;
 	include /config/nginx/site-confs/*;
-	lua_load_resty_core off;
+	#Removed lua. Do not remove this comment

 	##
 	# Geoip2 config
--- a/root/defaults/ssl.conf
+++ b/root/defaults/ssl.conf
@@ -1,4 +1,4 @@
-## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
+## Version 2020/10/29 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf

 ### Mozilla Recommendations
 # generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
@@ -40,7 +40,7 @@ ssl_early_data on;

 # Optional additional headers
 #add_header Cache-Control "no-transform" always;
-#add_header Content-Security-Policy "upgrade-insecure-requests";
+#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
 #add_header Referrer-Policy "same-origin" always;
 #add_header X-Content-Type-Options "nosniff" always;
 #add_header X-Frame-Options "SAMEORIGIN" always;
--- a/root/etc/cont-init.d/50-config
+++ b/root/etc/cont-init.d/50-config
@@ -10,6 +10,7 @@ SUBDOMAINS=${SUBDOMAINS}\\n\
 EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
 ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
 VALIDATION=${VALIDATION}\\n\
+CERTPROVIDER=${CERTPROVIDER}\\n\
 DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
 STAGING=${STAGING}\\n"
@@ -20,7 +21,7 @@ if [ -n "${TEST_RUN}" ]; then
 fi

 # Sanitize variables
-SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION )
+SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER )
 for i in "${SANED_VARS[@]}"
 do
  export echo "$i"="${!i//\"/}"
@@ -45,8 +46,6 @@ chown -R abc:abc /config/dns-conf

 # copy reverse proxy configs
 cp -R /defaults/proxy-confs /config/nginx/
-# remove outdated files (remove this action after 2020/10/17)
-rm -f /config/nginx/proxy-confs/seafile.subdomain.config.sample /config/nginx/proxy-confs/librespeed.subdomain.com.sample

 # copy/update the fail2ban config defaults to/in /config
 cp -R /defaults/fail2ban/filter.d /config/fail2ban/
@@ -79,6 +78,14 @@ cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
 	cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
 [[ ! -f /config/nginx/geoip2.conf ]] && \
 	cp /defaults/geoip2.conf /config/nginx/geoip2.conf
+[[ ! -f /config/www/502.html ]] &&
+	cp /defaults/502.html /config/www/502.html
+
+# remove lua bits from nginx.conf if not done before
+if ! grep -q '#Removed lua' /config/nginx/nginx.conf; then 
+  echo "Removing lua specific info from nginx.conf"
+  sed -i 's|\tlua_load_resty_core off;|\t#Removed lua. Do not remove this comment|g' /config/nginx/nginx.conf
+fi

 # copy pre-generated dhparams or generate if needed
 [[ ! -f /config/nginx/dhparams.pem ]] && \
@@ -92,7 +99,7 @@ if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
 fi

 # check to make sure DNSPLUGIN is selected if dns validation is used
-[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|dnsimple|dnsmadeeasy|domeneshop|gandi|google|inwx|linode|luadns|nsone|ovh|rfc2136|route53|transip)$ ]] && \
+[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|directadmin|dnsimple|dnsmadeeasy|domeneshop|gandi|gehirn|google|hetzner|inwx|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \
  echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
  sleep infinity

@@ -100,15 +107,18 @@ fi
 rm /etc/crontabs/*
 cp /config/crontabs/* /etc/crontabs/

-# create original config file if it doesn't exist
-if [ ! -f "/config/donoteditthisfile.conf" ]; then
-  echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
-  echo "Created donoteditthisfile.conf"
+# create original config file if it doesn't exist, move non-hidden legacy file to hidden
+if [ -f "/config/donoteditthisfile.conf" ]; then
+  mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
+fi
+if [ ! -f "/config/.donoteditthisfile.conf" ]; then
+  echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
+  echo "Created .donoteditthisfile.conf"
 fi

 # load original config settings
 # shellcheck disable=SC1091
-. /config/donoteditthisfile.conf
+. /config/.donoteditthisfile.conf

 # set default validation to http
 if [ -z "$VALIDATION" ]; then
@@ -116,11 +126,22 @@ if [ -z "$VALIDATION" ]; then
  echo "VALIDATION parameter not set; setting it to http"
 fi

-# if staging is set to true, use the staging server
-if [ "$STAGING" = "true" ]; then
+# if zerossl is selected or staging is set to true, use the relevant server
+if [ "$CERTPROVIDER" = "zerossl" ] && [ "$STAGING" = "true" ]; then
+  echo "ZeroSSL does not support staging mode, ignoring STAGING variable"
+fi
+if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+  echo "ZeroSSL is selected as the cert provider, registering cert with $EMAIL"
+  ACMESERVER="https://acme.zerossl.com/v2/DV90"
+elif [ "$CERTPROVIDER" = "zerossl" ] && [ -z "$EMAIL" ]; then
+  echo "ZeroSSL is selected as the cert provider, but the e-mail address has not been entered. Please visit https://zerossl.com, register a new account and set the account e-mail address in the EMAIL environment variable"
+  sleep infinity
+elif [ "$STAGING" = "true" ]; then
  echo "NOTICE: Staging is active"
+  echo "Using Let's Encrypt as the cert provider"
  ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
 else
+  echo "Using Let's Encrypt as the cert provider"
  ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
 fi

@@ -172,33 +193,42 @@ else
  EMAILPARAM="--register-unsafely-without-email"
 fi

+# update plugin names in dns conf inis
+sed -i 's|^certbot_dns_aliyun:||g' /config/dns-conf/aliyun.ini
+sed -i 's|^certbot_dns_domeneshop:||g' /config/dns-conf/domeneshop.ini
+sed -i 's|^certbot_dns_inwx:||g' /config/dns-conf/inwx.ini
+sed -i 's|^certbot_dns_transip:||g' /config/dns-conf/transip.ini
+
 # setting the validation method to use
 if [ "$VALIDATION" = "dns" ]; then
  if [ "$DNSPLUGIN" = "route53" ]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM}"
  elif [[ "$DNSPLUGIN" =~ ^(cpanel)$ ]]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  elif [[ "$DNSPLUGIN" =~ ^(gandi)$ ]]; then
    if [ -n "$PROPAGATION" ];then echo "Gandi dns plugin does not support setting propagation time"; fi
-    PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini --manual-public-ip-logging-ok"
+    PREFCHAL="-a certbot-plugin-${DNSPLUGIN}:dns --certbot-plugin-${DNSPLUGIN}:dns-credentials /config/dns-conf/${DNSPLUGIN}.ini"
  elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
-  elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|inwx|transip)$ ]]; then
-    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="-a certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN} --certbot-dns-${DNSPLUGIN}:dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
+  elif [[ "$DNSPLUGIN" =~ ^(aliyun|domeneshop|hetzner|inwx|netcup|njalla|transip|vultr)$ ]]; then
+    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+  elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
+    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
+    PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  else
    if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
-    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM} --manual-public-ip-logging-ok"
+    PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
  fi
  echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
 elif [ "$VALIDATION" = "tls-sni" ]; then
  PREFCHAL="--non-interactive --standalone --preferred-challenges http"
  echo "*****tls-sni validation has been deprecated, attempting http validation instead"
 elif [ "$VALIDATION" = "duckdns" ]; then
-  PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-public-ip-logging-ok --manual-auth-hook /app/duckdns-txt"
+  PREFCHAL="--non-interactive --manual --preferred-challenges dns --manual-auth-hook /app/duckdns-txt"
  chmod +x /app/duckdns-txt
  echo "duckdns validation is selected"
  if [ "$SUBDOMAINS" = "wildcard" ]; then
@@ -223,20 +253,34 @@ else
 fi

 # checking for changes in cert variables, revoking certs if necessary
-if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ]; then
+if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
  echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
  if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
    ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
-    [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem
  else
-    [[ -f /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGURL"/fullchain.pem
+    ORIGDOMAIN="$ORIGURL"
  fi
+  if [ "$ORIGCERTPROVIDER" = "zerossl" ] && [ -n "$ORIGEMAIL" ]; then
+    REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$ORIGEMAIL")
+    REV_ZEROSSL_EAB_KID=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+    REV_ZEROSSL_EAB_HMAC_KEY=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+    if [ -z "$REV_ZEROSSL_EAB_KID" ] || [ -z "$REV_ZEROSSL_EAB_HMAC_KEY" ]; then
+      echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+      sleep infinity
+    fi
+    REV_ACMESERVER="https://acme.zerossl.com/v2/DV90 --eab-kid ${REV_ZEROSSL_EAB_KID} --eab-hmac-key ${REV_ZEROSSL_EAB_HMAC_KEY}"
+  elif [ "$ORIGSTAGING" = "true" ]; then
+    REV_ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
+  else
+    REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
+  fi
+  [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
  rm -rf /config/etc/letsencrypt
  mkdir -p /config/etc/letsencrypt
 fi

 # saving new variables
-echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\"" > /config/donoteditthisfile.conf
+echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf

 # alter extension for error message
 if [ "$DNSPLUGIN" = "google" ]; then
@@ -247,9 +291,20 @@ fi

 # generating certs if necessary
 if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
+  if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
+    echo "Retrieving EAB from ZeroSSL"
+    EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$EMAIL")
+    ZEROSSL_EAB_KID=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
+    ZEROSSL_EAB_HMAC_KEY=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
+    if [ -z "$ZEROSSL_EAB_KID" ] || [ -z "$ZEROSSL_EAB_HMAC_KEY" ]; then
+      echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
+      sleep infinity
+    fi
+    ZEROSSL_EAB="--eab-kid ${ZEROSSL_EAB_KID} --eab-hmac-key ${ZEROSSL_EAB_HMAC_KEY}"
+  fi
  echo "Generating new certificate"
- # shellcheck disable=SC2086
- certbot certonly --renew-by-default --server $ACMESERVER $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
+  # shellcheck disable=SC2086
+  certbot certonly --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
  if [ -d /config/keys/letsencrypt ]; then
    cd /config/keys/letsencrypt || exit
  else
--- a/root/etc/cont-init.d/70-templates
+++ b/root/etc/cont-init.d/70-templates
@@ -0,0 +1,42 @@
+#!/usr/bin/with-contenv bash
+
+nginx_confs=( \
+    authelia-location.conf \
+    authelia-server.conf \
+    geoip2.conf \
+    ldap.conf \
+    nginx.conf \
+    proxy.conf \
+    site-confs/default \
+    ssl.conf )
+
+for i in ${nginx_confs[@]}; do
+    if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /config/nginx/${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /defaults/$(basename ${i}))" ]; then
+        nginx_confs_changed="/config/nginx/${i}\n${nginx_confs_changed}"
+    fi
+done
+
+if [ -n "$nginx_confs_changed" ]; then
+    echo "**** The following nginx confs have different version dates than the defaults that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the defaults. ****"
+    echo "**** To update them to the latest defaults shipped within the image, delete these files and restart the container. ****"
+    echo "**** If they are user customized, check the date version at the top and compare to the upstream changelog via the link. ****"
+    echo -e "${nginx_confs_changed}"
+fi
+
+proxy_confs=$(ls /config/nginx/proxy-confs/*.conf 2>/dev/null)
+
+for i in $proxy_confs; do
+    if [ -f "${i}.sample" ]; then
+        if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i}.sample)" ]; then
+            proxy_confs_changed="${i}\n${proxy_confs_changed}"
+        fi
+    fi
+done
+
+if [ -n "$proxy_confs_changed" ]; then
+    echo "**** The following reverse proxy confs have different version dates than the samples that are shipped. ****"
+    echo "**** This may be due to user customization or an update to the samples. ****"
+    echo "**** You should compare them to the samples in the same folder to make sure you have the latest updates. ****"
+    echo -e "${proxy_confs_changed}"
+fi
Author	SHA1	Message	Date
LinuxServer-CI	f0514ebdc1	Bot Updating Package Versions	2021-04-29 06:46:29 +01:00
LinuxServer-CI	6aa2e01ec3	Bot Updating Templated Files	2021-04-23 00:29:16 +00:00
aptalca	4d1c0d286b	Merge pull request #114 from authelia/feat/update-authelia-headers feat(authelia): add remote name/email headers and pass http method	2021-04-22 20:26:55 -04:00
James Elliott	1cb549ede1	docs: add readme-vars update as per code review	2021-04-23 07:43:44 +10:00
LinuxServer-CI	706e133b60	Bot Updating Package Versions	2021-04-22 06:00:31 +00:00
LinuxServer-CI	fffa782d67	Bot Updating Templated Files	2021-04-22 05:32:35 +00:00
LinuxServer-CI	9d016ec049	Bot Updating Templated Files	2021-04-22 05:30:57 +00:00
James Elliott	e116a1829e	feat(authelia): add remote name/email headers and pass http method This adds newer remote credential information from the auth_request headers sent by Authelia, Remote-Name includes the users display name, and Remote-Email includes their email. Additionally it sets the X-Forwarded-Method header to the original $request_method detected by nginx, which is used for the new acl rule method filter.	2021-04-21 13:17:25 +10:00
LinuxServer-CI	1f54740dc0	Bot Updating Package Versions	2021-04-15 07:04:29 +01:00
LinuxServer-CI	d675686e17	Bot Updating Package Versions	2021-04-12 23:45:05 +00:00
LinuxServer-CI	7cb21be1d1	Bot Updating Templated Files	2021-04-12 23:56:56 +01:00
aptalca	50b3c86a9e	Merge pull request #109 from Spunkie/php7-extensions swag: php7-gmp and php7-pecl-mailparse	2021-04-12 18:55:34 -04:00
Spunkie	6217372efe	swag: php7-gmp and php7-pecl-mailparse	2021-04-12 15:40:25 -06:00
LinuxServer-CI	8ff31a71c1	Bot Updating Package Versions	2021-04-12 16:41:36 +01:00
aptalca	ff56929cf7	Merge pull request #106 from tcuthbert/master Add vultr certbot authenticator plugin	2021-04-12 11:12:39 -04:00
Thomas Cuthbert	28cdf9b8c6	Add vultr DNS authenticator plugin documentation	2021-04-12 21:58:48 +08:00
Thomas Cuthbert	0ac5a2a4f2	Add vultr certbot authenticator plugin	2021-04-12 21:10:12 +08:00
LinuxServer-CI	36495ea204	Bot Updating Package Versions	2021-04-01 06:13:59 +00:00
LinuxServer-CI	a9be9a304f	Bot Updating Package Versions	2021-03-27 13:13:15 +00:00
LinuxServer-CI	867da78277	Bot Updating Package Versions	2021-03-25 07:22:56 +00:00
LinuxServer-CI	c0f8b3a8b2	Bot Updating Package Versions	2021-03-18 01:44:51 -04:00
LinuxServer-CI	9463ffdc73	Bot Updating Package Versions	2021-03-14 13:55:30 +00:00
LinuxServer-CI	4a43425d74	Bot Updating Templated Files	2021-03-14 13:30:21 +00:00
aptalca	7f0a3bfa80	Merge pull request #99 from Platzii/directadmin Add support for DirectAdmin DNS validation	2021-03-14 09:28:50 -04:00
Simon Lepla	6f8101e9b1	add support for directadmin dns validation	2021-03-14 11:53:29 +01:00
LinuxServer-CI	1a16a7c415	Bot Updating Package Versions	2021-03-11 05:43:28 +00:00
LinuxServer-CI	a134aa0d41	Bot Updating Package Versions	2021-03-03 16:09:33 -05:00
LinuxServer-CI	30d407e922	Bot Updating Package Versions	2021-02-25 05:41:47 +00:00
LinuxServer-CI	79d8ff0378	Bot Updating Package Versions	2021-02-18 05:34:37 +00:00
LinuxServer-CI	2988ac4a5f	Bot Updating Package Versions	2021-02-15 08:52:22 -05:00
LinuxServer-CI	a158c34ab9	Bot Updating Package Versions	2021-02-12 14:33:29 +00:00
LinuxServer-CI	ed57a1038e	Bot Updating Templated Files	2021-02-12 14:10:06 +00:00
Roxedus	a8c55b455a	Merge pull request #87 from linuxserver/cleanup cleanup cargo/rust crud	2021-02-12 15:08:36 +01:00
aptalca	f0be12bcda	cleanup cargo/rust crud	2021-02-12 08:39:08 -05:00
Eric Nemchik	adfe04cedb	Merge pull request #83 from linuxserver/sed fix the right inis	2021-02-10 18:11:22 -06:00
Eric Nemchik	d075d3e2c3	Merge pull request #69 from Erriez/transip-documentation Add documentation TransIP DNS TXT usage	2021-02-10 18:11:15 -06:00
aptalca	a84c6883a6	fix the right inis	2021-02-10 13:35:55 -05:00
LinuxServer-CI	61a5c40902	Bot Updating Package Versions	2021-02-10 15:54:58 +00:00
aptalca	0a32a84d8a	Merge pull request #80 from linuxserver/master-3.13 Rebase to 3.13, add brotli and dav-ext, remove lua	2021-02-10 10:35:03 -05:00
aptalca	e7b5816304	enable rust for py crypto	2021-02-10 09:52:09 -05:00
aptalca	b71f99cb7b	Merge branch 'master' into master-3.13	2021-02-10 09:51:11 -05:00
Erriez	dbd8fd4bd0	Add comments TransIP DNS TXT usage	2021-02-09 19:47:20 +01:00
aptalca	9074cf2d44	I like to copy pasta	2021-02-09 11:23:08 -05:00
aptalca	479ee5eac1	add brotli and dav-ext, remove lua	2021-02-09 10:50:54 -05:00
LinuxServer-CI	d7ce59b839	Bot Updating Package Versions	2021-02-09 05:59:41 -05:00
Roxedus	69fdcc1ff3	Merge pull request #79 from linuxserver/crypt avoid rust for py crypto	2021-02-09 11:48:06 +01:00
aptalca	00484f51d8	avoid rust for py crypto	2021-02-08 21:57:15 -05:00
aptalca	363ba433cc	Merge branch 'master' into master-3.13	2021-02-08 17:14:52 -05:00
aptalca	de98308c70	add cargo/rust to fix cryptography builds	2021-02-08 16:06:12 -05:00
aptalca	db657fa06a	Merge pull request #67 from linuxserver/hetzner add support for hetzner dns validation	2021-01-27 10:29:09 -05:00
aptalca	6f25f82996	add support for hetzner dns validation	2021-01-26 18:11:44 -05:00
thelamer	ea8b193858	Rebasing to Alpine 3.13	2021-01-23 15:13:00 -08:00
aptalca	d5c8106aac	Merge pull request #61 from linuxserver/typo fix typo	2021-01-23 17:22:09 -05:00
aptalca	cd5f29a8b0	fix typo	2021-01-23 15:49:03 -05:00
LinuxServer-CI	693da376b7	Bot Updating Package Versions	2021-01-20 10:56:21 -05:00
aptalca	d9f3a34a42	Merge pull request #60 from linuxserver/zerocheck Add check for ZeroSSL EAB retrieval	2021-01-20 10:41:21 -05:00
aptalca	8ac274550f	fix var name	2021-01-20 09:34:20 -05:00
aptalca	07e1ab096c	Add check for ZeroSSL EAB retrieval	2021-01-20 08:43:55 -05:00
LinuxServer-CI	99a4c55dcb	Bot Updating Package Versions	2021-01-13 09:08:27 -05:00
LinuxServer-CI	9a09573590	Bot Updating Templated Files	2021-01-13 08:53:18 -05:00
aptalca	00511ebb7a	Merge pull request #48 from linuxserver/zerossl Add ZeroSSL support via CERTPROVIDER var	2021-01-13 08:51:48 -05:00
aptalca	71747b2a6f	add more info to changelog	2021-01-08 18:21:28 -05:00
aptalca	af548a0966	Merge branch 'master' into zerossl	2021-01-08 18:16:07 -05:00
LinuxServer-CI	bb53d24b40	Bot Updating Templated Files	2021-01-08 15:13:54 +00:00
aptalca	f0fd8e67fd	Merge pull request #54 from Roxedus/master Added helpers	2021-01-08 10:12:18 -05:00
Roxedus	77a82f7163	Fix issues from review	2021-01-08 15:47:36 +01:00
LinuxServer-CI	0c7bc26fc2	Bot Updating Package Versions	2021-01-08 09:19:46 -05:00
Roxedus	6ebfdc1e87	Update dates	2021-01-03 20:23:48 +01:00
LinuxServer-CI	df74c02b4d	Bot Updating Package Versions	2021-01-01 09:13:46 -05:00
Roxedus	76f0a8c34c	Added helpers Replaced index.html with page with some info, including a the swag documentation. Added http502 helper page, also linking to our docs. UI suggestions welcome	2020-12-30 22:58:59 +01:00
aptalca	87cdcfdb18	update dns conf inis	2020-12-27 16:48:09 -05:00
aptalca	71397b40fd	update dns plugin names	2020-12-20 18:17:29 -05:00
aptalca	832dde3b35	remove unnecessary eab retrieval also suppress error when no proxy confs are activated	2020-12-20 16:55:11 -05:00
LinuxServer-CI	236553d119	Bot Updating Package Versions	2020-12-18 14:17:25 +00:00
LinuxServer-CI	b91ce7bd1a	Bot Updating Templated Files	2020-12-18 14:01:54 +00:00
LinuxServer-CI	0a1b8cf801	Bot Updating Templated Files	2020-12-18 14:00:19 +00:00
aptalca	21e9d7298a	fix typo	2020-12-10 16:43:54 -05:00
aptalca	1f85492fd5	save EMAIL value for later reuse	2020-12-10 16:04:10 -05:00
aptalca	3844b7f660	add zerossl support cert revokes	2020-12-10 14:32:15 -05:00
aptalca	7f6840373a	update conf name in scripts	2020-12-10 13:37:53 -05:00
aptalca	371b7d49ec	Add ZeroSSL support via CERTPROVIDER var and make donoteditthisfile.conf hidden	2020-12-10 11:58:52 -05:00
LinuxServer-CI	42e0e7452b	Bot Updating Templated Files	2020-12-10 10:21:34 -05:00
aptalca	471b018126	Merge pull request #41 from netthier/master Add Njalla DNS validation support	2020-12-10 10:20:23 -05:00
LinuxServer-CI	7c5bf4269c	Bot Updating Package Versions	2020-12-10 14:44:15 +00:00
aptalca	ffd9b806f9	Merge branch 'master' into master	2020-12-10 09:38:27 -05:00
aptalca	1a7bdec09b	Merge pull request #46 from linuxserver/defaults add new dns methods, check confs, add workflows	2020-12-10 09:31:23 -05:00
aptalca	1bdf9a98e2	add new dns methods, check confs, add workflows add gehirn and sakuracloud dns validation add conf checker add trigger workflows remove deprecated certbot option for public ip logging	2020-12-09 15:43:05 -05:00
LinuxServer-CI	7232890186	Bot Updating Package Versions	2020-12-08 11:09:05 +00:00
LinuxServer-CI	536c903fe2	Bot Updating Package Versions	2020-12-01 11:06:37 +00:00
nett_hier	1769aad85f	Update njalla.ini	2020-11-25 23:27:57 +01:00
netthier	dc55d77965	Update readme-vars.yml	2020-11-25 22:18:24 +01:00
netthier	8de14f3790	Create njalla.ini	2020-11-25 22:09:46 +01:00
netthier	1831bbbbcf	Update 50-config	2020-11-25 21:47:06 +01:00
netthier	b884e4181e	Update Dockerfile.armhf	2020-11-25 21:46:12 +01:00
netthier	cd57dff765	Update Dockerfile	2020-11-25 21:45:52 +01:00
netthier	5538ef6736	Update Dockerfile.aarch64	2020-11-25 21:45:22 +01:00
netthier	68e91b2870	Update Dockerfile	2020-11-25 21:45:00 +01:00
LinuxServer-CI	0bebcbed52	Bot Updating Package Versions	2020-11-22 17:39:23 -05:00
LinuxServer-CI	64b676eb06	Bot Updating Templated Files	2020-11-22 17:27:13 -05:00
aptalca	46c804c696	Merge pull request #40 from JohnMaguire/update-readme Update README with nginx-deny jail	2020-11-22 17:26:03 -05:00
John Maguire	cf74fe7a39	Update README with nginx-deny jail	2020-11-22 17:00:00 -05:00
LinuxServer-CI	177ba1b378	Bot Updating Package Versions	2020-11-02 15:15:03 +00:00
LinuxServer-CI	aded96c0a4	Bot Updating Templated Files	2020-11-02 15:01:28 +00:00
thelamer	8bcf64041a	update baseimages	2020-11-02 06:57:55 -08:00
LinuxServer-CI	04745dcf1f	Bot Updating Package Versions	2020-11-01 08:59:24 -05:00
LinuxServer-CI	0a4cac7f35	Bot Updating Templated Files	2020-11-01 08:48:28 -05:00
aptalca	95e7ef9db3	Merge pull request #31 from reey/master Add support for using provider netcup for DNS validation	2020-11-01 08:47:15 -05:00
Tristan Bastian	515addf76e	add changelog entry for supporting netcup	2020-11-01 13:40:09 +01:00
Tristan Bastian	046fb5447a	put netcup in correct order within DNSPLUGIN validation	2020-11-01 09:22:58 +01:00
Tristan Bastian	f23595d0b9	reorder netcup plugin to sort plugin list alphabetically	2020-11-01 00:22:39 +01:00
Tristan Bastian	812f2d3df5	add netcup as additional dns provider in readme	2020-11-01 00:20:11 +01:00
Tristan Bastian	71734a4e49	reduce to just netcup as option	2020-10-31 23:58:45 +01:00
Tristan Bastian	4d9439c899	add sample netcup.ini file	2020-10-31 23:54:11 +01:00
Tristan Bastian	a910da2633	configure parameters for netcup correctly	2020-10-31 23:41:13 +01:00
Tristan Bastian	35fa03e01c	add netcup as a valid dns validation method	2020-10-31 23:20:53 +01:00
Tristan Bastian	9de23713ca	add netcup dns plugin	2020-10-31 22:51:15 +01:00
aptalca	3e3dccd836	Merge pull request #30 from linuxserver/frame-ancestors Set frame-ancestors in Content-Security-Policy	2020-10-29 12:07:07 -04:00
Eric Nemchik	1d08b6f2e1	Update changelog	2020-10-29 10:38:32 -05:00
Eric Nemchik	01dd12f567	Set frame-ancestors in Content-Security-Policy https://infosec.mozilla.org/guidelines/web_security#x-frame-options	2020-10-29 10:13:55 -05:00
aptalca	50371fea4f	Merge pull request #26 from gilbN/geoip2-lan-fix adds an allow LAN ip list if geoip2 default is no.	2020-10-27 09:06:21 -04:00
GilbN	a81ab8bcf1	update version	2020-10-27 09:37:00 +01:00
gilbN	38fa575e1e	adds a lan allow list if default is no.	2020-10-26 22:51:04 +01:00