Bot Updating Package Versions

standard cron

package_versions.txt

@@ -23,8 +23,8 @@ azure-mgmt-core                 1.4.0                   python
 azure-mgmt-dns                  8.1.0                   python  
 bash                            5.2.15-r5               apk     
 beautifulsoup4                  4.12.2                  python  
-boto3                           1.29.3                  python  
+boto3                           1.29.6                  python  
-botocore                        1.32.3                  python  
+botocore                        1.32.6                  python  
 brotli-libs                     1.0.9-r14               apk     
 bs4                             0.0.1                   python  
 busybox                         1.36.1-r5               apk     
@@ -65,7 +65,7 @@ certbot-dns-linode              2.6.0                   python
 certbot-dns-loopia              1.0.1                   python  
 certbot-dns-luadns              2.6.0                   python  
 certbot-dns-namecheap           1.0.0                   python  
-certbot-dns-netcup              1.4.2                   python  
+certbot-dns-netcup              1.4.3                   python  
 certbot-dns-njalla              1.0.0                   python  
 certbot-dns-nsone               2.6.0                   python  
 certbot-dns-ovh                 2.6.0                   python  
@@ -122,7 +122,7 @@ gpgv                            2.4.3-r0                apk
 httplib2                        0.22.0                  python  
 icu-data-en                     73.2-r2                 apk     
 icu-libs                        73.2-r2                 apk     
-idna                            3.4                     python  
+idna                            3.5                     python  
 importlib-metadata              6.8.0                   python  
 ip6tables                       1.8.9-r2                apk     
 iptables                        1.8.9-r2                apk     
@@ -182,7 +182,7 @@ libxau                          1.0.11-r2               apk
 libxcb                          1.15-r1                 apk     
 libxdmcp                        1.1.4-r2                apk     
 libxext                         1.3.5-r2                apk     
-libxml2                         2.11.4-r0               apk     
+libxml2                         2.11.6-r0               apk     
 libxpm                          3.5.16-r1               apk     
 libxslt                         1.1.38-r0               apk     
 libxt                           1.3.0-r2                apk     
@@ -237,53 +237,53 @@ perl                            5.36.1-r2               apk
 perl-error                      0.17029-r1              apk     
 perl-git                        2.40.1-r0               apk     
 php82                           8.2.12-r0               apk     
-php82-bcmath                    8.2.12-r0               apk     
+php82-bcmath                    8.2.13-r0               apk     
-php82-bz2                       8.2.12-r0               apk     
+php82-bz2                       8.2.13-r0               apk     
 php82-common                    8.2.12-r0               apk     
 php82-ctype                     8.2.12-r0               apk     
 php82-curl                      8.2.12-r0               apk     
-php82-dom                       8.2.12-r0               apk     
+php82-dom                       8.2.13-r0               apk     
-php82-exif                      8.2.12-r0               apk     
+php82-exif                      8.2.13-r0               apk     
 php82-fileinfo                  8.2.12-r0               apk     
 php82-fpm                       8.2.12-r0               apk     
-php82-ftp                       8.2.12-r0               apk     
+php82-ftp                       8.2.13-r0               apk     
-php82-gd                        8.2.12-r0               apk     
+php82-gd                        8.2.13-r0               apk     
-php82-gmp                       8.2.12-r0               apk     
+php82-gmp                       8.2.13-r0               apk     
 php82-iconv                     8.2.12-r0               apk     
-php82-imap                      8.2.12-r0               apk     
+php82-imap                      8.2.13-r0               apk     
-php82-intl                      8.2.12-r0               apk     
+php82-intl                      8.2.13-r0               apk     
-php82-ldap                      8.2.12-r0               apk     
+php82-ldap                      8.2.13-r0               apk     
 php82-mbstring                  8.2.12-r0               apk     
-php82-mysqli                    8.2.12-r0               apk     
+php82-mysqli                    8.2.13-r0               apk     
-php82-mysqlnd                   8.2.12-r0               apk     
+php82-mysqlnd                   8.2.13-r0               apk     
-php82-opcache                   8.2.12-r0               apk     
+php82-opcache                   8.2.13-r0               apk     
 php82-openssl                   8.2.12-r0               apk     
-php82-pdo                       8.2.12-r0               apk     
+php82-pdo                       8.2.13-r0               apk     
-php82-pdo_mysql                 8.2.12-r0               apk     
+php82-pdo_mysql                 8.2.13-r0               apk     
-php82-pdo_odbc                  8.2.12-r0               apk     
+php82-pdo_odbc                  8.2.13-r0               apk     
-php82-pdo_pgsql                 8.2.12-r0               apk     
+php82-pdo_pgsql                 8.2.13-r0               apk     
-php82-pdo_sqlite                8.2.12-r0               apk     
+php82-pdo_sqlite                8.2.13-r0               apk     
-php82-pear                      8.2.12-r0               apk     
+php82-pear                      8.2.13-r0               apk     
 php82-pecl-apcu                 5.1.22-r0               apk     
 php82-pecl-igbinary             3.2.14-r0               apk     
 php82-pecl-mcrypt               1.0.6-r0                apk     
 php82-pecl-memcached            3.2.0-r1                apk     
 php82-pecl-msgpack              2.2.0-r0                apk     
 php82-pecl-redis                6.0.2-r0                apk     
-php82-pgsql                     8.2.12-r0               apk     
+php82-pgsql                     8.2.13-r0               apk     
 php82-phar                      8.2.12-r0               apk     
-php82-posix                     8.2.12-r0               apk     
+php82-posix                     8.2.13-r0               apk     
 php82-session                   8.2.12-r0               apk     
 php82-simplexml                 8.2.12-r0               apk     
-php82-soap                      8.2.12-r0               apk     
+php82-soap                      8.2.13-r0               apk     
-php82-sockets                   8.2.12-r0               apk     
+php82-sockets                   8.2.13-r0               apk     
-php82-sodium                    8.2.12-r0               apk     
+php82-sodium                    8.2.13-r0               apk     
-php82-sqlite3                   8.2.12-r0               apk     
+php82-sqlite3                   8.2.13-r0               apk     
-php82-tokenizer                 8.2.12-r0               apk     
+php82-tokenizer                 8.2.13-r0               apk     
 php82-xml                       8.2.12-r0               apk     
-php82-xmlreader                 8.2.12-r0               apk     
+php82-xmlreader                 8.2.13-r0               apk     
 php82-xmlwriter                 8.2.12-r0               apk     
-php82-xsl                       8.2.12-r0               apk     
+php82-xsl                       8.2.13-r0               apk     
 php82-zip                       8.2.12-r0               apk     
 pinentry                        1.2.1-r1                apk     
 pip                             23.3.1                  python  
@@ -296,7 +296,7 @@ publicsuffixlist                0.9.4                   python
 pyOpenSSL                       23.3.0                  python  
 pyRFC3339                       1.1                     python  
 pyacmedns                       0.4                     python  
-pyasn1                          0.5.0                   python  
+pyasn1                          0.5.1                   python  
 pyasn1-modules                  0.3.0                   python  
 pyc                             0.1-r0                  apk     
 pycparser                       2.21                    python  

root/etc/crontabs/abc

@@ -0,0 +1,2 @@
+# min   hour    day     month   weekday command
+8       2       *       *       *       /app/le-renew.sh >> /config/log/letsencrypt/letsencrypt.log 2>&1

root/etc/crontabs/root

@@ -1,9 +0,0 @@
-# do daily/weekly/monthly maintenance
-# min   hour    day     month   weekday command
-*/15    *       *       *       *       run-parts /etc/periodic/15min
-0       *       *       *       *       run-parts /etc/periodic/hourly
-0       2       *       *       *       run-parts /etc/periodic/daily
-0       3       *       *       6       run-parts /etc/periodic/weekly
-0       5       1       *       *       run-parts /etc/periodic/monthly
-# renew letsencrypt certs
-8       2       *       *       *       /app/le-renew.sh >> /config/log/letsencrypt/letsencrypt.log 2>&1

root/etc/s6-overlay/s6-rc.d/init-certbot-config/run

@@ -31,6 +31,12 @@ if [[ "${VALIDATION}" = "dns" ]] && ! echo "${CERTBOT_DNS_AUTHENTICATORS}" | gre
     sleep infinity
 fi
 
+# set owner of certbot's CONFIG_DIR, WORK_DIR, and LOGS_DIR to abc
+lsiown -R abc:abc \
+    /etc/letsencrypt \
+    /var/lib/letsencrypt \
+    /var/log/letsencrypt
+
 # set_ini_value logic:
 # - if the name is not found in the file, append the name=value to the end of the file
 # - if the name is found in the file, replace the value
@@ -46,6 +52,7 @@ function set_ini_value() {
 
 # ensure config files exist and has at least one value set (set_ini_value does not work on empty files)
 touch /config/etc/letsencrypt/cli.ini
+lsiown abc:abc /config/etc/letsencrypt/cli.ini
 grep -qF 'agree-tos' /config/etc/letsencrypt/cli.ini || echo 'agree-tos=true' >>/config/etc/letsencrypt/cli.ini
 
 # copy dns default configs
@@ -192,9 +199,9 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] ||
         REV_ACMESERVER=("https://acme-v02.api.letsencrypt.org/directory")
     fi
     if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
+        s6-setuidgid abc certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
     else
-        certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
+        s6-setuidgid abc certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
     fi
     rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
 fi
@@ -207,9 +214,9 @@ if [[ -f "/config/keys/letsencrypt/chain.pem" ]] && { [[ "${CERTPROVIDER}" == "l
     echo "The cert seems to be using the old LE root cert, which is no longer valid. Deleting and revoking."
     REV_ACMESERVER=("https://acme-v02.api.letsencrypt.org/directory")
     if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
+        s6-setuidgid abc certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
     else
-        certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
+        s6-setuidgid abc certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
     fi
     rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
 fi
@@ -342,7 +349,7 @@ if [[ ! -f "/config/keys/letsencrypt/fullchain.pem" ]]; then
         set_ini_value "eab-hmac-key" "${ZEROSSL_EAB_HMAC_KEY}" /config/etc/letsencrypt/cli.ini
     fi
     echo "Generating new certificate"
-    certbot certonly --non-interactive --renew-by-default
+    s6-setuidgid abc certbot certonly --non-interactive --renew-by-default
     if [[ ! -d /config/keys/letsencrypt ]]; then
         if [[ "${VALIDATION}" = "dns" ]]; then
             echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the ${DNSCREDENTIALFILE} file."

root/etc/s6-overlay/s6-rc.d/init-crontabs-config/run

@@ -1,38 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-# make folders
-mkdir -p \
-    /config/crontabs
-
-## root
-# if crontabs do not exist in config
-if [[ ! -f /config/crontabs/root ]]; then
-    # copy crontab from system
-    if crontab -l -u root; then
-        crontab -l -u root >/config/crontabs/root
-    fi
-
-    # if crontabs still do not exist in config (were not copied from system)
-    # copy crontab from included defaults (using -n, do not overwrite an existing file)
-    cp -n /etc/crontabs/root /config/crontabs/ 2> >(grep -v 'cp: not replacing')
-fi
-# set permissions and import user crontabs
-lsiown root:root /config/crontabs/root
-crontab -u root /config/crontabs/root
-
-## abc
-# if crontabs do not exist in config
-if [[ ! -f /config/crontabs/abc ]]; then
-    # copy crontab from system
-    if crontab -l -u abc; then
-        crontab -l -u abc >/config/crontabs/abc
-    fi
-
-    # if crontabs still do not exist in config (were not copied from system)
-    # copy crontab from included defaults (using -n, do not overwrite an existing file)
-    cp -n /etc/crontabs/abc /config/crontabs/ 2> >(grep -v 'cp: not replacing')
-fi
-# set permissions and import user crontabs
-lsiown abc:abc /config/crontabs/abc
-crontab -u abc /config/crontabs/abc

root/etc/s6-overlay/s6-rc.d/init-crontabs-config/type

@@ -1 +0,0 @@
-oneshot

root/etc/s6-overlay/s6-rc.d/init-crontabs-config/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-crontabs-config/run

root/etc/s6-overlay/s6-rc.d/init-folders-config/run

@@ -3,7 +3,7 @@
 
 # make our folders and links
 mkdir -p \
-    /config/{fail2ban,crontabs,dns-conf} \
+    /config/{fail2ban,dns-conf} \
     /config/etc/letsencrypt/renewal-hooks \
     /config/log/{fail2ban,letsencrypt,nginx} \
     /config/nginx/proxy-confs \