Bot Updating Package Versions

Add categories to readme-vars.yml

Dockerfile

@@ -29,6 +29,7 @@ RUN \
   apk add --no-cache \
     fail2ban \
     gnupg \
+    inotify-tools \
     iptables-legacy \
     memcached \
     nginx-mod-http-brotli \

Dockerfile.aarch64

@@ -29,6 +29,7 @@ RUN \
   apk add --no-cache \
     fail2ban \
     gnupg \
+    inotify-tools \
     iptables-legacy \
     memcached \
     nginx-mod-http-brotli \

README.md

@@ -190,6 +190,8 @@ services:
       - EXTRA_DOMAINS= #optional
       - STAGING=false #optional
       - DISABLE_F2B= #optional
+      - SWAG_AUTORELOAD= #optional
+      - SWAG_AUTORELOAD_WATCHLIST= #optional
     volumes:
       - /path/to/swag/config:/config
     ports:
@@ -218,6 +220,8 @@ docker run -d \
   -e EXTRA_DOMAINS= `#optional` \
   -e STAGING=false `#optional` \
   -e DISABLE_F2B= `#optional` \
+  -e SWAG_AUTORELOAD= `#optional` \
+  -e SWAG_AUTORELOAD_WATCHLIST= `#optional` \
   -p 443:443 \
   -p 80:80 `#optional` \
   -v /path/to/swag/config:/config \
@@ -247,6 +251,8 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `example.net,subdomain.example.net,*.example.org` |
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
 | `-e DISABLE_F2B=` | Set to `true` to disable the Fail2ban service in the container, if you're already running it elsewhere or using a different IPS. |
+| `-e SWAG_AUTORELOAD=` | Set to `true` to enable automatic reloading of confs on change without stopping/restarting nginx. Your filesystem must support inotify. This functionality was previously offered [via mod](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload). |
+| `-e SWAG_AUTORELOAD_WATCHLIST=` | A [pipe](https://en.wikipedia.org/wiki/Vertical_bar)-separated list of additional folders for auto reload to watch in addition to `/config/nginx` |
 | `-v /config` | Persistent config files |
 | `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
 | `--cap-add=NET_ADMIN` | Required for fail2Ban to be able to modify iptables rules. |
@@ -417,6 +423,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **19.01.25:** - Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG.
 * **17.12.24:** - Rebase to Alpine 3.21.
 * **21.10.24:** - Fix naming issue with Dynu plugin. If you are using Dynu, please make sure your credentials are set in /config/dns-conf/dynu.ini and your DNSPLUGIN variable is set to dynu (not dynudns).
 * **30.08.24:** - Fix zerossl cert revocation.

package_versions.txt

@@ -22,17 +22,17 @@ azure-mgmt-dns                  8.2.0             python
 backports-tarfile               1.2.0             python                   
 bash                            5.2.37-r0         apk                      
 beautifulsoup4                  4.12.3            python                   
-boto3                           1.36.2            python                   
-botocore                        1.36.2            python                   
+boto3                           1.36.4            python                   
+botocore                        1.36.4            python                   
 brotli-libs                     1.1.0-r2          apk                      
 bs4                             0.0.2             python                   
-busybox                         1.37.0-r9         apk                      
-busybox-binsh                   1.37.0-r9         apk                      
+busybox                         1.37.0-r12        apk                      
+busybox-binsh                   1.37.0-r12        apk                      
 c-ares                          1.34.3-r0         apk                      
 c-client                        2007f-r15         apk                      
 ca-certificates                 20241121-r1       apk                      
 ca-certificates-bundle          20241121-r1       apk                      
-cachetools                      5.5.0             python                   
+cachetools                      5.5.1             python                   
 catatonit                       0.2.0-r0          apk                      
 certbot                         3.1.0             python                   
 certbot-dns-acmedns             0.1.0             python                   
@@ -82,7 +82,7 @@ certifi                         2024.12.14        python
 cffi                            1.17.1            python                   
 charset-normalizer              3.4.1             python                   
 cloudflare                      2.19.4            python                   
-composer                        2.8.4             binary                   
+composer                        2.8.5             binary                   
 configargparse                  1.7               python                   
 configobj                       5.0.9             python                   
 coreutils                       9.5-r2            apk                      
@@ -99,7 +99,7 @@ domeneshop                      0.4.4             python
 fail2ban                        1.1.0             python                   
 fail2ban                        1.1.0-r2          apk                      
 fail2ban-pyc                    1.1.0-r2          apk                      
-filelock                        3.16.1            python                   
+filelock                        3.17.0            python                   
 findutils                       4.10.0-r0         apk                      
 fontconfig                      2.15.0-r1         apk                      
 freetype                        2.13.3-r0         apk                      
@@ -118,7 +118,7 @@ gnupg-wks-client                2.4.7-r0          apk
 gnutls                          3.8.8-r0          apk                      
 google-api-core                 2.24.0            python                   
 google-api-python-client        2.159.0           python                   
-google-auth                     2.37.0            python                   
+google-auth                     2.38.0            python                   
 google-auth-httplib2            0.2.0             python                   
 googleapis-common-protos        1.66.0            python                   
 gpg                             2.4.7-r0          apk                      
@@ -132,6 +132,8 @@ icu-libs                        74.2-r0           apk
 idna                            3.10              python                   
 importlib-metadata              8.0.0             python                   
 inflect                         7.3.1             python                   
+inotify-tools                   4.23.9.0-r0       apk                      
+inotify-tools-libs              4.23.9.0-r0       apk                      
 inwx-domrobot                   3.2.0             python                   
 iptables                        1.8.10-r5         apk                      
 iptables-legacy                 1.8.10-r5         apk                      
@@ -141,7 +143,7 @@ jaraco-context                  5.3.0             python
 jaraco-functools                4.0.1             python                   
 jaraco-text                     3.12.1            python                   
 jmespath                        1.0.1             python                   
-josepy                          1.14.0            python                   
+josepy                          1.15.0            python                   
 jq                              1.7.1-r0          apk                      
 jsonlines                       4.0.0             python                   
 jsonpickle                      4.0.1             python                   
@@ -249,7 +251,7 @@ packaging                       24.2              python
 parsedatetime                   2.6               python                   
 pcre                            8.45-r3           apk                      
 pcre2                           10.43-r0          apk                      
-perl                            5.40.0-r3         apk                      
+perl                            5.40.1-r0         apk                      
 perl-error                      0.17029-r2        apk                      
 perl-git                        2.47.2-r0         apk                      
 php83                           8.3.16-r0         apk                      
@@ -342,7 +344,7 @@ six                             1.17.0            python
 skalibs-libs                    2.14.3.0-r0       apk                      
 soupsieve                       2.6               python                   
 sqlite-libs                     3.47.1-r0         apk                      
-ssl_client                      1.37.0-r9         apk                      
+ssl_client                      1.37.0-r12        apk                      
 tiff                            4.7.0-r0          apk                      
 tldextract                      5.1.3             python                   
 tomli                           2.0.1             python                   

readme-vars.yml

@@ -6,6 +6,7 @@ project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
 project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
+project_categories: "Reverse Proxy"
 # supported architectures
 available_architectures:
   - {arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
@@ -38,6 +39,8 @@ opt_param_env_vars:
   - {env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `example.net,subdomain.example.net,*.example.org`"}
   - {env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes."}
   - {env_var: "DISABLE_F2B", env_value: "", desc: "Set to `true` to disable the Fail2ban service in the container, if you're already running it elsewhere or using a different IPS."}
+  - {env_var: "SWAG_AUTORELOAD", env_value: "", desc: "Set to `true` to enable automatic reloading of confs on change without stopping/restarting nginx. Your filesystem must support inotify. This functionality was previously offered [via mod](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload)."}
+  - {env_var: "SWAG_AUTORELOAD_WATCHLIST", env_value: "", desc: "A [pipe](https://en.wikipedia.org/wiki/Vertical_bar)-separated list of additional folders for auto reload to watch in addition to `/config/nginx`"}
 opt_param_usage_include_ports: true
 opt_param_ports:
   - {external_port: "80", internal_port: "80", port_desc: "HTTP port (required for HTTP validation and HTTP -> HTTPS redirect)"}
@@ -193,6 +196,8 @@ init_diagram: |
     svc-nginx -> legacy-services
     init-services -> svc-php-fpm
     svc-php-fpm -> legacy-services
+    init-services -> svc-swag-auto-reload
+    svc-swag-auto-reload -> legacy-services
   }
   Base Images: {
     "baseimage-alpine-nginx:3.21" <- "baseimage-alpine:3.21"
@@ -200,6 +205,7 @@ init_diagram: |
   "swag:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "19.01.25:", desc: "Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG."}
   - {date: "17.12.24:", desc: "Rebase to Alpine 3.21."}
   - {date: "21.10.24:", desc: "Fix naming issue with Dynu plugin. If you are using Dynu, please make sure your credentials are set in /config/dns-conf/dynu.ini and your DNSPLUGIN variable is set to dynu (not dynudns)."}
   - {date: "30.08.24:", desc: "Fix zerossl cert revocation."}

root/etc/s6-overlay/s6-rc.d/init-permissions-config/run

@@ -2,9 +2,7 @@
 # shellcheck shell=bash
 
 # permissions
+find /config/log ! -path '/config/log/logrotate.status' -exec chmod +r {} \+
+
 lsiown -R abc:abc \
     /config
-chmod -R +r /config/log
-
-# Workaround for systems with chmod errors
-true

root/etc/s6-overlay/s6-rc.d/svc-swag-auto-reload/run

@@ -0,0 +1,41 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+if [[ ${SWAG_AUTORELOAD,,} == "true" ]]; then
+    if [[ -f "/etc/s6-overlay/s6-rc.d/svc-mod-swag-auto-reload/run" ]]; then
+        echo "ERROR: Legacy SWAG Auto Reload Mod detected, to use the built-in Auto Reload functionality please remove it from your container config."
+        sleep infinity
+    else
+        echo "Auto-reload: Watching the following folders for changes to .conf files:"
+        echo "/config/nginx"
+        ACTIVE_WATCH=("/config/nginx")
+        for i in $(echo "${SWAG_AUTORELOAD_WATCHLIST}" | tr "|" " "); do
+            if [ -f "${i}" ] || [ -d "${i}" ]; then
+                echo "${i}"
+                ACTIVE_WATCH+=("${i}")
+            fi
+            done
+
+            function wait_for_changes {
+            inotifywait -rq \
+                --event modify,move,create,delete \
+                --includei '\.conf$' \
+                "${ACTIVE_WATCH[@]}"
+            }
+
+            while wait_for_changes; do
+            NGINX_CONF=()
+            if ! grep -q "/config/nginx/nginx.conf" /etc/nginx/nginx.conf; then
+                NGINX_CONF=("-c" "/config/nginx/nginx.conf")
+            fi
+            if /usr/sbin/nginx "${NGINX_CONF[@]}" -t; then
+                echo "Changes to nginx config detected and the changes are valid, reloading nginx"
+                /usr/sbin/nginx "${NGINX_CONF[@]}" -s reload
+            else
+                echo "Changes to nginx config detected but the changes are not valid, skipping nginx reload. Please fix your config."
+            fi
+        done
+    fi
+else
+    sleep infinity
+fi

root/etc/s6-overlay/s6-rc.d/svc-swag-auto-reload/type

@@ -0,0 +1 @@
+longrun