mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-12 16:04:25 +00:00
52 lines
2.0 KiB
Bash
Executable File
52 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# Certbot deploy hook: publish a renewed certificate where the containers can
|
|
# read it, then restart the two services that hold it open.
|
|
#
|
|
# Install as /etc/letsencrypt/renewal-hooks/deploy/warmbly-bus.sh, mode 0755.
|
|
#
|
|
# Certbot's own live directory is root-owned and 0700 on the private key, which
|
|
# neither container can read: NATS runs as uid 1000 and Redis as uid 999. The
|
|
# copy exists to widen that deliberately and in one place, rather than by
|
|
# loosening /etc/letsencrypt.
|
|
#
|
|
# It is widened to a group, not to the world. The compose file puts both
|
|
# containers in gid 2000 with group_add, so each can read the key and nothing
|
|
# else on the machine can. Create it once:
|
|
#
|
|
# groupadd -g 2000 warmbly-certs
|
|
#
|
|
# This matters more than it looks: the same guide suggests running the first
|
|
# worker on this box, and a world-readable private key is readable by that
|
|
# container too.
|
|
set -eu
|
|
|
|
CERT_GID="${WARMBLY_CERT_GID:-2000}"
|
|
INSTALL_DIR="/opt/warmbly/bus"
|
|
|
|
DOMAIN="${WARMBLY_BUS_DOMAIN:-bus.example.com}"
|
|
SRC="/etc/letsencrypt/live/$DOMAIN"
|
|
DEST="/opt/warmbly/certs"
|
|
|
|
[ -d "$SRC" ] || { echo "no certificate at $SRC" >&2; exit 1; }
|
|
|
|
mkdir -p "$DEST"
|
|
cp "$SRC/fullchain.pem" "$DEST/fullchain.pem"
|
|
cp "$SRC/chain.pem" "$DEST/chain.pem"
|
|
cp "$SRC/privkey.pem" "$DEST/privkey.pem"
|
|
|
|
# The chain is public by definition. The key is not: group-readable only, and
|
|
# only for the group the two containers are added to.
|
|
chmod 0644 "$DEST/fullchain.pem" "$DEST/chain.pem"
|
|
chgrp "$CERT_GID" "$DEST/privkey.pem" || {
|
|
echo "no group $CERT_GID; create it with: groupadd -g $CERT_GID warmbly-certs" >&2
|
|
exit 1
|
|
}
|
|
chmod 0640 "$DEST/privkey.pem"
|
|
|
|
# Both hold the certificate open and neither re-reads it on its own, so a
|
|
# renewal without this restart leaves them serving an expired certificate.
|
|
# The env has to be passed through: compose reads it for the cert path and the
|
|
# group, and a renewal must not quietly relocate either.
|
|
cd "$INSTALL_DIR" && WARMBLY_CERT_DIR="$DEST" WARMBLY_CERT_GID="$CERT_GID" \
|
|
docker compose restart nats redis
|