79 lines
1.9 KiB
Bash
Executable File
79 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
ENV_FILE="${ROOT_DIR}/.env.prod"
|
|
CERTBOT_EMAIL=""
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
Usage: $(basename "$0") --email you@example.com
|
|
|
|
Obtain or renew Let's Encrypt certificates for CLEARNET_DOMAIN using the webroot
|
|
challenge. Nginx must be running and serving /.well-known/acme-challenge/ from
|
|
deploy/certbot/www.
|
|
|
|
Environment is read from .env.prod (CLEARNET_DOMAIN).
|
|
EOF
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--email)
|
|
CERTBOT_EMAIL="$2"
|
|
shift 2
|
|
;;
|
|
-h | --help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Unknown option: $1" >&2
|
|
usage >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
echo "Missing ${ENV_FILE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# shellcheck disable=SC1090
|
|
set -a
|
|
source "$ENV_FILE"
|
|
set +a
|
|
|
|
if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
|
|
echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -z "$CERTBOT_EMAIL" ]]; then
|
|
echo "Pass --email for Let's Encrypt registration." >&2
|
|
usage >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
|
|
|
|
docker run --rm \
|
|
-v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
|
|
-v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
|
|
certbot/certbot certonly \
|
|
--webroot \
|
|
-w /var/www/certbot \
|
|
-d "$CLEARNET_DOMAIN" \
|
|
--email "$CERTBOT_EMAIL" \
|
|
--agree-tos \
|
|
--non-interactive
|
|
|
|
if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
|
|
echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
|
|
echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"
|