Skip to content

Commit 9a36ceb

Browse files
nachoparkernachoparker
committed
letsencrypt: use the latest github version
1 parent 338da33 commit 9a36ceb

File tree

6 files changed

+119
-30
lines changed

6 files changed

+119
-30
lines changed

‎bin/ncp/NETWORKING/letsencrypt.sh‎

Lines changed: 46 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@
88
# More at https://ownyourbits.com/2017/03/17/lets-encrypt-installer-for-apache/
99

1010

11-
NCDIR=/var/www/nextcloud
12-
OCC="$NCDIR/occ"
13-
VHOSTCFG=/etc/apache2/sites-available/nextcloud.conf
14-
VHOSTCFG2=/etc/apache2/sites-available/ncp.conf
11+
ncdir=/var/www/nextcloud
12+
vhostcfg=/etc/apache2/sites-available/nextcloud.conf
13+
vhostcfg2=/etc/apache2/sites-available/ncp.conf
14+
letsencrypt=/etc/letsencrypt/letsencrypt-auto
1515

1616
is_active()
1717
{
@@ -22,7 +22,13 @@ install()
2222
{
2323
cd /etc || return 1
2424
apt-get update
25-
apt-get install --no-install-recommends -y letsencrypt
25+
apt-get install --no-install-recommends -y python3-minimal
26+
wget -O- --content-disposition https://github.com/letsencrypt/letsencrypt/archive/master/latest.tar.gz \
27+
| tar -xz \
28+
|| exit 1
29+
mv certbot-master letsencrypt
30+
export VIRTUALENV_NO_DOWNLOAD=1 # temporal workaround for https://github.com/certbot/certbot/issues/6682
31+
$letsencrypt --help # do not actually run certbot, only install packages
2632
mkdir -p /etc/letsencrypt/live
2733

2834
[[ "$DOCKERBUILD" == 1 ]] && {
@@ -40,66 +46,79 @@ EOF
4046
return 0
4147
}
4248

43-
# tested with certbot 0.10.2
49+
# tested with certbot 0.30.0
4450
configure()
4551
{
4652
local DOMAIN_LOWERCASE="${DOMAIN,,}"
4753

4854
[[ "$DOMAIN" == "" ]] && { echo "empty domain"; return 1; }
4955

5056
# Configure Apache
51-
grep -q ServerName $VHOSTCFG && \
52-
sed -i "s|ServerName .*|ServerName $DOMAIN|" $VHOSTCFG || \
53-
sed -i "/DocumentRoot/aServerName $DOMAIN" $VHOSTCFG
57+
grep -q ServerName $vhostcfg && \
58+
sed -i "s|ServerName .*|ServerName $DOMAIN|" $vhostcfg || \
59+
sed -i "/DocumentRoot/aServerName $DOMAIN" $vhostcfg
5460

5561
# Do it
56-
letsencrypt certonly -n --no-self-upgrade --webroot -w $NCDIR --hsts --agree-tos -m $EMAIL -d $DOMAIN && {
62+
$letsencrypt certonly -n --no-self-upgrade --webroot -w $ncdir --hsts --agree-tos -m $EMAIL -d $DOMAIN && {
5763

5864
# Set up auto-renewal
5965
cat > /etc/cron.weekly/letsencrypt-ncp <<EOF
6066
#!/bin/bash
6167
6268
# renew and notify
63-
/usr/bin/certbot renew --quiet --renew-hook '
64-
sudo -u www-data php $OCC notification:generate \
65-
$NOTIFYUSER "SSL renewal" \
66-
-l "Your SSL certificate(s) \$RENEWED_DOMAINS has been renewed for another 90 days"
69+
$letsencrypt renew --quiet --deploy-hook '
70+
ncc notification:generate \
71+
$NOTIFYUSER "SSL renewal" \
72+
-l "Your SSL certificate(s) \$RENEWED_DOMAINS has been renewed for another 90 days"
6773
'
6874
6975
# notify if fails
70-
[[ \$? -ne 0 ]] && sudo -u www-data php $OCC notification:generate \
71-
$NOTIFYUSER "SSL renewal error" \
72-
-l "SSL certificate renewal failed. See /var/log/letsencrypt/letsencrypt.log"
76+
[[ \$? -ne 0 ]] && ncc notification:generate \
77+
$NOTIFYUSER "SSL renewal error" \
78+
-l "SSL certificate renewal failed. See /var/log/letsencrypt/letsencrypt.log"
7379
7480
# cleanup
75-
rm -rf $NCDIR/.well-known
81+
rm -rf $ncdir/.well-known
7682
EOF
77-
chmod +x /etc/cron.weekly/letsencrypt-ncp
83+
chmod 755 /etc/cron.weekly/letsencrypt-ncp
7884

7985
# Configure Apache
80-
sed -i "s|SSLCertificateFile.*|SSLCertificateFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/fullchain.pem|" $VHOSTCFG
81-
sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/privkey.pem|" $VHOSTCFG
86+
sed -i "s|SSLCertificateFile.*|SSLCertificateFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/fullchain.pem|" $vhostcfg
87+
sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/privkey.pem|" $vhostcfg
8288

83-
sed -i "s|SSLCertificateFile.*|SSLCertificateFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/fullchain.pem|" $VHOSTCFG2
84-
sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/privkey.pem|" $VHOSTCFG2
89+
sed -i "s|SSLCertificateFile.*|SSLCertificateFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/fullchain.pem|" $vhostcfg2
90+
sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile /etc/letsencrypt/live/$DOMAIN_LOWERCASE/privkey.pem|" $vhostcfg2
8591

8692
# Configure Nextcloud
87-
sudo -u www-data php $OCC config:system:set trusted_domains 4 --value=$DOMAIN
88-
sudo -u www-data php $OCC config:system:set overwrite.cli.url --value=https://"$DOMAIN"/
93+
ncc config:system:set trusted_domains 4 --value=$DOMAIN
94+
ncc config:system:set overwrite.cli.url --value=https://"$DOMAIN"/
8995

9096
# delayed in bg so it does not kill the connection, and we get AJAX response
9197
bash -c "sleep 2 && service apache2 reload" &>/dev/null &
92-
rm -rf $NCDIR/.well-known
98+
rm -rf $ncdir/.well-known
9399

94100
# Update configuration
95101
[[ "$DOCKERBUILD" == 1 ]] && update-rc.d letsencrypt enable
96102

97103
return 0
98104
}
99-
rm -rf $NCDIR/.well-known
105+
rm -rf $ncdir/.well-known
100106
return 1
101107
}
102108

109+
cleanup()
110+
{
111+
apt-get purge -y \
112+
augeas-lenses \
113+
libpython-dev \
114+
libpython2.7-dev \
115+
libssl-dev \
116+
python-dev \
117+
python2.7-dev \
118+
python-pip-whl
119+
}
120+
121+
103122
# License
104123
#
105124
# This script is free software; you can redistribute it and/or modify it

‎changelog.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11

2-
[v1.4.8](https://github.com/nextcloud/nextcloudpi/commit/ea9a1ea) (2019-01-26) ncp-update-nc: fix unnecessary quotes
2+
[v1.4.9](https://github.com/nextcloud/nextcloudpi/commit/c0f4b78) (2019-01-25) letsencrypt: use the latest github version
33

4-
[v1.4.7](https://github.com/nextcloud/nextcloudpi/commit/ffc1fa5) (2019-01-25) ncp-config: fix local variables
4+
[v1.4.8](https://github.com/nextcloud/nextcloudpi/commit/338da33) (2019-01-26) ncp-update-nc: fix unnecessary quotes
5+
6+
[v1.4.7 ](https://github.com/nextcloud/nextcloudpi/commit/ffc1fa5) (2019-01-25) ncp-config: fix local variables
57

68
[v1.4.6 ](https://github.com/nextcloud/nextcloudpi/commit/b338ede) (2019-01-24) ncp-config: fix missing variable
79

‎docker-armhf/nextcloudpi/Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,33 @@ rm /.ncp-image; \
4646
source /usr/local/etc/library.sh; \
4747
find /usr/local/bin/ncp -name '*.sh' | while read l; do cleanup_script $l; done; \
4848

49+
# letsencrypt build artifacts cleanup
50+
apt-get purge -y \
51+
make \
52+
binutils \
53+
cpp \
54+
cpp-6 \
55+
gcc \
56+
gcc-6 \
57+
libasan3 \
58+
libaugeas0 \
59+
libc-dev-bin \
60+
libc6-dev \
61+
libcc1-0 \
62+
libexpat1-dev \
63+
libffi-dev \
64+
libgcc-6-dev \
65+
libgomp1 \
66+
libisl15 \
67+
libmpc3 \
68+
libubsan0 \
69+
linux-libc-dev \
70+
python-virtualenv \
71+
python-pkg-resources \
72+
python3-pkg-resources \
73+
python3-virtualenv \
74+
virtualenv; \
75+
4976
# should be cleaned up in no-ip.sh, but breaks udiskie.
5077
# safe to do it here since no automount in docker
5178
apt-get purge -y make gcc libc-dev; \

‎docker/nextcloudpi/Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,33 @@ rm /.ncp-image; \
4646
source /usr/local/etc/library.sh; \
4747
find /usr/local/bin/ncp -name '*.sh' | while read l; do cleanup_script $l; done; \
4848

49+
# letsencrypt build artifacts cleanup
50+
apt-get purge -y \
51+
make \
52+
binutils \
53+
cpp \
54+
cpp-6 \
55+
gcc \
56+
gcc-6 \
57+
libasan3 \
58+
libaugeas0 \
59+
libc-dev-bin \
60+
libc6-dev \
61+
libcc1-0 \
62+
libexpat1-dev \
63+
libffi-dev \
64+
libgcc-6-dev \
65+
libgomp1 \
66+
libisl15 \
67+
libmpc3 \
68+
libubsan0 \
69+
linux-libc-dev \
70+
python-virtualenv \
71+
python-pkg-resources \
72+
python3-pkg-resources \
73+
python3-virtualenv \
74+
virtualenv; \
75+
4976
# should be cleaned up in no-ip.sh, but breaks udiskie.
5077
# safe to do it here since no automount in docker
5178
apt-get purge -y make gcc libc-dev; \

‎etc/ncp-config.d/freeDNS.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "freeDNS",
33
"name": "Dynamic DNS from freeDNS",
44
"title": "freeDNS",
5-
"description": "DynamicDNS service from FreeDNS client (need account from https://freedns.afraid.org/)",
5+
"description": "FreeDNS DynamicDNS service (need account from https://freedns.afraid.org/)",
66
"info": "",
77
"infotitle": "",
88
"params": [

‎update.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,20 @@ EOF
276276
[[ "$( ls -1 /etc/cron.daily/ | wc -l )" -gt 0 ]] && chmod 755 /etc/cron.daily/*
277277
[[ "$( ls -1 /etc/cron.hourly/ | wc -l )" -gt 0 ]] && chmod 755 /etc/cron.hourly/*
278278

279+
# change letsencrypt from package based to git based
280+
[[ -f /etc/letsencrypt/certbot-auto ]] || {
281+
echo "updating letsencrypt..."
282+
[[ -f /.docker-image ]] && mv "$(readlink /etc/letsencrypt)" /etc/letsencrypt-old
283+
[[ -f /.docker-image ]] || mv /etc/letsencrypt /etc/letsencrypt-old
284+
rm -f /etc/letsencrypt
285+
apt-get remove -y letsencrypt
286+
apt-get autoremove -y
287+
install_app letsencrypt
288+
cp -raT /etc/letsencrypt-old/live /etc/letsencrypt/live
289+
[[ -f /.docker-image ]] && persistent_cfg /etc/letsencrypt
290+
[[ -f /etc/cron.weekly/letsencrypt-ncp ]] && run_app letsencrypt
291+
}
292+
279293
# remove redundant opcache configuration. Leave until update bug is fixed -> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815968
280294
# Bug #416 reappeared after we moved to php7.2 and debian buster packages. (keep last)
281295
[[ "$( ls -l /etc/php/7.2/fpm/conf.d/*-opcache.ini | wc -l )" -gt 1 ]] && rm "$( ls /etc/php/7.2/fpm/conf.d/*-opcache.ini | tail -1 )"

0 commit comments

Comments
 (0)