Merge ../skel into antifascista

it leaves the lock in place

.woodpecker.yml

@@ -1,21 +1,21 @@
 pipeline:
   publish:
-    image: "plugins/docker"
+    image: "docker.io/woodpeckerci/plugin-docker-buildx"
     settings:
-      registry: "registry.nulo.in"
+      registry: "https://gitea.nulo.in"
       username: "sutty"
-      repo: "registry.nulo.in/sutty/certbot"
+      repo: "gitea.nulo.in/sutty/certbot"
       tags:
       - "${ALPINE_VERSION}"
       - "latest"
       build_args:
       - "ALPINE_VERSION=${ALPINE_VERSION}"
-      - "BASE_IMAGE=registry.nulo.in/sutty/monit"
+      - "BASE_IMAGE=gitea.nulo.in/sutty/monit"
     secrets:
-    - "docker_password"
+    - "DOCKER_PASSWORD"
     when:
       branch: "antifascista"
       event: "push"
 matrix:
   ALPINE_VERSION:
-  - "3.17.1"
+  - "3.17.3"

Dockerfile

@@ -5,7 +5,7 @@ MAINTAINER "f <f@sutty.nl>"
 
 RUN addgroup -S -g 777 ssl
 RUN install -dm 2700 -o root -g root /root/.ssh
-RUN apk add --no-cache certbot jq wget openssh-client rsync
+RUN apk add --no-cache certbot jq wget openssh-client rsync certbot-dns-njalla
 
 COPY ./monit.conf /etc/monit.d/certbot.conf
 COPY ./certbotd.sh /usr/local/bin/certbotd

certbotd.sh

@@ -42,26 +42,22 @@ set -e
 case $1 in
   # Renew certificates, trust in certbot's algorithms
   renew)
-    /usr/bin/certbot renew --quiet --agree-tos
+    /usr/bin/certbot renew --quiet --agree-tos || true
     touch "${updated}"
     ;;
   bootstrap)
-    for site in ${SUTTY} api.${SUTTY}; do
-      test -d "/etc/letsencrypt/live/${site}" && exit 0
+    test -d "/etc/letsencrypt/live/${SUTTY}" && exit 0
 
-      # Get the certificate for the domain, the webserver will need
-      # access to this directory
-      /usr/bin/certbot certonly --email "certbot@${SUTTY}" \
-                                --webroot \
-                                --agree-tos \
-                                --webroot-path /var/lib/letsencrypt \
-                                -d "${site}"
+    # Get a single certificate for the whole domain
+    /usr/bin/certbot \
+      -a dns-njalla \
+      --dns-njalla-credentials /etc/letsencrypt/njalla.ini \
+      --email "certbot@${SUTTY}" \
+      --agree-tos \
+      -d "${SUTTY}" \
+      -d "*.${SUTTY}"
 
-      cd /etc/letsencrypt/live
-      ln -s ${SUTTY} default
-
-      touch "${updated}"
-    done
+    touch "${updated}"
 
     ;;
   prune)