.woodpecker.yml

@@ -1,21 +1,21 @@
 pipeline:
   publish:
-    image: "docker.io/woodpeckerci/plugin-docker-buildx"
+    image: "plugins/docker"
     settings:
-      registry: "https://gitea.nulo.in"
+      registry: "registry.nulo.in"
       username: "sutty"
-      repo: "gitea.nulo.in/sutty/certbot"
+      repo: "registry.nulo.in/sutty/certbot"
       tags:
       - "${ALPINE_VERSION}"
       - "latest"
       build_args:
       - "ALPINE_VERSION=${ALPINE_VERSION}"
-      - "BASE_IMAGE=gitea.nulo.in/sutty/monit"
+      - "BASE_IMAGE=registry.nulo.in/sutty/monit"
     secrets:
-    - "DOCKER_PASSWORD"
+    - "docker_password"
     when:
       branch: "antifascista"
       event: "push"
 matrix:
   ALPINE_VERSION:
-  - "3.17.3"
+  - "3.17.1"

Dockerfile

@@ -5,7 +5,7 @@ MAINTAINER "f <f@sutty.nl>"
 
 RUN addgroup -S -g 777 ssl
 RUN install -dm 2700 -o root -g root /root/.ssh
-RUN apk add --no-cache certbot jq wget openssh-client rsync certbot-dns-njalla
+RUN apk add --no-cache certbot jq wget openssh-client rsync
 
 COPY ./monit.conf /etc/monit.d/certbot.conf
 COPY ./certbotd.sh /usr/local/bin/certbotd

certbotd.sh

@@ -42,22 +42,26 @@ set -e
 case $1 in
   # Renew certificates, trust in certbot's algorithms
   renew)
-    /usr/bin/certbot renew --quiet --agree-tos || true
+    /usr/bin/certbot renew --quiet --agree-tos
     touch "${updated}"
     ;;
   bootstrap)
-    test -d "/etc/letsencrypt/live/${SUTTY}" && exit 0
+    for site in ${SUTTY} api.${SUTTY}; do
+      test -d "/etc/letsencrypt/live/${site}" && exit 0
 
-    # Get a single certificate for the whole domain
-    /usr/bin/certbot \
-      -a dns-njalla \
-      --dns-njalla-credentials /etc/letsencrypt/njalla.ini \
-      --email "certbot@${SUTTY}" \
+      # Get the certificate for the domain, the webserver will need
+      # access to this directory
+      /usr/bin/certbot certonly --email "certbot@${SUTTY}" \
+                                --webroot \
                                 --agree-tos \
-      -d "${SUTTY}" \
-      -d "*.${SUTTY}"
+                                --webroot-path /var/lib/letsencrypt \
+                                -d "${site}"
+
+      cd /etc/letsencrypt/live
+      ln -s ${SUTTY} default
 
       touch "${updated}"
+    done
 
     ;;
   prune)