docker-compose/authentik
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

change to use wildcard certificates

Browse source
This commit is contained in:
Philip Henning 2025-01-28 18:49:38 +01:00
parent 0272c062d3
commit 452c255314
4 changed files with 24 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/init.sh
View file

@ -42,6 +42,13 @@ if [[ ! -f ./.env ]]; then
echo "" >> ./.env
fi
# Check if lego.env exists and exit if it is
if [[ ! -f ./lego.env ]]; then
echo "# Lego - Let's Encrypt certificate tool" >> ./lego.env
prompt_password HETZNER_API_KEY; echo "HETZNER_API_KEY=${RETURNED_PASSWORD}" >> ./lego.env; unset RETURNED_PASSWORD
echo "" >> ./.env
fi
# Check if ssh key already exists, otherwise generate one
[[ ! -d ./data/restic/ssh/ ]] && mkdir -p ./data/restic/ssh/
[[ ! -f ./data/restic/ssh/id_ed25519 ]] && ssh-keygen -t ed25519 -C "sso.base23.de" -f ./data/restic/ssh/id_ed25519
@ -59,24 +66,26 @@ if [[ ! -d ./data/.lego ]]; then
--path ./data/.lego \
--accept-tos \
--email="acme@base23.de" \
--domains="sso.base23.de" \
--http run \
&& install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{sso.base23.de.crt,sso.base23.de.issuer.crt,sso.base23.de.key} "./data/nginx/certs"
--domains="*.base23.de" \
--dns hetzner \
run \
&& install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{_.base23.de.crt,_.base23.de.issuer.crt,_.base23.de.key} "./data/nginx/certs"
fi
# Setup directory for acme cheallenges
[[ ! -d ./data/nginx/acme ]] && mkdir -p ./data/nginx/acme
# Setup cronjob to automatically renew certificates
[[ ! -f /etc/systemd/system/lego-renew-sso-base23-de.service ]] && cat <<EOF > /etc/systemd/system/lego-renew-sso-base23-de.service && systemctl daemon-reload
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.service ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.service && systemctl daemon-reload
[Unit]
Description=SSL Certificate renewal for sso.base23.de with LEGO
Description=SSL Certificate renewal for *.base23.de with LEGO
Documentation=https://go-acme.github.io/lego/
Wants=network-online.target
After=network-online.target
[Service]
Type=oneshot
EnvironmentFile=${AUTHENTIK_DOCKER_COMPOSE_PATH}/lego.env
ExecStart=${AUTHENTIK_DOCKER_COMPOSE_PATH}/scripts/cert_renew.sh
WorkingDirectory=${AUTHENTIK_DOCKER_COMPOSE_PATH}/
User=root
@ -87,9 +96,9 @@ RemainAfterExit=no
WantedBy=multi-user.target
EOF
[[ ! -f /etc/systemd/system/lego-renew-sso-base23-de.timer ]] && cat <<EOF > /etc/systemd/system/lego-renew-sso-base23-de.timer && systemctl daemon-reload && systemctl enable --now lego-renew-sso-base23-de.timer
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.timer ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.timer && systemctl daemon-reload && systemctl enable --now lego-renew-wildcard-base23-de.timer
[Unit]
Description=SSL Certificate renewal for sso.base23.de with LEGO Timer
Description=SSL Certificate renewal for *.base23.de with LEGO Timer
[Timer]
OnCalendar=*-*-* 01:32:00