DAG to renew letsencrypt certificates

main
Linux User 2022-09-09 12:10:06 +02:00
parent 1f6b461070
commit c313f6a6ee
2 changed files with 64 additions and 0 deletions

View File

@ -0,0 +1,53 @@
WD=/var/lib/dags/letsencrypt_renew
RENEW=$(WD)/renewed_certs
NGINX_RELOAD=$(WD)/nginx_reload
PROSODY_IMPORT=$(WD)/prosody_import
PROSODY_RELOAD=$(WD)/prosody_reload
.PHONY: all
all: $(RENEW) $(NGINX_RELOAD) $(PROSODY_RELOAD)
################################################################################
LETSENCRYPT_COMPOSE_FILE=/srv/services/letsencrypt/docker-compose.yml
$(RENEW):
mkdir -p $(@D)
docker-compose \
--file $(LETSENCRYPT_COMPOSE_FILE) \
run --rm certbot \
renew --deploy-hook "touch $@"
################################################################################
NGINX_COMPOSE_FILE=/srv/services/www/docker-compose.yml
$(NGINX_RELOAD): $(RENEW)
mkdir -p $(@D)
docker-compose \
--file $(NGINX_COMPOSE_FILE) \
exec nginx \
nginx -s reload
touch $@
################################################################################
PROSODY_COMPOSE_FILE=/srv/services/xmpp/docker-compose.yml
$(PROSODY_IMPORT): $(RENEW)
mkdir -p $(@D)
docker-compose \
--file $(PROSODY_COMPOSE_FILE) \
exec prosody \
prosodyctl --root cert import /etc/letsencrypt/live
touch $@
$(PROSODY_RELOAD): $(PROSODY_IMPORT)
mkdir -p $(@D)
docker-compose \
--file $(PROSODY_COMPOSE_FILE) \
exec prosody \
prosodyctl reload
touch $@

View File

@ -0,0 +1,11 @@
# letsencrypt renew
This DAG renews Letsencrypt certificates using certbot.
If certificates are renewed, NGINX is reload to pick up the new ones and
prosody imports the new certificates and realods too.
## TODO
I should probably only realod services when their specific certificates have
been renewed.