50 lines
1.6 KiB
Bash
Executable File
50 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
DOMAIN="${MAIL_DOMAIN:-mail.crabs-games.art}"
|
|
EMAIL="${ACME_EMAIL:-admin@crabs-games.art}"
|
|
REPROXY_CONTAINER="${REPROXY_CONTAINER:-reproxy}"
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPROXY_SSL_DIR="${REPROXY_SSL_DIR:-/Users/vladimir/reproxy/var/ssl}"
|
|
CERTBOT_DIR="$REPROXY_SSL_DIR/certbot"
|
|
CERT_DIR="$REPROXY_SSL_DIR/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN"
|
|
COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"
|
|
|
|
command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
|
|
docker info >/dev/null || { echo "docker access is required" >&2; exit 1; }
|
|
|
|
mkdir -p "$CERTBOT_DIR" "$CERT_DIR"
|
|
|
|
reproxy_was_running=0
|
|
if docker inspect -f '{{.State.Running}}' "$REPROXY_CONTAINER" 2>/dev/null | grep -qx true; then
|
|
reproxy_was_running=1
|
|
docker stop "$REPROXY_CONTAINER" >/dev/null
|
|
fi
|
|
|
|
restart_reproxy() {
|
|
if [ "$reproxy_was_running" -eq 1 ]; then
|
|
docker start "$REPROXY_CONTAINER" >/dev/null
|
|
fi
|
|
}
|
|
trap restart_reproxy EXIT
|
|
|
|
docker run --rm \
|
|
-p 80:80 \
|
|
-v "$CERTBOT_DIR:/etc/letsencrypt" \
|
|
certbot/certbot:latest \
|
|
certonly --standalone \
|
|
--keep-until-expiring \
|
|
--non-interactive \
|
|
--agree-tos \
|
|
--email "$EMAIL" \
|
|
--cert-name "$DOMAIN" \
|
|
-d "$DOMAIN"
|
|
|
|
cp "$CERTBOT_DIR/live/$DOMAIN/fullchain.pem" "$CERT_DIR/$DOMAIN.crt"
|
|
cp "$CERTBOT_DIR/live/$DOMAIN/privkey.pem" "$CERT_DIR/$DOMAIN.key"
|
|
|
|
docker compose -f "$COMPOSE_FILE" up -d --force-recreate mailserver
|
|
|
|
echo "TLS certificate for $DOMAIN is installed."
|
|
echo "Check it with: openssl s_client -connect $DOMAIN:465 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -dates"
|