Skip to content

Commit b875064

Browse files
jss-tgipcjsclith-ci
authored
feat: 添加certbot自动更新证书的配置 (#28)
* wip: 添加certbot * wip: 尝试改成执行脚本 * wip: 使用Dockerfile给certbot的容器添加docker compose命令 * wip: 添加过期提醒邮箱 * wip: email参数不支持=分隔 * fix: 规范ini文件格式 * wip: 添加自动申请证书的demo和说明 * wip: 重启所有包含nginx的服务 * wip: 优化日志 --------- Co-authored-by: ipcjs.mac4 <[email protected]> Co-authored-by: cli <cli@debian> Co-authored-by: th-ci <[email protected]>
1 parent ed01f99 commit b875064

File tree

7 files changed

+114
-11
lines changed

7 files changed

+114
-11
lines changed

‎.env.default‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ SERVER_HOSTNAME='' # livedvr.tripsdd.com
3636

3737
# 使用https时, 必填, 证书文件的绝对路径, 排除.crt/.key后缀, nginx实际读取的是 ${SSL_CERTIFICATE}.crt 和 ${SSL_CERTIFICATE}.key 两个文件
3838
# 如果暂时没有申请到证书, 可以使用内置的假证书: /home/docker/nginx/ssl/placeholder
39+
# 若使用crotbot自动申请证书, 证书的路径会在日志中打印, 一般为: /data/certbot/live/${SERVER_HOSTNAME}/certificate
3940
SSL_CERTIFICATE='' # /home/docker-compose/ssl/livedvr_tripsdd_com
4041

4142
# bus和track部署在同一台服务器上时, 需要通过域名区分两者
@@ -51,6 +52,20 @@ WEB_PORT_HTTPS=443
5152
# jtt808和maintain分开部署时, 必须填写这个变量
5253
WEB_BASE_URL='' # https://livedvr.tripsdd.com
5354

55+
# certbot的配置
56+
# 注意: 修改这些配置之后, 必须强制重建(docker compose up --force-recreate certbot), 才会生效
57+
#
58+
# DNS解析的提供商, 常用的提供商如下:
59+
# - dnspod: https://console.dnspod.cn/account/token/token
60+
# - cloudflare: https://go-acme.github.io/lego/dns/cloudflare/
61+
# - tencentcloud: https://console.cloud.tencent.com/cam/capi
62+
CERTBOT_DNS_PROVIDER='dnspod'
63+
CERTBOT_DNS_API_KEY='' # 必填
64+
# tencentcloud还需要额外设置这个变量
65+
CERTBOT_TENCENTCLOUD_SECRET_ID=''
66+
# 接收证书过期提醒的email
67+
CERTBOT_EMAIL='[email protected]'
68+
5469
## ================================ Services ================================
5570

5671
## 视频服务器

‎certbot/.env‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../.env.default

‎certbot/Dockerfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# 支持100+DNS提供商的Certbot插件
2+
# 详见: https://github.com/alexzorin/certbot-dns-multi
3+
FROM ghcr.io/alexzorin/certbot-dns-multi:4.27.0
4+
5+
# 添加docker和docker compose命令
6+
COPY --from=docker:cli /usr/local/bin/docker /usr/local/bin/docker
7+
COPY --from=docker:cli /usr/local/libexec/docker/cli-plugins/docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose

‎certbot/compose.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
services:
2+
certbot:
3+
build: .
4+
command:
5+
- certonly
6+
- --non-interactive
7+
- --agree-tos
8+
- --email
9+
- ${CERTBOT_EMAIL:[email protected]}
10+
- --authenticator=dns-multi
11+
- --dns-multi-credentials=/etc/letsencrypt/dns-multi.ini
12+
# 四个域名可以同时申请, 故不要求必填
13+
- --domains=${SERVER_HOSTNAME}
14+
- --domains=${TRACK_HOSTNAME}
15+
- --domains=${BUS_HOSTNAME}
16+
- --domains=${VIDEO_HOSTNAME}
17+
- --deploy-hook
18+
- "sh -c 'COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME} DATA=${DATA_DIR:-/data} /home/docker/certbot/deploy-hook.sh'"
19+
volumes:
20+
- /var/run/docker.sock:/var/run/docker.sock
21+
- ${DATA_DIR:-/data}/certbot:/etc/letsencrypt
22+
configs:
23+
- source: certbot-deploy-hook.sh
24+
target: /home/docker/certbot/deploy-hook.sh
25+
- source: certbot-dns-multi.ini
26+
target: /etc/letsencrypt/dns-multi.ini
27+
mode: 0600
28+
29+
30+
ofelia:
31+
image: mcuadros/ofelia
32+
command: daemon --docker
33+
volumes:
34+
- /var/run/docker.sock:/var/run/docker.sock:ro
35+
labels:
36+
# 通过ofelia重启其他服务, 需要这样绕一道
37+
# https://github.com/mcuadros/ofelia/issues/280#issuecomment-2561863012
38+
ofelia.job-run.certbot-renew.schedule: "@daily"
39+
ofelia.job-run.certbot-renew.command: "sh -c 'docker compose -p ${COMPOSE_PROJECT_NAME} restart certbot'"
40+
ofelia.job-run.certbot-renew.image: "docker:cli"
41+
ofelia.job-run.certbot-renew.volume: "/var/run/docker.sock:/var/run/docker.sock"
42+
43+
configs:
44+
certbot-deploy-hook.sh:
45+
file: ./deploy-hook.sh
46+
# certbot-dns-multi的配置文件
47+
# https://github.com/alexzorin/certbot-dns-multi#usage
48+
certbot-dns-multi.ini:
49+
content: |
50+
dns_multi_provider = ${CERTBOT_DNS_PROVIDER:-dnspod}
51+
DNSPOD_API_KEY = "${CERTBOT_DNS_API_KEY:?required}"
52+
CLOUDFLARE_DNS_API_TOKEN = "${CERTBOT_DNS_API_KEY:?required}"
53+
TENCENTCLOUD_SECRET_KEY = "${CERTBOT_DNS_API_KEY:?required}"
54+
TENCENTCLOUD_SECRET_ID = "${CERTBOT_TENCENTCLOUD_SECRET_ID}"

‎certbot/deploy-hook.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/sh
2+
set -e
3+
4+
cp -f "$RENEWED_LINEAGE/fullchain.pem" "$RENEWED_LINEAGE/certificate.crt"
5+
cp -f "$RENEWED_LINEAGE/privkey.pem" "$RENEWED_LINEAGE/certificate.key"
6+
7+
echo "======================"
8+
echo "请将证书变量设置为:"
9+
echo "SSL_CERTIFICATE='${DATA_DIR:-/data}/certbot/live/$(basename "$RENEWED_LINEAGE")/certificate'"
10+
echo
11+
12+
echo "正在查找包含'nginx'的服务..."
13+
nginx_services=$(docker compose -p "${COMPOSE_PROJECT_NAME}" ps --services | grep nginx || true)
14+
15+
if [ -n "$nginx_services" ]; then
16+
echo "重启 $nginx_services 中..." | tr '\n' ' '
17+
echo
18+
echo "$nginx_services" | xargs docker compose -p "${COMPOSE_PROJECT_NAME}" restart
19+
echo "重启完成"
20+
else
21+
echo "未找到包含'nginx'的服务"
22+
fi
23+
echo "======================"

‎examples/bus-https/.env‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,24 @@
1-
#---------服务器信息, 必须按实际服务器信息填写-----------------
2-
## 公网IP
1+
##---------服务器信息, 必须按实际服务器信息填写-----------------
2+
# 公网IP
33
SERVER_IP_PUBLIC='81.71.36.80'
4-
## HOSTNAME 没有用域名IP替代
4+
# HOSTNAME 没有用域名IP替代
55
SERVER_HOSTNAME='transcodegroup.cn'
6-
## SSL证书
7-
SSL_CERTIFICATE='/home/docker-compose/ssl/tg_com'
6+
# 自动申请的SSL证书
7+
SSL_CERTIFICATE="/data/certbot/live/${SERVER_HOSTNAME}/certificate"
8+
# dnspod的api key, 由id和token拼接而成: https://console.dnspod.cn/account/token/token
9+
CERTBOT_DNS_API_KEY='id,token'
810

9-
#---------自定义初始密码, 建议随机生成新的替换-------------
10-
## MYSQL, 必填
11+
##---------自定义初始密码, 建议随机生成新的替换-------------
12+
# MYSQL, 必填
1113
MYSQL_PASSWORD='ZfJwfEJvL8wbPr4LvCyx'
12-
## REDIS, 必填
14+
# REDIS, 必填
1315
REDIS_PASSWORD='ZfJwfEJvL8wbPr4LvCyx'
14-
## RABBIT_MQ, 必填
16+
# RABBIT_MQ, 必填
1517
RABBITMQ_PASSWORD='ZfJwfEJvL8wbPr4LvCyx'
16-
## Email，必填
18+
# Email，必填
1719
MAIL_PASSWORD='ZfJwfEJvL8wbPr4LvCyx'
1820

19-
#----------自定义端口信息, 推荐开放9000~9100,443,80--------
21+
##----------自定义端口信息, 推荐开放9000~9100,443,80--------
2022
# 前端端口配置, HTTP默认80， HTTPS默认443
2123
WEB_PORT_HTTP=9070
2224
WEB_PORT_HTTPS=9080

‎examples/bus-https/compose.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ include:
77
- ../docker/redis/compose.yml
88
- ../docker/bus/compose.yml
99
- ../docker/video-nginx/compose.yml
10+
- ../docker/certbot/compose.yml
1011
- path:
1112
- ../docker/video/compose.yml
1213
- ../docker/video/compose.bus.yml

0 commit comments

Comments
 (0)