[Let's Encrypt + Nginx Proxy Companion + Release Detection + Key Mount and Cert Mount Sharing] #release #automation for #certs using #letsencrypt #certificate #key #automation

release-automation.lets-encrypt.jwilder.volume.lyns.md

#
# This simply allows the script to find the private key, chain certifiate, and root cert for any sub-domain that was triggered in automation using Lets Encrypt and a Jwilder proxy # # # companion container and their awesome API!
#

#  1. With LynsLang/Fish or Bash you can first `docker ps` with a filter for "name=nginx-proxy-lets" which will provide the container id easily,
#     provided you supply the correct go-lang template parameters:
#

in lyns / fish lyn$ abbr nginx-proxy-get 'docker ps --filter "name=nginx-proxy-lets" --format "{{.ID}}"'

     
> or in bash:
 

bash-4.2$ alias nginx-proxy-get='docker ps --filter "name=nginx-proxy-lets" --format "{{.ID}}"'

#
#    then supply your abbreviation/alias as a container id filter to the exec command from that point forward:

in lynslang / fish lyn$ docker exec -it (nginx-proxy-get) find -L /etc/acme.sh/ -name "*.key"

> or in bash:

docker exec -it $(nginx-proxy-get) find -L /etc/acme.sh/ -name "*.key"

/etc/acme.sh/jane@does.com/ca/acme-v02.api.letsencrypt.org/account.key
/etc/acme.sh/jane@does.com/registry.site.com/site.com.key
/etc/acme.sh/jane@does.comm/releases.site.com/site.com.key

2. Run the above command till you are satisfied you have the key path and cert path, then you can set those in the docker-compose by first adding them to the .env file.

#    So your .env file might look something like:

>   ` NGINX_FULLCHAIN_PEM=$(docker exec -it $(nginx-proxy-get) find -L /etc/acme.sh/ -name "mywebsite.pem")`
>   ` NGINX_CERT_CER=$(docker exec -it $(nginx-proxy-get) find -L /etc/acme.sh/ -name "mywebsite.cer")`
>    `NGINX_RSA_KEY=$(docker exec -it $(nginx-proxy-get) find -L /etc/acme.sh/ -name "mywebsite.key")`

This would dynamically turn your env vars into variables which supply the volume mount path, you just gotta be sure you attach that volume to your container.

• IMPORTANT TO NOTE:

if you hit the path and the $(nginx-proxy-get) alias/abbr path is in a volume that cannot be read by your target container, then it simply "won't work".

3. Attach your volume to the paths. which we setup in the env, for docker-compose:

// Example Compose:

version: '2.3'
services:
  registry:
    image: lynsei/lang:0.9.86
    container_name: test
    entrypoint: sleep(10)
    environment:
      - VIRTUAL_HOST=${VIRTUAL_HOST}
      - LETSENCRYPT_EMAIL=${LE_EMAIL}
      - LETSENCRYPT_HOST=${VIRTUAL_HOST}
    volumes:
      - type: bind
        source: ${NGINX_FULLCHAIN_CER}
        target: /cust_cert_cer
      - type: bind
        source: ${NGINX_FULLCHAIN_PEM}
        target: /cust_cert_pem
    networks:
      - harbor
    depends_on:
      - "nginx-proxy-lets"

4. That's all, just make sure you use a proxy like this one:

#!/usr/bin/bash

OS=`uname -s`
REV=`uname -r`
MACH=`uname -m`

if [ "${OS}" = "SunOS" ] ; then
  OS=Solaris
  ARCH=`uname -p`
  OSSTR="${OS} ${REV}(${ARCH} `uname -v`)"
elif [ "${OS}" = "AIX" ] ; then
  OSSTR="${OS} `oslevel` (`oslevel -r`)"
elif [ "${OS}" = "Linux" ] ; then
  KERNEL=`uname -r`
  if [ -f /etc/redhat-release ] ; then
    DIST=$(cat /etc/redhat-release | awk '{print $1}')
    if [ "${DIST}" = "CentOS" ]; then
      DIST="CentOS"
    elif [ "${DIST}" = "Mandriva" ]; then
      DIST="Mandriva"
      PSEUDONAME=`cat /etc/mandriva-release | sed s/.*\(// | sed s/\)//`
      REV=`cat /etc/mandriva-release | sed s/.*release\ // | sed s/\ .*//`
    elif [ "${DIST}" = "Fedora" ]; then
      DIST="Fedora"
    else
      DIST="RedHat"
    fi

    PSEUDONAME=`cat /etc/redhat-release | sed s/.*\(// | sed s/\)//`
    REV=`cat /etc/redhat-release | sed s/.*release\ // | sed s/\ .*//`
  elif [ -f /etc/SuSE-release ] ; then
    DIST=`cat /etc/SuSE-release | tr "\n" ' '| sed s/VERSION.*//`
    REV=`cat /etc/SuSE-release | tr "\n" ' ' | sed s/.*=\ //`
  elif [ -f /etc/mandrake-release ] ; then
    DIST='Mandrake'
    PSEUDONAME=`cat /etc/mandrake-release | sed s/.*\(// | sed s/\)//`
    REV=`cat /etc/mandrake-release | sed s/.*release\ // | sed s/\ .*//`
  elif [ -f /etc/debian_version ] ; then
    if [ -f /etc/mailcleaner/etc/mailcleaner/version.def ] ; then
      DIST="MailCleaner"
      REV=`cat /etc/mailcleaner/etc/mailcleaner/version.def`
    else
      DIST="Debian `cat /etc/debian_version`"
      REV=""
    fi
  fi

  if [ -f /etc/UnitedLinux-release ] ; then
    DIST="${DIST}[`cat /etc/UnitedLinux-release | tr "\n" ' ' | sed s/VERSION.*//`]"
  fi

  if [ -f /etc/slackware-version ] ; then
    DIST="Slackware";
    REV=$(cat /etc/slackware-version | awk '{print $2}')
  fi

  if [ -f /etc/lsb-release ] ; then
    LSB_DIST="`cat /etc/lsb-release | grep DISTRIB_ID | cut -d "=" -f2`"
    LSB_REV="`cat /etc/lsb-release | grep DISTRIB_RELEASE | cut -d "=" -f2`"
    if [ "$LSB_DIST" != "" ] ; then
      DIST=$LSB_DIST
      REV=$LSB_REV
    fi
  fi

#  OSSTR="${OS} ${DIST} ${REV}(${PSEUDONAME} ${KERNEL} ${MACH})"
  OSSTR="${DIST} ${REV}"
elif [ "${OS}" = "Darwin" ] ; then
  if [ -f /usr/bin/sw_vers ] ; then
    OSSTR=`/usr/bin/sw_vers|grep -v Build|sed 's/^.*:.//'| tr "\n" ' '`
  fi
fi

echo ${OSSTR}

declare x=`docker ps --filter "name=nginx-proxy" --format "{{.ID}}" | tail -n 1`
if [[ $x ]]; then
  echo "Your port 443 is bound to an existing proxy container.  You must first remove any existing proxies to launch a new nginx-proxy...  run:"
  echo "-------- "
 echo docker rm -f `docker ps --filter "name=nginx-proxy" --format "{{.ID}}" | tail -n 1 `\
  "   && ./proxy.sh"
else
  echo "Instantiating a reverse proxy container bound to 80 and 443";
  docker run -d --name nginx-proxy --restart=always -p 80:80 -p 443:443 -v /etc/nginx/vhost.d \
   -v /usr/share/nginx/html \
   -v /etc/nginx/ssl:/etc/nginx/certs \
   -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy:alpine
  docker run --detach \
    --name nginx-proxy-letsencrypt \
    --volumes-from nginx-proxy -v /var/run/docker.sock:/var/run/docker.sock:ro \
    --env "DEFAULT_EMAIL=jane@janedoe.com" \
    jrcs/letsencrypt-nginx-proxy-companion
fi