2020-08-03 11:00:14 -04:00
#!/usr/bin/with-contenv bash
# Display variables for troubleshooting
echo -e "Variables set:\\n\
PUID=${PUID}\\n\
PGID=${PGID}\\n\
TZ=${TZ}\\n\
URL=${URL}\\n\
SUBDOMAINS=${SUBDOMAINS}\\n\
EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
VALIDATION=${VALIDATION}\\n\
2020-12-10 11:58:52 -05:00
CERTPROVIDER=${CERTPROVIDER}\\n\
2020-08-03 11:00:14 -04:00
DNSPLUGIN=${DNSPLUGIN}\\n\
EMAIL=${EMAIL}\\n\
STAGING=${STAGING}\\n"
# Sanitize variables
2021-02-15 13:02:26 -05:00
SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER)
for i in "${SANED_VARS[@]}"; do
2021-04-27 15:32:41 -04:00
export echo "$i"="${!i//\"/}"
export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
2020-08-03 11:00:14 -04:00
done
# check to make sure DNSPLUGIN is selected if dns validation is used
2022-10-06 14:08:20 -04:00
if [[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(acmedns|aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|do|domeneshop|duckdns|dynu|gandi|gehirn|godaddy|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|porkbun|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]]; then
2021-10-14 15:01:48 -04:00
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details."
2021-04-27 15:32:41 -04:00
sleep infinity
2021-10-14 15:01:48 -04:00
fi
2020-08-03 11:00:14 -04:00
2021-02-15 13:02:26 -05:00
# copy dns default configs
cp -n /defaults/dns-conf/* /config/dns-conf/
chown -R abc:abc /config/dns-conf
# update plugin names in dns conf inis
sed -i 's|^certbot_dns_aliyun:||g' /config/dns-conf/aliyun.ini
2022-10-06 10:58:47 -04:00
sed -i 's|^certbot_dns_cpanel:|dns_|g' /config/dns-conf/cpanel.ini
2021-02-15 13:02:26 -05:00
sed -i 's|^certbot_dns_domeneshop:||g' /config/dns-conf/domeneshop.ini
sed -i 's|^certbot_dns_inwx:||g' /config/dns-conf/inwx.ini
sed -i 's|^certbot_dns_transip:||g' /config/dns-conf/transip.ini
2022-10-06 10:58:47 -04:00
sed -i 's|^certbot_plugin_gandi:dns_|dns_gandi_|g' /config/dns-conf/gandi.ini
2021-02-15 13:02:26 -05:00
# copy default renewal hooks
chmod -R +x /defaults/etc/letsencrypt/renewal-hooks
cp -nR /defaults/etc/letsencrypt/renewal-hooks/* /config/etc/letsencrypt/renewal-hooks/
chown -R abc:abc /config/etc/letsencrypt/renewal-hooks
2020-12-10 11:58:52 -05:00
# create original config file if it doesn't exist, move non-hidden legacy file to hidden
if [ -f "/config/donoteditthisfile.conf" ]; then
2021-04-27 15:32:41 -04:00
mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
2020-12-10 11:58:52 -05:00
fi
if [ ! -f "/config/.donoteditthisfile.conf" ]; then
2022-10-06 14:08:20 -04:00
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" >/config/.donoteditthisfile.conf
2021-04-27 15:32:41 -04:00
echo "Created .donoteditthisfile.conf"
2020-08-03 11:00:14 -04:00
fi
# load original config settings
# shellcheck disable=SC1091
2020-12-10 11:58:52 -05:00
. /config/.donoteditthisfile.conf
2020-08-03 11:00:14 -04:00
# set default validation to http
if [ -z "$VALIDATION" ]; then
2021-04-27 15:32:41 -04:00
VALIDATION="http"
echo "VALIDATION parameter not set; setting it to http"
2020-08-03 11:00:14 -04:00
fi
2022-10-06 14:08:20 -04:00
# set duckdns validation to dns
if [ "$VALIDATION" = "duckdns" ]; then
VALIDATION="dns"
DNSPLUGIN="duckdns"
if [ -n "$DUCKDNSTOKEN" ] && ! grep -q "dns_duckdns_token=${DUCKDNSTOKEN}$" /config/dns-conf/duckdns.ini;then
sed -i "s|^dns_duckdns_token=.*|dns_duckdns_token=${DUCKDNSTOKEN}|g" /config/dns-conf/duckdns.ini
fi
fi
if [ "$VALIDATION" = "dns" ] && [ "$DNSPLUGIN" = "duckdns" ]; then
if [ "$SUBDOMAINS" = "wildcard" ]; then
echo "the resulting certificate will only cover the subdomains due to a limitation of duckdns, so it is advised to set the root location to use www.subdomain.duckdns.org"
export ONLY_SUBDOMAINS=true
else
echo "the resulting certificate will only cover the main domain due to a limitation of duckdns, ie. subdomain.duckdns.org"
export SUBDOMAINS=""
fi
export EXTRA_DOMAINS=""
fi
2020-12-10 11:58:52 -05:00
# if zerossl is selected or staging is set to true, use the relevant server
if [ "$CERTPROVIDER" = "zerossl" ] && [ "$STAGING" = "true" ]; then
2021-04-27 15:32:41 -04:00
echo "ZeroSSL does not support staging mode, ignoring STAGING variable"
2020-12-10 11:58:52 -05:00
fi
if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
2021-04-27 15:32:41 -04:00
echo "ZeroSSL is selected as the cert provider, registering cert with $EMAIL"
ACMESERVER="https://acme.zerossl.com/v2/DV90"
2020-12-10 11:58:52 -05:00
elif [ "$CERTPROVIDER" = "zerossl" ] && [ -z "$EMAIL" ]; then
2021-04-27 15:32:41 -04:00
echo "ZeroSSL is selected as the cert provider, but the e-mail address has not been entered. Please visit https://zerossl.com, register a new account and set the account e-mail address in the EMAIL environment variable"
sleep infinity
2020-12-10 11:58:52 -05:00
elif [ "$STAGING" = "true" ]; then
2021-04-27 15:32:41 -04:00
echo "NOTICE: Staging is active"
echo "Using Let's Encrypt as the cert provider"
ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
2020-08-03 11:00:14 -04:00
else
2021-04-27 15:32:41 -04:00
echo "Using Let's Encrypt as the cert provider"
ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
2020-08-03 11:00:14 -04:00
fi
# figuring out url only vs url & subdomains vs subdomains only
if [ -n "$SUBDOMAINS" ]; then
echo "SUBDOMAINS entered, processing"
2021-04-27 15:32:41 -04:00
if [ "$SUBDOMAINS" = "wildcard" ]; then
if [ "$ONLY_SUBDOMAINS" = true ]; then
export URL_REAL="-d *.${URL}"
echo "Wildcard cert for only the subdomains of $URL will be requested"
else
export URL_REAL="-d *.${URL} -d ${URL}"
echo "Wildcard cert for $URL will be requested"
fi
2020-08-03 11:00:14 -04:00
else
2021-04-27 15:32:41 -04:00
echo "SUBDOMAINS entered, processing"
for job in $(echo "$SUBDOMAINS" | tr "," " "); do
export SUBDOMAINS_REAL="$SUBDOMAINS_REAL -d ${job}.${URL}"
done
if [ "$ONLY_SUBDOMAINS" = true ]; then
URL_REAL="$SUBDOMAINS_REAL"
echo "Only subdomains, no URL in cert"
else
URL_REAL="-d ${URL}${SUBDOMAINS_REAL}"
fi
echo "Sub-domains processed are: $SUBDOMAINS_REAL"
2020-08-03 11:00:14 -04:00
fi
else
2021-04-27 15:32:41 -04:00
echo "No subdomains defined"
URL_REAL="-d $URL"
2020-08-03 11:00:14 -04:00
fi
# add extra domains
if [ -n "$EXTRA_DOMAINS" ]; then
2021-04-27 15:32:41 -04:00
echo "EXTRA_DOMAINS entered, processing"
for job in $(echo "$EXTRA_DOMAINS" | tr "," " "); do
export EXTRA_DOMAINS_REAL="$EXTRA_DOMAINS_REAL -d ${job}"
done
echo "Extra domains processed are: $EXTRA_DOMAINS_REAL"
URL_REAL="$URL_REAL $EXTRA_DOMAINS_REAL"
2020-08-03 11:00:14 -04:00
fi
# figuring out whether to use e-mail and which
if [[ $EMAIL == *@* ]]; then
2021-04-27 15:32:41 -04:00
echo "E-mail address entered: ${EMAIL}"
EMAILPARAM="-m ${EMAIL} --no-eff-email"
2020-08-03 11:00:14 -04:00
else
2021-04-27 15:32:41 -04:00
echo "No e-mail address entered or address invalid"
EMAILPARAM="--register-unsafely-without-email"
2020-08-03 11:00:14 -04:00
fi
# setting the validation method to use
if [ "$VALIDATION" = "dns" ]; then
2021-04-27 15:32:41 -04:00
if [ "$DNSPLUGIN" = "route53" ]; then
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
2021-04-27 15:32:41 -04:00
PREFCHAL="--dns-${DNSPLUGIN} ${PROPAGATIONPARAM}"
2022-10-06 10:58:47 -04:00
elif [[ "$DNSPLUGIN" =~ ^(azure|gandi)$ ]]; then
if [ -n "$PROPAGATION" ]; then echo "${DNSPLUGIN} dns plugin does not support setting propagation time"; fi
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini"
2022-11-11 10:59:29 -05:00
elif [[ "$DNSPLUGIN" =~ ^(duckdns)$ ]]; then
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini --dns-duckdns-no-txt-restore ${PROPAGATIONPARAM}"
2021-04-27 15:32:41 -04:00
elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
2021-04-27 15:32:41 -04:00
PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
2022-11-11 10:59:29 -05:00
elif [[ "$DNSPLUGIN" =~ ^(acmedns|aliyun|cpanel|desec|dnspod|do|domeneshop|dynu|godaddy|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|porkbun|transip|vultr)$ ]]; then
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
2021-04-27 15:32:41 -04:00
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
2021-11-06 11:07:51 -04:00
elif [[ "$DNSPLUGIN" =~ ^(standalone)$ ]]; then
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then echo "standalone dns plugin does not support setting propagation time"; fi
2021-11-06 11:07:51 -04:00
PREFCHAL="-a dns-${DNSPLUGIN}"
2021-04-27 15:32:41 -04:00
elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
2021-04-27 15:32:41 -04:00
PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
else
2021-02-15 13:02:26 -05:00
if [ -n "$PROPAGATION" ]; then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
2021-04-27 15:32:41 -04:00
PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
fi
echo "${VALIDATION} validation via ${DNSPLUGIN} plugin is selected"
2020-08-03 11:00:14 -04:00
elif [ "$VALIDATION" = "tls-sni" ]; then
2022-10-06 10:58:47 -04:00
PREFCHAL="--standalone --preferred-challenges http"
2021-04-27 15:32:41 -04:00
echo "*****tls-sni validation has been deprecated, attempting http validation instead"
2020-08-03 11:00:14 -04:00
else
2022-10-06 10:58:47 -04:00
PREFCHAL="--standalone --preferred-challenges http"
2021-04-27 15:32:41 -04:00
echo "http validation is selected"
2020-08-03 11:00:14 -04:00
fi
# setting the symlink for key location
rm -rf /config/keys/letsencrypt
2021-02-15 13:02:26 -05:00
if [ "$ONLY_SUBDOMAINS" = "true" ] && [ ! "$SUBDOMAINS" = "wildcard" ]; then
2021-04-27 15:32:41 -04:00
DOMAIN="$(echo "$SUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${URL}"
ln -s ../etc/letsencrypt/live/"$DOMAIN" /config/keys/letsencrypt
2020-08-03 11:00:14 -04:00
else
2021-05-14 16:22:32 -04:00
ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
2020-08-03 11:00:14 -04:00
fi
# checking for changes in cert variables, revoking certs if necessary
2022-10-06 14:08:20 -04:00
if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
2021-04-27 15:32:41 -04:00
echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
if [ "$ORIGONLY_SUBDOMAINS" = "true" ] && [ ! "$ORIGSUBDOMAINS" = "wildcard" ]; then
ORIGDOMAIN="$(echo "$ORIGSUBDOMAINS" | tr ',' ' ' | awk '{print $1}').${ORIGURL}"
else
ORIGDOMAIN="$ORIGURL"
2021-01-20 08:43:55 -05:00
fi
2021-04-27 15:32:41 -04:00
if [ "$ORIGCERTPROVIDER" = "zerossl" ] && [ -n "$ORIGEMAIL" ]; then
REV_EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$ORIGEMAIL")
REV_ZEROSSL_EAB_KID=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
REV_ZEROSSL_EAB_HMAC_KEY=$(echo "$REV_EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
if [ -z "$REV_ZEROSSL_EAB_KID" ] || [ -z "$REV_ZEROSSL_EAB_HMAC_KEY" ]; then
2021-05-14 16:22:32 -04:00
echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
sleep infinity
2021-04-27 15:32:41 -04:00
fi
REV_ACMESERVER="https://acme.zerossl.com/v2/DV90 --eab-kid ${REV_ZEROSSL_EAB_KID} --eab-hmac-key ${REV_ZEROSSL_EAB_HMAC_KEY}"
elif [ "$ORIGSTAGING" = "true" ]; then
REV_ACMESERVER="https://acme-staging-v02.api.letsencrypt.org/directory"
else
REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
fi
2021-10-14 15:01:48 -04:00
if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
fi
2022-10-10 19:36:29 -04:00
rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
2020-08-03 11:00:14 -04:00
fi
# saving new variables
2022-10-06 14:08:20 -04:00
echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGEMAIL=\"$EMAIL\"" >/config/.donoteditthisfile.conf
2020-08-03 11:00:14 -04:00
# alter extension for error message
if [ "$DNSPLUGIN" = "google" ]; then
2021-04-27 15:32:41 -04:00
FILENAME="$DNSPLUGIN.json"
2020-08-03 11:00:14 -04:00
else
2021-04-27 15:32:41 -04:00
FILENAME="$DNSPLUGIN.ini"
2020-08-03 11:00:14 -04:00
fi
2021-10-01 11:18:12 -04:00
# Check if the cert is using the old LE root cert, revoke and regen if necessary
2021-02-15 13:02:26 -05:00
if [ -f "/config/keys/letsencrypt/chain.pem" ] && { [ "${CERTPROVIDER}" == "letsencrypt" ] || [ "${CERTPROVIDER}" == "" ]; } && [ "${STAGING}" != "true" ] && ! openssl x509 -in /config/keys/letsencrypt/chain.pem -noout -issuer | grep -q "ISRG Root X"; then
2021-10-01 11:18:12 -04:00
echo "The cert seems to be using the old LE root cert, which is no longer valid. Deleting and revoking."
2021-10-12 10:04:57 -04:00
REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
2022-10-06 10:58:47 -04:00
if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
fi
2022-10-10 19:36:29 -04:00
rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
2021-10-01 11:18:12 -04:00
fi
2020-08-03 11:00:14 -04:00
# generating certs if necessary
if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
2021-04-27 15:32:41 -04:00
if [ "$CERTPROVIDER" = "zerossl" ] && [ -n "$EMAIL" ]; then
echo "Retrieving EAB from ZeroSSL"
EAB_CREDS=$(curl -s https://api.zerossl.com/acme/eab-credentials-email --data "email=$EMAIL")
ZEROSSL_EAB_KID=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_kid'])")
ZEROSSL_EAB_HMAC_KEY=$(echo "$EAB_CREDS" | python3 -c "import sys, json; print(json.load(sys.stdin)['eab_hmac_key'])")
if [ -z "$ZEROSSL_EAB_KID" ] || [ -z "$ZEROSSL_EAB_HMAC_KEY" ]; then
2021-05-14 16:22:32 -04:00
echo "Unable to retrieve EAB credentials from ZeroSSL. Check the outgoing connections to api.zerossl.com and dns. Sleeping."
sleep infinity
2021-04-27 15:32:41 -04:00
fi
ZEROSSL_EAB="--eab-kid ${ZEROSSL_EAB_KID} --eab-hmac-key ${ZEROSSL_EAB_HMAC_KEY}"
2021-01-20 08:43:55 -05:00
fi
2021-04-27 15:32:41 -04:00
echo "Generating new certificate"
# shellcheck disable=SC2086
2021-02-15 13:02:26 -05:00
certbot certonly --non-interactive --renew-by-default --server $ACMESERVER $ZEROSSL_EAB $PREFCHAL --rsa-key-size 4096 $EMAILPARAM --agree-tos $URL_REAL
if [ ! -d /config/keys/letsencrypt ]; then
2021-04-27 15:32:41 -04:00
if [ "$VALIDATION" = "dns" ]; then
2021-05-14 16:22:32 -04:00
echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the /config/dns-conf/${FILENAME} file."
2021-04-27 15:32:41 -04:00
else
2021-05-14 16:22:32 -04:00
echo "ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container"
2021-04-27 15:32:41 -04:00
fi
sleep infinity
2020-08-03 11:00:14 -04:00
fi
2021-02-15 13:02:26 -05:00
run-parts /config/etc/letsencrypt/renewal-hooks/deploy/
2021-04-27 15:32:41 -04:00
echo "New certificate generated; starting nginx"
2020-08-03 11:00:14 -04:00
else
2021-04-27 15:32:41 -04:00
echo "Certificate exists; parameters unchanged; starting nginx"
2020-08-03 11:00:14 -04:00
fi
2022-11-23 09:39:22 -05:00
# if certbot generated key exists, remove self-signed cert and replace it with symlink to live cert
if [ -d /config/keys/letsencrypt ]; then
rm -rf /config/keys/cert.crt
ln -s ./letsencrypt/fullchain.pem /config/keys/cert.crt
rm -rf /config/keys/cert.key
ln -s ./letsencrypt/privkey.pem /config/keys/cert.key
fi