diff --git a/.env b/.env index 59d5579..6d37258 100644 --- a/.env +++ b/.env @@ -1 +1 @@ -VERSION='3.7.5' +VERSION='3.7.6' diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index b2ba346..1527e6e 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -68,11 +68,12 @@ jobs: /usr/bin/chmod --verbose '0755' './traefik/DEBIAN/prerm' /usr/bin/chmod --verbose '0755' './traefik/etc/init.d/traefik' /usr/bin/touch './traefik/etc/traefik/traefik.env' - /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env' /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme' /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/00-export' /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/01-changelog' /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/acme/acme.env' + /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/providers.env' + /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env' /usr/bin/install --directory --verbose './traefik/usr/sbin' /usr/bin/mv --verbose './sources/traefik' './traefik/usr/sbin' - name: Debian Package [Generate] diff --git a/traefik/DEBIAN/conffiles b/traefik/DEBIAN/conffiles index 5ef0748..262c02e 100644 --- a/traefik/DEBIAN/conffiles +++ b/traefik/DEBIAN/conffiles @@ -2,5 +2,4 @@ /etc/traefik/traefik.env /etc/traefik/traefik.yml /etc/traefik/acme/00-export -/etc/traefik/acme/01-changelog /etc/traefik/acme/acme.env diff --git a/traefik/DEBIAN/control b/traefik/DEBIAN/control index 81b8046..b3f97fb 100644 --- a/traefik/DEBIAN/control +++ b/traefik/DEBIAN/control @@ -2,7 +2,7 @@ Package: traefik Version: Architecture: Installed-Size: -Depends: jq +Depends: jq, openssl, ssl-cert Priority: optional Section: misc Homepage: http://www.privlab.it diff --git a/traefik/DEBIAN/postinst b/traefik/DEBIAN/postinst index 9494d52..8eca03b 100644 --- a/traefik/DEBIAN/postinst +++ b/traefik/DEBIAN/postinst @@ -37,10 +37,11 @@ case "${1}" in /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/lib/traefik' /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/log/traefik' /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/logrotate/traefik' - /usr/bin/chown --quiet --recursive 'traefik' \ - '/etc/traefik/providers.yml' \ - '/etc/traefik/traefik.env' \ - '/etc/traefik/traefik.yml' + /usr/bin/chown --quiet 'traefik' \ + '/etc/traefik' \ + '/etc/traefik/providers.yml' \ + '/etc/traefik/traefik.env' \ + '/etc/traefik/traefik.yml' if [ -x '/usr/bin/deb-systemd-invoke' ]; then /usr/bin/systemctl --system daemon-reload > '/dev/null' || true if [ -n "${2}" ]; then diff --git a/traefik/etc/traefik/acme/00-export b/traefik/etc/traefik/acme/00-export index dde14fd..d7ab7ea 100644 --- a/traefik/etc/traefik/acme/00-export +++ b/traefik/etc/traefik/acme/00-export @@ -24,8 +24,27 @@ set -o pipefail ### source '/etc/traefik/acme/acme.env' -ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}" ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}" +ACME_STORAGE="${ACME_STORAGE:='/etc/ssl/traefik'}" + + +### +# +# Function Section +# +### + +function export () { + local PREFIX="${1}" + /usr/bin/echo "${CERTIFICATE}" | \ + /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt" + /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt" + /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt" + /usr/bin/echo "${KEY}" | \ + /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key" + /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key" + /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key" +} ### @@ -34,7 +53,7 @@ ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}" # ### -if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then +if [[ "${EUID}" -ne '0' ]]; then /usr/bin/echo -e 'Error: Permission Denied' exit 1 fi @@ -43,36 +62,25 @@ if [[ -d "${ACME_STORAGE}" ]]; then /usr/bin/rm --force --recursive "${ACME_STORAGE}" fi -/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}" +/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}" for RESOLVER in $(/usr/bin/jq --raw-output --exit-status 'keys[]' "${ACME_DATABASE}"); do + ACCOUNT=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Account.PrivateKey' "${ACME_DATABASE}") - /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/.${RESOLVER}" + /usr/bin/install --directory --group='root' --mode='0700' --owner='root' "${ACME_STORAGE}/.acme/${RESOLVER}" /usr/bin/echo -e "-----BEGIN RSA PRIVATE KEY-----\n${ACCOUNT}\n-----END RSA PRIVATE KEY-----" | \ - /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.${RESOLVER}/account.key" &> '/dev/null' - /usr/bin/chmod '0400' "${ACME_STORAGE}/.${RESOLVER}/account.key" + /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" &> '/dev/null' + /usr/bin/chmod '0400' "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" for DOMAIN in $(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Certificates[].domain.main' "${ACME_DATABASE}"); do CERTIFICATE=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .certificate' "${ACME_DATABASE}") KEY=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .key' "${ACME_DATABASE}") - /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}" + /usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}/${DOMAIN}" case "${RESOLVER}" in *rsa*) - /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/rsa" - /usr/bin/echo "${CERTIFICATE}" | \ - /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt" - /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt" - /usr/bin/echo "${KEY}" | \ - /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.key" - /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.key" + export 'rsa' ;; *ecdsa*) - /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/ecc" - /usr/bin/echo "${CERTIFICATE}" | \ - /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt" - /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt" - /usr/bin/echo "${KEY}" | \ - /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.key" - /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.key" + export 'ecc' ;; esac done diff --git a/traefik/etc/traefik/acme/01-changelog b/traefik/etc/traefik/acme/01-changelog deleted file mode 100644 index 068aa78..0000000 --- a/traefik/etc/traefik/acme/01-changelog +++ /dev/null @@ -1,62 +0,0 @@ -#!/usr/bin/bash - - -# -# Generate changelog with hashsum from the exported certificates -# - - -### -# -# Options Section -# -### - -set -e -set -u -set -o pipefail - - -### -# -# Variables Section -# -### - -source '/etc/traefik/acme/acme.env' -ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}" -ACME_STORAGE_HASH="${ACME_STORAGE_HASH:='/var/lib/traefik/acme.md5sum'}" -ACME_STORAGE_CHANGELOG="${ACME_STORAGE_CHANGELOG:='/var/lib/traefik/acme.log'}" - - -### -# -# Runtime Environment -# -### - -if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then - /usr/bin/echo -e 'Error: Permission Denied' - exit 1 -fi - -TMP_DIRECTORY=$(/usr/bin/mktemp --directory --quiet) -trap "/usr/bin/rm --force --recursive ${TMP_DIRECTORY}" EXIT - -if [[ ! -f "${ACME_STORAGE_HASH}" ]]; then - /usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${ACME_STORAGE_HASH}" - /usr/bin/chmod 0600 "${ACME_STORAGE_HASH}" -# /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_HASH}" - /usr/bin/diff '/dev/null' "${ACME_STORAGE_HASH}" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \ - /usr/bin/true - /usr/bin/chmod 0600 "${ACME_STORAGE_CHANGELOG}" -# /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_CHANGELOG}" - exit 0 -fi - -/usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${TMP_DIRECTORY}/traefik_acme.md5sum" - -/usr/bin/diff "${ACME_STORAGE_HASH}" "${TMP_DIRECTORY}/traefik_acme.md5sum" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \ - /usr/bin/true - -/usr/bin/cat "${TMP_DIRECTORY}/traefik_acme.md5sum" > "${ACME_STORAGE_HASH}" diff --git a/traefik/etc/traefik/acme/acme.env b/traefik/etc/traefik/acme/acme.env index 9465a8f..d895248 100644 --- a/traefik/etc/traefik/acme/acme.env +++ b/traefik/etc/traefik/acme/acme.env @@ -10,14 +10,8 @@ # Default: '/var/lib/traefik/acme.json' ACME_DATABASE='/var/lib/traefik/acme.json' -# Default: '/var/lib/traefik/acme' -ACME_STORAGE='/var/lib/traefik/acme' - -# Default: '/var/lib/traefik/acme.md5sum' -ACME_STORAGE_HASH='/var/lib/traefik/acme.md5sum' - -# Default: '/var/lib/traefik/acme.log' -ACME_STORAGE_CHANGELOG='/var/lib/traefik/acme.log' +# Default: '/etc/ssl/traefik' +ACME_STORAGE='/etc/ssl/traefik' ################################