3

traefik/etc/traefik/acme/00-export

@@ -24,8 +24,27 @@ set -o pipefail
 ###
 
 source '/etc/traefik/acme/acme.env'
-ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
 ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
+ACME_STORAGE="${ACME_STORAGE:='/etc/ssl/traefik'}"
+
+
+###
+#
+# Function Section
+#
+###
+
+function export () {
+  local PREFIX="${1}"
+  /usr/bin/echo "${CERTIFICATE}" | \
+    /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/echo "${KEY}" | \
+    /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+  /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+  /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+}
 
 
 ###
@@ -34,7 +53,7 @@ ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
 #
 ###
 
-if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
+if [[ "${EUID}" -ne '0' ]]; then
   /usr/bin/echo -e 'Error: Permission Denied'
   exit 1
 fi
@@ -43,36 +62,25 @@ if [[ -d "${ACME_STORAGE}" ]]; then
   /usr/bin/rm --force --recursive "${ACME_STORAGE}"
 fi
 
-/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}"
+/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}"
 
 for RESOLVER in $(/usr/bin/jq --raw-output --exit-status 'keys[]' "${ACME_DATABASE}"); do
+
   ACCOUNT=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Account.PrivateKey' "${ACME_DATABASE}")
-  /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/.${RESOLVER}"
+  /usr/bin/install --directory --group='root' --mode='0700' --owner='root' "${ACME_STORAGE}/.acme/${RESOLVER}"
   /usr/bin/echo -e "-----BEGIN RSA PRIVATE KEY-----\n${ACCOUNT}\n-----END RSA PRIVATE KEY-----" | \
-    /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.${RESOLVER}/account.key" &> '/dev/null'
-  /usr/bin/chmod '0400' "${ACME_STORAGE}/.${RESOLVER}/account.key"
+    /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" &> '/dev/null'
+  /usr/bin/chmod '0400' "${ACME_STORAGE}/.acme/${RESOLVER}/account.key"
   for DOMAIN in $(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Certificates[].domain.main' "${ACME_DATABASE}"); do
     CERTIFICATE=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .certificate' "${ACME_DATABASE}")
     KEY=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .key' "${ACME_DATABASE}")
-    /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}"
+    /usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}/${DOMAIN}"
     case "${RESOLVER}" in
       *rsa*)
-        /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/rsa"
-	      /usr/bin/echo "${CERTIFICATE}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
-	      /usr/bin/echo "${KEY}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
+        export 'rsa'
       ;;
       *ecdsa*)
-        /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/ecc"
-	      /usr/bin/echo "${CERTIFICATE}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
-	      /usr/bin/echo "${KEY}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
+        export 'ecc'
       ;;
     esac
   done

traefik/etc/traefik/acme/01-changelog

@@ -1,62 +0,0 @@
-#!/usr/bin/bash
-
-
-#
-# Generate changelog with hashsum from the exported certificates
-#
-
-
-###
-#
-# Options Section
-#
-###
-
-set -e
-set -u
-set -o pipefail
-
-
-###
-#
-# Variables Section
-#
-###
-
-source '/etc/traefik/acme/acme.env'
-ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
-ACME_STORAGE_HASH="${ACME_STORAGE_HASH:='/var/lib/traefik/acme.md5sum'}"
-ACME_STORAGE_CHANGELOG="${ACME_STORAGE_CHANGELOG:='/var/lib/traefik/acme.log'}"
-
-
-###
-#
-# Runtime Environment
-#
-###
-
-if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
-  /usr/bin/echo -e 'Error: Permission Denied'
-  exit 1
-fi
-
-TMP_DIRECTORY=$(/usr/bin/mktemp --directory --quiet)
-trap "/usr/bin/rm --force --recursive ${TMP_DIRECTORY}" EXIT
-
-if [[ ! -f "${ACME_STORAGE_HASH}" ]]; then
-  /usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${ACME_STORAGE_HASH}"
-  /usr/bin/chmod 0600 "${ACME_STORAGE_HASH}"
-#  /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_HASH}"
-  /usr/bin/diff '/dev/null' "${ACME_STORAGE_HASH}" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
-    /usr/bin/true
-  /usr/bin/chmod 0600 "${ACME_STORAGE_CHANGELOG}"
-#  /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_CHANGELOG}"
-  exit 0
-fi
-
-/usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${TMP_DIRECTORY}/traefik_acme.md5sum"
-
-/usr/bin/diff "${ACME_STORAGE_HASH}" "${TMP_DIRECTORY}/traefik_acme.md5sum" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
-  /usr/bin/true
-
-/usr/bin/cat "${TMP_DIRECTORY}/traefik_acme.md5sum" > "${ACME_STORAGE_HASH}"

traefik/etc/traefik/acme/acme.env

@@ -10,14 +10,8 @@
 # Default: '/var/lib/traefik/acme.json'
 ACME_DATABASE='/var/lib/traefik/acme.json'
 
-# Default: '/var/lib/traefik/acme'
-ACME_STORAGE='/var/lib/traefik/acme'
-
-# Default: '/var/lib/traefik/acme.md5sum'
-ACME_STORAGE_HASH='/var/lib/traefik/acme.md5sum'
-
-# Default: '/var/lib/traefik/acme.log'
-ACME_STORAGE_CHANGELOG='/var/lib/traefik/acme.log'
+# Default: '/etc/ssl/traefik'
+ACME_STORAGE='/etc/ssl/traefik'
 
 
 ################################