3

.env

@@ -1 +1 @@
-VERSION='3.7.5'
+VERSION='3.7.6'

.gitea/workflows/release.yml

@@ -68,11 +68,12 @@ jobs:
           /usr/bin/chmod --verbose '0755' './traefik/DEBIAN/prerm'
           /usr/bin/chmod --verbose '0755' './traefik/etc/init.d/traefik'
           /usr/bin/touch './traefik/etc/traefik/traefik.env'
-          /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env'
           /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme'
           /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/00-export'
           /usr/bin/chmod --verbose '0750' './traefik/etc/traefik/acme/01-changelog'
           /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/acme/acme.env'
+          /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/providers.env'
+          /usr/bin/chmod --verbose '0640' './traefik/etc/traefik/traefik.env'
           /usr/bin/install --directory --verbose './traefik/usr/sbin'
           /usr/bin/mv --verbose './sources/traefik' './traefik/usr/sbin'
       - name: Debian Package [Generate]

traefik/DEBIAN/conffiles

@@ -2,5 +2,4 @@
 /etc/traefik/traefik.env
 /etc/traefik/traefik.yml
 /etc/traefik/acme/00-export
-/etc/traefik/acme/01-changelog
 /etc/traefik/acme/acme.env

traefik/DEBIAN/control

@@ -2,7 +2,7 @@ Package: traefik
 Version:
 Architecture:
 Installed-Size:
-Depends: jq
+Depends: jq, openssl, ssl-cert
 Priority: optional
 Section: misc
 Homepage: http://www.privlab.it

traefik/DEBIAN/postinst

@@ -37,10 +37,11 @@ case "${1}" in
     /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/lib/traefik'
     /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/log/traefik'
     /usr/bin/install --directory --group='traefik' --mode='750' --owner='traefik' '/var/logrotate/traefik'
-    /usr/bin/chown --quiet --recursive 'traefik' \
+    /usr/bin/chown --quiet 'traefik' \
-      '/etc/traefik/providers.yml' \
+                           '/etc/traefik' \
-      '/etc/traefik/traefik.env' \
+                           '/etc/traefik/providers.yml' \
-      '/etc/traefik/traefik.yml'
+                           '/etc/traefik/traefik.env' \
+                           '/etc/traefik/traefik.yml'
     if [ -x '/usr/bin/deb-systemd-invoke' ]; then
       /usr/bin/systemctl --system daemon-reload > '/dev/null' || true
       if [ -n "${2}" ]; then

traefik/etc/traefik/acme/00-export

@@ -24,8 +24,27 @@ set -o pipefail
 ###
 
 source '/etc/traefik/acme/acme.env'
-ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
 ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
+ACME_STORAGE="${ACME_STORAGE:='/etc/ssl/traefik'}"
+
+
+###
+#
+# Function Section
+#
+###
+
+function export () {
+  local PREFIX="${1}"
+  /usr/bin/echo "${CERTIFICATE}" | \
+    /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.crt"
+  /usr/bin/echo "${KEY}" | \
+    /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+  /usr/bin/chmod '0440' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+  /usr/bin/chown 'root':'ssl-cert' "${ACME_STORAGE}/${DOMAIN}/root.${PREFIX}.key"
+}
 
 
 ###
@@ -34,7 +53,7 @@ ACME_DATABASE="${ACME_DATABASE:='/var/lib/traefik/acme.json'}"
 #
 ###
 
-if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
+if [[ "${EUID}" -ne '0' ]]; then
   /usr/bin/echo -e 'Error: Permission Denied'
   exit 1
 fi
@@ -43,36 +62,25 @@ if [[ -d "${ACME_STORAGE}" ]]; then
   /usr/bin/rm --force --recursive "${ACME_STORAGE}"
 fi
 
-/usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}"
+/usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}"
 
 for RESOLVER in $(/usr/bin/jq --raw-output --exit-status 'keys[]' "${ACME_DATABASE}"); do
+
   ACCOUNT=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Account.PrivateKey' "${ACME_DATABASE}")
-  /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/.${RESOLVER}"
+  /usr/bin/install --directory --group='root' --mode='0700' --owner='root' "${ACME_STORAGE}/.acme/${RESOLVER}"
   /usr/bin/echo -e "-----BEGIN RSA PRIVATE KEY-----\n${ACCOUNT}\n-----END RSA PRIVATE KEY-----" | \
-    /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.${RESOLVER}/account.key" &> '/dev/null'
+    /usr/bin/openssl 'rsa' -inform 'pem' -out "${ACME_STORAGE}/.acme/${RESOLVER}/account.key" &> '/dev/null'
-  /usr/bin/chmod '0400' "${ACME_STORAGE}/.${RESOLVER}/account.key"
+  /usr/bin/chmod '0400' "${ACME_STORAGE}/.acme/${RESOLVER}/account.key"
   for DOMAIN in $(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --exit-status '.[$resolver].Certificates[].domain.main' "${ACME_DATABASE}"); do
     CERTIFICATE=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .certificate' "${ACME_DATABASE}")
     KEY=$(/usr/bin/jq --raw-output --arg resolver "${RESOLVER}" --arg domain "${DOMAIN}" --exit-status '.[$resolver].Certificates[] | select (.domain.main == $domain ) | .key' "${ACME_DATABASE}")
-    /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}"
+    /usr/bin/install --directory --group='ssl-cert' --mode='2750' --owner='root' "${ACME_STORAGE}/${DOMAIN}"
     case "${RESOLVER}" in
       *rsa*)
-        /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/rsa"
+        export 'rsa'
-	      /usr/bin/echo "${CERTIFICATE}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.crt"
-	      /usr/bin/echo "${KEY}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/rsa/root.key"
       ;;
       *ecdsa*)
-        /usr/bin/install --directory --group='traefik' --mode='0700' --owner='traefik' "${ACME_STORAGE}/${DOMAIN}/ecc"
+        export 'ecc'
-	      /usr/bin/echo "${CERTIFICATE}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.crt"
-	      /usr/bin/echo "${KEY}" | \
-          /usr/bin/base64 --decode > "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
-        /usr/bin/chmod '0400' "${ACME_STORAGE}/${DOMAIN}/ecc/root.key"
       ;;
     esac
   done

traefik/etc/traefik/acme/01-changelog

@@ -1,62 +0,0 @@
-#!/usr/bin/bash
-
-
-#
-# Generate changelog with hashsum from the exported certificates
-#
-
-
-###
-#
-# Options Section
-#
-###
-
-set -e
-set -u
-set -o pipefail
-
-
-###
-#
-# Variables Section
-#
-###
-
-source '/etc/traefik/acme/acme.env'
-ACME_STORAGE="${ACME_STORAGE:='/var/lib/traefik/acme'}"
-ACME_STORAGE_HASH="${ACME_STORAGE_HASH:='/var/lib/traefik/acme.md5sum'}"
-ACME_STORAGE_CHANGELOG="${ACME_STORAGE_CHANGELOG:='/var/lib/traefik/acme.log'}"
-
-
-###
-#
-# Runtime Environment
-#
-###
-
-if [[ "${EUID}" -ne '0' && "${USER}" != 'traefik' ]]; then
-  /usr/bin/echo -e 'Error: Permission Denied'
-  exit 1
-fi
-
-TMP_DIRECTORY=$(/usr/bin/mktemp --directory --quiet)
-trap "/usr/bin/rm --force --recursive ${TMP_DIRECTORY}" EXIT
-
-if [[ ! -f "${ACME_STORAGE_HASH}" ]]; then
-  /usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${ACME_STORAGE_HASH}"
-  /usr/bin/chmod 0600 "${ACME_STORAGE_HASH}"
-#  /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_HASH}"
-  /usr/bin/diff '/dev/null' "${ACME_STORAGE_HASH}" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
-    /usr/bin/true
-  /usr/bin/chmod 0600 "${ACME_STORAGE_CHANGELOG}"
-#  /usr/bin/chown 'traefik':'traefik' "${ACME_STORAGE_CHANGELOG}"
-  exit 0
-fi
-
-/usr/bin/find "${ACME_STORAGE}" -type f -exec /usr/bin/md5sum {} + > "${TMP_DIRECTORY}/traefik_acme.md5sum"
-
-/usr/bin/diff "${ACME_STORAGE_HASH}" "${TMP_DIRECTORY}/traefik_acme.md5sum" | /usr/bin/grep '^>' | /usr/bin/awk '{print $3}' > "${ACME_STORAGE_CHANGELOG}" || \
-  /usr/bin/true
-
-/usr/bin/cat "${TMP_DIRECTORY}/traefik_acme.md5sum" > "${ACME_STORAGE_HASH}"

traefik/etc/traefik/acme/acme.env

@@ -10,14 +10,8 @@
 # Default: '/var/lib/traefik/acme.json'
 ACME_DATABASE='/var/lib/traefik/acme.json'
 
-# Default: '/var/lib/traefik/acme'
+# Default: '/etc/ssl/traefik'
-ACME_STORAGE='/var/lib/traefik/acme'
+ACME_STORAGE='/etc/ssl/traefik'
-
-# Default: '/var/lib/traefik/acme.md5sum'
-ACME_STORAGE_HASH='/var/lib/traefik/acme.md5sum'
-
-# Default: '/var/lib/traefik/acme.log'
-ACME_STORAGE_CHANGELOG='/var/lib/traefik/acme.log'
 
 
 ################################