- PHP 96.1%
- Shell 3.9%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
NaeiKinDus
e2ba74df14
feat: use Box to handle all phar metadata build: automatically release tagged assets (#1) build: fix issue when setting version metadata from box compile (#2) build: trigger asset release when pushing tags (#3) build: fixed missing artifact in release (#4) docs: added LICENSE, CoC and related badges (#5) fix(task): fix task not using fetch composer when building phar; improved test tasks description fix: improved env variables management to ignore inappropriate variables_order in default CLI config feat: added a way to get log traces to help debugging fix: changed the way the script detects whether its an auth or cleanup stage doc: added version of certbot used to perform functional tests feat: perform proper DNS propagation check before returning to certbot during auth hook call build(deps): bump actions/download-artifact in /.github/workflows (#6) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3 to 4.1.7. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v3...v4.1.7) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump symfony/process from 7.0.2 to 7.1.7 (#7) Bumps [symfony/process](https://github.com/symfony/process) from 7.0.2 to 7.1.7. - [Release notes](https://github.com/symfony/process/releases) - [Changelog](https://github.com/symfony/process/blob/7.1/CHANGELOG.md) - [Commits](https://github.com/symfony/process/compare/v7.0.2...v7.1.7) --- updated-dependencies: - dependency-name: symfony/process dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump symfony/http-client from 6.3.5 to 6.4.15 (#9) Bumps [symfony/http-client](https://github.com/symfony/http-client) from 6.3.5 to 6.4.15. - [Release notes](https://github.com/symfony/http-client/releases) - [Changelog](https://github.com/symfony/http-client/blob/7.1/CHANGELOG.md) - [Commits](https://github.com/symfony/http-client/compare/v6.3.5...v6.4.15) --- updated-dependencies: - dependency-name: symfony/http-client dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> license |
||
| .github/workflows | ||
| bin | ||
| scripts | ||
| src | ||
| .env.dist | ||
| .gitignore | ||
| box.json.dist | ||
| CODE_OF_CONDUCT.md | ||
| composer.json | ||
| composer.lock | ||
| LICENSE | ||
| main.php | ||
| README.md | ||
| Taskfile.yml | ||
Online Certbot Hook
A hook to help automatically renew Let's Encrypt certificates using the DNS-01 challenge when your domain is managed by Online.net.
Rationale
Popular tools (e.g. Lego) used to perform this renewal task often lack the support for this provider because Scaleway and Online.net administration consoles are now merged but it is still not possible to manage Online.net domains via Scaleway's API.
This script simplifies the renewal process by using Certbot's support for renewal hooks and calls Online.net's API to push and then delete the Acme Challenge TXT record.
Installation
Requirements
The generated binary is a PHP Phar archive so you will need the following on your production server:
- PHAR support (which should be enabled by default),
- PHP 8.2+,
- cURL and JSON extensions for PHP,
- the
digbinary to perform DNS propagation checks, - Certbot.
For development only
- Composer (can be automatically installed by Task),
- Box (can be automatically installed by Task),
- go-task, while not a requirement, strongly recommended.
From Github releases
Check the releases section and download the latest asset available.
From the source
git clone https://github.com/naeikindus/certbot-online.git
# install tooling
task setup
# install Composer dependencies and create a PHAR binary
task build
# then you can either install the PHAR binary locally
task install
# or copy it where you need it
scp bin/certbot-online.phar you@your-machine:~/
Usage
First, you need to generate a secret API token on the Online Console and then save it in a .env file
(use the provided .env.dist file as a template, available in the Github repository).
This file may reside in any of the following paths:
- the script user's $HOME,
- '<project_root>/' if you are in a development environment and using the Git source,
- in the same directory where the script is located,
- in the current working directory where user is located when starting the script.
Generating certificates
# Obtaining or renewing a basic certificate
certbot certonly -n \
--manual --manual-auth-hook certbot-online.phar --manual-cleanup-hook certbot-online.phar \
--agree-tos --email <YOUR_EMAIL> --preferred-challenges dns \
-d <YOUR_DOMAIN_NAME>
# Obtaining or renewing a wildcard certificate with OCSP stapling and HSTS
certbot certonly -n \
--manual --manual-auth-hook certbot-online.phar --manual-cleanup-hook certbot-online.phar \
--hsts --must-staple --agree-tos --email <YOUR_EMAIL> --preferred-challenges dns \
-d \*.<YOUR_DOMAIN_NAME>
The generated certificates will either be in your certbot's directory or, if you don't have one and are not running as root, you will have an error thrown by certbot about missing directories or permission denied. You can correct this (and choose where your certificates will be stored) by providing the following options:
certbot [...] --config-dir=/<SOME_DIR> --work-dir=/<ANOTHER_DIR> --logs-dir=/<YET_ANOTHER_DIR>
# e.g. certbot [...] --config-dir=/home/myuser --work-dir=/home/myuser --logs-dir=/var/log