Refactor start.letsencrypt.sh to improve error handling and logging during certificate issuance

- Added shared volume for temporary output storage
- Implemented logging of letsencrypt output to a file
- Created JSON log entries for certificate creation status
- Improved handling of domain checks and output file initialization

.drone.yml

@@ -0,0 +1,47 @@
+kind: pipeline
+type: kubernetes
+name: default
+
+node_selector:
+  physical-node: dev2
+
+trigger:
+  branch:
+    - master
+  event:
+    - push
+workspace:
+  path: /drone/src
+
+steps:
+  - name: build multiarch from dev
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "registry.dev.format.hu/letsencrypt" ]
+      registry: registry.dev.format.hu
+      repo: registry.dev.format.hu/letsencrypt
+      tags: latest
+      dockerfile: Dockerfile
+      username:
+        from_secret: dev-hu-registry-username
+      password: 
+        from_secret: dev-hu-registry-password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+    
+  - name: pull image to dockerhub
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "safebox/letsencrypt" ]
+      repo: safebox/letsencrypt
+      tags: latest
+      username:
+        from_secret: dockerhub-username
+      password: 
+        from_secret: dockerhub-password
+      platforms:
+        - linux/amd64
+        - linux/arm64

Dockerfile

@@ -1,7 +1,6 @@
-FROM neilpang/acme.sh:latest
+FROM alpine
-MAINTAINER gyurix
 
-RUN apk update && apk add --no-cache jq
+RUN apk update && apk add --no-cache jq curl openssl socat
 COPY ./start.letsencrypt.sh /start.letsencrypt.sh
 
 ENTRYPOINT ["/start.letsencrypt.sh"]

firewall-29eexhrh.json

@@ -0,0 +1,65 @@
+{
+	"main": {
+		"SERVICE_NAME": "firewalls",
+		"DOMAIN": "null" 
+	},
+	"containers": [
+		{ 
+			"IMAGE": "registry.format.hu/firewall",
+			"NAME": "null",
+			"MEMORY": "64M",
+			"IP": "null",
+			"NETWORK": "host",
+			"VOLUMES": [
+				{
+				"SOURCE": "/run/",
+				"DEST": "/run/",
+				"TYPE": "rw"
+				},
+				{
+				"SOURCE": "/etc/user/config/services",
+				"DEST": "/services",
+				"TYPE": "ro"
+				}
+				],
+			"PORTS": [ ],
+			"READYNESS": [
+			        {"tcp": ""},
+			        {"HTTP": ""},
+				{"EXEC": "/ready.sh"}
+				],
+                        "ENVS": [ 
+                                {          
+                                "NAME": "CHAIN",
+                                "VALUE": "DOCKER-USER"
+                                }, 
+                                {          
+                                "NAME": "SOURCE_IP",
+                                "VALUE": "172.18.100.2"
+                                }, 
+                                {          
+                                "NAME": "TARGET_IP",
+                                "VALUE": "172.18.254.254"
+                                }, 
+                                {          
+                                "NAME": "TYPE",
+                                "VALUE": "tcp"
+                                }, 
+                                {          
+                                "NAME": "TARGET_PORT",
+                                "VALUE": "80"
+                                }, 
+                                {          
+                                "NAME": "COMMENT",
+                                "VALUE": "29eexhrh"
+                                }  
+                                ], 
+			"EXTRA": "--privileged",
+			"DEPEND": "null",
+			"START_ON_BOOT": "false",
+			"CMD": "null",
+			"PRE_START": "null",
+			"POST_START": "null"
+		}
+	]
+}

letsencrypt.json

@@ -0,0 +1,64 @@
+{
+    "main": {
+        "SERVICE_NAME": "letsencrypt",
+        "DOMAIN": "null"
+    },
+    "networks": [
+        {
+            "NAME": "letsencrypt",
+            "DRIVER": "bridge",
+            "SUBNET": "172.18.254.0/24",
+            "RANGE": "172.18.254.0/24",
+            "GATEWAY": "172.18.254.1"
+        }
+    ],
+    "containers": [
+        {
+            "IMAGE": "registry.format.hu/letsencrypt",
+            "NAME": "letsencrypt",
+            "MEMORY": "64M",
+            "IP": "172.18.254.254",
+            "NETWORK": "letsencrypt",
+            "VOLUMES": [
+                {
+                    "SOURCE": "/etc/system/data/ssl/keys/",
+                    "DEST": "/acme.sh/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "SHARED",
+                    "DEST": "/var/tmp/shared",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/user/config/domains",
+                    "DEST": "/domains",
+                    "TYPE": "ro"
+                }
+            ],
+            "PORTS": [],
+            "ENV_FILES": [
+                "/etc/user/config/user.json"
+            ],
+            "READYNESS": [
+                {
+                    "tcp": ""
+                },
+                {
+                    "HTTP": ""
+                },
+                {
+                    "EXEC": "/ready.sh"
+                }
+            ],
+            "EXTRA": "",
+            "DEPEND": "null",
+            "START_ON_BOOT": "false",
+            "CMD": "null",
+            "PRE_START": "null",
+            "POST_START": [
+                "firewall-29eexhrh"
+            ]
+        }
+    ]
+}

start.letsencrypt.sh

@@ -1,43 +1,165 @@
 #!/bin/sh
 
-email=$EMAIL
+email="-m $EMAIL"
+DOMAIN=$DOMAIN
 
-start_letsencrypt() {
+LOG_DIR=/var/tmp/shared/output
+LOG_FILE=$LOG_DIR/letsencrypt.txt
+LETSENCRYPT_OUTPUT=$LOG_DIR/letsencrypt.json
+DATE=$(date +"%Y-%m-%d-%H-%M")
 
-	mkdir -p /acme.sh/$DOMAIN/ ;
+echo "email $EMAIL"
+echo "DOMAIN: $DOMAIN"
 
-	acme.sh --register-account -m $email --issue --standalone --keylength 4096 -d  $DOMAIN --cert-file /acme.sh/$DOMAIN/cert.pem --key-file /acme.sh/$DOMAIN/key.pem --fullchain-file /acme.sh/$DOMAIN/fullchain.pem ;
+if [ "$LETSENCRYPT_SERVER" != "" ]; then
+    L_S="--server $LETSENCRYPT_SERVER"
+fi
 
-	#mkdir -p /acme.sh/$DOMAIN/ecc-certs ;
+if [ "$EAB_KID" != "" ]; then
+    EK="--eab-kid $EAB_KID"
+fi
 
-	#acme.sh --issue --standalone --keylength ec-384 -d  $DOMAIN --cert-file /acme.sh/$DOMAIN/ecc-certs/cert.pem --key-file /acme.sh/$DOMAIN/ecc-certs/key.pem --fullchain-file /acme.sh/$DOMAIN/ecc-certs/fullchain.pem
+if [ "$EAB_HMAC_KEY" != "" ]; then
+    EHK="--eab-hmac-key $EAB_HMAC_KEY"
+fi
 
+TIMEOUT=$TIMEOUT
+if [[ -z "$TIMEOUT" ]]; then
+    TIMEOUT=10
+fi
+
+RESTART=$RESTART
+if [[ -z "$RESTART" ]]; then
+    RESTART=5
+fi
+
+sending_error_msg() {
+
+    echo "there was unsucessfuly created "$DOMAIN" at date: "$DATE
 }
 
-LETSENCRYPT_FILE=$(find /acme.sh/ -type f -name letsencrypt);
+create_json() {
-if [ -n "$LETSENCRYPT_FILE" ] ; then
+    LOG=$(cat $LOG_FILE | base64 -w0)
-	DOMAIN=$(jq -r .DOMAIN $LETSENCRYPT_FILE) ;
+    TMP_FILE=$(mktemp)
-	start_letsencrypt;
+    jq '
-	rm $LETSENCRYPT_FILE;
+      if . == null or . == [] then 
+        {"'$DOMAIN'":{"date": "'$DATE'", "status": "'$STATUS'", "log": "'$LOG'"}}
       else 
-	for i in `ls` ; do
+        . + {"'$DOMAIN'": {"date": "'$DATE'", "status": "'$STATUS'", "log": "'$LOG'"}}
-		DOMAIN=$(jq -r .DOMAIN $i) ;
+      end
-		if [[ -f /acme.sh/$DOMAIN/key.pem && -f /acme.sh/$DOMAIN/fullchain.pem && -f /acme.sh/$DOMAIN/cert.pem ]] ; then
+    ' $LETSENCRYPT_OUTPUT >$TMP_FILE
-			start_letsencrypt ;
+    cat $TMP_FILE >$LETSENCRYPT_OUTPUT
-			touch /acme.sh/$DOMAIN/renew_certificate;
+    rm $TMP_FILE
+}
+
+start_letsencrypt() {
+    cd /root
+    if [ "$LETSENCRYPT_INSTALLED" != "true" ]; then
+        curl https://get.acme.sh | sh -s email=$EMAIL
+        LETSENCRYPT_INSTALLED=true
+    fi
+
+    sh /root/.acme.sh/acme.sh $L_S $EK $EHK --issue --standalone --keylength 4096 -d $DOMAIN --cert-file /acme.sh/$DOMAIN/cert.pem --key-file /acme.sh/$DOMAIN/key.pem --fullchain-file /acme.sh/$DOMAIN/fullchain.pem >$LOG_FILE 2>&1
+    RESPONSE=$?
+    echo "OUTPOUT: $RESPONSE"
+    if [[ "$(echo $RESPONSE)" == "1" ]]; then
+        for retries in $(seq 0 $((RESTART + 1))); do
+            if [[ $retries -le $RESTART ]]; then
+                # Check certificate issuer
+                ISSUER=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -text -noout | grep -w CN | grep Issuer | cut -d '=' -f2)
+                SUBJECT=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -text -noout | grep -w CN | grep Subject | cut -d '=' -f2)
+                if [ "$ISSUER" == "$SUBJECT" ]; then
+                    echo "Self signed certificate found"
+                    sh /root/.acme.sh/acme.sh $L_S $EK $EHK --issue --standalone --keylength 4096 -d $DOMAIN --cert-file /acme.sh/$DOMAIN/cert.pem --key-file /acme.sh/$DOMAIN/key.pem --fullchain-file /acme.sh/$DOMAIN/fullchain.pem >>$LOG_FILE 2>&1
+                    RESPONSE=$?
+                    if [[ "$(echo $RESPONSE)" == "1" ]]; then
+                        sleep $TIMEOUT
+                        echo "Restarting number is only: "$retries" so try again"
                     else
-			start_letsencrypt;
+                        echo "Created or renew successfuly the certificate for $DOMAIN"
+                        echo "Creating log json from letsencrypt output"
+                        STATUS=success
+                        create_json $STATUS
+                        break
+                    fi
+                else
+                    sleep $TIMEOUT
+                    echo "Restarting number is only: "$retries" so try again"
+                fi
+            else
+                echo "Reached retrying limit: "$RESTART" ,giving up"
+                echo "Creating log json from letsencrypt output"
+                STATUS=failed
+                create_json $STATUS
+            fi
+
+        done
+    else
+        echo "Created or renew successfuly the certificate for $DOMAIN"
+        echo "Creating log json from letsencrypt output"
+        STATUS=success
+        create_json $STATUS
+    fi
+}
+
+check_new_cert() {
+    #DATE=$(date +%s)
     if [[ -f /acme.sh/$DOMAIN/key.pem && -f /acme.sh/$DOMAIN/fullchain.pem && -f /acme.sh/$DOMAIN/cert.pem ]]; then
-				touch /acme.sh/$DOMAIN/new_certificate;
+        #D1=$(date -r /acme.sh/$DOMAIN/fullchain.pem +%s)
+        #DIFF=$(expr $DATE - $D1);
+        #if [ $DIFF < 3600 ]; then touch /acme.sh/$DOMAIN/new_certificate; fi
+        NEW=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout)
+        if [ "$ORIGINAL" != "$NEW" ]; then
+            touch /acme.sh/$DOMAIN/new_certificate
+        fi
+    else
+        sending_error_msg $DOMAIN $DATE
+    fi
+}
+
+LETSENCRYPT_FILES=$(find /acme.sh/ -type f -name letsencrypt)
+
+if [ "$DOMAIN" != "localhost" ]; then
+    if [ ! -f $LETSENCRYPT_OUTPUT ]; then
+        install -m 664 -g 65534 /dev/null $LETSENCRYPT_OUTPUT
+        echo '{}' >$LETSENCRYPT_OUTPUT
+    fi
+
+    if [ "$DOMAIN" != "" ]; then
+        echo "DOMAIN: $DOMAIN"
+        echo "domain exists"
+        ORIGINAL=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout)
+        if [ "$DOMAIN" != "localhost" ]; then
+            start_letsencrypt
+            check_new_cert
+        fi
+
+    elif [ -n "$LETSENCRYPT_FILES" ]; then
+        echo "letsencrypt files exist"
+        for LETSENCRYPT_FILE in $(echo $LETSENCRYPT_FILES); do
+            DOMAIN=$(jq -r .DOMAIN $LETSENCRYPT_FILE)
+            echo "DOMAIN: $DOMAIN"
+            for DOMAIN in $(echo $DOMAIN); do
+                ORIGINAL=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout)
+                start_letsencrypt $DOMAIN
+                check_new_cert
+                DOMAIN=""
+            done
+        done
 
     else
-				while [[ ! -f /acme.sh/$DOMAIN/key.pem || ! -f /acme.sh/$DOMAIN/fullchain.pem || ! -f /acme.sh/$DOMAIN/cert.pem ]] ; do
+        DOMAIN_FILE=""
-					sleep 10;
+        echo "no any new created domain exists try renew all"
-					start_letsencrypt ;
+        for DOMAIN_FILE in $(ls /domains); do
+            cd /domains
+            echo "DOMAIN_FILE: $(basename $DOMAIN_FILE)"
+            DOMAIN=$(jq -r .DOMAIN $DOMAIN_FILE)
+            echo "DOMAIN: $DOMAIN"
+            if [ "$DOMAIN" != "localhost" ]; then
+                ORIGINAL=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout)
+                start_letsencrypt $DOMAIN
+                check_new_cert
+            fi
         done
     fi
 fi
-	done ;
-fi
-
-

user.json

@@ -0,0 +1,6 @@
+{
+	"letsencrypt": {
+                "EMAIL": "postmaster@format.hu",
+		"DOCKER_REGISTRY_URL": "registry.format.hu"
+        }
+}