mixandClaude Opus 5.5
2e1544dac5
test / test (push) Canceled after 0s
C-A1, C-Q4, D-guide:258, :291, :722. certbot's live/<host>/*.pem are relative links into ../../archive/<host>/ (eff-certbot docs, "Where are my certificates?": point a server at them "or create symlinks"). The guide had `ln -s /etc/letsencrypt/live/<host> certs` and the nginx fragment mounted live/<host> alone: inside the container the links led into a directory it did not have - postfix-config.sh's [ -f ] false, no copy, Postfix without a certificate - and the panel's backup, reading certs/ through /selfpost-deploy, skipped links silently. Now certs/fullchain.pem and certs/privkey.pem are links to /etc/letsencrypt/live/<host>/, and /etc/letsencrypt is mounted read-only at the same path: a commented line in deploy/docker-compose.yml for the Apache scenario, mounted in the nginx fragment (./nginx/certbot-etc). The guide's steps add certbot's own commands for a server that is not root - chmod 0755 live archive, chgrp 998 + chmod 0640 the key, which certbot keeps on renewal - so the panel reads them (Health, backup). Postfix's side follows links already ([ -f ], cp, cmp, openssl). The vhost comment says the same. The backup table: links are followed by the panel's backup; a stopped tar stores them as links unless -h (GNU tar). internal/backup: addTree follows, for certs/ only, a link to a regular file and archives that file under the link's name; a link to nothing reachable is an error naming it and the mount. Tests: TestCertsLinksAreFollowed (certs/ -> live/ -> archive/, the archive holds the files; the tree gone, Check names the dangling link; Linux). Stand (2026-10-15, make e2e, exit 0): the stand mounts ./letsencrypt at /etc/letsencrypt; new certbot_layout_followed puts a new pair into letsencrypt/archive/, relative links in live/, absolute links in certs/, recreates the container: 465 serves the new serial, Health names no renewal waiting, and the full backup holds certs/*.pem as regular files with the archive's bytes. go vet and go test ./... pass on the server (24 packages); the Linux-only tests of this session run there and pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
66 lines
2.8 KiB
YAML
66 lines
2.8 KiB
YAML
|
|
# Alternative reverse-proxy: nginx. PEM files land on the host exactly like the
|
|
# Apache+certbot scenario — nginx and certbot are close cousins here, both
|
|
# writing/reading plain PEM under /etc/letsencrypt.
|
|
#
|
|
# This is a FRAGMENT, not a full replacement for ../docker-compose.yml: it
|
|
# adds an nginx + certbot pair and removes the panel's host port publish (nginx
|
|
# takes over 80/443 and proxies to the panel over the compose network
|
|
# instead). Merge it with the base file — run this from the deploy/ directory
|
|
# (Compose resolves every relative path in both files against the directory of
|
|
# the FIRST -f file, i.e. deploy/, which is why paths below are ./nginx/... -
|
|
# docs.docker.com/compose/how-tos/multiple-compose-files/merge/: "Paths are
|
|
# evaluated relative to the base file"):
|
|
#
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
|
|
#
|
|
# First-run certificate issuance (webroot method, before nginx has a cert to
|
|
# serve — run once):
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
|
|
# run --rm certbot certonly --webroot -w /var/www/certbot \
|
|
# -d mail.example.com --email you@example.com --agree-tos --no-eff-email
|
|
|
|
services:
|
|
selfpost:
|
|
ports: !override
|
|
- "465:465"
|
|
- "587:587"
|
|
- "25:25"
|
|
# No host publish for 8080 here: nginx reaches it over the compose
|
|
# network at selfpost:8080 instead (see nginx.conf.example).
|
|
volumes: !override
|
|
- ./data:/data
|
|
- .:/selfpost-deploy:ro
|
|
# certs/ holds two links, fullchain.pem and privkey.pem, to
|
|
# /etc/letsencrypt/live/mail.example.com/ - a path inside the
|
|
# container: certbot's directory below is mounted there whole, because
|
|
# its live/ files are relative links into archive/ (mounting live/ alone
|
|
# left them pointing at nothing). docs/guide.md, "Reverse proxy", nginx.
|
|
- ./certs:/etc/postfix/tls:ro
|
|
- ./nginx/certbot-etc:/etc/letsencrypt:ro
|
|
|
|
nginx:
|
|
image: nginx:1.27
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- selfpost
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./nginx/nginx.conf.example:/etc/nginx/conf.d/selfpost.conf:ro
|
|
- ./nginx/certbot-etc:/etc/letsencrypt:ro
|
|
- ./nginx/certbot-www:/var/www/certbot:ro
|
|
|
|
certbot:
|
|
image: certbot/certbot:latest
|
|
volumes:
|
|
- ./nginx/certbot-etc:/etc/letsencrypt
|
|
- ./nginx/certbot-www:/var/www/certbot
|
|
# Renewal twice a day is certbot's own recommended cadence; it no-ops
|
|
# until a certificate is within its renewal window.
|
|
# (eff-certbot.readthedocs.io, User Guide, "Automated Renewals": the
|
|
# sample cron runs "certbot renew" at 0 and 12 h; renew acts only on a
|
|
# certificate near expiry.)
|
|
entrypoint: sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done'
|