mixandClaude Opus 5.5
599149bf83
Comments only, no behaviour changed. Each main.cf/master.cf parameter the
build sets, the wrapper's and the reload hook's reliance on Postfix 3.7.11
(postfix-script, master.5, postconf.5, cleanup_init.c, smtpd_peer.c,
README_FILES), supervisor 4.2.5 (process.py, options.py, events.rst),
logrotate 3.21.0, OpenDKIM's config, Cyrus SASL's sasldb, rspamd 3.11.1
(milter_headers.lua, multimap, the map watcher), Docker Compose, CoreDNS
and certbot now say where that is written. Measurements already there stay
measurements ("date not recorded" where none was); hand-composed fixtures
say so.
Contradictions left for their own commits: C-P31 cleanup's size limit,
C-P42 master outside supervisor's signal, C-V5/V6 startsecs, C-V10,
C-S3/Q3 sasldb written in place, C-Q4/A1 certbot's symlinks, C-R7 rspamd
skips local clients but the signature routine does not, C-P8, C-R4, C-R12,
C-M7, C-E2, C-K8/K9, C-D1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.4 KiB
Bash
36 lines
1.4 KiB
Bash
#!/bin/sh
|
|
# Extracts a PEM cert/key pair for one domain out of Traefik's acme.json —
|
|
# Traefik keeps its certificates there, so a PEM extraction step is required.
|
|
# Run this on the host, after Traefik has issued or renewed the certificate, and
|
|
# again on a schedule (cron/systemd timer) since acme.json is not itself watched
|
|
# by SelfPost/Postfix.
|
|
#
|
|
# Requires jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
|
|
#
|
|
# The layout is not documented (doc.traefik.io/traefik/v3.1/https/acme/ says
|
|
# only "JSON file"); read in Traefik v3.1.0: pkg/provider/acme/local_store.go
|
|
# keeps map[resolver name]*StoredData, store.go StoredData{Account,
|
|
# Certificates}, provider.go Certificate{domain, certificate, key} with the PEM
|
|
# as []byte - base64 in JSON (Go encoding/json). "le" is the resolver
|
|
# docker-compose.traefik.yml names.
|
|
set -eu
|
|
|
|
ACME_JSON="${1:?path to acme.json}"
|
|
DOMAIN="${2:?domain name, e.g. mail.example.com}"
|
|
OUT_DIR="${3:?output directory, e.g. ./extracted-certs}"
|
|
|
|
mkdir -p "$OUT_DIR"
|
|
|
|
jq -r --arg domain "$DOMAIN" '
|
|
.le.Certificates[]
|
|
| select(.domain.main == $domain)
|
|
| .certificate' "$ACME_JSON" | base64 -d > "$OUT_DIR/fullchain.pem"
|
|
|
|
jq -r --arg domain "$DOMAIN" '
|
|
.le.Certificates[]
|
|
| select(.domain.main == $domain)
|
|
| .key' "$ACME_JSON" | base64 -d > "$OUT_DIR/privkey.pem"
|
|
|
|
chmod 0640 "$OUT_DIR/fullchain.pem" "$OUT_DIR/privkey.pem"
|
|
echo "extracted $DOMAIN to $OUT_DIR/{fullchain,privkey}.pem"
|