Initial commit.

Dockerfile

@@ -0,0 +1,16 @@
+FROM ubuntu:xenial 
+MAINTAINER Chris Smith <dle@chameth.com> 
+
+RUN apt-get update \
+ && apt-get install -y \
+      curl \
+      inotify-tools
+
+COPY dehydrated run.sh config /
+RUN chmod +x /run.sh /dehydrated
+
+VOLUME ["/letsencrypt"]
+
+ENTRYPOINT ["/bin/bash"]
+CMD ["/run.sh"]
+

LICENCE

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+boulder copyright (c) 2015-2017 Lukas Schauer
+all other content copyright (c) 2016-2017 Chris Smith
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,68 @@
+# Let's Encrypt HTTP Service
+
+This container uses [dehydrated](https://github.com/lukas2511/dehydrated)
+to automatically obtain SSL certs from [Let's Encrypt](https://letsencrypt.org/).
+
+You will need a webserver that will serve the challenge responses when
+queried by Let's Encrypt, such as my
+[service-nginx](https://github.com/csmith/docker-service-nginx) container.
+
+Multiple domains, as well as SANs, are supported. Certificates will be
+renewed automatically, and obtained automatically as soon as new domains
+are added.
+
+## Usage
+
+### Accepting Let's Encrypt's terms
+
+In order to issue certificates with Let's Encrypt, you must agree to the
+Let's Encrypt terms of service. You can do this by running the command
+`/dehydrated --register --accept-terms` from within the container.
+
+For ease of automation, you can define the `ACCEPT_CA_TERMS` env var
+(with any non-empty value) to automatically accept the terms. Be warned
+that doing so will automatically accept any future changes to the terms
+of service.
+
+### Defining domains
+
+The container defines one volume at `/letsencrypt`, and expects there to be
+a list of domains in `/letsencrypt/domains.txt`. Certificates are output to
+`/letsencrypt/certs/{domain}`.
+
+domains.txt should contain one line per certificate. If you want alternate
+names on the cert, these should be listed after the primary domain. e.g.
+
+```
+example.com www.example.com
+admin.example.com
+```
+
+This will request two certificates: one for example.com with a SAN of
+www.example.com, and a separate one for admin.example.com.
+
+The container uses inotify to monitor the domains.txt file for changes,
+so you can update it while the container is running and changes will be
+automatically applied.
+
+### Well-known files 
+
+To verify that you own the domain, a webserver must be listening for
+requests and serve a unique file under the `/.well-known/acme-challenge`
+directory. The responses for these files are written by this container
+to `/letsencrypt/well-known`. 
+
+### Other configuration
+
+For testing purposes, you can set the `STAGING` environment variable to
+a non-empty value. This will use the Let's Encrypt staging server, which
+has much more relaxed limits.
+
+You should pass in a contact e-mail address by setting the `EMAIL` env var.
+This is passed on to Let's Encrypt, and may be used for important service
+announcements.
+
+By default this container uses Eliptic Curve keys. You can override this
+behaviour by setting the `ALGORITHM` environment variable. Dehydrated
+supports the following algorithms: `rsa`, `prime256v1` and `secp384r1`.
+

config

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+WELLKNOWN=/letsencrypt/well-known
+BASEDIR=/letsencrypt
+CONTACT_EMAIL=$EMAIL
+KEY_ALGO=${ALGORITHM:-secp384r1}
+
+if [ -z ${STAGING+-} ]; then
+  CA="https://acme-v01.api.letsencrypt.org/directory"
+else
+  CA="https://acme-staging.api.letsencrypt.org/directory"
+fi
+

run.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+interrupt() {
+  echo
+  echo "Caught ^C, exiting."
+  exit 1
+}
+
+trap interrupt SIGINT
+
+if [ -n "${ACCEPT_CA_TERMS:-}" ]; then
+  DEHYDRATED_CMD="/dehydrated --accept-terms"
+else
+  DEHYDRATED_CMD="/dehydrated"
+fi
+
+while true; do
+  $DEHYDRATED_CMD --cron --challenge http-01
+  $DEHYDRATED_CMD --cleanup
+  inotifywait --timeout 86400 /letsencrypt/domains.txt
+  sleep 60
+done
+