public/dotege: Docker template generator

Docker template generator

Chris Smith b8b1d93a08 Move config to env vars. I'll make up my mind one day.		vor 5 Jahren
certs	Add auth label	vor 5 Jahren
docker	Logging tweaks	vor 5 Jahren
model	Move acme settings to config, not env vars	vor 5 Jahren
templates	Add auth label	vor 5 Jahren
.gitignore	Initial import	vor 5 Jahren
.pre-commit-config.yaml	Use new docker and lego code	vor 5 Jahren
Dockerfile	Use new docker and lego code	vor 5 Jahren
LICENCE	Add licence	vor 5 Jahren
README.adoc	Move config to env vars.	vor 5 Jahren
docker.go	First-pass rewrite of docker code	vor 5 Jahren
dotege.go	Move config to env vars.	vor 5 Jahren
go.mod	Use new docker and lego code	vor 5 Jahren
go.sum	Use new docker and lego code	vor 5 Jahren
lego.go	Cleanup, redeploy, deal with expired certs	vor 5 Jahren
template_generator.go	Skeleton certificate scanning	vor 5 Jahren

== Dotege

=== Configuration

Dotege is configured using environment variables:

`DOTEGE_CERT_DESTINATION`::
The folder where certificates will be placed. Defaults to `/data/certs`.

`DOTEGE_DNS_PROVIDER`::
The DNS provider to use. Must be one https://go-acme.github.io/lego/dns/[supported by Lego].
The DNS provider will also be configured using environmental variables, as documented by
the Lego project. Required.

`DOTEGE_ACME_CACHE_FILE`::
The path to a JSON file to store ACME credentials and certificates. This file will
contain the private keys for all certificates generated by Dotege, so must not
be accessible to other users or processes. Defaults to `/data/config/certs.json`.

`DOTEGE_ACME_EMAIL`::
The e-mail address to provide to the ACME service for updates, renewal reminders, etc.
Required.

`DOTEGE_ACME_ENDPOINT`::
The ACME server to request certificates from. Defaults to the Let's Encrypt production
server at https://acme-v02.api.letsencrypt.org/directory. For staging, this can be set
to https://acme-staging-v02.api.letsencrypt.org/directory.

`DOTEGE_ACME_KEY_TYPE`::
The key type to use for private keys when generating a certificate using ACME. Valid
values are:
+
* `P256` for EC256
* `P384` for EC384
* `2048` for RSA-2048
* `4096` for RSA-4096
* `8192` for RSA-8192
+
The default value is `P384`.

`DOTEGE_TEMPLATE_DESTINATION`::
Location to write the templated configuration file to. Defaults to `/data/output/haproxy.cfg`.

`DOTEGE_TEMPLATE_SOURCE`::
Path to a template to use to generate configuration. Defaults to `./templates/haproxy.cfg.tpl`,
which is a bundled basic template for generating HAProxy configurations.

=== Docker labels

Dotege operates by parsing labels applied to docker containers. It understands the following:

`com.chameth.auth`::
Specifies the name of an auth group (which must be defined appropriately in the template file)
that users are required to be in to access the container.

`com.chameth.proxy`::
The port on which the container is listening for requests.

`com.chameth.vhost`::
Comma- or space-delimited list of hostnames that the container will handle requests for.
Certificates will have the first host as the subject, and any additional hosts will be
alternate names. Certificates are only reused if all hostnames match.

README.adoc