From d424a63d6049d8d241ab1294aea035d4b187a111 Mon Sep 17 00:00:00 2001
From: generalfuzz <generalfuzz@gmail.com>
Date: Thu, 17 Mar 2022 11:15:08 -0700
Subject: Replace Certbot with Lego for Let's Encrypt container

Replaces Certbot with Lego for certificate retrieval and renewal.
Lego includes support for DNS ACME Challenges.

Adds ssh-client to LetsEncrypt and ssh-server to HAProxy to allow both
the transfer of Let's Encrypt certificates to the HAProxy container and
to enable live updating of HAProxy certifices using the HAProxy API
exposed on the local HAProxy socket.

Implements: blueprint letsencrypt-https
Change-Id: I737e1ce5bfc37d0703879c8272a9e915084c5ca6
---
 docker/haproxy/haproxy-ssh/extend_start.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 docker/haproxy/haproxy-ssh/extend_start.sh

(limited to 'docker/haproxy/haproxy-ssh/extend_start.sh')

diff --git a/docker/haproxy/haproxy-ssh/extend_start.sh b/docker/haproxy/haproxy-ssh/extend_start.sh
new file mode 100644
index 000000000..d571e7292
--- /dev/null
+++ b/docker/haproxy/haproxy-ssh/extend_start.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+SSH_HOST_KEY_TYPES=( "ecdsa" )
+
+for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
+    KEY_PATH=/etc/ssh/ssh_host_${key_type}_key
+    if [[ ! -f "${KEY_PATH}" ]]; then
+        ssh-keygen -q -t ${key_type} -f ${KEY_PATH} -N ""
+    fi
+done
+
+mkdir -p /var/lib/haproxy/.ssh
+
+if [[ $(stat -c %U:%G /var/lib/haproxy/.ssh) != "haproxy:haproxy" ]]; then
+    sudo chown haproxy: /var/lib/haproxy/.ssh
+fi
-- 
cgit v1.2.3