blob: f1c2776ba8413a15e1e4e9ec9182899030542076 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
job "certificates" {
type = "batch"
periodic {
cron = "@monthly"
}
group "lego" {
restart {
attempts = 1
delay = "1h"
}
volume "certs" {
type = "host"
source = "ca-certificates"
}
network {
port "http" { }
}
service {
name = "certificates"
port = "http"
provider = "nomad"
tags = [
"nginx.acme-challenge",
]
}
task "lego" {
driver = "exec"
volume_mount {
volume = "certs"
destination = "/lego"
}
config {
command = "certs.sh"
}
template {
data = <<EOF
#!/usr/bin/env bash
function dns() {
[ -f "/lego/certificates/$1.key" ] && cmd="renew --no-random-sleep --days 45" || cmd=run
/local/lego \
--accept-tos \
--path /lego \
--email mathias+certs@magnusson.space \
--dns cloudflare \
$${@/#/-d=} \
$cmd
}
function http() {
[ -f "/lego/certificates/$1.key" ] && cmd="renew --no-random-sleep --days 45" || cmd=run
/local/lego \
--accept-tos \
--path /lego \
--email mathias+certs@magnusson.space \
--http --http.port ":$NOMAD_PORT_http" \
$${@/#/-d=} \
$cmd
}
dns magnusson.space *.magnusson.space
dns magnusson.wiki *.magnusson.wiki
dns xn--srskildakommandorrelsegruppen-0pc88c.se *.xn--srskildakommandorrelsegruppen-0pc88c.se
dns xn--hvd-sna.ing *.xn--hvd-sna.ing
http dinlugnastund.se www.dinlugnastund.se
CLOUDFLARE_DNS_API_TOKEN=$CTFTAJM_TOKEN dns ctftajm.se *.ctftajm.se
EOF
destination = "local/certs.sh"
}
template {
data = <<EOF
{{ with nomadVar "nomad/jobs/certificates" }}
CLOUDFLARE_DNS_API_TOKEN={{ .cloudflare_dns_api_token }}
CTFTAJM_TOKEN={{ .cloudflare_dns_api_token_ctftajm }}
{{ end }}
EOF
destination = "local/.env"
env = true
}
artifact {
source = "https://github.com/go-acme/lego/releases/download/v4.13.3/lego_v4.13.3_linux_amd64.tar.gz"
}
}
}
}
|
