deuill/coreos-home-server
1
0
Fork 0
mirror of https://github.com/deuill/coreos-home-server.git synced 2024-09-21 13:40:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

letsencrypt: Use dedicated user for ACME process

Browse Source 
This improves security and ensures that files end up under a consistent
set of UID and GID values.
This commit is contained in:
Alex Palaistras 2021-09-22 21:21:21 +01:00
parent 27201fd195
commit d5d75b3995
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
config/service/letsencrypt/Containerfile
View File

@ -1 +1,9 @@
FROM docker.io/goacme/lego:v4.4.0
RUN addgroup --system --gid 10000 letsencrypt
RUN adduser --system --uid 10000 --ingroup letsencrypt --home /var/lib/letsencrypt letsencrypt
RUN apk --no-cache --no-progress add gosu
COPY container/run-lego /run-lego
ENTRYPOINT ["/run-lego"]

7
config/service/letsencrypt/container/run-lego Executable file
View File

@ -0,0 +1,7 @@
#!/bin/sh
# Correct permissions where needed.
chown -R letsencrypt:letsencrypt /var/lib/letsencrypt
# Run ACME verification with parameters given.
gosu letsencrypt /usr/bin/lego "$@"