From ed1c15929d2eb2dbc6432986c26661bf1549964a Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Thu, 17 Sep 2026 21:26:20 +0200 Subject: Add native TLS transport, TLS clients and lego cert sidecar - bokfd: optional TLS listener (OpenSSL), certificate reload on change - clients: tls:host:port targets with chain and host verification - compose: port 8788 and an INWX/lego renewal sidecar - Makefile: header dependency tracking (-MMD -MP) --- compose.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'compose.yaml') diff --git a/compose.yaml b/compose.yaml index d1739fd..5f824c0 100644 --- a/compose.yaml +++ b/compose.yaml @@ -6,6 +6,8 @@ services: build: context: . restart: unless-stopped + ports: + - "8788:8788" volumes: - ./var/db:/var/lib/bokfd - ./var/run:/run/bokfd @@ -15,3 +17,30 @@ services: BOKFD_BACKUP_DIR: /var/lib/bokfd/backup BOKFD_EXPORT_DIR: /var/lib/bokfd/export BOKFD_LOG_LEVEL: info + BOKFD_TLS: 0.0.0.0:8788 + BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt + BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key + + certs: + image: goacme/lego:latest + restart: unless-stopped + entrypoint: ["/bin/sh", "-c"] + command: + - | + while :; do + if [ -n "$INWX_USERNAME" ] && [ -n "$INWX_PASSWORD" ]; then + /lego --path=/certs --email="$LEGO_EMAIL" --dns=inwx \ + --domains="$LEGO_DOMAIN" --accept-tos run --days 30 || true + chown -R 10001:10001 /certs || true + else + echo "certs: set INWX_USERNAME and INWX_PASSWORD in .env" + fi + sleep 12h + done + environment: + LEGO_EMAIL: ${LEGO_EMAIL:-anders@makandra.eu} + LEGO_DOMAIN: ${LEGO_DOMAIN:-bokf.makandra.eu} + INWX_USERNAME: ${INWX_USERNAME:-} + INWX_PASSWORD: ${INWX_PASSWORD:-} + volumes: + - ./var/db/certs:/certs -- cgit v1.3