diff --git a/.version b/.version index dcb27a75..e4643748 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -2.12.5 +2.12.6 diff --git a/README.md b/README.md index 3f7c2178..2116a55a 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@



- + diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh index 1ec117e1..fa946518 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh @@ -8,37 +8,53 @@ log_info 'Setting ownership ...' # root chown root /tmp/nginx -# npm user and group -chown -R "$PUID:$PGID" /data -chown -R "$PUID:$PGID" /etc/letsencrypt -chown -R "$PUID:$PGID" /run/nginx -chown -R "$PUID:$PGID" /tmp/nginx -chown -R "$PUID:$PGID" /var/cache/nginx -chown -R "$PUID:$PGID" /var/lib/logrotate -chown -R "$PUID:$PGID" /var/lib/nginx -chown -R "$PUID:$PGID" /var/log/nginx +locations=( + "/data" + "/etc/letsencrypt" + "/run/nginx" + "/tmp/nginx" + "/var/cache/nginx" + "/var/lib/logrotate" + "/var/lib/nginx" + "/var/log/nginx" + "/etc/nginx/nginx" + "/etc/nginx/nginx.conf" + "/etc/nginx/conf.d" +) -# Don't chown entire /etc/nginx folder as this causes crashes on some systems -chown -R "$PUID:$PGID" /etc/nginx/nginx -chown -R "$PUID:$PGID" /etc/nginx/nginx.conf -chown -R "$PUID:$PGID" /etc/nginx/conf.d +chownit() { + local dir="$1" + local recursive="${2:-true}" -# Certbot directories - optimized approach -CERT_INIT_FLAG="/opt/certbot/.ownership_initialized" + local have + have="$(stat -c '%u:%g' "$dir")" + echo "- $dir ... " -if [ ! -f "$CERT_INIT_FLAG" ]; then - # Prevents errors when installing python certbot plugins when non-root - if [ "$SKIP_CERTBOT_OWNERSHIP" != "true" ]; then - log_info 'Changing ownership of /opt/certbot directories ...' - chown "$PUID:$PGID" /opt/certbot /opt/certbot/bin + if [ "$have" != "$PUID:$PGID" ]; then + if [ "$recursive" = 'true' ] && [ -d "$dir" ]; then + chown -R "$PUID:$PGID" "$dir" + else + chown "$PUID:$PGID" "$dir" + fi + echo " DONE" + else + echo " SKIPPED" fi +} + +for loc in "${locations[@]}"; do + chownit "$loc" +done + +if [ "$(is_true "${SKIP_CERTBOT_OWNERSHIP:-}")" = '1' ]; then + log_info 'Skipping ownership change of certbot directories' +else + log_info 'Changing ownership of certbot directories, this may take some time ...' + chownit "/opt/certbot" false + chownit "/opt/certbot/bin" false # Handle all site-packages directories efficiently find /opt/certbot/lib -type d -name "site-packages" | while read -r SITE_PACKAGES_DIR; do - chown -R "$PUID:$PGID" "$SITE_PACKAGES_DIR" + chownit "$SITE_PACKAGES_DIR" done - - # Create a flag file to skip this step on subsequent runs - touch "$CERT_INIT_FLAG" - chown "$PUID:$PGID" "$CERT_INIT_FLAG" fi diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/40-dynamic.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/40-dynamic.sh index 0cb9f126..e02f41ca 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/40-dynamic.sh +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/40-dynamic.sh @@ -5,12 +5,9 @@ set -e log_info 'Dynamic resolvers ...' -DISABLE_IPV6=$(echo "${DISABLE_IPV6:-}" | tr '[:upper:]' '[:lower:]') - # Dynamically generate resolvers file, if resolver is IPv6, enclose in `[]` # thanks @tfmm -if [ "$DISABLE_IPV6" == "true" ] || [ "$DISABLE_IPV6" == "on" ] || [ "$DISABLE_IPV6" == "1" ] || [ "$DISABLE_IPV6" == "yes" ]; -then +if [ "$(is_true "$DISABLE_IPV6")" = '1' ]; then echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" { sub(/%.*$/,"",$2); print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf) ipv6=off valid=10s;" > /etc/nginx/conf.d/include/resolvers.conf else echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" { sub(/%.*$/,"",$2); print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf) valid=10s;" > /etc/nginx/conf.d/include/resolvers.conf diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/50-ipv6.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/50-ipv6.sh index 0c4d261c..2ae61ae5 100755 --- a/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/50-ipv6.sh +++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/50-ipv6.sh @@ -8,14 +8,11 @@ set -e log_info 'IPv6 ...' -# Lowercase -DISABLE_IPV6=$(echo "${DISABLE_IPV6:-}" | tr '[:upper:]' '[:lower:]') - process_folder () { FILES=$(find "$1" -type f -name "*.conf") SED_REGEX= - if [ "$DISABLE_IPV6" == "true" ] || [ "$DISABLE_IPV6" == "on" ] || [ "$DISABLE_IPV6" == "1" ] || [ "$DISABLE_IPV6" == "yes" ]; then + if [ "$(is_true "$DISABLE_IPV6")" = '1' ]; then # IPV6 is disabled echo "Disabling IPV6 in hosts in: $1" SED_REGEX='s/^([^#]*)listen \[::\]/\1#listen [::]/g' diff --git a/docker/rootfs/usr/bin/common.sh b/docker/rootfs/usr/bin/common.sh index 13cf06ac..46529870 100644 --- a/docker/rootfs/usr/bin/common.sh +++ b/docker/rootfs/usr/bin/common.sh @@ -56,3 +56,13 @@ get_group_id () { getent group "$1" | cut -d: -f3 fi } + +# param $1: value +is_true () { + VAL=$(echo "${1:-}" | tr '[:upper:]' '[:lower:]') + if [ "$VAL" == 'true' ] || [ "$VAL" == 'on' ] || [ "$VAL" == '1' ] || [ "$VAL" == 'yes' ]; then + echo '1' + else + echo '0' + fi +}