changes on ssl

Signed-off-by: Zoey <zoey@z0ey.de>
2025-08-03 07:53:39 +00:00 · 2022-12-27 12:35:02 +01:00
parent 920bce627a
commit d7db5527d9
36 changed files with 201 additions and 251 deletions
--- a/rootfs/bin/check-health.sh
+++ b/rootfs/bin/check-health.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if (cgi-fcgi -bind -connect /dev/php7.sock &> /dev/null && cgi-fcgi -bind -connect /dev/php8.sock &> /dev/null && cgi-fcgi -bind -connect /dev/php81.sock &> /dev/null && cgi-fcgi -bind -connect /dev/php82.sock &> /dev/null && [ "$(wget -q --no-check-certificate https://127.0.0.1:81/api -O - | jq --raw-output '.status')" == "OK" ]); then
+	echo "OK"
+	exit 0
+else
+	echo "NOT OK"
+	exit 1
+fi
--- a/rootfs/usr/local/bin/start
+++ b/rootfs/usr/local/bin/start
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash

 # From https://github.com/nextcloud/all-in-one/pull/1377/files
 if [ -n "$PHP_APKS" ]; then
@@ -21,23 +21,23 @@ if [ -n "$PHP_APKS" ]; then
        fi
    
        echo "Installing $apk via apk..."
-        if ! apk add --no-cache "$apk" >/dev/null; then
+        if ! apk add --no-cache "$apk" &> /dev/null; then
            echo "The packet $apk was not installed!"
        fi

    done
 fi

-mkdir -p /tmp/letsencrypt-acme-challenge \
-         /data/letsencrypt \
-         /data/custom_ssl \
-         /data/access \
+mkdir -p /tmp/acme-challenge \
+         /data/ssl/certbot \
+         /data/ssl/custom \
         /data/php \
         /data/nginx/redirection_host \
         /data/nginx/proxy_host \
         /data/nginx/dead_host \
         /data/nginx/stream \
         /data/nginx/custom \
+         /data/nginx/access \
         /data/nginx/html || exit 1

 if [ -f /data/nginx/default_host/site.conf ]; then
@@ -48,21 +48,46 @@ if [ -f /data/nginx/default_www/index.html ]; then
 mv /data/nginx/default_www/index.html /data/nginx/html/index.html || exit 1
 fi

+if [ -e /data/access ]; then
+mv /data/access/* /data/nginx/access || exit 1
+fi
+
+if [ -e /etc/letsencrypt/live ]; then
+mv /etc/letsencrypt/* /data/ssl/certbot || exit 1
+fi
+
+if [ -e /data/letsencrypt/live ]; then
+mv /data/letsencrypt/* /data/ssl/certbot || exit 1
+fi
+
+if [ -e /data/custom_ssl/npm-* ]; then
+mv /data/custom_ssl/* /data/ssl/custom || exit 1
+fi
+
 rm -rf /data/letsencrypt-acme-challenge \
       /data/nginx/default_host \
       /data/nginx/default_www \
       /data/nginx/streams \
       /data/nginx/temp \
+       /data/index.html \
+       /data/letsencrypt \
+       /data/custom_ssl \
+       /data/certbot \
+       /data/access \
       /data/logs \
       /data/error.log \
       /data/nginx/error.log || exit 1

-if [ -e /etc/letsencrypt/live ]; then
-mv /etc/letsencrypt/* /data/letsencrypt || exit 1
-fi
+find /data/nginx -type f -name '*.conf' -exec sed -i "s|/data/access|/data/nginx/access|g" {} \; || exit 1

-find /data/nginx -type f -name '*.conf' -exec sed -i "s|/etc/letsencrypt|/data/letsencrypt|g" {} \; || exit 1
-find /data/letsencrypt -type f -name '*.conf' -exec sed -i "s|/etc/letsencrypt|/data/letsencrypt|g" {} \; || exit 1
+find /data/nginx -type f -name '*.conf' -exec sed -i "s|/data/custom_ssl|/data/ssl/custom|g" {} \; || exit 1
+find /data/nginx -type f -name '*.conf' -exec sed -i "s|/etc/letsencrypt|/data/ssl/certbot|g" {} \; || exit 1
+find /data/nginx -type f -name '*.conf' -exec sed -i "s|/data/letsencrypt|/data/ssl/certbot|g" {} \; || exit 1
+
+find /data/ssl/certbot/renewal -type f -name '*.conf' -exec sed -i "s|/etc/letsencrypt|/data/ssl/certbot|g" {} \; || exit 1
+find /data/ssl/certbot/renewal -type f -name '*.conf' -exec sed -i "s|/data/letsencrypt|/data/ssl/certbot|g" {} \; || exit 1
+
+find /data/nginx -type f -name '*.conf' -exec sed -i "s|include conf.d/include/letsencrypt-acme-challenge.conf;|include conf.d/include/acme-challenge.conf;|g" {} \; || exit 1

 find /data/nginx -type f -name '*.conf' -exec sed -i "s|include conf.d/include/assets.conf;||g" {} \; || exit 1
 find /data/nginx -type f -name '*.conf' -exec sed -i "s/# Asset Caching//g" {} \; || exit 1
@@ -78,12 +103,17 @@ if [ ! -f /data/nginx/default.conf ]; then
 cp /usr/local/nginx/conf/conf.d/include/default.conf /data/nginx/default.conf || exit 1
 fi

+if [ ! -f /data/ssl/certbot/config.ini ]; then
+cp /etc/ssl/certbot.ini /data/ssl/certbot/config.ini || exit 1
+fi
+
 touch /data/nginx/default.conf \
      /data/nginx/html/index.html \
      /data/nginx/custom/root.conf \
      /data/nginx/custom/events.conf \
      /data/nginx/custom/http.conf \
      /data/nginx/custom/http_top.conf \
+      /data/nginx/custom/server_dead.conf \
      /data/nginx/custom/server_proxy.conf \
      /data/nginx/custom/server_redirect.conf \
      /data/nginx/custom/stream.conf \
@@ -107,32 +137,32 @@ if [ "$NGINX_LOG_NOT_FOUND" == "true" ]; then
 sed -i "s/log_not_found off;/log_not_found on;/g" /usr/local/nginx/conf/nginx.conf || exit 1
 fi

-if ! nginx -t 2> /dev/null; then
+if ! nginx -t &> /dev/null; then
 nginx -T || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-while (nginx -t 2> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt 2> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt 2> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt 2> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt 2> /dev/null); do
+while (nginx -t &> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt &> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt &> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt &> /dev/null && cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt &> /dev/null); do
 nginx || exit 1 &
 cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FOR || exit 1 &
 cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FOR || exit 1 &
@@ -142,27 +172,27 @@ node --abort_on_uncaught_exception --max_old_space_size=250 index.js || exit 1 &
 wait
 done

-if ! nginx -t 2> /dev/null; then
+if ! nginx -t &> /dev/null; then
 nginx -T || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/7/conf.d php-fpm7 -c /data/php/7 -y /data/php/7/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/8/conf.d php-fpm8 -c /data/php/8 -y /data/php/8/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/81/conf.d php-fpm81 -c /data/php/81 -y /data/php/81/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi

-if ! cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt 2> /dev/null; then
+if ! cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt &> /dev/null; then
 cross-env PHP_INI_SCAN_DIR=/data/php/82/conf.d php-fpm82 -c /data/php/82 -y /data/php/82/php-fpm.conf -FORt || exit 1
 sleep inf || exit 1
 fi
--- a/rootfs/etc/ssl/certbot.ini
+++ b/rootfs/etc/ssl/certbot.ini
@@ -0,0 +1,13 @@
+text = true
+agree-tos = true
+non-interactive = true
+key-type = ecdsa
+must-staple = true
+rsa-key-size = 4096
+elliptic-curve = secp384r1
+webroot-path = /tmp/acme-challenge
+
+# An example of using an alternate ACME server that uses EAB credentials
+# server = https://dv.acme-v02.api.pki.goog/directory
+# eab-kid = somestringofstuffwithoutquotes
+# eab-hmac-key = yaddayaddahexhexnotquoted
--- a/rootfs/etc/ssl/dhparam.txt
+++ b/rootfs/etc/ssl/dhparam.txt
@@ -1,96 +0,0 @@
-    DH Parameters: (8192 bit)
-        prime:
-            00:ea:c9:82:7f:46:79:c5:05:5f:8e:70:c6:a7:2b:
-            b2:66:57:1b:99:cd:9a:50:f2:96:57:c2:fb:fd:c7:
-            40:e4:7c:43:52:bc:ec:4c:88:0f:1a:80:d9:b6:be:
-            9c:30:e0:f2:15:f0:37:66:b8:29:70:fa:58:b4:06:
-            2b:eb:c5:a5:04:b4:a3:55:de:da:74:68:68:29:fe:
-            a0:69:c0:f6:c3:61:79:f5:64:59:c3:5a:77:7c:b8:
-            83:c1:db:96:d7:fb:59:20:84:0e:49:ad:40:f0:bd:
-            b7:21:1f:a9:bf:6e:38:88:24:27:83:cb:42:f2:1f:
-            2e:37:d3:15:a9:b4:01:ab:19:1d:fe:a0:0b:36:80:
-            40:49:c2:7b:06:de:fb:5e:48:c0:92:74:8b:cf:a1:
-            0a:ff:f5:d9:f5:c6:57:2e:37:cc:8f:e2:45:f7:ec:
-            f2:e1:52:ef:c6:fb:75:33:ae:3b:b8:aa:20:84:80:
-            b5:10:ff:ae:db:ca:31:85:e4:ab:60:da:53:50:0b:
-            7e:5d:66:83:b8:e8:e2:98:3c:b2:4a:bf:05:52:e9:
-            d3:9b:a0:4b:b7:da:52:70:2e:92:38:97:65:0d:78:
-            58:77:93:e3:c2:f6:ea:da:86:cc:df:4a:19:14:db:
-            8f:8d:48:cf:5b:29:fa:b8:51:66:9d:6f:83:65:8f:
-            59:70:fb:aa:c8:8d:98:6b:d8:9f:5b:ee:48:b5:f1:
-            ef:c3:a4:85:cc:c8:15:fe:ed:4c:aa:bf:49:66:70:
-            5a:21:6a:b8:af:cb:ad:6c:3d:59:33:10:18:a8:04:
-            6b:f0:6b:39:1d:ec:46:34:1b:eb:24:2a:84:2b:06:
-            7d:73:90:22:ef:06:1a:c2:10:bd:99:11:4b:67:a3:
-            7b:86:6a:05:3a:cc:64:00:e6:6a:f5:b1:24:b6:79:
-            0f:d4:ba:36:1b:80:eb:f4:23:a8:1d:8e:93:87:eb:
-            d5:f4:43:e2:aa:ce:ad:7c:53:c6:e7:8e:92:9d:11:
-            fe:18:53:c3:dc:24:77:77:8d:04:01:d8:14:5b:1c:
-            aa:de:46:cb:5e:cd:b5:bd:41:6d:59:fa:9e:5a:8a:
-            b8:25:76:63:ac:97:21:75:e8:ed:3c:d5:e2:bf:d1:
-            79:b9:52:b5:fd:56:bd:91:8a:ea:61:69:f9:e2:80:
-            ca:cd:4a:04:c0:e0:5d:26:96:49:73:67:90:5d:14:
-            b2:c3:c8:80:68:7f:95:38:f8:da:fe:50:cc:ea:ef:
-            c8:eb:a6:ae:51:92:50:73:c3:c2:44:09:f7:d5:a1:
-            6a:da:03:33:ef:b5:ed:ac:89:a7:02:a1:f8:a4:37:
-            eb:db:e9:6a:2a:39:5e:48:23:23:12:3c:80:60:f9:
-            36:1a:c3:20:ff:e3:e5:67:ca:54:16:d7:44:c4:f3:
-            75:f3:9b:37:19:4e:a5:07:a5:49:53:d3:17:6d:4a:
-            b2:e5:34:88:e2:f4:b0:36:5a:4b:05:70:ef:de:c5:
-            a0:a0:83:3d:72:a4:e0:13:27:0b:fe:29:95:5b:42:
-            56:84:c1:3c:d7:09:80:ea:f8:33:2d:f1:42:20:b6:
-            ca:8b:68:71:af:2c:24:e9:c6:b9:e0:f4:ca:8f:78:
-            c1:ff:7c:d4:62:d1:e3:b3:65:aa:41:68:7f:18:9f:
-            c1:90:a8:e4:8c:82:07:a8:72:81:f6:98:12:ea:bd:
-            29:9e:54:94:fa:9e:f0:2f:e2:d5:47:88:4d:47:ee:
-            ec:b9:16:ba:29:47:11:d9:c5:3c:0f:4c:87:93:2c:
-            e4:93:df:70:71:17:df:01:7b:e2:84:d0:26:56:47:
-            7e:03:a3:18:89:66:d6:a5:65:2c:ea:64:ff:6a:b9:
-            8f:c4:18:2d:b3:68:2a:0e:74:b5:f5:9a:0b:cc:4e:
-            20:ee:46:69:06:2e:a9:58:a0:48:b9:0c:71:2e:b7:
-            3a:84:11:d0:6e:e0:1d:a7:56:4e:35:7c:da:88:72:
-            4a:8e:7f:af:fd:4b:68:0b:08:dd:90:b0:a1:9c:e1:
-            0a:7a:b9:38:1a:08:46:07:f7:83:70:ad:95:58:77:
-            fa:bb:83:37:c3:81:90:2f:59:2a:9c:eb:f4:bf:dd:
-            15:1b:b2:f0:b7:03:c8:aa:d9:6f:ee:e4:0b:42:c1:
-            e5:bc:01:af:e5:c7:6c:07:a1:e0:47:ca:ad:b7:f6:
-            2b:7c:4f:09:08:7c:d9:34:21:64:93:f6:a4:c3:6d:
-            c4:de:11:5b:a5:85:af:f9:f7:13:1a:ab:1e:93:6a:
-            99:20:23:63:d3:b4:52:1d:4a:a8:bc:cd:4c:27:42:
-            e3:84:fb:42:69:00:65:ae:a1:ee:16:6e:e4:39:b2:
-            c8:3f:34:de:ec:dc:46:56:8e:b2:e8:40:97:b5:56:
-            f0:d7:d9:ae:1f:3b:ec:ca:56:80:c4:d1:18:21:19:
-            8b:a6:13:08:8e:48:56:ad:63:42:89:43:41:f0:63:
-            c8:cf:f2:6e:d1:6b:f6:1b:a5:bc:23:00:2e:2d:37:
-            71:51:99:3b:1c:fe:1b:bb:2e:d2:c7:e3:2b:70:cc:
-            aa:8b:8f:98:51:23:dc:3c:3f:32:47:99:41:c0:98:
-            0a:3b:b5:44:23:f6:b7:ec:2d:b5:81:20:f2:e5:4a:
-            3c:6e:f5:5d:da:dd:d2:7d:47:18:1d:43:d9:50:c5:
-            6e:da:4e:73:5d:ba:17:c2:33:92:0d:8f:1a:8d:0a:
-            3c:4b:9b:0f:0f:82:a6:d8:c7:fa:38:2b:89:95:df:
-            05:16:d1:9e:e7
-        generator: 5 (0x5)
-----BEGIN DH PARAMETERS-----
-MIIECAKCBAEA6smCf0Z5xQVfjnDGpyuyZlcbmc2aUPKWV8L7/cdA5HxDUrzsTIgP
-GoDZtr6cMODyFfA3ZrgpcPpYtAYr68WlBLSjVd7adGhoKf6gacD2w2F59WRZw1p3
-fLiDwduW1/tZIIQOSa1A8L23IR+pv244iCQng8tC8h8uN9MVqbQBqxkd/qALNoBA
-ScJ7Bt77XkjAknSLz6EK//XZ9cZXLjfMj+JF9+zy4VLvxvt1M647uKoghIC1EP+u
-28oxheSrYNpTUAt+XWaDuOjimDyySr8FUunTm6BLt9pScC6SOJdlDXhYd5Pjwvbq
-2obM30oZFNuPjUjPWyn6uFFmnW+DZY9ZcPuqyI2Ya9ifW+5ItfHvw6SFzMgV/u1M
-qr9JZnBaIWq4r8utbD1ZMxAYqARr8Gs5HexGNBvrJCqEKwZ9c5Ai7wYawhC9mRFL
-Z6N7hmoFOsxkAOZq9bEktnkP1Lo2G4Dr9COoHY6Th+vV9EPiqs6tfFPG546SnRH+
-GFPD3CR3d40EAdgUWxyq3kbLXs21vUFtWfqeWoq4JXZjrJchdejtPNXiv9F5uVK1
-/Va9kYrqYWn54oDKzUoEwOBdJpZJc2eQXRSyw8iAaH+VOPja/lDM6u/I66auUZJQ
-c8PCRAn31aFq2gMz77XtrImnAqH4pDfr2+lqKjleSCMjEjyAYPk2GsMg/+PlZ8pU
-FtdExPN185s3GU6lB6VJU9MXbUqy5TSI4vSwNlpLBXDv3sWgoIM9cqTgEycL/imV
-W0JWhME81wmA6vgzLfFCILbKi2hxrywk6ca54PTKj3jB/3zUYtHjs2WqQWh/GJ/B
-kKjkjIIHqHKB9pgS6r0pnlSU+p7wL+LVR4hNR+7suRa6KUcR2cU8D0yHkyzkk99w
-cRffAXvihNAmVkd+A6MYiWbWpWUs6mT/armPxBgts2gqDnS19ZoLzE4g7kZpBi6p
-WKBIuQxxLrc6hBHQbuAdp1ZONXzaiHJKjn+v/UtoCwjdkLChnOEKerk4GghGB/eD
-cK2VWHf6u4M3w4GQL1kqnOv0v90VG7LwtwPIqtlv7uQLQsHlvAGv5cdsB6HgR8qt
-t/YrfE8JCHzZNCFkk/akw23E3hFbpYWv+fcTGqsek2qZICNj07RSHUqovM1MJ0Lj
-hPtCaQBlrqHuFm7kObLIPzTe7NxGVo6y6ECXtVbw19muHzvsylaAxNEYIRmLphMI
-jkhWrWNCiUNB8GPIz/Ju0Wv2G6W8IwAuLTdxUZk7HP4buy7Sx+MrcMyqi4+YUSPc
-PD8yR5lBwJgKO7VEI/a37C21gSDy5Uo8bvVd2t3SfUcYHUPZUMVu2k5zXboXwjOS
-DY8ajQo8S5sPD4Km2Mf6OCuJld8FFtGe5wIBBQ==
-----END DH PARAMETERS-----
--- a/rootfs/usr/local/bin/check-health
+++ b/rootfs/usr/local/bin/check-health
@@ -1,9 +0,0 @@
-#!/bin/sh
-
-if (cgi-fcgi -bind -connect /dev/php7.sock > /dev/null && cgi-fcgi -bind -connect /dev/php8.sock > /dev/null && cgi-fcgi -bind -connect /dev/php81.sock > /dev/null && cgi-fcgi -bind -connect /dev/php82.sock > /dev/null && [ "$(wget -q --no-check-certificate https://127.0.0.1:81/api -O - | jq --raw-output '.status')" == "OK" ]); then
-	echo "OK"
-	exit 0
-else
-	echo "NOT OK"
-	exit 1
-fi
--- a/rootfs/usr/local/nginx/conf/conf.d/include/letsencrypt-acme-challenge.conf
+++ b/rootfs/usr/local/nginx/conf/conf.d/include/letsencrypt-acme-challenge.conf
@@ -2,7 +2,7 @@ location ^~ /.well-known/acme-challenge/ {
    auth_basic off;
    auth_request off;
    allow all;
-    root /tmp/letsencrypt-acme-challenge;
+    root /tmp/acme-challenge;
 }

 location = /.well-known/acme-challenge/ {
--- a/rootfs/usr/local/nginx/conf/conf.d/include/default.conf
+++ b/rootfs/usr/local/nginx/conf/conf.d/include/default.conf
@@ -15,7 +15,7 @@ server {

  include conf.d/include/force-ssl.conf;
  include conf.d/include/ssl-ciphers.conf;
-  include conf.d/include/letsencrypt-acme-challenge.conf;
+  include conf.d/include/acme-challenge.conf;
  include conf.d/include/block-exploits.conf;
  add_header alt-svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400';

@@ -23,7 +23,7 @@ server {
  ssl_certificate_key /data/nginx/dummykey.pem;

  location / {
-    include conf.d/include/letsencrypt-acme-challenge.conf;
+    include conf.d/include/acme-challenge.conf;
    alias /html/default/;
  }
 }
--- a/rootfs/usr/local/nginx/conf/conf.d/no-server-name.conf
+++ b/rootfs/usr/local/nginx/conf/conf.d/no-server-name.conf
@@ -19,7 +19,6 @@ server {

    include conf.d/include/force-ssl.conf;
    include conf.d/include/ssl-ciphers.conf;
-    include conf.d/include/letsencrypt-acme-challenge.conf;
    include conf.d/include/block-exploits.conf;
    add_header alt-svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400';

--- a/rootfs/usr/local/nginx/conf/conf.d/npm.conf
+++ b/rootfs/usr/local/nginx/conf/conf.d/npm.conf
@@ -10,7 +10,6 @@ server {
    ssl_certificate_key /data/nginx/dummykey.pem;
    include conf.d/include/ssl-ciphers.conf;
    include conf.d/include/block-exploits.conf;
-    include conf.d/include/letsencrypt-acme-challenge.conf;
    add_header alt-svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400';

    location /api {
--- a/rootfs/usr/local/nginx/conf/letsencrypt.ini
+++ b/rootfs/usr/local/nginx/conf/letsencrypt.ini
@@ -1,7 +0,0 @@
-text = True
-non-interactive = True
-webroot-path = /tmp/letsencrypt-acme-challenge
-rsa-key-size = 4096
-key-type = ecdsa
-elliptic-curve = secp384r1
-preferred-chain = ISRG Root X1