Maxfield Luke
67c1d41a0c
Fresh repository history for elektrine/elektrine-haraka hosted at https://git.elektrine.com/elektrine/elektrine-haraka.
64 lines
1.6 KiB
Bash
Executable file
64 lines
1.6 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
# SSL Certificate Initialization Script for elektrine-haraka
|
|
# This script runs inside Docker and sets up Let's Encrypt SSL certificates
|
|
|
|
set -e
|
|
|
|
DOMAIN="${HARAKA_DOMAIN:-mail.example.com}"
|
|
EMAIL="${SSL_EMAIL:-admin@example.com}"
|
|
STAGING=${STAGING:-0}
|
|
|
|
echo "🔐 Setting up SSL certificates for $DOMAIN"
|
|
|
|
# Check if certificates already exist
|
|
if [ -d "/etc/letsencrypt/live/$DOMAIN" ]; then
|
|
echo "✅ SSL certificates already exist for $DOMAIN"
|
|
exit 0
|
|
fi
|
|
|
|
echo "📋 Starting SSL certificate setup..."
|
|
|
|
# Wait for nginx to be ready
|
|
sleep 10
|
|
|
|
# Request certificate using certbot
|
|
echo "📄 Requesting SSL certificate..."
|
|
if [ "$STAGING" = "1" ]; then
|
|
echo "⚠️ Using Let's Encrypt staging environment"
|
|
STAGING_FLAG="--staging"
|
|
else
|
|
STAGING_FLAG=""
|
|
fi
|
|
|
|
# Use certbot with webroot method
|
|
certbot certonly \
|
|
--webroot \
|
|
--webroot-path=/var/www/certbot \
|
|
--email $EMAIL \
|
|
--agree-tos \
|
|
--no-eff-email \
|
|
--non-interactive \
|
|
$STAGING_FLAG \
|
|
-d $DOMAIN
|
|
|
|
echo "✅ SSL certificate obtained successfully!"
|
|
|
|
# Update Haraka TLS configuration to use the certificates
|
|
echo "🔧 Updating Haraka TLS configuration..."
|
|
cat > /etc/letsencrypt/haraka-tls.ini << EOF
|
|
[main]
|
|
# Let's Encrypt certificates (mounted from Docker volume)
|
|
key=/app/ssl/live/$DOMAIN/privkey.pem
|
|
cert=/app/ssl/live/$DOMAIN/fullchain.pem
|
|
|
|
# Security settings
|
|
ciphers=ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
|
|
requestCert=false
|
|
rejectUnauthorized=false
|
|
|
|
# TLS versions
|
|
# secureProtocol=TLSv1_2_method
|
|
EOF
|
|
|
|
echo "🎉 SSL setup complete! Certificates ready for use."
|