Compare commits

..

No commits in common. "master" and "v1.4.0" have entirely different histories.

3 changed files with 9 additions and 43 deletions

View File

@ -15,4 +15,4 @@ RUN pip3 install -r requirements.txt
COPY . /app COPY . /app
# Define entrypoint of the app # Define entrypoint of the app
ENTRYPOINT ["python3", "-u", "extractor.py", "-c", "data/acme.json", "-d", "certs"] ENTRYPOINT ["python3", "-u", "extractor.py"]

View File

@ -5,65 +5,31 @@ Forked from [DanielHuisman/traefik-certificate-extractor](https://github.com/Dan
Tool to extract Let's Encrypt certificates from Traefik's ACME storage file. Can automatically restart containers using the docker API. Tool to extract Let's Encrypt certificates from Traefik's ACME storage file. Can automatically restart containers using the docker API.
## Installation ## Installation
```shell ```
git clone https://github.com/snowmb/traefik-certificate-extractor git clone https://github.com/snowmb/traefik-certificate-extractor
cd traefik-certificate-extractor cd traefik-certificate-extractor
``` ```
## Usage ## Usage
```shell ```
usage: extractor.py [-h] [-c CERTIFICATE] [-d DIRECTORY] [-f] [-r] [--dry-run] python3 extractor.py [FILE]
[--include [INCLUDE [INCLUDE ...]] | --exclude
[EXCLUDE [EXCLUDE ...]]]
Extract traefik letsencrypt certificates.
optional arguments:
-h, --help show this help message and exit
-c CERTIFICATE, --certificate CERTIFICATE
file that contains the traefik certificates (default
acme.json)
-d DIRECTORY, --directory DIRECTORY
output folder
-f, --flat outputs all certificates into one folder
-r, --restart_container
uses the docker API to restart containers that are
labeled accordingly
--dry-run Don't write files and do not start docker containers.
--include [INCLUDE [INCLUDE ...]]
--exclude [EXCLUDE [EXCLUDE ...]]
``` ```
Default file is `./data/acme.json`. The output directories are `./certs` and `./certs_flat`. Default file is `./data/acme.json`. The output directories are `./certs` and `./certs_flat`.
## Docker ## Docker
There is a Docker image available for this tool: [snowmb/traefik-certificate-extractor](https://hub.docker.com/r/snowmb/traefik-certificate-extractor/). There is a Docker image available for this tool: [snowmb/traefik-certificate-extractor](https://hub.docker.com/r/snowmb/traefik-certificate-extractor/).
Example run: Example run:
```shell ```
docker run --name extractor -d \ docker run --name extractor -d \
-v /opt/traefik:/app/data \ -v /opt/traefik:/app/data \
-v ./certs:/app/certs \ -v ./certs:/app/certs \
-v /var/run/docker.socket:/var/run/docker.sock \ -v /var/run/docker.socket:/var/run/docker.socket \
snowmb/traefik-certificate-extractor -r snowmb/traefik-certificate-extractor
``` ```
Mount the whole folder containing the traefik certificate file (`acme.json`) as `/app/data`. The extracted certificates are going to be written to `/app/certs`. Mount the whole folder containing the traefik certificate file as `/app/data`. The extracted certificates are going to be written to `/app/certs`.
The docker socket is used to find any containers with this label: `com.github.SnowMB.traefik-certificate-extractor.restart_domain=<DOMAIN>`. The docker socket is used to find any containers with this label: `com.github.SnowMB.traefik-certificate-extractor.restart_domain=<DOMAIN>`.
If the domains of an extracted certificate and the restart domain matches, the container is restarted. Multiple domains can be given seperated by `,`. If the domains of an extracted certificate and the restart domain matches, the container is restarted. Multiple domains can be given seperated by `,`.
You can easily use `docker-compose` to integrate this container into your setup:
```yaml
...
services:
certs:
image: snowmb/traefik-certificate-extractor
volumes:
- path/to/acme.json:/app/data/acme.json:ro
- certs:/app/certs:rw
- /var/run/docker.sock:/var/run/docker.sock
command: -r --include example.com
restart: always
```
## Output ## Output
``` ```

View File

@ -217,7 +217,7 @@ if __name__ == "__main__":
parser.add_argument('-f', '--flat', action='store_true', parser.add_argument('-f', '--flat', action='store_true',
help='outputs all certificates into one folder') help='outputs all certificates into one folder')
parser.add_argument('-r', '--restart_container', action='store_true', parser.add_argument('-r', '--restart_container', action='store_true',
help="uses the docker API to restart containers that are labeled with 'com.github.SnowMB.traefik-certificate-extractor.restart_domain=<DOMAIN>' if the domain name of a generated certificates matches. Multiple domains can be seperated by ','") help='uses the docker API to restart containers that are labeled accordingly')
parser.add_argument('--dry-run', action='store_true', dest='dry', parser.add_argument('--dry-run', action='store_true', dest='dry',
help="Don't write files and do not start docker containers.") help="Don't write files and do not start docker containers.")
group = parser.add_mutually_exclusive_group() group = parser.add_mutually_exclusive_group()