Certbot Statefile for Nanocl v0.18

Description

This job uses Certbot to obtain and renew SSL certificates for a specified domain. It is designed to run each 2 weeks and can be configured to use a test certificate. The generated certificates are stored as secrets in Nanocl for easy integration with other services. It shares the PID namespace and volumes of the default installed proxy container, system.ncproxy.c.

Synopsis

nanocl state apply -s nr.next-hat.com/v0.18/certbot -- [--help] ARGUMENTS
nanocl state rm -s nr.next-hat.com/v0.18/certbot -- [--help] ARGUMENTS

Arguments

Argument	Type	Description	Default
`--email` Required	`String`	Email address for Certbot registration and recovery contact.	—
`--domain` Required	`String`	Domain name for which to generate the SSL certificate.	—
`--test` Optional	`Boolean`	Use a test certificate from Let's Encrypt.	—

Render locally

Render this Statefile and save the result to Statefile.yml for review before applying it.

Pass any required Statefile arguments after --.

nanocl state render -s nr.next-hat.com/v0.18/certbot -o Statefile.yml

Content

YAML

ApiVersion: v0.18
Args:
  - Name: email
    Kind: String
    Required: true
    Description: Email address for Certbot registration and recovery contact.
  - Name: domain
    Kind: String
    Required: true
    Description: Domain name for which to generate the SSL certificate.
  - Name: test
    Kind: Boolean
    Description: Use a test certificate from Let's Encrypt.
Jobs:
  - Name: certbot-gen-${{ Args.domain }}
    Schedule: 0 0 */14 * *
    Containers:
      - Image: ubuntu:26.04
        Tty: false
        HostConfig:
          NetworkMode: host
          PidMode: container:system.ncproxy.c
          VolumesFrom:
            - system.ncproxy.c
        Cmd:
          - /bin/sh
          - -c
          - >
            export DEBIAN_FRONTEND=noninteractive

            apt-get update -yqq

            apt-get install --force-yes -yqq wget certbot python3-certbot-nginx
            nginx-extras

            wget
            https://github.com/next-hat/nanocl/releases/download/nanocl-0.18.0/nanocl_0.18.0_amd64.deb

            dpkg -i nanocl_0.18.0_amd64.deb

            certbot --nginx -n \
              --agree-tos \
              --email ${{ Args.email }} \
              --force-renewal \
              -d ${{ Args.domain }} \
              {% if Args.test %}--test-cert {% endif %} \
              --nginx-server-root /var/lib/nanocl/proxy
            FULL_CHAIN=`cat /etc/letsencrypt/live/${{ Args.domain
            }}/fullchain.pem | awk 1 ORS='\\\n'`

            PRIV_KEY=`cat /etc/letsencrypt/live/${{ Args.domain }}/privkey.pem |
            awk 1 ORS='\\\n'`

            cat <<EOF > /tmp/secret.yaml
              ApiVersion: v0.18
              Secrets:
              - Name: cert.{% if Args.test %}test.{% endif %}${{ Args.domain }}
                Kind: nanocl.io/tls
                Data:
                  Certificate: "$FULL_CHAIN"
                  CertificateKey: "$PRIV_KEY"
            EOF

            cat /tmp/secret.yaml

            nanocl state apply -ys /tmp/secret.yaml