Add automated Let's Encrypt support via certbot#185
Open
madest92 wants to merge 4 commits into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds two Certbot services to docker-compose for one-time certificate issuance and continuous renewal, and updates environment file comments explaining the ACME workflow and an optional GitLab PKI chain variable. ChangesLet's Encrypt automation
Sequence Diagram(s)sequenceDiagram
participant User
participant Compose as Docker Compose
participant CertInit as certbot-init
participant LE as Let's Encrypt
participant FS as File System
participant Nginx
participant CertRenew as certbot-renew
User->>Compose: Run with acme-init profile
Compose->>CertInit: Start certbot-init
CertInit->>FS: Check /etc/letsencrypt/live/$DOMAIN
alt certificate missing
CertInit->>LE: Request cert via HTTP-01 on ${HTTP_PORT}
LE->>CertInit: HTTP-01 challenge
CertInit->>LE: Respond to challenge
LE->>FS: Issue and store certificate
else certificate exists
CertInit->>CertInit: Exit successfully
end
User->>Compose: Run with acme profile
Compose->>Nginx: Start nginx
Compose->>CertRenew: Start certbot-renew
loop Every 24 hours
CertRenew->>LE: certbot renew for ${DOMAIN}
alt renewed
LE->>FS: Update certificate files
CertRenew->>Nginx: deploy hook (kill -HUP 1)
Nginx->>Nginx: Reload configuration
end
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
docker-compose.nginx.yml (1)
33-54: Add restart policy to the renewal sidecar.If
shorcertbotexits unexpectedly, auto-renewal stops until manual intervention. Set a restart policy like the other services.🔧 Proposed diff
certbot-renew: image: certbot/certbot profiles: ["acme"] + restart: ${RESTART_POLICY} depends_on: - nginx🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker-compose.nginx.yml` around lines 33 - 54, The certbot-renew service lacks a Docker restart policy so if sh or certbot exits auto-renewal stops; update the certbot-renew service (look for the certbot-renew block and its entrypoint) to include a restart policy (e.g., restart: unless-stopped or restart: always) matching the other services so the container is automatically restarted on unexpected exits.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docker-compose.nginx.yml`:
- Around line 63-74: The entrypoint script calling certbot certonly is missing
an email parameter and references $HTTP_PORT which isn't set in the service
environment; update the service environment to include HTTP_PORT and an email
variable (e.g., CERTBOT_EMAIL or EMAIL) and modify the certbot invocation in the
entrypoint to pass that email via --email "$CERTBOT_EMAIL" (and keep --agree-tos
--non-interactive). Ensure the environment block contains DOMAIN, HTTP_PORT, and
the chosen email variable so the shell script sees them at container start.
---
Nitpick comments:
In `@docker-compose.nginx.yml`:
- Around line 33-54: The certbot-renew service lacks a Docker restart policy so
if sh or certbot exits auto-renewal stops; update the certbot-renew service
(look for the certbot-renew block and its entrypoint) to include a restart
policy (e.g., restart: unless-stopped or restart: always) matching the other
services so the container is automatically restarted on unexpected exits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 388d7242-a2ff-449d-866b-f397cc82c86d
📒 Files selected for processing (2)
docker-compose.nginx.ymlenv.example
Contributor
Author
|
@coderabbitai approve |
✅ Actions performedComments resolved and changes approved. |
|
This PR has been automatically labelled "stale" because it hasn't had recent activity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds automated Let's Encrypt certificate management using Certbot.
This introduces two optional Docker Compose services:
certbot-init– performs the initial certificate issuance using standalone modecertbot-renew– runs in the background and periodically renews certificatesNginx is reloaded automatically after successful renewal using
kill -HUP 1