mirror of
https://github.com/jupyter/docker-stacks.git
synced 2025-10-11 20:12:58 +00:00
65c5fadbd1
Cannot use custom output path when renewing, so do not use it at all (c) Copyright IBM Corp. 2015
49 lines
1.9 KiB
Makefile
49 lines
1.9 KiB
Makefile
# Copyright (c) Jupyter Development Team.
|
|
# Distributed under the terms of the Modified BSD License.
|
|
|
|
letsencrypt: NAME?=notebook
|
|
letsencrypt: SECRETS_VOLUME?=$(NAME)-secrets
|
|
letsencrypt:
|
|
@test -n "$(FQDN)" || \
|
|
(echo "ERROR: FQDN not defined or blank"; exit 1)
|
|
@test -n "$(EMAIL)" || \
|
|
(echo "ERROR: EMAIL not defined or blank"; exit 1)
|
|
@docker volume create --name $(SECRETS_VOLUME) > /dev/null
|
|
# Specifying an alternative cert path doesn't work with the --duplicate
|
|
# setting which we want to use for renewal.
|
|
@docker run -it --rm -p 80:80 \
|
|
-v $(SECRETS_VOLUME):/etc/letsencrypt \
|
|
quay.io/letsencrypt/letsencrypt:latest \
|
|
certonly \
|
|
--standalone \
|
|
--standalone-supported-challenges http-01 \
|
|
--agree-tos \
|
|
--duplicate \
|
|
--domain '$(FQDN)' \
|
|
--email '$(EMAIL)'
|
|
# The lets encrypt image has an entrypoint so we use the notebook image
|
|
# instead which we know uses tini as the entry and can run arbitrary commands.
|
|
# Here we need to set the permissions so nobody in the proxy container can read
|
|
# the cert and key. Plus we want to symlink the certs into the root of the
|
|
# /etc/letsencrypt directory so that the FQDN doesn't have to be known later.
|
|
@docker run -it --rm \
|
|
-v $(SECRETS_VOLUME):/etc/letsencrypt \
|
|
$(NOTEBOOK_IMAGE) \
|
|
bash -c "ln -s /etc/letsencrypt/live/$(FQDN)/* /etc/letsencrypt/ && \
|
|
find /etc/letsencrypt -type d -exec chmod 755 {} +"
|
|
|
|
letsencrypt-notebook: PORT?=443
|
|
letsencrypt-notebook: NAME?=notebook
|
|
letsencrypt-notebook: WORK_VOLUME?=$(NAME)-data
|
|
letsencrypt-notebook: SECRETS_VOLUME?=$(NAME)-secrets
|
|
letsencrypt-notebook: DOCKER_ARGS:=-e USE_HTTPS=yes \
|
|
-e PASSWORD=$(PASSWORD) \
|
|
-v $(SECRETS_VOLUME):/etc/letsencrypt
|
|
letsencrypt-notebook: ARGS:=\
|
|
--NotebookApp.certfile=/etc/letsencrypt/fullchain.pem \
|
|
--NotebookApp.keyfile=/etc/letsencrypt/privkey.pem
|
|
letsencrypt-notebook: check
|
|
@test -n "$(PASSWORD)" || \
|
|
(echo "ERROR: PASSWORD not defined or blank"; exit 1)
|
|
$(RUN_NOTEBOOK)
|