Package: certdeploy
certdeployA tool to automatically sync certificates and update services.This tool has two parts:The "server". Which is implemented as a deploy hook for certbot and a docker container that bundles the deploy hook with certbot.The "client". Which when run as a script moves certs from a staging directory to another directory, updates services after it moves the certs and can be run via cron or systemd timer and the "client" daemon which also runs an SFTP server that the CertDepoly server can connect to directly.This tool can be used in a few different ways:As a set of docker containers automatically renewing and distributing certs then updating docker services and restarting docker containers via the Docker API.As scripts embeded in regular linux systems.As a mix of both.The ServerThere are three parts to the server.The certbot hook, which is run by Certbot as a deploy hook. This queues updates to be pushed to clients.The command, which can be used to push certs to clients directly or try to renew certs immediately. This is useful for testing setups.The daemon, which runscertbot renewon an interval (and indirectlycertdeploy-serveras a hook when certs are renewed). It also processes the push queue. This is optional, but is the default in the server docker container.Commandline Options for the command/daemon--config- The path to the config file. Defaults to/etc/certdeploy/server.yml.--daemon- Run the daemon. Without this option the server command will run once and exit.--domains- A space separated list of domains as a single string (eg"www.example.com example.com"). This is mutually exclusive with--daemon.--lineage- The path of a lineage (eg/etc/letsencrypt/live/example.com). This is mutually exclusive with--daemon.--log-filename- Set the log file location. Defaults to theconfiguredlog_filename.--log-level- Set the log level toDEBUG,INFO,WARNING,ERROR, orCRITICAL. Defaults to theconfiguredlog_level.--push- Run the daemon only until the queue is empty and all pushes have been processed. When used with--lineageand--domainsit populates the queue and then runs the daemon until the push is complete.--renew- Run the cert renewal part of the daemon once and exit.--sftp-log-filename- Set the SFTP client log file location. Defaults to theconfiguredsftp_log_filename.--sftp-log-level- Set the SFTP client log level toDEBUG,INFO,WARNING,ERROR, orCRITICAL. Defaults to theconfiguredsftp_log_level.ExamplesTo run these in the running docker container prefix the commands withdocker container exec <container name>.Run the daemon with a custom config file location and log level.certdeploy-server--daemon--config/path/to/server.yml--log-levelINFORun the command to force deploying certs. Where/etc/letsencrypt/live/is the path to the lineages. Certbot puts it there by default. The server script can only handle one lineage at a time.certdeploy-server--push--lineage/etc/letsencrypt/live/example.com--domains"www.example.com example.com"Run the command to try to renew certs. This will not cause the certs to be pushed to clients unless the daemon is running or is run after the CertDeploy deploy hook is run.certdeploy-server--renewRun the command to push an existing push queue, but without adding to the queue.certdeploy-server--pushEnviroment VariablesCommandline options override environment variables.CERTDEPLOY_SERVER_CONFIG- The path to the server config file. Equivalent to--config.CERTDEPLOY_SERVER_DAEMON- If set totrueit is the equivalent of--daemon.CERTDEPLOY_SERVER_LOG_FILENAME- The path to the server log file. Equivalent to--log-filename.CERTDEPLOY_SERVER_LOG_LEVEL- The log level. Equivalent to--log-level.CERTDEPLOY_SERVER_RENEW_ONLY- If set totrueit is the equivalent of--renew.CERTDEPOLY_SERVER_PUSH_ONLY- If set totrueit is the equivalent of--push. This overridesCERTDEPLOY_SERVER_DAEMONand--daemonso that the docker container respects this environment variable.CERTDEPOLY_SERVER_SFTP_LOG_FILENAME- The log path for the SFTP client. Equivalent to--sftp-log-filename.CERTDEPOLY_SERVER_SFTP_LOG_LEVEL- The log level of the SFTP client. Equivalent to--sftp-log-level.Hook Environment VariablesThe hook (certdeploy-serverwhen it's run by Certbot) expects the following environmental variables from Certbot in addition to the optionalCERTDEPLOY_SERVER_CONFIGandCERTDEPLOY_SERVER_LOG_LEVELas described above.RENEWED_LINEAGE- The "lineage" or path to the renewed certs.RENEWED_DOMAINS- A space separated list of domains associated to the renewed certs.ConfigurationServer Settingsprivkey_filename- The path to the CertDeploy server private key file.client_configs(optional) - A list ofclient connection settings.client_config_directory(optional) - A directory containing files with one set ofclient connection settings.fail_fast(optional) - Stop on the first failed action. Defaults tofalse.log_level(optional) - The logging level. Options areDEBUG,INFO,WARNING,ERROR,CRITICAL. Defaults toERROR.log_filename(optional) - The path to the log file. Defaults to the default global log file (/dev/stdout).sftp_log_level(optional) - The SFTP client logging level. Options areDEBUG,INFO,WARNING,ERROR,CRITICAL. Defaults toERROR.sftp_log_filename(optional) - The path to the SFTP client log file. Defaults to the default global log file (/dev/stdout).The following are daemon specific configs.renew_every(optional) - The interval count to multiplyrenew_unitby. This must be a positive integer. The default is1.renew_unit(optional) - The interval unit to check for new certs. This can beminute,day,week, or a weekday. Defaults today.renew_at(optional) - The time of day to check for new certs. FormattedHH:MM. Defaults tonullwhich is equivalent to the current time.renew_exec(optional) - The path of thecertbotexecutable. If for some reasoncertbotisn't in the$PATHthis lets the full path be given. This is also useful for testing. A script that touches a flag file or does a web request when run can be mounted in the container and the path given with this option. That way settings can be tested without spammingLet's Encrypt.renew_args(optional) - A list of arguments to pass tocertbotwhen attempting to renew certs. Defaults to['renew'].push_mode(optional) - The mode used to push certs to clients. This must beserialorparallel. Defaults toserial.push_interval(optional) - The number of seconds to wait between pushing to clients. This must be a positive integer or0.0disables the delay. Defaults to0.push_retries(optional) - The number of times to retry pushing certs to clients. This must be a positive integer or0.0disables retries. Defaults to1(one initial attempt and one retry). This can be overridden by the same setting inclient connection configs.push_retry_interval(optional) - The delay in seconds between retrying to push certs to clients. This must be an positive integer or0.0disables the delay between retries. Defaults to30. This can be overridden by the same setting inclient connection configs.join_timeout(optional) - The number of seconds to wait while joining push threads. This must be a positive number ornull.nulldisables the timeout. Defaults tonull. Set this to help identify the cause of hung pushes.queue_dir(optional) - The directory where the queue and the lock file will be stored. Defaults to/var/run/certdeploy.Scheduling ExamplesThe default behavior is to try to renew once a day which is equivalent to the following.renew_every:1renew_unit:dayrenew_at:nullTo try to renew certs every other day at 3pm use the following.renew_every:2# ``day`` is the default for `renew_unit` so this can be left out if you want.renew_unit:dayrenew_at:15:00To try to renew certs every Monday and you don't care about the time use the following.renew_unit:mondayPush Retry ExamplesWait 30 seconds between initial attempts to push to clients.push_interval:30Retry pushing to clients after an hour (3600seconds).push_retry_interval:3600Retry pushing to clients after an hour and retry every hour twelve times.push_retry_interval:3600push_retries:12Client Connection Settingsaddress- The client address (IP address or hostname).domains- A list of domains that this client needs certs for.pubkey- The text of the client's public key. If the client is a regular SSH server remember to grab the SSH server's pubkey not the user's pubkey.port(optional) - The remote port of either an ssh server on the client or the CertDeploy client. Defaults to22.username(optional) - The remote username to login to the ssh server or CertDeploy client with. Defaults tocertdeploy.path(optional) - The directory on the remote system where the CertDeploy client will look for new certs. Defaults to/var/cache/certdeploy. If set tonullor an empty string the base path for the client will be used. This will be the configuredsourcepath on the client daemon or the home directory if the client is relying on the host system for SFTP.  This directory should only be readable by the CertDeploy user on the client since it will have TLS certs hanging around.needs_chain(optional) - If this istruethechain.pemfrom the relevant lineages will be copied to this client. Defaults tofalse.needs_fullchain(optional) - If this istruethefullchain.pemfrom the relevant lineages will be copied to this client. Defaults totrue.needs_privkey(optional) - If this istruetheprivkey.pemfrom the relevant lineages will be copied to this client. Defaults totrue.push_retries(optional) - The number of times to retry connecting to this client. This must be a positive integer or0if set. If set, it overrides the server'spush_retriesvalue for this client.0will cause the server to only try to push once (no retries). Defaults tonull.push_retry_interval(optional) - The interval in seconds to wait between retries for this client. This must be a positive integer or0if set. If set, it overrides the server'spush_retry_intervalvalue for this client. Defaults tonull.Client Connection ExamplesOverride the push retries and retry interval for just one client.client_configs:-address:1.2.3.4pubkey:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+H3Nk/9uSa7LHNt8fvCPKKkNFnVE5SGC5tnthf6/OKdomains:-example.compush_retries:42push_retry_interval:3600-address:5.6.7.8pubkey:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuhX3Q690lnBhpfGHOs0j4CuCxE3E3jekWehvHRmVKtdomains:-example.netA file inclient_config_directory.address:1.2.3.4pubkey:ssh-ed25519 aaaac3nzac1lzdi1nte5aaaaip+h3nk/9usa7lhnt8fvcpkkknfnve5sgc5tnthf6/okdomains:-example.comExamplesSimpleA single client and private key. This will work in any of the server modes.---privkey_filename:/etc/certdeploy/server_keyclient_configs:-address:1.2.3.4pubkey:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+H3Nk/9uSa7LHNt8fvCPKKkNFnVE5SGC5tnthf6/OKdomains:-example.comDaemonThis can be given tocertdeploy-serveralong with the--daemonoption or as part of thedocker imageto runcertbot renewevery Monday at 9:00AM and deploy new certs forexample.comto1.2.3.4.---privkey_filename:/etc/certdeploy/server_keyrenew_every:mondayrenew_at:09:00client_configs:-address:1.2.3.4pubkey:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+H3Nk/9uSa7LHNt8fvCPKKkNFnVE5SGC5tnthf6/OKdomains:-example.comServer Security ConsiderationsWhen run as a script (--renew) or daemon outside of docker it's expected that the CertDeploy server will run as root or a user that has permission to runcertbot renew. Because it can run arbitrary code (via therenew_execandrenew_argsconfigs) and distributes your TLS certs, it is very strongly recommended that the config file is globally read only or readable only by the user running the server, and writable only by root or at most only by the user that runs the server. Similarly (but less so) the push queue can be used to force the server to push certs or files that are where the given lineage should be. Putting the queue file in a place where other users can get to it doesn't directly create a security hole but it can be combined with other potential problems to distribute or exfiltrate data.InstallationThe recommended way to use the server is to have it running in a docker container. Theserver imagehas Certbot baked in and automatically runscertbot renewon a schedule.DockerCreate a directory to put the configs in and enter it. For examplemkdir conf && cd conf.Generate server key pairssh-keygen -t ed25519 -f server_keyDon't enter a password. CertDeploy doesn't support password files.Create aserver.ymlwith the clients. For now we'll assume you have the public key for the first client.---private_key_file:/etc/certdeploy/server_keyclient_configs:-address:<your client ip or hostname>pubkey:<your client's public key without the comment>domains:-<the domain name that this client needs certs for>check_renew:every:weekInstall the docker container.dockerrun-d-v$(pwd)/conf:/etc/certdeploy-v/etc/letsencrypt:/etc/letsencrypthaxwithaxe/certdeploy-serverWhere./confis a directory with aserver.ymland an ED25519 key pair. If you don't see anything in the logs it's probably working fine. The default log level isn't verbose. You can add--env 'CERTDEPLOY_SERVER_LOG_LEVEL=DEBUG'to get the firehose of output if you want to be certian it's working.Or with docker-compose with the following:---version:"3"services:certdeploy-server:image:haxwithaxe/certdeploy-servervolumes:-"./conf:/etc/certdeploy"-"/etc/letsencrypt:/etc/letsencrypt"Install In An Existing SystemCreate a directory to put the configs in and enter it. For examplesudo mkdir /etc/certdeploy && cd /etc/certdeploy.Generate server key pairsudo ssh-keygen -t ed25519 -f server_keyDon't enter a password. CertDeploy doesn't support password files.Create aserver.ymlwith the clients. For now we'll assume you have the public key for the first client.---private_key_file:/etc/certdeploy/server_keyclient_configs:-address:<your client ip or hostname>pubkey:<your client's public key without the comment>domains:-<the domain name that this client needs certs for>check_renew:every:weekInstall CertDeploysudo pip install certdeploy.Install the CertDeploy CertBot hook.sudoln-s/usr/local/bin/certdeploy-server/etc/letsencrypt/renewal-hooks/deploy/certdeploy-hookThe ClientCommandline Options--config- The path to the config file. Defaults to/etc/certdeploy/client.yml.--daemon- Run the daemon. Without this option the sync and update actions will run once and quit.--log-filename- Set the log file location. Defaults to theconfiguredlog_filename.--log-level- Set the log level toDEBUG,INFO,WARNING,ERROR, orCRITICAL. Defaults to theconfiguredlog_level.--sftp-log-filename- Set the SFTP server log file location. Defaults to theconfigured(SFTP)log_filename.--sftp-log-level- Set the SFTP server log level toDEBUG,INFO,WARNING,ERROR, orCRITICAL. Defaults to theconfigured(SFTP)log_level.Environment VariablesCommandline options override environment variables.CERTDEPLOY_CLIENT_CONFIG- The path to the client config file. Equivalent to--config.CERTDEPLOY_CLIENT_DAEMON- If set totrueit is the equivalent of--daemon.CERTDEPLOY_CLIENT_LOG_FILENAME- The path to the client log file. Equivalent to--log-filename.CERTDEPLOY_CLIENT_LOG_LEVEL- The client log level. Equivalent to--log-level.CERTDEPOLY_CLIENT_SFTP_LOG_FILENAME- The log path for the SFTP server. Equivalent to--sftp-log-filename.CERTDEPOLY_CLIENT_SFTP_LOG_LEVEL- The log level of the SFTP server. Equivalent to--sftp-log-level.ConfigurationGenerate Client Key Pairssh-keygen -t ed25519 -f client_keyDon't enter a password. CertDeploy doesn't support password files.Client Settingsdestination- The path to dump the certs in. The certs will be placed in "lineage" directories within this directory as seen in/etc/letsencrypt/livein a certbot installation.update_sevices- A list of definitions of services to reload/restart/run after deploying the certs. SeeService Definitions.source(optional) - The directory the server uploads the certs to. Defaults to/var/cache/certdeploy.sftpd(optional) - The SFTP server settings. SeeDaemon Specific Settings.systemd_exec(optional) - The path to thesystemctlexecutable for restarting/reloading Systemd units.systemd_timeout(optional) - The timeout in seconds for executing systemctl commands. Defaults tonull(wait indefinitely).docker_url(optional) - The URL to the Docker API. Defaults to the local socket location.log_level(optional) - The logging level. Options areDEBUG,INFO,WARNING,ERROR,CRITICAL. Defaults toERROR.log_filename(optional) - The path to the log file. Defaults to the default global log file (/dev/stdout).file_permissions(optional) - The permissions to set the cert files and lineage directories to indestination. By default the permissions are not actively set by the client. The CertDeploy server (SFTP client) sets the permissions with the attributes of the files from the lineage directory when it transfers them and the client moves the files that were transfered without altering the permissions. SeeFile PermissionsThis is an example of a hyper simple cron job or Systemd timer run client config that just moves the certs and doesn't restart any services. It just moves certificates from the defaultsourcetodestination.destination:/etc/letsencrypt/liveIn a case like this the certs are delivered via whatever ssh server is running on the client host and thecertdeploy-clientscript is run as a user with permission to write to the destination directory (probably root). See thethissection for more info and security considerations.Service DefinitionsEach definition has atypekey and one or more other keys. They are run in the order they are written in the config.Docker swarm services have atypeofdocker_serviceand can have anamekey with a string value or afilterskey with a dictionary of filters. SeeDocker Services and Containers.Docker containers have atypeofdocker_containerand can have anamekey with a string value or afilterskey with a dictionary of filters. SeeDocker Services and Containers.Systemd units  have atypeofdocker_service, anamekey with the unit name, and optionally anactionkey that can be eitherrestartorreload. Thenameis the full unit names (with the unit type extension egnginx.service). The value ofactioncorresponds to the systemctl arguments. SeeSystemd Units.Arbitrary scripts have thetypescriptand anamekey with the path of the script to execute. SeeScripts.Service settingsDocker Services and ContainersThe two config fields for each docker service or container arenameandfilters. Eithernameorfilterscan be given.update_services:-type:docker_containername:ingress_nginx-type:docker_servicefilters:label:-restart_on_cert_update-type:docker_containername:web_nginx_1-type:docker_containerfilters:name:web_traefik_1The first of the example definitions is equivalent to the following:update_container:-type:docker_containerfilters:name:"^ingress_nginx$"For docker containers the name is automatically converted into a filter for the exact match if no filters are given.Due to thebugdocker services the name is used to get the container directly whetherfiltersare set or not.WARNINGDue to adocker bugfilters for dockerservicesdon't work as expected at release time. Any regex will cause a failure to match. Plain old substring matching works fine sofilters: { label: [ foo ] }will still match services with 'foo' in the keys any of their labels butfilters: { label: [ ^foo ] }orfilters: { label: [ foo.* ] }will not match any services even if there are services that match those criteria.ScriptsThe only option for scripts isnamewhich is the path to the script.namecan be an absolute path, an executable in the system's$PATH, or relative path (complicated). The path is evaluated in that order.
The relative path is relative to the current working directory which is different depending on how the client is being run.update_services:-type:scriptname:script_in_path.sh-type:scriptname:/path/to/script.shSystemd UnitsThe two config fields for each Systemd service arenameandaction.actioncan berestartorreloadwhich correspond to thesystemctl restart ...andsystemctl reload ...commands. The defaultactionisrestart.update_services:-type:systemdname:nginx_or_whatever.service-type:systemdname:apache_or_whatever.serviceaction:reloadFile PermissionsThese are the permissions to set the cert files and lineage directories to in thedestinationdirectory. All options are optional. Any combination of options is valid.mode(optional) - The file mode in an octal string or as a base10 integer. A safe value is0o600(only the owner can read or write the certificates) For example the following are valid and equivalent:'0o600'- A string with an octal prefix.'0600'- A plain octal string. The sticky bit is not used but if it's given and is0it's ignored.384- As a base10 integer.directory_mode(optional) - The mode for the lineage directory. Same criteria asmode, just don't forget to set the execute bit for the relevant parts. A safe value is0o700(only the owner is allowed to read write and enumerate the directory).owner(optional) - The owner's UID or username. This defaults to the user the client is run as.group(optional) - The group's GID or group name. This defaults to the primary group user the client is run as or the GID set for the process when running the client.By default the permissions are not actively set by the client. The CertDeploy server (SFTP client) sets the permissions with the attributes of the files from the lineage directory when it transfers them and the client moves the files that were transferred without altering the permissions.ExampleThis example sets the permissions of the lineage directory and certs to the defaults assuming the certs originated from the certbot managed letsencrypt directory and the CertDeploy client is running as root....file_permissions:mode:0o600directory_mode:0o700owner:rootgroup:root...File Permissions Security ConsiderationsNothing more than the usual precautions for letsencrypt certs.Avoid setting the rightmost bit to anything but0. These permissions are for files that shouldn't be accessible to anyone that doesn't absolutely need to read them.Avoid setting the owner or group tonobody(UID65534) as it's often oversubscribed by other services. If you need to set user or group to something other thanroottry to use a UID and GID that aren't used by other processes on the system and add the users that need access to the certs to the unique group.Daemon Specific SettingsThesftpdsection contains the settings for the SFTP server that accepts incoming certs from the CertDeploy server.privkey_filename- The path to the CertDeploy client (SFTP server) private key file.server_pubkey- The text of the remote CertDeploy server (SFTP client) public key. This is optional ifserver_pubkey_filenameis given and is overridden byserver_pubkey_filename.server_pubkey_filename- The path to the remote CertDeploy server (SFTP client) public key file. This is optional ifserver_pubkeyis given.listen_port(optional) - The port the CertDeploy client (SFTP server) listens on. Defaults to22.listen_address(optional) - The address the CertDeploy client (SFTP server) listens on. Defaults to listening on all interfaces (literally''but equivalent to0.0.0.0).username(optional) - The username to require the CertDeploy server to login with. Defaults tocertdeploy.log_level(optional) - The SFTP server log level. The options areDEBUG,INFO,WARNING,ERROR,CRITICAL. Defaults toERROR.log_filename(optional) - The log file for the SFTP server. Defaults to the global default (/dev/stdout).Example snippet:sftpd:listen_port:33774privkey_filename:/etc/certdeploy/client_keyserver_pubkey_filename:/etc/certdeploy/server_key.pubFull Client Config ExampleThis config accepts new certs via SFTP into the default source directory. Moves them to the given destination directory. Then updates services. It restarts the nginx systemd service. It runs two scripts. It restarts a docker container. It force-updates docker swarm services based on two sets of filters. Logs CertDeploy logs atDEBUGlevel to/dev/stdoutand SFTP logs to/dev/stderratCITICALlevel. It also sets the mode of the lineage directories to0o700and certs toOo600all owned by root when the certs are deployed to thedestinationdirectory.
The updates aren't guaranteed to be in any given order for now. The plan is to make the order something users set.---destination:/etc/letsencrypt/liveupdate_services:-type:systemdname:nginx.service-type:scriptname:touch-flag-file.sh-type:scriptname:poke-the-custom-server.sh-type:docker_containername:internal_traefik_1-type:docker_servicefilters:label:-restart_on_cert_updatelog_filename:/dev/stdoutlog_level:DEBUGfile_permissions:mode:0o600directory_mode:0o700owner:rootgroup:rootsftpd:listen_port:33774privkey_filename:/etc/certdeploy/client_keyserver_pubkey_filename:/etc/certdeploy/server_key.publog_filename:/dev/stderrlog_level:CRITICALClient Security ConsiderationsWhen run as a script or daemon outside of docker it's expected that the CertDeploy client will run as root or a user that has permission to manage system services and docker. Because it can run arbitrary code (via thescriptservice definitions) it is very strongly recommended that the config file and the update scripts are globally read only or readable only by the user that runs the client, and writable only by root or at most only the user that runs the client. See alsoFile Permissions.InstallationCron JobCreate a config directorymkdir /etc/certdeploy.Create a config in/etc/certdeploy/client.yml.---source:/var/cache/certdeploydestination:/etc/letsencrypt/liveupdate_services:<put your service definitions here>Ensure yoursourcedirectory exists, is owned by the user the client is running as, and that only that user can read the contents of that directory.Ensure thedestinationdirectory exists and is writable by the user the client is running as.Add a cron entry that runs thecertdeploy-clientat whatever frequency you want.@daily                   /usr/bin/certdeploy-clientDaemonCreate a config directorymkdir /etc/certdeploy.Generate a client key pairssh-keygen -t ed25519 -f /etc/certdeploy/client_key. Don't enter a password. CertDeploy doesn't support password files.Create a config in/etc/certdeploy/client.yml.---source:/var/cache/certdeploydestination:/etc/letsencrypt/liveupdate_services:<put your service definitions here>sftpd:listen_port:33774privkey_filename:/etc/certdeploy/client_keyserver_pubkey_filename:/etc/certdeploy/server_key.pubEnsure yoursourcedirectory exists, is owned by the user the client is running as, and that only that user can read the contents of that directory.Ensure thedestinationdirectory exists and is writable by the user the client is running as.Start the daemon.certdeploy-client--daemonSystemd DaemonTo run the client as a daemon with systemd the following example unit can be used./usr/local/lib/systemd/system/certdeploy-client.service[Unit]Description=Certdeploy Client DaemonAfter=network.target[Service]Type=execExecStart=/usr/local/bin/certdeploy-client --daemon[Install]WantedBy=multi-user.targetThe instructions above for configuring the daemon apply here. Except for theStart the daemonstep which should be replaced with the following commands.systemctlenablecertdeploy-client.service
systemctlstartcertdeploy-client.serviceSystemd TimerIf only syncronization between directories is needed these two systemd units can be used to run the client as a script every hour./usr/local/lib/systemd/system/certdeploy-client.service[Unit]Description=Certdeploy ClientAfter=network.target[Service]Type=oneshotExecStart=/usr/local/bin/certdeploy-client/usr/local/lib/systemd/system/certdeploy-client.timer[Unit]Description=CertDeploy Client Timer[Timer]OnUnitActiveSec=1hUnit=certdeploy-client.service[Install]WantedBy=timers.targetThe instructions in theCron Jobsection above can be followed until theAdd a cron entry ...step which should be replaced with the following.systemctlenablecertdeploy-client.timerDockerCreate a config directorymkdir conf.Generate a client key pairssh-keygen -t ed25519 -f conf/client_key. Don't enter a password. CertDeploy doesn't support password files.Create a config inconf/client.yml.---source:/certdeploy/stagingdestination:/certdeploy/certsupdate_delay:10mupdate_services:<put your service definitions here>sftpd:listen_port:33774privkey_filename:/etc/certdeploy/client_keyserver_pubkey_filename:/etc/certdeploy/server_key.pubStart the daemon.dockerrun-d-v$(pwd)/conf:/etc/certdeploy-vshared_certs:/certdeploy/certshaxwithaxe/certdeploy-clientWhereshared_certsis a docker volume shared with other containers that need access to the certs.Or with docker-compose using this:---version:"3"services:certdeploy-client:image:haxwithaxe/certdeploy-clientvolumes:-"./conf:/etc/certdeploy"-"shared_certs:/certdeploy/certs"NoteThis project has been set up using PyScaffold 4.3. For details and usage
information on PyScaffold seehttps://pyscaffold.org/.