ssl #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ssl | |
| on: | |
| schedule: | |
| - cron: 0 8 1 * * | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| jobs: | |
| ssl: | |
| timeout-minutes: 60 | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| domain: | |
| # domain that has a 127.0.0.1 A record | |
| - local.jmw.nz | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: cloudflare | |
| run: | | |
| mkdir -p ssl | |
| echo "dns_cloudflare_api_token = $CLOUDFLARE_API_TOKEN" > ssl/cloudflare.ini | |
| - name: certbot | |
| working-directory: ssl | |
| run: | | |
| docker run --rm \ | |
| -v $PWD/cloudflare.ini:/cloudflare.ini \ | |
| -v $PWD/letsencrypt:/etc/letsencrypt \ | |
| certbot/dns-cloudflare certonly \ | |
| --non-interactive \ | |
| --domains ${{ matrix.domain }} \ | |
| --dns-cloudflare \ | |
| --dns-cloudflare-credentials /cloudflare.ini \ | |
| --dns-cloudflare-propagation-seconds 60 \ | |
| --agree-tos \ | |
| --preferred-challenges dns \ | |
| -m contact@jmw.nz | |
| - name: chown | |
| working-directory: ssl | |
| # whoami - uid=1001 gid=121, user: runner, group: docker | |
| run: sudo chown -R 1001:121 letsencrypt | |
| - name: package | |
| working-directory: ssl | |
| run: | | |
| mkdir ${{ matrix.domain }} | |
| cp letsencrypt/archive/${{ matrix.domain }}/fullchain1.pem ${{ matrix.domain }}/${{ matrix.domain }}.crt | |
| cp letsencrypt/archive/${{ matrix.domain }}/privkey1.pem ${{ matrix.domain }}/${{ matrix.domain }}.key | |
| # Create PFX for .NET (no password for easier loading) | |
| openssl pkcs12 -export -out ${{ matrix.domain }}/${{ matrix.domain }}.pfx \ | |
| -inkey letsencrypt/archive/${{ matrix.domain }}/privkey1.pem \ | |
| -in letsencrypt/archive/${{ matrix.domain }}/fullchain1.pem \ | |
| -passout pass: | |
| # Password-protected zip to prevent CA from scanning and revoking | |
| zip -P password -r ${{ matrix.domain }}.zip ${{ matrix.domain }} | |
| - name: commit to orphan branch | |
| run: | | |
| # Configure git | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| # Create orphan branch or reset it | |
| git checkout --orphan certs-temp | |
| git rm -rf . | |
| # Add only the zip file | |
| cp ssl/${{ matrix.domain }}.zip . | |
| git add ${{ matrix.domain }}.zip | |
| git commit -m "Update SSL certificates $(date -u +%Y-%m-%d)" | |
| # Force push to certs branch | |
| git push origin certs-temp:certs --force | |
| # Only upload the password-protected zip as artifact | |
| - name: artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.domain }} | |
| path: ssl/${{ matrix.domain }}.zip |