diff --git a/.github/workflows/build_containers_aarch64.yml b/.github/disabled_workflows/build_containers_aarch64.yml similarity index 100% rename from .github/workflows/build_containers_aarch64.yml rename to .github/disabled_workflows/build_containers_aarch64.yml diff --git a/.github/workflows/build_container_template.yml b/.github/workflows/build_container_template.yml index 71d2579..b5c6f45 100644 --- a/.github/workflows/build_container_template.yml +++ b/.github/workflows/build_container_template.yml @@ -100,7 +100,7 @@ jobs: ./build-images.sh $BSH_ARG - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.33.1 + uses: aquasecurity/trivy-action@0.34.0 with: scan-type: 'image' image-ref: '${{ inputs.image_name }}:${{ inputs.type }}-${{ inputs.image_tag }}' diff --git a/core_files/intcmd/applypermissions.sh b/core_files/intcmd/applypermissions.sh index ff3bddf..d2aee77 100644 --- a/core_files/intcmd/applypermissions.sh +++ b/core_files/intcmd/applypermissions.sh @@ -7,7 +7,12 @@ while true; do for path in "${WWWDATA_PATHS[@]}"; do if [[ -d "$path" ]]; then echo "[INFO] Setting permissions for $path to $WWDATA_PERMISSION_CODE" - chmod -R "$WWDATA_PERMISSION_CODE" "$path" + FINAL_PERMCODE="$WWDATA_PERMISSION_CODE" + if [[ "$path" == "/run/php" ]]; then + FINAL_PERMCODE=0777 + echo "[INFO] Special case for $path: setting permissions to $FINAL_PERMCODE" + fi + chmod -R "$FINAL_PERMCODE" "$path" if [[ $? -ne 0 ]]; then echo "[ERROR] Failed to set permissions for $path" else diff --git a/core_files/intcmd/letsencrypt/createLECert.sh b/core_files/intcmd/letsencrypt/createLECert.sh index f390531..8348311 100644 --- a/core_files/intcmd/letsencrypt/createLECert.sh +++ b/core_files/intcmd/letsencrypt/createLECert.sh @@ -17,15 +17,31 @@ if ! checkDir $sslDirPath; then fi WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot" +CLOUDFLARE_USED=false if [ -f "/cloudflare-account.ini" ]; then echo "Using CloudFlare API for DNS" WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini" + unset CLOUDFLARE_USED + CLOUDFLARE_USED=true fi echo "Creating a cert for ${1}" certbot certonly --config-dir $sslDirPath $WEBROOT_OPTS -n --agree-tos --register-unsafely-without-email -d ${1} if [ $? -ne 0 ]; then echo "[Failure] Unable to create certificate '${1}' due to an error" + if [ $CLOUDFLARE_USED = true ]; then + echo "If you are using CloudFlare DNS, make sure your API key and email are correct in /cloudflare-account.ini! Using webroot method!" + unset WEBROOT_OPTS + WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot" + certbot certonly --config-dir $sslDirPath $WEBROOT_OPTS -n --agree-tos --register-unsafely-without-email -d ${1} + if [ $? -ne 0 ]; then + echo "[Failure] Unable to create certificate '${1}' using webroot method as well. Please check your configuration and try again." + exit 1 + else + echo "Certificate created successfully using webroot method. Please check your configuration for CloudFlare DNS and try again if you want to use that method." + exit 0 + fi + fi exit 1 else echo "End of script have a nice day! Enjoy you're new cert if it was created" diff --git a/core_files/intcmd/letsencrypt/renewLEAllCert.sh b/core_files/intcmd/letsencrypt/renewLEAllCert.sh index 384df00..cb92ee8 100644 --- a/core_files/intcmd/letsencrypt/renewLEAllCert.sh +++ b/core_files/intcmd/letsencrypt/renewLEAllCert.sh @@ -9,6 +9,7 @@ checkFile() { certStuffRoot="/web/cert_webroot" sslDirPath="/web/ssl" +sslLiveDirPath="/web/ssl/live" logFile="/scripts/letsencrypt/letsencrypt-renew.log" if ! checkDir $certStuffRoot; then @@ -26,10 +27,39 @@ if ! checkFile $logFile; then touch $logFile fi -WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot" -if [ -f "/cloudflare-account.ini" ]; then - echo "Using CloudFlare API for DNS" - WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini" -fi +function renew() { + local certName="$1" + local WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot" + local CLOUDFLARE_USED=false + if [ -f "/cloudflare-account.ini" ]; then + echo "Using CloudFlare API for DNS" + WEBROOT_OPTS="--dns-cloudflare --dns-cloudflare-credentials /cloudflare-account.ini" + CLOUDFLARE_USED=true + fi + echo "Renewing certificate for $certName" + certbot renew --config-dir $sslDirPath $WEBROOT_OPTS --cert-name "$certName" + if [ $? -ne 0 ]; then + echo "Failed to renew certificate for $certName" + if [ "$CLOUDFLARE_USED" = true ]; then + echo "Please check your CloudFlare API credentials and permissions. Using webroot method as a fallback." + unset WEBROOT_OPTS + WEBROOT_OPTS="--webroot --webroot-path $certStuffRoot" + certbot renew --config-dir $sslDirPath $WEBROOT_OPTS --cert-name "$certName" + if [ $? -ne 0 ]; then + echo "Failed to renew certificate for $certName using webroot method as well." + return 1 + else + echo "Successfully renewed certificate for $certName using webroot method." + return 0 + fi + fi + return 1 + fi +} -certbot renew --config-dir $sslDirPath $WEBROOT_OPTS >> /scripts/letsencrypt/letsencrypt-renew.log \ No newline at end of file +for certPath in "$sslLiveDirPath"/*; do + if [ -d "$certPath" ]; then + certName=$(basename "$certPath") + renew "$certName" + fi +done diff --git a/core_files/intcmd/reloadPHPfpm.sh b/core_files/intcmd/reloadPHPfpm.sh index 5a24dea..edea8be 100644 --- a/core_files/intcmd/reloadPHPfpm.sh +++ b/core_files/intcmd/reloadPHPfpm.sh @@ -21,5 +21,8 @@ function reloadService() { echo "$service_name started successfully." } +chmod 0777 -R /run/php +chown www-data:www-data -R /run/php + reloadService "php7.4-fpm" reloadService "php8.3-fpm" \ No newline at end of file