From 346b9b4b79072d4d600ac1119205c03285aff058 Mon Sep 17 00:00:00 2001 From: gabbe Date: Wed, 30 Jun 2021 14:11:58 +0200 Subject: [PATCH 1/9] Added Loopia dns provider --- global/certbot-dns-plugins.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/global/certbot-dns-plugins.js b/global/certbot-dns-plugins.js index 461bb223f..17bb1c9f4 100644 --- a/global/certbot-dns-plugins.js +++ b/global/certbot-dns-plugins.js @@ -304,6 +304,16 @@ dns_linode_version = [|3|4]`, full_plugin_name: 'dns-linode', }, //####################################################// + loopia: { + display_name: 'Loopia', + package_name: 'certbot-dns-loopia', + package_version: '1.0.0', + dependencies: '', + credentials: `dns_loopia_user = user@loopiaapi +dns_loopia_password = abcdef0123456789abcdef01234567abcdef0123`, + full_plugin_name: 'dns-loopia', + }, + //####################################################// luadns: { display_name: 'LuaDNS', package_name: 'certbot-dns-luadns', From 6c1ae77a2a40283c5444c2f7e0a7c8227aeecbd2 Mon Sep 17 00:00:00 2001 From: Amir Zarrinkafsh Date: Fri, 23 Jul 2021 16:24:46 +1000 Subject: [PATCH 2/9] Utilise variable for custom locations proxy_pass If a custom location is currently set to proxy to a DNS hostname this hostname is cached by nginx. When the underlying IP for the hostname changes this will be cached in nginx until it is restarted. This behaviour is somewhat undesirable if utilising containers. This change sets the proxy_pass for custom locations into a variable and utilises said variable for routing to the upstream backend. This will ensure that nginx will utilise the resolver and resolve the hostname to the current IP instead of relying on the nginx cache. --- backend/templates/_location.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/templates/_location.conf b/backend/templates/_location.conf index 5a7a6abeb..7d707009f 100644 --- a/backend/templates/_location.conf +++ b/backend/templates/_location.conf @@ -1,10 +1,11 @@ location {{ path }} { + set $upstream {{ forward_scheme }}://{{ forward_host }}:{{ forward_port }}{{ forward_path }}; proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; - proxy_pass {{ forward_scheme }}://{{ forward_host }}:{{ forward_port }}{{ forward_path }}; + proxy_pass $upstream; {% if access_list_id > 0 %} {% if access_list.items.length > 0 %} From cea80b482ebc5848d7246e7a74f2557384750070 Mon Sep 17 00:00:00 2001 From: chaptergy Date: Wed, 4 Aug 2021 13:47:44 +0200 Subject: [PATCH 3/9] Fixes certificate renewal for dns challenges --- docker/rootfs/etc/letsencrypt.ini | 1 - 1 file changed, 1 deletion(-) diff --git a/docker/rootfs/etc/letsencrypt.ini b/docker/rootfs/etc/letsencrypt.ini index 3565d6e5c..25c375e87 100644 --- a/docker/rootfs/etc/letsencrypt.ini +++ b/docker/rootfs/etc/letsencrypt.ini @@ -1,4 +1,3 @@ text = True non-interactive = True -authenticator = webroot webroot-path = /data/letsencrypt-acme-challenge From d34691152ca5efd93087a343d423fadcd6e06989 Mon Sep 17 00:00:00 2001 From: chaptergy Date: Wed, 4 Aug 2021 13:52:20 +0200 Subject: [PATCH 4/9] Fixes renewal unused http certificates --- backend/templates/default.conf | 2 ++ docker/rootfs/etc/nginx/conf.d/default.conf | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/backend/templates/default.conf b/backend/templates/default.conf index 7eef11f65..5196f2854 100644 --- a/backend/templates/default.conf +++ b/backend/templates/default.conf @@ -16,6 +16,8 @@ server { error_log /data/logs/default-host_error.log warn; {% include "_exploits.conf" %} + include conf.d/include/letsencrypt-acme-challenge.conf; + {%- if value == "404" %} location / { return 404; diff --git a/docker/rootfs/etc/nginx/conf.d/default.conf b/docker/rootfs/etc/nginx/conf.d/default.conf index a76349855..81d6ae488 100644 --- a/docker/rootfs/etc/nginx/conf.d/default.conf +++ b/docker/rootfs/etc/nginx/conf.d/default.conf @@ -9,9 +9,10 @@ server { server_name localhost-nginx-proxy-manager; access_log /data/logs/fallback_access.log standard; - error_log /dev/null crit; + error_log /data/logs/fallback_error.log warn; include conf.d/include/assets.conf; include conf.d/include/block-exploits.conf; + include conf.d/include/letsencrypt-acme-challenge.conf; location / { index index.html; From fb8c0b9a48942a152a2bdb6ae71f5054180679a1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 4 Aug 2021 20:15:26 +0000 Subject: [PATCH 5/9] Bump tar from 4.4.13 to 4.4.15 in /backend Bumps [tar](https://github.com/npm/node-tar) from 4.4.13 to 4.4.15. - [Release notes](https://github.com/npm/node-tar/releases) - [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/npm/node-tar/compare/v4.4.13...v4.4.15) --- updated-dependencies: - dependency-name: tar dependency-type: indirect ... Signed-off-by: dependabot[bot] --- backend/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/yarn.lock b/backend/yarn.lock index 84180c265..71e6676d1 100644 --- a/backend/yarn.lock +++ b/backend/yarn.lock @@ -3351,9 +3351,9 @@ table@^5.2.3: string-width "^3.0.0" tar@^4, tar@^4.4.2: - version "4.4.13" - resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.13.tgz#43b364bc52888d555298637b10d60790254ab525" - integrity sha512-w2VwSrBoHa5BsSyH+KxEqeQBAllHhccyMFVHtGtdMpF4W7IRWfZjFiQceJPChOeTsSDVUpER2T8FA93pr0L+QA== + version "4.4.15" + resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.15.tgz#3caced4f39ebd46ddda4d6203d48493a919697f8" + integrity sha512-ItbufpujXkry7bHH9NpQyTXPbJ72iTlXgkBAYsAjDXk3Ds8t/3NfO5P4xZGy7u+sYuQUbimgzswX4uQIEeNVOA== dependencies: chownr "^1.1.1" fs-minipass "^1.2.5" From 83c5c55f32be3792330ba860c77273a84e247628 Mon Sep 17 00:00:00 2001 From: chaptergy Date: Fri, 6 Aug 2021 10:56:06 +0200 Subject: [PATCH 6/9] Fixes creation of certificates using the http challenge --- backend/internal/certificate.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js index 96972fe19..661950dcb 100644 --- a/backend/internal/certificate.js +++ b/backend/internal/certificate.js @@ -758,6 +758,7 @@ const internalCertificate = { }, /** + * Request a certificate using the http challenge * @param {Object} certificate the certificate row * @returns {Promise} */ @@ -768,6 +769,7 @@ const internalCertificate = { '--config "' + letsencryptConfig + '" ' + '--cert-name "npm-' + certificate.id + '" ' + '--agree-tos ' + + '--authenticator webroot ' + '--email "' + certificate.meta.letsencrypt_email + '" ' + '--preferred-challenges "dns,http" ' + '--domains "' + certificate.domain_names.join(',') + '" ' + From d260edc5473bda39f5cc01cd0eee44ba5a766fff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Aug 2021 03:02:18 +0000 Subject: [PATCH 7/9] Bump tar from 6.0.2 to 6.1.6 in /docs Bumps [tar](https://github.com/npm/node-tar) from 6.0.2 to 6.1.6. - [Release notes](https://github.com/npm/node-tar/releases) - [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/npm/node-tar/compare/v6.0.2...v6.1.6) --- updated-dependencies: - dependency-name: tar dependency-type: indirect ... Signed-off-by: dependabot[bot] --- docs/yarn.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/yarn.lock b/docs/yarn.lock index df7550e63..90394e1ee 100644 --- a/docs/yarn.lock +++ b/docs/yarn.lock @@ -6405,10 +6405,10 @@ minipass@^3.0.0, minipass@^3.1.1: dependencies: yallist "^4.0.0" -minizlib@^2.1.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-2.1.0.tgz#fd52c645301ef09a63a2c209697c294c6ce02cf3" - integrity sha512-EzTZN/fjSvifSX0SlqUERCN39o6T40AMarPbv0MrarSFtIITCBh7bi+dU8nxGFHuqs9jdIAeoYoKuQAAASsPPA== +minizlib@^2.1.1: + version "2.1.2" + resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-2.1.2.tgz#e90d3466ba209b932451508a11ce3d3632145931" + integrity sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg== dependencies: minipass "^3.0.0" yallist "^4.0.0" @@ -9156,14 +9156,14 @@ tapable@^1.0.0, tapable@^1.1.3: integrity sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA== tar@^6.0.2: - version "6.0.2" - resolved "https://registry.yarnpkg.com/tar/-/tar-6.0.2.tgz#5df17813468a6264ff14f766886c622b84ae2f39" - integrity sha512-Glo3jkRtPcvpDlAs/0+hozav78yoXKFr+c4wgw62NNMO3oo4AaJdCo21Uu7lcwr55h39W2XD1LMERc64wtbItg== + version "6.1.6" + resolved "https://registry.yarnpkg.com/tar/-/tar-6.1.6.tgz#c23d797b0a1efe5d479b1490805c5443f3560c5d" + integrity sha512-oaWyu5dQbHaYcyZCTfyPpC+VmI62/OM2RTUYavTk1MDr1cwW5Boi3baeYQKiZbY2uSQJGr+iMOzb/JFxLrft+g== dependencies: chownr "^2.0.0" fs-minipass "^2.0.0" minipass "^3.0.0" - minizlib "^2.1.0" + minizlib "^2.1.1" mkdirp "^1.0.3" yallist "^4.0.0" From b1ceda3af4c4e14f8867443c9e333dc288389992 Mon Sep 17 00:00:00 2001 From: David Dosoudil <69464125+phantomski77@users.noreply.github.com> Date: Wed, 28 Jul 2021 11:25:24 +0100 Subject: [PATCH 8/9] Update letsencrypt.ini to support ECDSA keys Since we have newer certbot available, it's time to support more modern and safer ECDSA keys instead of RSA. --- docker/rootfs/etc/letsencrypt.ini | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docker/rootfs/etc/letsencrypt.ini b/docker/rootfs/etc/letsencrypt.ini index 25c375e87..ccb2f0b31 100644 --- a/docker/rootfs/etc/letsencrypt.ini +++ b/docker/rootfs/etc/letsencrypt.ini @@ -1,3 +1,5 @@ text = True non-interactive = True webroot-path = /data/letsencrypt-acme-challenge +key-type = ecdsa +elliptic-curve = secp384r1 From f6efcdf9f97dcfc89a0d825fd22146d16ea2085c Mon Sep 17 00:00:00 2001 From: Jamie Curnow Date: Sat, 7 Aug 2021 20:05:35 +1000 Subject: [PATCH 9/9] Bumped version --- .version | 2 +- README.md | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.version b/.version index 23ae1b5dc..102011854 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -2.9.6 +2.9.7 diff --git a/README.md b/README.md index dd8a6c7f9..92e59f7a7 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@



- + @@ -458,6 +458,18 @@ Special thanks to the following contributors:
Fuechslein + + + +
Amir Zarrinkafsh + + + + + +
gabbe + +