davide/plm-electrumx
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docker: automatic SSL with a self-signed certificate, reused if present

Browse Source 
docker-entrypoint.sh uses the given SSL_CERTFILE/SSL_KEYFILE, or the
certificate in the electrumx-ssl volume, and generates a self-signed one
(10 years) only when none exists, never overwriting it, as clients pin it.
It also sets SERVICES (tcp 50001 + ssl 50002). SSL is on by default.

Documented in README.md and DEPLOY.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
davideandClaude Sonnet 5.5 committed 2026-10-22 15:23:29 +02:00
1 parent 3e5d005efe
commit c2dcff5cc8
7 files changed
+173 -29
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docker-entrypoint.sh
Executable
+64
View File
@@ -0,0 +1,64 @@
#!/bin/sh
# Entrypoint of the plm-electrumx image: sets up SSL, then runs the server (the command given to the container).
#
# SSL_ENABLED true (default) / false. If true, the server also listens on ssl://:50002.
# SSL_HOSTNAME name (or IP) written in a generated certificate. Default: electrumx.
# SSL_CERTFILE, SSL_KEYFILE
# paths of your own certificate and key (mounted in the container). If unset, the files
# /var/lib/electrumx-ssl/server.crt and server.key are used; they are generated on the first
# start (self-signed, 10 years) and reused on every later start, never overwritten.
# SERVICES if unset: tcp://:50001, plus ssl://:50002 when SSL is enabled. If set, it is left as it is.
set -eu
SSL_DIR=/var/lib/electrumx-ssl
SSL_ENABLED="${SSL_ENABLED:-true}"
SSL_HOSTNAME="${SSL_HOSTNAME:-electrumx}"
log() { echo "entrypoint: $*"; }
case "$SSL_ENABLED" in
true|TRUE|True|1|yes|on)
if [ -n "${SSL_CERTFILE:-}" ] || [ -n "${SSL_KEYFILE:-}" ]; then
if [ -z "${SSL_CERTFILE:-}" ] || [ -z "${SSL_KEYFILE:-}" ]; then
log "ERROR: set both SSL_CERTFILE and SSL_KEYFILE, or neither" >&2; exit 1
fi
if [ ! -r "$SSL_CERTFILE" ] || [ ! -r "$SSL_KEYFILE" ]; then
log "ERROR: cannot read $SSL_CERTFILE / $SSL_KEYFILE (is it mounted, and readable by uid $(id -u)?)" >&2; exit 1
fi
log "using the SSL certificate $SSL_CERTFILE"
else
export SSL_CERTFILE="$SSL_DIR/server.crt"
export SSL_KEYFILE="$SSL_DIR/server.key"
if [ -e "$SSL_CERTFILE" ] && [ -e "$SSL_KEYFILE" ]; then
log "using the existing SSL certificate $SSL_CERTFILE"
elif [ -e "$SSL_CERTFILE" ] || [ -e "$SSL_KEYFILE" ]; then
log "ERROR: only one of $SSL_CERTFILE and $SSL_KEYFILE exists; not overwriting it. Fix or remove it." >&2; exit 1
else
case "$SSL_HOSTNAME" in
*[!0-9.]*) san="DNS:$SSL_HOSTNAME" ;;
*) san="IP:$SSL_HOSTNAME" ;;
esac
log "generating a self-signed SSL certificate for $SSL_HOSTNAME (valid 10 years) in $SSL_DIR"
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
-subj "/CN=$SSL_HOSTNAME" -addext "subjectAltName=$san" \
-keyout "$SSL_KEYFILE" -out "$SSL_CERTFILE" 2>/dev/null
chmod 600 "$SSL_KEYFILE"
fi
fi
log "certificate: $(openssl x509 -in "$SSL_CERTFILE" -noout -subject -enddate | tr '\n' ' ')"
log "$(openssl x509 -in "$SSL_CERTFILE" -noout -fingerprint -sha256)"
if ! openssl x509 -in "$SSL_CERTFILE" -noout -checkend 2592000 >/dev/null; then
log "WARNING: the SSL certificate expires in less than 30 days or is already expired"
fi
export SERVICES="${SERVICES:-tcp://:50001,ssl://:50002}"
;;
*)
# empty values would be read by the server as "set"
unset SSL_CERTFILE SSL_KEYFILE 2>/dev/null || true
export SERVICES="${SERVICES:-tcp://:50001}"
log "SSL disabled"
;;
esac
log "SERVICES=$SERVICES"
exec "$@"