davideandClaude Sonnet 5.5
c2dcff5cc8
docker-entrypoint.sh uses the given SSL_CERTFILE/SSL_KEYFILE, or the certificate in the electrumx-ssl volume, and generates a self-signed one (10 years) only when none exists, never overwriting it, as clients pin it. It also sets SERVICES (tcp 50001 + ssl 50002). SSL is on by default. Documented in README.md and DEPLOY.md. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
65 lines
3.2 KiB
Bash
Executable File
65 lines
3.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# Entrypoint of the plm-electrumx image: sets up SSL, then runs the server (the command given to the container).
|
|
#
|
|
# SSL_ENABLED true (default) / false. If true, the server also listens on ssl://:50002.
|
|
# SSL_HOSTNAME name (or IP) written in a generated certificate. Default: electrumx.
|
|
# SSL_CERTFILE, SSL_KEYFILE
|
|
# paths of your own certificate and key (mounted in the container). If unset, the files
|
|
# /var/lib/electrumx-ssl/server.crt and server.key are used; they are generated on the first
|
|
# start (self-signed, 10 years) and reused on every later start, never overwritten.
|
|
# SERVICES if unset: tcp://:50001, plus ssl://:50002 when SSL is enabled. If set, it is left as it is.
|
|
set -eu
|
|
|
|
SSL_DIR=/var/lib/electrumx-ssl
|
|
SSL_ENABLED="${SSL_ENABLED:-true}"
|
|
SSL_HOSTNAME="${SSL_HOSTNAME:-electrumx}"
|
|
|
|
log() { echo "entrypoint: $*"; }
|
|
|
|
case "$SSL_ENABLED" in
|
|
true|TRUE|True|1|yes|on)
|
|
if [ -n "${SSL_CERTFILE:-}" ] || [ -n "${SSL_KEYFILE:-}" ]; then
|
|
if [ -z "${SSL_CERTFILE:-}" ] || [ -z "${SSL_KEYFILE:-}" ]; then
|
|
log "ERROR: set both SSL_CERTFILE and SSL_KEYFILE, or neither" >&2; exit 1
|
|
fi
|
|
if [ ! -r "$SSL_CERTFILE" ] || [ ! -r "$SSL_KEYFILE" ]; then
|
|
log "ERROR: cannot read $SSL_CERTFILE / $SSL_KEYFILE (is it mounted, and readable by uid $(id -u)?)" >&2; exit 1
|
|
fi
|
|
log "using the SSL certificate $SSL_CERTFILE"
|
|
else
|
|
export SSL_CERTFILE="$SSL_DIR/server.crt"
|
|
export SSL_KEYFILE="$SSL_DIR/server.key"
|
|
if [ -e "$SSL_CERTFILE" ] && [ -e "$SSL_KEYFILE" ]; then
|
|
log "using the existing SSL certificate $SSL_CERTFILE"
|
|
elif [ -e "$SSL_CERTFILE" ] || [ -e "$SSL_KEYFILE" ]; then
|
|
log "ERROR: only one of $SSL_CERTFILE and $SSL_KEYFILE exists; not overwriting it. Fix or remove it." >&2; exit 1
|
|
else
|
|
case "$SSL_HOSTNAME" in
|
|
*[!0-9.]*) san="DNS:$SSL_HOSTNAME" ;;
|
|
*) san="IP:$SSL_HOSTNAME" ;;
|
|
esac
|
|
log "generating a self-signed SSL certificate for $SSL_HOSTNAME (valid 10 years) in $SSL_DIR"
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-subj "/CN=$SSL_HOSTNAME" -addext "subjectAltName=$san" \
|
|
-keyout "$SSL_KEYFILE" -out "$SSL_CERTFILE" 2>/dev/null
|
|
chmod 600 "$SSL_KEYFILE"
|
|
fi
|
|
fi
|
|
log "certificate: $(openssl x509 -in "$SSL_CERTFILE" -noout -subject -enddate | tr '\n' ' ')"
|
|
log "$(openssl x509 -in "$SSL_CERTFILE" -noout -fingerprint -sha256)"
|
|
if ! openssl x509 -in "$SSL_CERTFILE" -noout -checkend 2592000 >/dev/null; then
|
|
log "WARNING: the SSL certificate expires in less than 30 days or is already expired"
|
|
fi
|
|
export SERVICES="${SERVICES:-tcp://:50001,ssl://:50002}"
|
|
;;
|
|
*)
|
|
# empty values would be read by the server as "set"
|
|
unset SSL_CERTFILE SSL_KEYFILE 2>/dev/null || true
|
|
export SERVICES="${SERVICES:-tcp://:50001}"
|
|
log "SSL disabled"
|
|
;;
|
|
esac
|
|
|
|
log "SERVICES=$SERVICES"
|
|
exec "$@"
|