diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml deleted file mode 100644 index b6d0758..0000000 --- a/.gitea/workflows/container.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Build and Push Docker Image - -on: - push: - branches: [ main ] - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v4 - - - name: Login to Registry - uses: docker/login-action@v2 - with: - registry: ${GITHUB_SERVER_URL} - username: ${{ secrets.REGISTRY_USER }} - password: ${{ secrets.REGISTRY_PASSWORD }} - - - name: Build Docker Image - env: - BRANCH_NAME: ${{ github.ref_name }} - SHORT_HASH: ${{ github.sha }} - run: | - # Build the image with the commit hash tag - docker build --build-arg BUILD_IDENTIFIER=${SHORT_HASH:0:5} -t ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} . - - # Tag the same image as "latest" - docker tag ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-latest - - - name: Push Docker Images - env: - BRANCH_NAME: ${{ github.ref_name }} - SHORT_HASH: ${{ github.sha }} - run: | - docker push ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} - docker push ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-latest - - - name: Log out from registry - if: always() - run: docker logout ${GITHUB_SERVER_URL} - diff --git a/Dockerfile b/Dockerfile index ea8ac0d..561e2bd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,3 @@ -FROM docker.io/library/python:3.11-alpine AS cabuilder -RUN apk add --no-cache ca-certificates -ADD bin/fetch_letsencrypt_ca_certs.py /usr/local/bin/fetch_letsencrypt_ca_certs.py -RUN /usr/local/bin/fetch_letsencrypt_ca_certs.py /usr/local/share/ca-certificates/ -RUN update-ca-certificates - FROM docker.io/library/python:3.11-alpine RUN apk --no-cache add sshpass openssh-client lftp nodejs npm; mkdir -p /opt/app @@ -11,11 +5,9 @@ WORKDIR /opt/app ADD requirements.txt /root/ ADD Dockerfile /root/ ADD bin/*.sh /usr/local/bin/ -COPY --from=cabuilder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # ignore "Running pip as root" warning ENV PIP_ROOT_USER_ACTION=ignore -ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt RUN chmod 755 /usr/local/bin/*.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)" diff --git a/bin/fetch_letsencrypt_ca_certs.py b/bin/fetch_letsencrypt_ca_certs.py deleted file mode 100755 index 85eb8f3..0000000 --- a/bin/fetch_letsencrypt_ca_certs.py +++ /dev/null @@ -1,109 +0,0 @@ -#!/usr/bin/env python3 - -import os -import sys -import requests -from html.parser import HTMLParser -from urllib.parse import urljoin - -LETSENCRYPT_CERT_PAGE = "https://letsencrypt.org/certificates/" -DEFAULT_TARGET_DIR = "./letsencrypt-ca" - - -class PemLinkParser(HTMLParser): - def __init__(self): - super().__init__() - self.pem_links = set() - - def handle_starttag(self, tag, attrs): - if tag.lower() != "a": - return - for attr, value in attrs: - if attr == "href" and value.lower().endswith(".pem"): - self.pem_links.add(value) - - -def fetch_certificate_page(): - resp = requests.get(LETSENCRYPT_CERT_PAGE, timeout=15) - resp.raise_for_status() - return resp.text - - -def extract_pem_links(html): - parser = PemLinkParser() - parser.feed(html) - return sorted( - urljoin(LETSENCRYPT_CERT_PAGE, link) - for link in parser.pem_links - ) - - -def download_and_store(url, target_dir): - base_name = os.path.basename(url) - # Zielname = .crt statt .pem - target_name = os.path.splitext(base_name)[0] + ".crt" - target_path = os.path.join(target_dir, target_name) - - if os.path.exists(target_path): - print(f"[=] Bereits vorhanden: {target_name}") - return target_name - - print(f"[+] Lade herunter: {base_name}") - resp = requests.get(url, timeout=15) - resp.raise_for_status() - - if b"BEGIN CERTIFICATE" not in resp.content: - print(f"[!] Ungültiges Zertifikat: {base_name}") - return None - - # Direkt als .crt speichern (PEM-Inhalt) - with open(target_path, "wb") as f: - f.write(resp.content) - - return target_name - - -def list_local_crt_files(target_dir): - return { - f for f in os.listdir(target_dir) - if f.lower().endswith(".crt") - } - - -def main(): - target_dir = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_TARGET_DIR - os.makedirs(target_dir, exist_ok=True) - - print(f"[*] Zielverzeichnis: {os.path.abspath(target_dir)}") - print("[*] Format: PEM-Inhalt mit .crt-Endung") - - html = fetch_certificate_page() - pem_urls = extract_pem_links(html) - - # Remote-Dateinamen im .crt-Format - remote_files = { - os.path.splitext(os.path.basename(url))[0] + ".crt" - for url in pem_urls - } - - for url in pem_urls: - download_and_store(url, target_dir) - - local_files = list_local_crt_files(target_dir) - orphaned = sorted(local_files - remote_files) - - print("\n" + "=" * 60) - if orphaned: - print("[!] Lokal vorhanden, aber nicht mehr gelistet:") - for f in orphaned: - print(f" - {f}") - else: - print("[✓] Keine veralteten Dateien gefunden") - print("=" * 60) - print("[✓] Fertig.") - - -if __name__ == "__main__": - main() - -