Small updates based on PR feedback

Author: tashian

README.md

@@ -73,6 +73,14 @@ The architectures supported by this image are:
 * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
 * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
 
+### Using A Private ACME Server
+
+If you are getting certificates from a private ACME server instead of Let's Encrypt or ZeroSSL, you will need to configure your ACME server URL and CA trust.
+
+* Set `CERTPROVIDER` to `custom`
+* Set `ACMEURL` to the URL of your ACME server
+* Set `ACMECABUNDLE` to a base64-wrapped PEM file containing your trusted root CA certificate bundle. (Yes, this ends up being double-encoded.)
+
 ### Security and password protection
 
 * The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.

readme-vars.yml

@@ -50,10 +50,8 @@ cap_add_param_vars:
 opt_param_usage_include_env: true
 opt_param_env_vars:
   - { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
-  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Set to `custom` to use a custom ACME server. Defaults to Let's Encrypt unless `ACMESERVER` is set. " }
+  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define a cert provider other than Let's Encrypt. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Set to `custom` to use a custom ACME server. If using `custom`, you must also set `ACMEURL` (the URL of the ACME server to use) and `ACMECABUNDLE` (a base64-encoded PEM file containing a root CA bundle to trust). Defaults to Let's Encrypt." }
   - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`,`aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
-  - { env_var: "ACMESERVER", env_value: "", desc: "The URL of a custom ACME server to use." }
-  - { env_var: "ACMECABUNDLE", env_value: "", desc: "A base64-encoded PEM file containing a CA bundle to trust, for use with an internal ACME CA. Required for a custom ACME CA." }
   - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
   - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
   - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }

root/etc/cont-init.d/50-certbot

@@ -11,7 +11,7 @@ EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
 ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
 VALIDATION=${VALIDATION}\\n\
 CERTPROVIDER=${CERTPROVIDER}\\n\
-ACMESERVER=${ACMESERVER}\\n\
+ACMEURL=${ACMEURL}\\n\
 ACMECABUNDLE=${ACMECABUNDLE}\\n\
 DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
@@ -41,7 +41,7 @@ if [ -f "/config/donoteditthisfile.conf" ]; then
     mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
 fi
 if [ ! -f "/config/.donoteditthisfile.conf" ]; then
-    echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGACMESERVER=\"$ACMESERVER\" ORIGACMECABUNDLE=\"$ACMECABUNDLE\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
+    echo -e "ORIGURL=\"$URL\" ORIGSUBDOMAINS=\"$SUBDOMAINS\" ORIGONLY_SUBDOMAINS=\"$ONLY_SUBDOMAINS\" ORIGEXTRA_DOMAINS=\"$EXTRA_DOMAINS\" ORIGVALIDATION=\"$VALIDATION\" ORIGDNSPLUGIN=\"$DNSPLUGIN\" ORIGPROPAGATION=\"$PROPAGATION\" ORIGSTAGING=\"$STAGING\" ORIGDUCKDNSTOKEN=\"$DUCKDNSTOKEN\" ORIGCERTPROVIDER=\"$CERTPROVIDER\" ORIGACMEURL=\"$ACMEURL\" ORIGACMECABUNDLE=\"$ACMECABUNDLE\" ORIGEMAIL=\"$EMAIL\"" > /config/.donoteditthisfile.conf
     echo "Created .donoteditthisfile.conf"
 fi
 
@@ -56,12 +56,13 @@ if [ -z "$VALIDATION" ]; then
 fi
 
 # Choose the relevant CA server
-if [ -n "$ACMESERVER" ]; then
+if [ -n "$ACMEURL" ]; then
 	if [ -z "$EMAIL" ]; then
-		echo 'A custom $ACMESERVER URL requires an account $EMAIL to be supplied'
+		echo 'A custom $ACMEURL requires an account $EMAIL to be supplied'
 		sleep infinity
 	fi
-	echo "Using $ACMESERVER as the cert provider; registering cert with $EMAIL"
+	echo "Using $ACMEURL as the cert provider; registering cert with $EMAIL"
+	ACMESERVER=$ACMEURL
 elif [ "$CERTPROVIDER" = "zerossl" ]; then
 	ACMESERVER="https://acme.zerossl.com/v2/DV90"
 	if [ "$STAGING" = "true" ]; then
@@ -84,6 +85,9 @@ fi
 
 if [ -n "$ACMECABUNDLE" ]; then
 	echo "$ACMECABUNDLE" | base64 -d - > /config/cabundle.pem
+fi
+
+if [ -f "/config/cabundle.pem" ]; then
 	export REQUESTS_CA_BUNDLE="/config/cabundle.pem"
 fi