Add certmate (ct)

ct/certmate.sh

@@ -2,12 +2,12 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: Nicolas Pastorello (opastorello)
+# Author: fabriziosalmi
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://tvheadend.org/ | Github: https://github.com/tvheadend/tvheadend
+# Source: https://github.com/fabriziosalmi/certmate
 
-APP="Tvheadend"
-var_tags="${var_tags:-media;pvr;tv;dvr}"
+APP="CertMate"
+var_tags="${var_tags:-ssl;certificates;acme}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
@@ -16,9 +16,6 @@ var_version="${var_version:-13}"
 #var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
 var_unprivileged="${var_unprivileged:-1}"
 
-export var_admin_user="${var_admin_user:-admin}"
-export var_admin_pass="${var_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)}"
-
 header_info "$APP"
 variables
 color
@@ -29,20 +26,31 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  if [[ ! -d /var/lib/tvheadend ]]; then
+  if [[ ! -d /opt/certmate ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
 
-  msg_info "Updating Tvheadend"
-  $STD apt update
-  $STD apt install -y tvheadend
-  msg_ok "Updated Tvheadend"
+  if check_for_gh_release "certmate" "fabriziosalmi/certmate"; then
+    msg_info "Stopping CertMate"
+    systemctl stop certmate
+    msg_ok "Stopped CertMate"
 
-  msg_info "Restarting Service"
-  systemctl restart tvheadend
-  msg_ok "Restarted Service"
-  msg_ok "Updated successfully!"
+    PYTHON_VERSION="3.12" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
+
+    msg_info "Installing CertMate Dependencies"
+    cd /opt/certmate
+    $STD uv venv --python 3.12 /opt/certmate/.venv
+    $STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
+    $STD /opt/certmate/.venv/bin/certbot --version
+    msg_ok "Installed CertMate Dependencies"
+
+    msg_info "Starting CertMate"
+    systemctl start certmate
+    msg_ok "Started CertMate"
+    msg_ok "Updated successfully!"
+  fi
   exit
 }
 
@@ -53,6 +61,5 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9981${CL}"
-echo -e "${INFO}${YW}Admin Username: ${var_admin_user}${CL}"
-echo -e "${INFO}${YW}Admin Password: ${var_admin_pass}${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}The first page creates the admin account and asks for the API token: grep API_BEARER_TOKEN /opt/certmate_data/.env${CL}"

install/certmate-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: fabriziosalmi
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fabriziosalmi/certmate
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PYTHON_VERSION="3.12" setup_uv
+fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
+
+msg_info "Installing CertMate Dependencies"
+cd /opt/certmate
+$STD uv venv --python 3.12 /opt/certmate/.venv
+# requirements.lock is the fully pinned set the official image is built from
+$STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
+$STD /opt/certmate/.venv/bin/certbot --version
+msg_ok "Installed CertMate Dependencies"
+
+msg_info "Configuring CertMate"
+mkdir -p /opt/certmate_data/{certificates,data,backups,logs}
+cat <<EOF >/opt/certmate_data/.env
+API_BEARER_TOKEN=$(openssl rand -hex 32)
+SECRET_KEY=$(openssl rand -hex 32)
+CERTMATE_BACKUP_PASSPHRASE=$(openssl rand -hex 32)
+BEHIND_PROXY=false
+EOF
+chmod 600 /opt/certmate_data/.env
+msg_ok "Configured CertMate"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/certmate.service
+[Unit]
+Description=CertMate SSL Certificate Manager
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/certmate
+Environment=PATH=/opt/certmate/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Environment=CERTMATE_CERT_DIR=/opt/certmate_data/certificates
+Environment=CERTMATE_DATA_DIR=/opt/certmate_data/data
+Environment=CERTMATE_BACKUP_DIR=/opt/certmate_data/backups
+Environment=CERTMATE_LOGS_DIR=/opt/certmate_data/logs
+Environment=ACME_CHALLENGES_DIR=/opt/certmate_data/data/acme-challenges
+EnvironmentFile=/opt/certmate_data/.env
+# One worker: the renewal scheduler, sessions and rate limits live in-process
+ExecStart=/opt/certmate/.venv/bin/gunicorn --bind 0.0.0.0:8000 --workers 1 --threads 8 --timeout 300 --no-control-socket app:app
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now certmate
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/tvheadend-install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Nicolas Pastorello (opastorello)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://tvheadend.org/ | Github: https://github.com/tvheadend/tvheadend
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-setup_deb822_repo \
-  "tvheadend" \
-  "https://dl.cloudsmith.io/public/tvheadend/tvheadend/gpg.C6CC06BD69B430C6.key" \
-  "https://dl.cloudsmith.io/public/tvheadend/tvheadend/deb/debian" \
-  "$(get_os_info codename)" \
-  "main"
-
-var_admin_user="${var_admin_user:-admin}"
-var_admin_pass="${var_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)}"
-
-msg_info "Installing Tvheadend"
-echo "tvheadend tvheadend/admin_username string ${var_admin_user}" | debconf-set-selections
-echo "tvheadend tvheadend/admin_password password ${var_admin_pass}" | debconf-set-selections
-$STD apt install -y tvheadend
-msg_ok "Installed Tvheadend"
-
-msg_info "Starting Service"
-systemctl enable -q --now tvheadend
-msg_ok "Started Service"
-
-msg_info "Saving Credentials"
-cat <<EOF >~/tvheadend.creds
-Tvheadend Admin Credentials
-Username: ${var_admin_user}
-Password: ${var_admin_pass}
-EOF
-msg_ok "Saved Credentials"
-
-motd_ssh
-customize
-cleanup_lxc