38 lines
1.5 KiB
Bash
38 lines
1.5 KiB
Bash
|
#!/bin/sh
|
||
|
|
# coturn entrypoint: stage the TLS certificate for the unprivileged user.
|
||
|
|
#
|
||
|
|
# Let's Encrypt keeps privkey.pem as root:root 0600, but coturn drops to
|
||
|
|
# nobody, so it cannot read the key from the mounted store and silently
|
||
|
|
# starts without TLS listeners (no turns: on 5349). Rather than loosening
|
||
|
|
# permissions on the shared Let's Encrypt tree -- which would expose the key
|
||
|
|
# to every other container and user on the host -- copy it to a private
|
||
|
|
# directory owned by the runtime user.
|
||
|
|
#
|
||
|
|
# This mirrors what the Prosody entrypoint does. Because the copy happens at
|
||
|
|
# start, a certificate renewal needs a container restart to be picked up;
|
||
|
|
# that is handled by the certbot deploy hook.
|
||
|
|
set -e
|
||
|
|
|
||
|
|
SRC="/etc/letsencrypt/live/guschin.info"
|
||
|
|
DST="/var/lib/coturn/certs"
|
||
|
|
RUN_AS_UID="${COTURN_UID:-65534}"
|
||
|
|
RUN_AS_GID="${COTURN_GID:-65533}"
|
||
|
|
|
||
|
|
if [ -r "$SRC/fullchain.pem" ] && [ -r "$SRC/privkey.pem" ]; then
|
||
|
|
mkdir -p "$DST"
|
||
|
|
# -L to dereference the live/ symlinks into archive/.
|
||
|
|
cp -L "$SRC/fullchain.pem" "$DST/fullchain.pem"
|
||
|
|
cp -L "$SRC/privkey.pem" "$DST/privkey.pem"
|
||
|
|
chown "$RUN_AS_UID:$RUN_AS_GID" "$DST/fullchain.pem" "$DST/privkey.pem"
|
||
|
|
chmod 644 "$DST/fullchain.pem"
|
||
|
|
chmod 600 "$DST/privkey.pem"
|
||
|
|
chown "$RUN_AS_UID:$RUN_AS_GID" "$DST"
|
||
|
|
echo "coturn: staged TLS certificate for uid $RUN_AS_UID"
|
||
|
|
else
|
||
|
|
# Not fatal: coturn still serves STUN and plain TURN on 3478. Make the
|
||
|
|
# degraded state loud rather than letting it hide in the noise.
|
||
|
|
echo "coturn: WARNING - cannot read $SRC; turns:// on 5349 will be DISABLED" >&2
|
||
|
|
fi
|
||
|
|
|
||
|
|
exec "$@"
|