openso/traefik-certs-dumper
Watch
1
0
Fork
You've already forked traefik-certs-dumper
 0
Code Issues Pull requests Packages 1 Activity Actions

Document runtime, env vars, and Compose usage in README #2

Merged
MHE merged 1 commit from readme-document-image-usage-env into main 2026-10-31 14:25:36 +01:00
Conversation 0 Commits 1 Files changed 1 +81 -2
MHE commented 2026-10-31 14:24:35 +01:00
Owner
Copy link

What changed

Expanded README.md from a short image summary into full operational documentation:

  • Scope: states that the customer stack lives in docker-templates (templates/traefik_certs-dumper) and this repo is the image only.
  • Image tag: clarifies that docker-templates uses the untagged image, so Compose pulls :latest, which tracks :main.
  • Security posture: documents uid/gid 1000, read-only root filesystem, and the writable paths (tmpfs plus PEM destination).
  • Runtime: describes the entrypoint flow: ACME_FILENAME validation, waiting for certificates, polling with snapshot digest and lock, running traefik-certs-dumper file with v3/domain-subdir/pem flags, running POST_HOOK, and writing the ready marker.
  • Environment variables: table of ACME_FILENAME, ACME_DIR, ACME_DEST, POST_HOOK, CERTS_DUMPER_RUNTIME_DIR, CERTS_DUMPER_POLL_SECONDS with defaults and purpose. Notes that Mailcow settings belong to the hook in docker-templates, not the entrypoint.
  • Compose: example service definition (read-only, cap_drop ALL, no-new-privileges, tmpfs runtime, bind mounts, healthcheck on ready).
  • Build: notes that the runtime image now includes openssh-client, jq, curl, openssl, and bind-tools for the mounted post-hook.

Why

The previous README did not describe the entrypoint behaviour, configuration surface, or how the image is consumed by the docker-templates service. These additions make the contract between the image, the hook, and the Compose template explicit, and document the runtime packages needed by the post-hook.

Notes

  • Documentation only; no code or Dockerfile logic changes are described beyond the package list the README already reflects.
  • Secrets are not added; the example uses placeholder-free paths and env names only.
## What changed Expanded `README.md` from a short image summary into full operational documentation: - **Scope**: states that the customer stack lives in `docker-templates` (`templates/traefik_certs-dumper`) and this repo is the image only. - **Image tag**: clarifies that `docker-templates` uses the untagged image, so Compose pulls `:latest`, which tracks `:main`. - **Security posture**: documents uid/gid `1000`, read-only root filesystem, and the writable paths (tmpfs plus PEM destination). - **Runtime**: describes the entrypoint flow: `ACME_FILENAME` validation, waiting for certificates, polling with snapshot digest and lock, running `traefik-certs-dumper file` with v3/domain-subdir/pem flags, running `POST_HOOK`, and writing the `ready` marker. - **Environment variables**: table of `ACME_FILENAME`, `ACME_DIR`, `ACME_DEST`, `POST_HOOK`, `CERTS_DUMPER_RUNTIME_DIR`, `CERTS_DUMPER_POLL_SECONDS` with defaults and purpose. Notes that Mailcow settings belong to the hook in `docker-templates`, not the entrypoint. - **Compose**: example service definition (read-only, cap_drop ALL, no-new-privileges, tmpfs runtime, bind mounts, healthcheck on `ready`). - **Build**: notes that the runtime image now includes `openssh-client`, `jq`, `curl`, `openssl`, and `bind-tools` for the mounted post-hook. ## Why The previous README did not describe the entrypoint behaviour, configuration surface, or how the image is consumed by the `docker-templates` service. These additions make the contract between the image, the hook, and the Compose template explicit, and document the runtime packages needed by the post-hook. ## Notes - Documentation only; no code or Dockerfile logic changes are described beyond the package list the README already reflects. - Secrets are not added; the example uses placeholder-free paths and env names only.
Document runtime, env vars, and Compose usage in README
All checks were successful
ci / compose (pull_request) Successful in 12s
Details
ci / shellcheck (pull_request) Successful in 2s
Details
ci / conventions (pull_request) Successful in 2s
Details
ci / image (pull_request) Successful in 34s
Details
66187ab1f8
MHE merged commit e894e0bbb6 into main 2026-10-31 14:25:36 +01:00
MHE deleted branch readme-document-image-usage-env 2026-10-31 14:27:05 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/traefik-certs-dumper!2
No description provided.