|
1 | | -# Zero - Go ACME Client for ZeroSSL |
| 1 | +# Zero - SSL Certificate Manager |
2 | 2 |
|
3 | 3 | ## Problem |
4 | 4 |
|
5 | 5 | Nginx servers need SSL/TLS certificates for secure connections. Existing solutions like Certbot are often too large and complex for simple setups. |
6 | 6 |
|
7 | 7 | ## Solution |
8 | 8 |
|
9 | | -Zero is a lightweight Go ACME client for obtaining and renewing SSL/TLS certificates from ZeroSSL using the ACME protocol. It runs as a daemon, serving HTTP-01 challenges and automatically managing certificate renewals. |
| 9 | +Zero is a lightweight service that manages SSL/TLS certificates using ZeroSSL. It automatically handles certificate obtainment, renewal, and HTTP challenges while running as a background service. |
10 | 10 |
|
11 | 11 | ## Features |
12 | 12 |
|
13 | | -- Obtains and renews SSL/TLS certificates from ZeroSSL |
14 | | -- Runs as a daemon with automatic daily certificate checks |
15 | | -- Serves HTTP-01 challenges and redirects HTTP to HTTPS |
16 | | -- Automatic renewal before expiration (30 days) |
| 13 | +Core Features: |
| 14 | +- Automatic SSL/TLS certificate management via ZeroSSL |
| 15 | +- Daily certificate monitoring and renewal (30 days before expiration) |
| 16 | +- Built-in HTTP server for ACME challenges |
| 17 | +- HTTP to HTTPS traffic redirection |
| 18 | + |
| 19 | +Deployment: |
| 20 | +- Available as a Docker image (AMD64/ARM64) |
17 | 21 | - Minimal dependencies |
18 | | -- Automatic retrieval of ZeroSSL credentials using email |
19 | | -- Configurable certificate storage directory |
20 | | -- POSIX-compatible command-line interface |
| 22 | +- Simple command-line interface |
| 23 | +- Configurable certificate storage |
| 24 | +- Configurable renewal schedule |
| 25 | + |
| 26 | +Integration: |
| 27 | +- Works seamlessly with Nginx |
| 28 | +- Easy to use with Docker Compose |
| 29 | +- Automatic ZeroSSL account management |
21 | 30 |
|
22 | 31 | ## Requirements |
23 | 32 |
|
24 | | -- Go 1.16 or later |
| 33 | +- Go 1.23 or later |
25 | 34 |
|
26 | 35 | ## Installation |
27 | 36 |
|
| 37 | +Download the latest release from the [releases page](https://github.com/yarlson/zero/releases/latest). |
| 38 | + |
| 39 | +### macOS |
| 40 | + |
| 41 | +1. Download the appropriate archive for your system architecture: |
| 42 | + |
| 43 | + - For AMD64 (Intel): `zero_*_darwin_amd64.tar.gz` |
| 44 | + - For ARM64 (Apple Silicon): `zero_*_darwin_arm64.tar.gz` |
| 45 | + |
| 46 | +2. Extract the binary: |
| 47 | + |
| 48 | + ```bash |
| 49 | + tar xzf zero_*.tar.gz |
| 50 | + ``` |
| 51 | + |
| 52 | +3. Make the binary executable and move it to your local bin directory: |
| 53 | + |
| 54 | + ```bash |
| 55 | + chmod +x ./zero |
| 56 | + sudo mv ./zero /usr/local/bin/ |
| 57 | + ``` |
| 58 | + |
| 59 | +4. Remove the macOS security quarantine attribute: |
| 60 | + ```bash |
| 61 | + sudo xattr -d com.apple.quarantine /usr/local/bin/zero |
| 62 | + ``` |
| 63 | + |
| 64 | +### Linux |
| 65 | + |
| 66 | +1. Download the appropriate archive for your system architecture: |
| 67 | + |
| 68 | + - For AMD64: `zero_*_linux_amd64.tar.gz` |
| 69 | + - For ARM64: `zero_*_linux_arm64.tar.gz` |
| 70 | + |
| 71 | +2. Extract the binary: |
| 72 | + |
| 73 | + ```bash |
| 74 | + tar xzf zero_*.tar.gz |
| 75 | + ``` |
| 76 | + |
| 77 | +3. Make the binary executable and move it to your local bin directory: |
| 78 | + ```bash |
| 79 | + chmod +x ./zero |
| 80 | + sudo mv ./zero /usr/local/bin/ |
| 81 | + ``` |
| 82 | + |
| 83 | +### Windows |
| 84 | + |
| 85 | +1. Download the appropriate archive for your system architecture: |
| 86 | + |
| 87 | + - For Windows AMD64: `zero_*_windows_amd64.tar.gz` |
| 88 | + - For Windows ARM64: `zero_*_windows_arm64.tar.gz` |
| 89 | + |
| 90 | +2. Extract the archive using your preferred archive tool |
| 91 | + |
| 92 | +3. Add the extracted binary location to your system's PATH environment variable |
| 93 | + |
| 94 | +### From Source |
| 95 | + |
| 96 | +If you have Go 1.23 or later installed: |
| 97 | + |
28 | 98 | ```bash |
29 | 99 | go install github.com/yarlson/zero@latest |
30 | 100 | ``` |
31 | 101 |
|
| 102 | +### Using Docker |
| 103 | + |
| 104 | +Pull and run the latest image: |
| 105 | + |
| 106 | +```bash |
| 107 | +docker pull yarlson/zero:latest |
| 108 | +``` |
| 109 | + |
| 110 | +See the [Docker](#docker) section for detailed usage instructions. |
| 111 | + |
| 112 | +### Verify Installation |
| 113 | + |
| 114 | +To verify the installation: |
| 115 | +```bash |
| 116 | +zero --help |
| 117 | +``` |
| 118 | + |
32 | 119 | ## Usage |
33 | 120 |
|
34 | 121 | Basic usage: |
35 | 122 |
|
36 | 123 | ```bash |
37 | | -sudo zero -d example.com -e user@example.com |
| 124 | +zero -d example.com -e user@example.com |
38 | 125 | ``` |
39 | 126 |
|
40 | 127 | With all options: |
41 | 128 |
|
42 | 129 | ```bash |
43 | | -sudo zero -d example.com -e user@example.com [-c /path/to/certs] [-p port] [-t HH:mm] |
| 130 | +zero -d example.com -e user@example.com [-c /path/to/certs] [-p port] [-t HH:mm] |
44 | 131 | ``` |
45 | 132 |
|
46 | 133 | Options: |
@@ -86,3 +173,99 @@ Contributions are welcome. Please submit pull requests with clear descriptions o |
86 | 173 | ## License |
87 | 174 |
|
88 | 175 | This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details. |
| 176 | + |
| 177 | +## Docker |
| 178 | + |
| 179 | +Zero is available as a Docker image supporting both AMD64 and ARM64 architectures. |
| 180 | + |
| 181 | +Basic usage: |
| 182 | +```bash |
| 183 | +docker run -d \ |
| 184 | + --name zero \ |
| 185 | + -p 80:80 \ |
| 186 | + -v /path/to/certs:/certs \ |
| 187 | + yarlson/zero:latest \ |
| 188 | + -d example.com \ |
| 189 | + -e user@example.com \ |
| 190 | + -c /certs |
| 191 | +``` |
| 192 | + |
| 193 | +Options: |
| 194 | +- `-d`: Run container in background |
| 195 | +- `-p 80:80`: Map container's port 80 to host's port 80 (required for ACME challenges) |
| 196 | +- `-v /path/to/certs:/certs`: Mount local directory for certificate storage |
| 197 | +- `yarlson/zero:latest`: Use latest version (or specify a version like `yarlson/zero:0.3.7`) |
| 198 | + |
| 199 | +The certificates will be stored in the mounted volume at `/path/to/certs` on the host. |
| 200 | + |
| 201 | +### Docker Compose |
| 202 | + |
| 203 | +Example docker-compose.yml: |
| 204 | +```yaml |
| 205 | +volumes: |
| 206 | + certs: # Named volume for certificates |
| 207 | + |
| 208 | +services: |
| 209 | + zero: |
| 210 | + image: yarlson/zero:latest |
| 211 | + ports: |
| 212 | + - "80:80" |
| 213 | + volumes: |
| 214 | + - certs:/certs |
| 215 | + command: |
| 216 | + - -d |
| 217 | + - example.com |
| 218 | + - -e |
| 219 | + - user@example.com |
| 220 | + - -c |
| 221 | + - /certs |
| 222 | + restart: unless-stopped |
| 223 | +``` |
| 224 | +
|
| 225 | +### Using with Nginx |
| 226 | +
|
| 227 | +Example docker-compose.yml with Nginx: |
| 228 | +```yaml |
| 229 | +volumes: |
| 230 | + certs: # Named volume for certificates |
| 231 | + |
| 232 | +services: |
| 233 | + zero: |
| 234 | + image: yarlson/zero:latest |
| 235 | + ports: |
| 236 | + - "80:80" |
| 237 | + volumes: |
| 238 | + - certs:/certs |
| 239 | + command: |
| 240 | + - -d |
| 241 | + - example.com |
| 242 | + - -e |
| 243 | + - user@example.com |
| 244 | + - -c |
| 245 | + - /certs |
| 246 | + restart: unless-stopped |
| 247 | + |
| 248 | + nginx: |
| 249 | + image: nginx:alpine |
| 250 | + ports: |
| 251 | + - "443:443" |
| 252 | + volumes: |
| 253 | + - certs:/etc/nginx/certs:ro # Mount the same volume as read-only |
| 254 | + - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro |
| 255 | + depends_on: |
| 256 | + - zero |
| 257 | + restart: unless-stopped |
| 258 | +``` |
| 259 | +
|
| 260 | +Example nginx.conf: |
| 261 | +```nginx |
| 262 | +server { |
| 263 | + listen 443 ssl; |
| 264 | + server_name example.com; |
| 265 | + |
| 266 | + ssl_certificate /etc/nginx/certs/example.com.crt; |
| 267 | + ssl_certificate_key /etc/nginx/certs/example.com.key; |
| 268 | + |
| 269 | + # ... rest of your configuration ... |
| 270 | +} |
| 271 | +``` |
0 commit comments