Generate HTTPS certs with certbot for syncthing packer

.envrc

@@ -10,6 +10,7 @@ export SYNCTHING_PW=$(pass packer-syncthing-pw)
 export SYNCTHING_API_KEY=$(pass packer-syncthing-api-key)
 export SYNCTHING_CERT_PEM=$(pass packer-syncthing-cert.pem)
 export SYNCTHING_KEY_PEM=$(pass packer-syncthing-key.pem)
+export CERTBOT_EMAIL=$(pass certbot-email)
 
 if [ -f ".env.local" ]; then
     echo "sourcing .env.local"

prod/syncthing-packer/.gitignore

@@ -1,3 +1,5 @@
 packer/syncthing-config.xml
 packer/syncthing-cert.pem
 packer/syncthing-key.pem
+packer/do.ini
+packer/certbot/

prod/syncthing-packer/packer/Makefile

@@ -1,6 +1,6 @@
 .PHONY: packer
 
-packer: syncthing-config.xml syncthing.json
+packer: syncthing-config.xml syncthing.json syncthing-cert.pem syncthing-key.pem certbot/live/syncthing.jeremydormitzer.com/fullchain.pem certbot/live/syncthing.jeremydormitzer.com/privkey.pem
 	packer build syncthing.json
 
 syncthing-config.xml: syncthing-config.xml.template
@@ -11,3 +11,10 @@ syncthing-cert.pem: syncthing-cert.pem.template
 
 syncthing-key.pem: syncthing-key.pem.template
 	sigil -p -f syncthing-key.pem.template > syncthing-key.pem
+
+certbot/live/syncthing.jeremydormitzer.com/fullchain.pem certbot/live/syncthing.jeremydormitzer.com/privkey.pem &: do.ini
+	certbot certonly -n --agree-tos --email ${CERTBOT_EMAIL} --dns-digitalocean --dns-digitalocean-credentials do.ini --config-dir ./certbot --work-dir ./certbot --logs-dir ./certbot -d syncthing.jeremydormitzer.com
+
+do.ini: do.ini.template
+	sigil -p -f do.ini.template > do.ini
+	chmod 600 do.ini

prod/syncthing-packer/packer/do.ini.template

@@ -0,0 +1 @@
+dns_digitalocean_token = ${DIGITALOCEAN_API_TOKEN:?}