Mercurial Hosting > luan
annotate host/renewSsl.sh @ 2082:cdc9a31c6f71 ssltesting
update renewSsl.sh to reflect changes in directory structure
| author | Violet7 |
|---|---|
| date | Tue, 09 Dec 2025 17:53:16 -0800 |
| parents | 385ab09fb2ca |
| children | 39d4215259ec |
| rev | line source |
|---|---|
| 1632 | 1 #!/bin/bash |
| 2072 | 2 set -e |
| 1632 | 3 |
| 2076 | 4 if [ -n "$1" ]; then |
| 5 cd "$1" || echo "no first argument passed, staying in cwd" | |
| 6 fi | |
| 2048 | 7 |
| 2037 | 8 ROOTPWD=$(pwd) |
| 2076 | 9 # this awkward method is used for portability |
| 10 ROOTPWDOWNER=$(ls -ld $ROOTPWD | awk '{printf "%s", $3}') | |
| 11 | |
| 12 # change to owner of host/ if running as root | |
| 13 # prevents nginx being unable to read files owned by root | |
| 14 if [ "$(id -u)" -eq 0 ]; then | |
| 15 echo "switching to $ROOTPWDOWNER in order to preserve permissions" | |
| 16 exec sudo -u $ROOTPWDOWNER "$0" "$@" | |
| 17 fi | |
| 18 | |
| 2048 | 19 KEYFILE="$ROOTPWD/local/tiny_account.key" |
| 2037 | 20 for SITEROOT in "$ROOTPWD"/sites/*; do |
| 2048 | 21 { |
| 22 # Skip if not a directory | |
| 23 [ -d "$SITEROOT" ] || continue | |
| 2037 | 24 |
| 2048 | 25 DOMAIN=$(basename "$SITEROOT") |
|
2082
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
26 SSLDIR="$SITEROOT/ssl" |
|
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
27 CSRFILE="$SSLDIR/$DOMAIN.csr" |
|
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
28 FULLCHAIN="$SSLDIR/fullchain.cer" |
|
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
29 CHALLENGEDIR="$SITEROOT/.well-known/acme-challenge" |
|
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
30 TMPOUT="$SSLDIR/$DOMAIN.crt.tmp" |
| 2048 | 31 echo "Processing domain: $DOMAIN" |
| 1632 | 32 |
| 2048 | 33 # local_https.sh does not create a csr file, assume |
| 34 # it is a self-signed local cert if it doesn't exist | |
| 35 if [ ! -f "$CSRFILE" ]; then | |
| 36 echo "CSR file not found, assuming self-signed and skipping." | |
| 37 continue | |
| 38 fi | |
| 39 | |
| 40 mkdir -p "$CHALLENGEDIR" | |
| 1632 | 41 |
|
2061
dd10659fcdb9
Renew ssl monthly instead of daily; Fix renewSsl.sh
Violet7
parents:
2052
diff
changeset
|
42 "$ROOTPWD/acme_tiny" \ |
| 2048 | 43 --account-key "$KEYFILE" \ |
| 44 --csr "$CSRFILE" \ | |
| 45 --acme-dir "$CHALLENGEDIR" \ | |
| 2076 | 46 >"$TMPOUT" |
| 47 | |
| 48 # If TMPOUT is empty, something failed. | |
|
2082
cdc9a31c6f71
update renewSsl.sh to reflect changes in directory structure
Violet7
parents:
2076
diff
changeset
|
49 # Do not modify the current fullchain. |
| 2076 | 50 if [ ! -s "$TMPOUT" ]; then |
| 51 echo "Error: $TMPOUT is empty - please see previous output for details.\nContinuing to next domain..." | |
| 52 rm -f "$TMPOUT" | |
| 53 continue | |
| 54 fi | |
| 2037 | 55 |
| 2048 | 56 # check if exists |
| 57 if [ -f "$FULLCHAIN" ]; then | |
| 58 mv $FULLCHAIN "$FULLCHAIN.old" | |
| 59 fi | |
| 2037 | 60 |
| 2048 | 61 mv "$TMPOUT" "$FULLCHAIN" |
| 62 | |
| 63 echo "Renewed certificate for $DOMAIN" | |
| 64 } || { | |
| 65 echo "Error processing $SITEROOT — skipping." | |
| 66 } | |
| 2037 | 67 done |
| 68 | |
| 2050 | 69 sudo /usr/local/bin/nginx -s reload -c "$(pwd)/local/nginx.conf" |
| 2037 | 70 echo "Nginx reloaded." |