Mercurial Hosting > luan
annotate host/renewSsl.sh @ 2080:d7de1f976c1d ssltesting
use site/xyz/ssl/ for fullchain
| author | Violet7 |
|---|---|
| date | Tue, 09 Dec 2025 17:33:51 -0800 |
| parents | 385ab09fb2ca |
| children | cdc9a31c6f71 |
| rev | line source |
|---|---|
| 1632 | 1 #!/bin/bash |
| 2072 | 2 set -e |
| 1632 | 3 |
| 2076 | 4 if [ -n "$1" ]; then |
| 5 cd "$1" || echo "no first argument passed, staying in cwd" | |
| 6 fi | |
| 2048 | 7 |
| 2037 | 8 ROOTPWD=$(pwd) |
| 2076 | 9 # this awkward method is used for portability |
| 10 ROOTPWDOWNER=$(ls -ld $ROOTPWD | awk '{printf "%s", $3}') | |
| 11 | |
| 12 # change to owner of host/ if running as root | |
| 13 # prevents nginx being unable to read files owned by root | |
| 14 if [ "$(id -u)" -eq 0 ]; then | |
| 15 echo "switching to $ROOTPWDOWNER in order to preserve permissions" | |
| 16 exec sudo -u $ROOTPWDOWNER "$0" "$@" | |
| 17 fi | |
| 18 | |
| 2048 | 19 KEYFILE="$ROOTPWD/local/tiny_account.key" |
| 2037 | 20 for SITEROOT in "$ROOTPWD"/sites/*; do |
| 2048 | 21 { |
| 22 # Skip if not a directory | |
| 23 [ -d "$SITEROOT" ] || continue | |
| 2037 | 24 |
| 2048 | 25 DOMAIN=$(basename "$SITEROOT") |
| 26 CSRFILE="$SITEROOT/$DOMAIN.csr" | |
| 27 FULLCHAIN="$SITEROOT/fullchain.cer" | |
| 28 CHALLENGEDIR="$SITEROOT/site/.well-known/acme-challenge" | |
| 29 TMPOUT="/tmp/$DOMAIN.crt" | |
| 30 echo "Processing domain: $DOMAIN" | |
| 1632 | 31 |
| 2048 | 32 # local_https.sh does not create a csr file, assume |
| 33 # it is a self-signed local cert if it doesn't exist | |
| 34 if [ ! -f "$CSRFILE" ]; then | |
| 35 echo "CSR file not found, assuming self-signed and skipping." | |
| 36 continue | |
| 37 fi | |
| 38 | |
| 39 mkdir -p "$CHALLENGEDIR" | |
| 1632 | 40 |
|
2061
dd10659fcdb9
Renew ssl monthly instead of daily; Fix renewSsl.sh
Violet7
parents:
2052
diff
changeset
|
41 "$ROOTPWD/acme_tiny" \ |
| 2048 | 42 --account-key "$KEYFILE" \ |
| 43 --csr "$CSRFILE" \ | |
| 44 --acme-dir "$CHALLENGEDIR" \ | |
| 2076 | 45 >"$TMPOUT" |
| 46 | |
| 47 wc -c <$TMPOUT | |
| 48 | |
| 49 # If TMPOUT is empty, something failed. | |
| 50 if [ ! -s "$TMPOUT" ]; then | |
| 51 echo "Error: $TMPOUT is empty - please see previous output for details.\nContinuing to next domain..." | |
| 52 rm -f "$TMPOUT" | |
| 53 continue | |
| 54 fi | |
| 2037 | 55 |
| 2048 | 56 # check if exists |
| 57 if [ -f "$FULLCHAIN" ]; then | |
| 58 mv $FULLCHAIN "$FULLCHAIN.old" | |
| 59 fi | |
| 2037 | 60 |
| 2048 | 61 mv "$TMPOUT" "$FULLCHAIN" |
| 62 | |
| 63 echo "Renewed certificate for $DOMAIN" | |
| 64 } || { | |
| 65 echo "Error processing $SITEROOT — skipping." | |
| 66 } | |
| 2037 | 67 done |
| 68 | |
| 2050 | 69 sudo /usr/local/bin/nginx -s reload -c "$(pwd)/local/nginx.conf" |
| 2037 | 70 echo "Nginx reloaded." |