Mercurial Hosting > luan

comparison host/renewSsl.sh @ 2083:39d4215259ec ssltesting

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
tabs instead of spaces
author Violet7
date Tue, 09 Dec 2025 22:12:51 -0800
parents cdc9a31c6f71
children
comparison
equal deleted inserted replaced
2082:cdc9a31c6f71 2083:39d4215259ec
1 #!/bin/bash 1 #!/bin/bash
2 set -e 2 set -e
3 3
4 if [ -n "$1" ]; then 4 if [ -n "$1" ]; then
5 cd "$1" || echo "no first argument passed, staying in cwd" 5 cd "$1" || echo "no first argument passed, staying in cwd"
6 fi 6 fi
7 7
8 ROOTPWD=$(pwd) 8 ROOTPWD=$(pwd)
9 # this awkward method is used for portability 9 # this awkward method is used for portability
10 ROOTPWDOWNER=$(ls -ld $ROOTPWD | awk '{printf "%s", $3}') 10 ROOTPWDOWNER=$(ls -ld $ROOTPWD | awk '{printf "%s", $3}')
11 11
12 # change to owner of host/ if running as root 12 # change to owner of host/ if running as root
13 # prevents nginx being unable to read files owned by root 13 # prevents nginx being unable to read files owned by root
14 if [ "$(id -u)" -eq 0 ]; then 14 if [ "$(id -u)" -eq 0 ]; then
15 echo "switching to $ROOTPWDOWNER in order to preserve permissions" 15 echo "switching to $ROOTPWDOWNER in order to preserve permissions"
16 exec sudo -u $ROOTPWDOWNER "$0" "$@" 16 exec sudo -u $ROOTPWDOWNER "$0" "$@"
17 fi 17 fi
18 18
19 KEYFILE="$ROOTPWD/local/tiny_account.key" 19 KEYFILE="$ROOTPWD/local/tiny_account.key"
20 for SITEROOT in "$ROOTPWD"/sites/*; do 20 for SITEROOT in "$ROOTPWD"/sites/*; do
21 { 21 {
22 # Skip if not a directory 22 # Skip if not a directory
23 [ -d "$SITEROOT" ] || continue 23 [ -d "$SITEROOT" ] || continue
24 24
25 DOMAIN=$(basename "$SITEROOT") 25 DOMAIN=$(basename "$SITEROOT")
26 SSLDIR="$SITEROOT/ssl" 26 SSLDIR="$SITEROOT/ssl"
27 CSRFILE="$SSLDIR/$DOMAIN.csr" 27 CSRFILE="$SSLDIR/$DOMAIN.csr"
28 FULLCHAIN="$SSLDIR/fullchain.cer" 28 FULLCHAIN="$SSLDIR/fullchain.cer"
29 CHALLENGEDIR="$SITEROOT/.well-known/acme-challenge" 29 CHALLENGEDIR="$SITEROOT/.well-known/acme-challenge"
30 TMPOUT="$SSLDIR/$DOMAIN.crt.tmp" 30 TMPOUT="$SSLDIR/$DOMAIN.crt.tmp"
31 echo "Processing domain: $DOMAIN" 31 echo "Processing domain: $DOMAIN"
32 32
33 # local_https.sh does not create a csr file, assume 33 # local_https.sh does not create a csr file, assume
34 # it is a self-signed local cert if it doesn't exist 34 # it is a self-signed local cert if it doesn't exist
35 if [ ! -f "$CSRFILE" ]; then 35 if [ ! -f "$CSRFILE" ]; then
36 echo "CSR file not found, assuming self-signed and skipping." 36 echo "CSR file not found, assuming self-signed and skipping."
37 continue 37 continue
38 fi 38 fi
39 39
40 mkdir -p "$CHALLENGEDIR" 40 mkdir -p "$CHALLENGEDIR"
41 41
42 "$ROOTPWD/acme_tiny" \ 42 "$ROOTPWD/acme_tiny" \
43 --account-key "$KEYFILE" \ 43 --account-key "$KEYFILE" \
44 --csr "$CSRFILE" \ 44 --csr "$CSRFILE" \
45 --acme-dir "$CHALLENGEDIR" \ 45 --acme-dir "$CHALLENGEDIR" \
46 >"$TMPOUT" 46 >"$TMPOUT"
47 47
48 # If TMPOUT is empty, something failed. 48 # If TMPOUT is empty, something failed.
49 # Do not modify the current fullchain. 49 # Do not modify the current fullchain.
50 if [ ! -s "$TMPOUT" ]; then 50 if [ ! -s "$TMPOUT" ]; then
51 echo "Error: $TMPOUT is empty - please see previous output for details.\nContinuing to next domain..." 51 echo "Error: $TMPOUT is empty - please see previous output for details.\nContinuing to next domain..."
52 rm -f "$TMPOUT" 52 rm -f "$TMPOUT"
53 continue 53 continue
54 fi 54 fi
55 55
56 # check if exists 56 # check if exists
57 if [ -f "$FULLCHAIN" ]; then 57 if [ -f "$FULLCHAIN" ]; then
58 mv $FULLCHAIN "$FULLCHAIN.old" 58 mv $FULLCHAIN "$FULLCHAIN.old"
59 fi 59 fi
60 60
61 mv "$TMPOUT" "$FULLCHAIN" 61 mv "$TMPOUT" "$FULLCHAIN"
62 62
63 echo "Renewed certificate for $DOMAIN" 63 echo "Renewed certificate for $DOMAIN"
64 } || { 64 } || {
65 echo "Error processing $SITEROOT — skipping." 65 echo "Error processing $SITEROOT — skipping."
66 } 66 }
67 done 67 done
68 68
69 sudo /usr/local/bin/nginx -s reload -c "$(pwd)/local/nginx.conf" 69 sudo /usr/local/bin/nginx -s reload -c "$(pwd)/local/nginx.conf"
70 echo "Nginx reloaded." 70 echo "Nginx reloaded."