Проект разделен на два репозитория

VM1_app/codebase/backend/deployment/scripts/ssl-renew.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+CONFIG_FILE=${CONFIG_FILE:-.env}
+SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
+
+if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
+  [ -x "$SECRETS_LAUNCHER" ] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
+
+lock=/tmp/han-chat-cert-renew.lock
+exec 9>"$lock"
+flock -n 9 || { echo '{"event":"tls.renew.skipped","reason":"lock_busy"}'; exit 0; }
+
+compose() {
+  docker compose --env-file "$CONFIG_FILE" "$@"
+}
+
+nginx_container="$(compose ps --status running --quiet nginx)"
+if [ -z "$nginx_container" ]; then
+  echo '{"event":"tls.renew.failed","reason":"nginx_not_running"}' >&2
+  exit 1
+fi
+
+compose --profile certbot run --rm certbot renew \
+  --webroot -w /var/www/certbot --quiet
+compose exec -T nginx nginx -t -c /tmp/nginx.conf
+
+# Сигнал отправляется PID 1 контейнера. Нельзя использовать `nginx -s reload`:
+# он ищет дефолтный /var/run/nginx.pid, тогда как рабочий PID — /tmp/nginx.pid.
+compose kill --signal HUP nginx
+
+compose ps --status running --quiet nginx | awk 'NF {found=1} END {exit !found}'
+echo "{\"event\":\"tls.renew.completed\",\"timestamp\":\"$(date -u +%FT%TZ)\"}"