mi
39 lines
1.3 KiB
Bash
39 lines
1.3 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
cd "$(dirname "$0")/../.."
|
|
CONFIG_FILE=${CONFIG_FILE:-.env}
|
|
SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
|
|
|
|
if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
|
|
[ -x "$SECRETS_LAUNCHER" ] || {
|
|
echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
|
|
exit 66
|
|
}
|
|
exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
|
|
fi
|
|
|
|
lock=/tmp/han-chat-cert-renew.lock
|
|
exec 9>"$lock"
|
|
flock -n 9 || { echo '{"event":"tls.renew.skipped","reason":"lock_busy"}'; exit 0; }
|
|
|
|
compose() {
|
|
docker compose --env-file "$CONFIG_FILE" "$@"
|
|
}
|
|
|
|
nginx_container="$(compose ps --status running --quiet nginx)"
|
|
if [ -z "$nginx_container" ]; then
|
|
echo '{"event":"tls.renew.failed","reason":"nginx_not_running"}' >&2
|
|
exit 1
|
|
fi
|
|
|
|
compose --profile certbot run --rm certbot renew \
|
|
--webroot -w /var/www/certbot --quiet
|
|
compose exec -T nginx nginx -t -c /tmp/nginx.conf
|
|
|
|
# Сигнал отправляется PID 1 контейнера. Нельзя использовать `nginx -s reload`:
|
|
# он ищет дефолтный /var/run/nginx.pid, тогда как рабочий PID — /tmp/nginx.pid.
|
|
compose kill --signal HUP nginx
|
|
|
|
compose ps --status running --quiet nginx | awk 'NF {found=1} END {exit !found}'
|
|
echo "{\"event\":\"tls.renew.completed\",\"timestamp\":\"$(date -u +%FT%TZ)\"}"
|