mi
50 lines
1.4 KiB
Bash
50 lines
1.4 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
COMPOSE=/usr/local/sbin/han-vm1-compose
|
|
TLS_DIR=/var/lib/han-chat/public-tls
|
|
TLS_GROUP=han-nginx-tls
|
|
|
|
lineage=${RENEWED_LINEAGE:?Certbot did not provide RENEWED_LINEAGE}
|
|
test -s "$lineage/fullchain.pem"
|
|
test -s "$lineage/privkey.pem"
|
|
test -d "$TLS_DIR"
|
|
getent group "$TLS_GROUP" >/dev/null
|
|
|
|
staging=$(mktemp -d "${TLS_DIR}/.renew.XXXXXX")
|
|
trap 'rm -rf -- "$staging"' EXIT HUP INT TERM
|
|
install -m 0640 -o root -g "$TLS_GROUP" \
|
|
"$lineage/fullchain.pem" "$staging/fullchain.pem"
|
|
install -m 0640 -o root -g "$TLS_GROUP" \
|
|
"$lineage/privkey.pem" "$staging/privkey.pem"
|
|
|
|
cert_public=$(
|
|
openssl x509 -in "$staging/fullchain.pem" -pubkey -noout |
|
|
openssl pkey -pubin -outform DER 2>/dev/null |
|
|
sha256sum | awk '{print $1}'
|
|
)
|
|
key_public=$(
|
|
openssl pkey -in "$staging/privkey.pem" -passin pass: -pubout -outform DER 2>/dev/null |
|
|
sha256sum | awk '{print $1}'
|
|
)
|
|
[ "$cert_public" = "$key_public" ] || {
|
|
echo "renewed certificate and private key do not match" >&2
|
|
exit 1
|
|
}
|
|
|
|
mv -f "$staging/fullchain.pem" "$TLS_DIR/fullchain.pem"
|
|
mv -f "$staging/privkey.pem" "$TLS_DIR/privkey.pem"
|
|
rmdir "$staging"
|
|
trap - EXIT HUP INT TERM
|
|
|
|
container=$("$COMPOSE" ps --status running --quiet nginx)
|
|
[ -n "$container" ] || {
|
|
echo "HAN VM1 nginx is not running" >&2
|
|
exit 1
|
|
}
|
|
if ! output=$("$COMPOSE" exec -T nginx nginx -t -c /tmp/nginx.conf 2>&1); then
|
|
printf '%s\n' "$output" >&2
|
|
exit 1
|
|
fi
|
|
/usr/bin/docker kill --signal HUP "$container" >/dev/null
|