29 lines
894 B
Bash
29 lines
894 B
Bash
|
#!/bin/sh
|
||
|
|
# cert-renew-check.sh — weekly via cron; renew LE certs near expiry
|
||
|
|
# Logs to /var/log/cert-renew.log
|
||
|
|
|
||
|
|
LOG=/var/log/cert-renew.log
|
||
|
|
echo "[$(date -u +%FT%TZ)] cert-renew-check start" >>"$LOG"
|
||
|
|
|
||
|
|
DOMAINS="s8n.ru veilor.uk"
|
||
|
|
RC=0
|
||
|
|
|
||
|
|
for d in $DOMAINS; do
|
||
|
|
if /usr/local/sbin/acme-client -v "$d" >>"$LOG" 2>&1; then
|
||
|
|
echo "[$(date -u +%FT%TZ)] $d: renewed" >>"$LOG"
|
||
|
|
else
|
||
|
|
rc=$?
|
||
|
|
echo "[$(date -u +%FT%TZ)] $d: acme-client exit=$rc (likely no renewal needed; harmless if >30d to expiry)" >>"$LOG"
|
||
|
|
# Don't fail the script for "no renewal needed"
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
# Reload relayd if any cert files changed in last 5 minutes
|
||
|
|
if find /etc/ssl -name '*.fullchain.pem' -mmin -5 | grep -q .; then
|
||
|
|
rcctl reload relayd
|
||
|
|
echo "[$(date -u +%FT%TZ)] relayd reloaded for new certs" >>"$LOG"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "[$(date -u +%FT%TZ)] cert-renew-check done" >>"$LOG"
|
||
|
|
exit $RC
|