Initial commit

scripts/certbot-init.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "Usage: $0 <domain> <email>" >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+DOMAIN="$1"
+EMAIL="$2"
+LE_LIVE_DIR="${PROJECT_DIR}/letsencrypt/live"
+BOOTSTRAP_DIR="${LE_LIVE_DIR}/current"
+LE_RENEWAL_DIR="${PROJECT_DIR}/letsencrypt/renewal"
+LE_RENEWAL_CONF="${LE_RENEWAL_DIR}/${DOMAIN}.conf"
+
+cd "${PROJECT_DIR}"
+
+mkdir -p "${BOOTSTRAP_DIR}" "${LE_RENEWAL_DIR}"
+
+if [[ ! -f "${BOOTSTRAP_DIR}/fullchain.pem" || ! -f "${BOOTSTRAP_DIR}/privkey.pem" ]]; then
+  openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
+    -keyout "${BOOTSTRAP_DIR}/privkey.pem" \
+    -out "${BOOTSTRAP_DIR}/fullchain.pem" \
+    -subj "/CN=${DOMAIN}"
+fi
+
+docker compose up -d proxy
+
+docker compose --profile certbot run --rm certbot certonly \
+  --webroot \
+  --webroot-path /var/www/certbot \
+  --domain "${DOMAIN}" \
+  --email "${EMAIL}" \
+  --agree-tos \
+  --no-eff-email
+
+rm -f "${BOOTSTRAP_DIR}/fullchain.pem" "${BOOTSTRAP_DIR}/privkey.pem"
+"${PROJECT_DIR}/scripts/update-active-cert-links.sh" "${DOMAIN}"
+docker compose exec proxy nginx -s reload