auto-issue certs on nginx deploy, document one-domain-per-conf convention

scripts/deploy.sh

@@ -54,7 +54,34 @@ if ! docker compose pull; then
 fi
 
 if [ "$APP" = "nginx" ]; then
-    # Test config before applying — a bad config (e.g. missing cert) would take down all sites
+    # Issue certs for any new domains (brief nginx downtime while certbot binds port 80)
+    missing_certs=false
+    for conf in /opt/hantim/docker/nginx/conf.d/*.conf; do
+        cert_name=$(basename "$conf" .conf)
+        if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
+            missing_certs=true
+            break
+        fi
+    done
+    if [ "$missing_certs" = true ]; then
+        docker stop nginx 2>/dev/null || true
+        trap 'docker start nginx 2>/dev/null || true' EXIT
+        for conf in /opt/hantim/docker/nginx/conf.d/*.conf; do
+            cert_name=$(basename "$conf" .conf)
+            if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
+                domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
+                domain_args=""
+                for d in $domains; do
+                    domain_args="$domain_args -d $d"
+                done
+                echo "Issuing cert for $cert_name..."
+                certbot certonly --standalone --non-interactive --agree-tos \
+                    --register-unsafely-without-email --cert-name "$cert_name" $domain_args
+            fi
+        done
+        trap - EXIT
+    fi
+    # Test config before applying — a bad config would take down all sites
     docker compose run --rm -T nginx nginx -t
 fi