self-heal standalone cert renewal configs on provision

2026-06-08 11:35:37 -04:00
parent f093a66580
commit 0f951281d5
2 changed files with 30 additions and 1 deletions
@@ -105,7 +105,12 @@ cert as SANs.
 1. Run `app.sh cert <domain>` (uses `certbot --webroot`, zero downtime)
 2. Deploy nginx config — `deploy.sh` verifies certs exist, fails if missing

-**Renewal:** certbot timer/cron runs daily, deploy hook reloads nginx.
+**Renewal:** certbot timer/cron runs daily, deploy hook reloads nginx. All certs
+must use the `webroot` authenticator so nginx can keep port 80; certs issued by
+the old `--standalone` flow (removed in `de1d60b`) can never renew because nginx
+holds port 80. `configure.sh` self-heals this on every `provision`: it scans
+`/etc/letsencrypt/renewal/*.conf` and reissues any `standalone` cert via the
+`cert-<domain>` webroot path (best-effort; warns and exits non-zero on failure).

 ## `.env.keys` mechanism