add nginx and cert subcommands to service.sh

scripts/deploy.sh

@@ -6,12 +6,21 @@ CMD="${SSH_ORIGINAL_COMMAND:-${1:-}}"
 if [[ "$CMD" =~ ^cert-[a-zA-Z0-9._-]+$ ]]; then
     APP="${CMD#cert-}"
 
+    # Subdomains (e.g., garage.hantim.net) don't have www variants
+    if [[ "$APP" == *.*.* ]]; then
+        CERT_DOMAINS="-d $APP"
+        SERVER_NAMES="$APP"
+    else
+        CERT_DOMAINS="-d $APP -d www.$APP"
+        SERVER_NAMES="$APP www.$APP"
+    fi
+
     # Write temporary HTTP-only config so nginx can serve ACME challenges
     cat > "/opt/hantim/docker/nginx/conf.d/$APP.conf" <<NGINXCONF
 server {
     listen 80;
     listen [::]:80;
-    server_name $APP www.$APP;
+    server_name $SERVER_NAMES;
 
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
@@ -27,7 +36,7 @@ NGINXCONF
     docker exec nginx nginx -t && docker exec nginx nginx -s reload
     certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
         --non-interactive --agree-tos -m timothykim@fastmail.fm \
-        --cert-name "$APP" -d "$APP" -d "www.$APP"
+        --cert-name "$APP" $CERT_DOMAINS
     git -C /opt/hantim restore "docker/nginx/conf.d/$APP.conf" 2>/dev/null || rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"
     trap - EXIT
     docker exec nginx nginx -t && docker exec nginx nginx -s reload