audit fixes: error handling, docs consistency, bucket idempotency

scripts/bootstrap.sh

@@ -18,8 +18,8 @@ BWS_TOKEN_FILE="/etc/bws-token"
 BWS_VERSION="2.0.0"
 
 # Secret IDs (Bitwarden Secrets Manager)
-SECRET_REGISTRY_TOKEN="43f4a77d-7bb4-49ad-8044-b411016c5c6e"
-SECRET_DEPLOY_PUBKEY="945760dd-90e2-46e5-98ad-b411016e3f3b"
+SECRET_REGISTRY_TOKEN="43f4a77d-7bb4-49ad-8044-b411016c5c6e"  # hantim-ci-registry-push
+SECRET_DEPLOY_PUBKEY="945760dd-90e2-46e5-98ad-b411016e3f3b"    # hantim-deploy-ssh-public-key
 
 # --- Prerequisites ---
 

scripts/configure.sh

@@ -31,7 +31,7 @@ chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
 if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then
     systemctl enable --now certbot-renew.timer
 else
-    echo "0 3 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew
+    echo "0 3 * * * root certbot renew --quiet --deploy-hook 'docker exec nginx nginx -s reload' 2>&1 | logger -t certbot" > /etc/cron.d/certbot-renew
 fi
 
 echo "==> Deploying services..."

scripts/deploy.sh

@@ -23,11 +23,13 @@ server {
 }
 NGINXCONF
 
+    trap 'rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"' EXIT
     docker exec nginx nginx -t && docker exec nginx nginx -s reload
     certbot certonly --webroot -w /opt/hantim/docker/nginx/certbot/www \
         --non-interactive --agree-tos --register-unsafely-without-email \
         --cert-name "$APP" -d "$APP" -d "www.$APP"
     rm -f "/opt/hantim/docker/nginx/conf.d/$APP.conf"
+    trap - EXIT
     echo "Certificate issued for $APP"
     exit 0
 fi
@@ -59,8 +61,9 @@ if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
         secret_key="${line#*=}"
         value=$(bws secret list | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
         if [ -z "$value" ]; then
-            echo "WARNING: Secret '$secret_key' not found in bws, skipping."
-            continue
+            echo "ERROR: Secret '$secret_key' not found in bws."
+            echo "  Check that the secret exists and the machine account has access."
+            exit 1
         fi
         env_content="${env_content}${var_name}=${value}"$'\n'
     done < "docker/$APP/.env.keys"