39 lines
1.1 KiB
Bash
Executable file
39 lines
1.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# certbot-init.sh — obtain the first Let's Encrypt certificate for the
|
|
# «Контракт-чек» edge proxy and reload nginx.
|
|
#
|
|
# Run this once on the VPS after DNS points the domain at this server and the
|
|
# certbot container is started (see DEPLOY.md).
|
|
#
|
|
# Usage:
|
|
# chmod +x deploy/nginx/certbot-init.sh
|
|
# ./deploy/nginx/certbot-init.sh your-domain.example.com admin@example.com
|
|
|
|
DOMAIN="${1:-}"
|
|
EMAIL="${2:-}"
|
|
|
|
if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
|
|
echo "Usage: $0 <domain> <email>"
|
|
exit 1
|
|
fi
|
|
|
|
# The certbot container in docker-compose mounts these directories.
|
|
# It must be running so certbot can write the webroot challenge response.
|
|
CERTBOT_WEBROOT=/var/www/certbot
|
|
LE_DIR=/etc/letsencrypt
|
|
|
|
docker compose --profile edge run --rm --entrypoint "certbot certonly \
|
|
--webroot \
|
|
--webroot-path ${CERTBOT_WEBROOT} \
|
|
--agree-tos \
|
|
--no-eff-email \
|
|
--email ${EMAIL} \
|
|
-d ${DOMAIN} \
|
|
--non-interactive" certbot
|
|
|
|
# Reload nginx so it picks up the new certificate.
|
|
docker compose --profile edge exec nginx nginx -s reload
|
|
|
|
echo "Certificate issued for ${DOMAIN}. Nginx reloaded."
|