From 9270bd70cb22fe6c5e2ef196cd49f2430a41a364 Mon Sep 17 00:00:00 2001 From: "Timur Kh." Date: Mon, 19 Oct 2026 15:04:08 +0300 Subject: [PATCH] deploy: reload nginx after a certificate renewal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `certbot certonly` replaces the files on disk but signals nothing, so nginx would have gone on serving the old certificate until some unrelated reload happened — which is to say the cert would have quietly expired in January. `--nginx` installs this hook itself; keeping the vhost in git means we install it ourselves. Co-Authored-By: Claude Opus 5 --- deploy/deploy.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/deploy/deploy.sh b/deploy/deploy.sh index 7958b21..73dfd8b 100755 --- a/deploy/deploy.sh +++ b/deploy/deploy.sh @@ -115,6 +115,19 @@ EOF --keep-until-expiring fi +# `certonly` renews the files but tells nothing to pick them up, so without a +# deploy hook nginx keeps serving the old certificate until something reloads it +# by chance — i.e. it silently expires. `--nginx` would have done this for us; +# this is the price of keeping the vhost in git. +say "Installing the renewal hook" +install -d /etc/letsencrypt/renewal-hooks/deploy +cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK' +#!/bin/sh +# Installed by kadence's deploy/deploy.sh. Runs after any successful renewal. +nginx -t && systemctl reload nginx +HOOK +chmod 755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh + say "Installing the vhost" install -m 644 "$VHOST_SRC" "$VHOST_DST" ln -sfn "$VHOST_DST" "/etc/nginx/sites-enabled/${DOMAIN}"