#!/bin/sh
# Certbot post hook. Runs after every renewal attempt, whether or not anything was renewed; the
# marker left by the deploy hook is what makes it a no-op when nothing was.
#
# Without this the renewal succeeds on disk and Nginx goes on presenting the certificate it loaded at
# startup. Nothing fails at the time. It surfaces up to ninety days later as an expired certificate
# while a perfectly good one sits in /etc/letsencrypt, which is a miserable thing to diagnose.
set -eu

[ -e /run/veiledcrossroads-nginx-reload ] || exit 0

if nginx -t 2>/dev/null; then
  systemctl reload nginx
  rm -f /run/veiledcrossroads-nginx-reload
else
  # The marker is deliberately kept: the next renewal attempt retries rather than leaving new
  # certificates permanently unserved. Non-zero so it reaches the journal instead of passing quietly.
  echo "veiledcrossroads: nginx -t failed, so Nginx was not reloaded." >&2
  echo "  Renewed certificates are on disk but are not being served. Fix the configuration," >&2
  echo "  then: nginx -t && systemctl reload nginx" >&2
  exit 1
fi
