#!/bin/sh
# Certbot deploy hook. Runs once per certificate that was actually renewed.
#
# It only leaves a marker. Every jump has its own certificate, so a single `certbot renew` can renew
# dozens in one pass, and reloading here would reload Nginx once per certificate. Nginx holds
# long-lived WebSocket connections to the contract containers, and a reload retires workers only once
# their connections drain — so dozens of reloads in a row accumulate worker processes rather than
# replacing them. The post hook does the reloading, once.
set -eu

touch /run/veiledcrossroads-nginx-reload

# Certbot creates these 0700 root, and the hub cannot then see its own certificates — it decides
# what to put in a server block by asking whether the file exists. postinst sets this at install;
# repeated here so a directory Certbot recreates later does not quietly close again.
for d in /etc/letsencrypt/live /etc/letsencrypt/archive; do
  [ -d "$d" ] || continue
  chgrp veiledcrossroads "$d" 2>/dev/null || true
  chmod 0750 "$d" 2>/dev/null || true
done
