From 76096a037d13d8d5342c212c8c11cced4a6f1fea Mon Sep 17 00:00:00 2001
From: Pascal <pascal@pdev.dev>
Date: Sun, 5 Apr 2020 23:38:24 -0400
Subject: [PATCH] [add] added deploy hook to indicate new cert  -
 $certs_updated is now only touched when a cert has been generated/renewed

---
 certbot/files/entrypoint.sh | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/certbot/files/entrypoint.sh b/certbot/files/entrypoint.sh
index ae42405..b0c0e69 100644
--- a/certbot/files/entrypoint.sh
+++ b/certbot/files/entrypoint.sh
@@ -14,6 +14,7 @@ log_file="" # leave empty for stdout
 # variables
 local_webserver="http://proxy:8080"
 domain_file="$temp_path/domains.txt"
+certs_deployed="$temp_path/.deployed"
 certs_updated="$cert_root_path/.updated"
 
 #functions
@@ -145,6 +146,7 @@ function get_cert()
             log WARNING get_cert "PRODUCTION not set, exiting"
             return 0
         fi
+        # using -deploy-hook to indicate a newly deployed cert
         log get_cert "Running certbot"
         certbot certonly \
             --config-dir "$cert_bot_ssl" \
@@ -156,6 +158,7 @@ function get_cert()
             --no-eff-email \
             --expand \
             --noninteractive \
+            --deploy-hook "touch $certs_deployed.$root_domain" \
             --webroot \
             --webroot-path "$web_root_path"
         #    $OPTIONS || true
@@ -189,11 +192,15 @@ function domain_handler()
     local domain=$1; shift
     local subs=$@
     local domain_string="$domain"
+
+    # check if dns record for root domain exists
     log domain_handler "Checking root domain [$domain]"
     if ! verify_domain $domain; then
         log ERROR domain_handler "Root domain [$domain] does not exist"
         return 1
     fi
+
+    # only add sub domains with dns record to domain string
     for sub in $subs ; do
         local subdomain="$sub.$domain"
         log domain_handler "Checking sub domain [$subdomain]"
@@ -203,12 +210,30 @@ function domain_handler()
             domain_string="$domain_string,$subdomain"
         fi
     done
-    init_cert $domain
+
+    # generate or renew cert via certbot
     if ! get_cert $domain $domain_string; then
-        log ERROR domain_handler "No cert generated by certbot for [$domain]"
+        log ERROR domain_handler "Error when generating/renewing cert for [$domain]"
         return 1
     fi
-    copy_cert $domain
+
+    # install any newly deployed certs
+    if [[ -f "$certs_deployed.$domain" ]]; then
+        if ! copy_cert $domain; then
+            log ERROR domain_handler "Certs for [$domain] could not be installed"
+            return 1
+        fi
+        rm "$certs_deployed.$domain"
+
+        # indicated that certs have been updated to nginx
+        touch "$certs_updated"
+        log domain_handler "Certs for [$domain] installed"
+    else
+        log domain_handler "No new certs for [$domain] to be installed"
+    fi
+
+    return 0
+    
 }
 
 function main()
@@ -228,9 +253,7 @@ function main()
         # requires nginx to be started
         # timout is set via $server_retries (default 10s)
         read_file domain_handler "$domain_file"
-
-        # indicated that certs have been updated to nginx
-        touch "$certs_updated"
+        
         log main "Ending intervall"
         log main "Next interval in $intervall"
         sleep "$intervall"