mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-25 18:40:06 -04:00
29 lines
976 B
Bash
29 lines
976 B
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Check if the WROLPi leaf certificate is expired or expiring within 30 days.
|
||
|
|
# If so, regenerate it and reload Caddy.
|
||
|
|
|
||
|
|
set -e
|
||
|
|
|
||
|
|
CERT_DIR="${CERT_DIR:-/etc/ssl/wrolpi}"
|
||
|
|
LEAF_CERT="${CERT_DIR}/cert.crt"
|
||
|
|
|
||
|
|
if [ ! -f "${LEAF_CERT}" ]; then
|
||
|
|
echo "Leaf certificate not found at ${LEAF_CERT}, generating..."
|
||
|
|
/opt/wrolpi/scripts/generate_certificates.sh
|
||
|
|
systemctl reload caddy || systemctl restart caddy || echo "Warning: failed to reload Caddy"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Check if cert expires within 30 days.
|
||
|
|
if openssl x509 -checkend 2592000 -noout -in "${LEAF_CERT}" 2>/dev/null; then
|
||
|
|
echo "Certificate is still valid for more than 30 days, no renewal needed."
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "Certificate is expired or expiring within 30 days, renewing..."
|
||
|
|
/opt/wrolpi/scripts/generate_certificates.sh
|
||
|
|
|
||
|
|
# Reload Caddy to pick up new cert.
|
||
|
|
systemctl reload caddy || systemctl restart caddy || echo "Warning: failed to reload Caddy"
|
||
|
|
echo "Certificate renewed and Caddy reloaded."
|