mirror of
https://github.com/lrnselfreliance/wrolpi.git
synced 2026-10-26 02:48:38 -04:00
d6b019c24e
help.sh now detects invalid Caddy certificates: expired or unparseable CA/leaf certs, a leaf expiring within 30 days, a leaf that does not match its private key or the current hostname, and Caddy serving a stale cert after regeneration. It also checks that the renewal script is executable and its timer is enabled. scripts/renew_certificates.sh was committed without the executable bit, so wrolpi-cert-renew.service failed with "Permission denied". Set the bit and make repair.sh restore executable bits on all scripts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
976 B
Bash
Executable file
28 lines
976 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Check if the WROLPi leaf certificate is expired or expiring within 30 days.
|
|
# If so, regenerate it and reload Caddy.
|
|
|
|
set -e
|
|
|
|
CERT_DIR="${CERT_DIR:-/etc/ssl/wrolpi}"
|
|
LEAF_CERT="${CERT_DIR}/cert.crt"
|
|
|
|
if [ ! -f "${LEAF_CERT}" ]; then
|
|
echo "Leaf certificate not found at ${LEAF_CERT}, generating..."
|
|
/opt/wrolpi/scripts/generate_certificates.sh
|
|
systemctl reload caddy || systemctl restart caddy || echo "Warning: failed to reload Caddy"
|
|
exit 0
|
|
fi
|
|
|
|
# Check if cert expires within 30 days.
|
|
if openssl x509 -checkend 2592000 -noout -in "${LEAF_CERT}" 2>/dev/null; then
|
|
echo "Certificate is still valid for more than 30 days, no renewal needed."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Certificate is expired or expiring within 30 days, renewing..."
|
|
/opt/wrolpi/scripts/generate_certificates.sh
|
|
|
|
# Reload Caddy to pick up new cert.
|
|
systemctl reload caddy || systemctl restart caddy || echo "Warning: failed to reload Caddy"
|
|
echo "Certificate renewed and Caddy reloaded."
|