dehydrated/cron.weekly/local-dehydrated



#!/bin/sh
#
# Renew letsencrypt certificates

set -eu

REALM=$(cat /etc/local-ORG/realm) || true

mailhost=$(cat "/etc/local-REDPILL/$REALM/mailhost") || true
mailname=$(cat /etc/mailname) || true
fqdn=$(hostname --fqdn)
domain=$(hostname --domain)

# update non-EC mailhost cert if resolvable and not a certdomain
if [ -n "$mailhost" ]; then
    if [ -n "$fqdn" ] && [ "$mailhost" != "$fqdn" ]; then
        extradomains=${extradomains:+$extradomains }$fqdn
    fi
    if [ -n "$domain" ] && [ "$mailhost" != "$domain" ] && [ "$fqdn" != "$domain" ]; then
        extradomains=${extradomains:+$extradomains }$domain
    fi
    if [ "$mailhost" = "$mailname" ] && ! grep ^"$mailhost" /etc/dehydrated/domains.txt; then
        dehydrated --cron --domain "$mailhost $extradomains" --algo rsa
    fi
fi

# update certdomain certs
dehydrated --cron "$@"