Add guarded IP certificate flow and renewal history

backend/internal/nginxgateway/renewal-hook.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+/usr/sbin/nginx -t
+/bin/systemctl reload nginx
+
+# Certbot sets RENEWED_LINEAGE for successful renewals. Record only a simple
+# lineage name, not certificate contents, account credentials, or key paths.
+case "${RENEWED_LINEAGE:-}" in
+  /etc/letsencrypt/live/*)
+    cert_name=${RENEWED_LINEAGE##*/}
+    case "$cert_name" in
+      ''|*[!a-zA-Z0-9._-]*) exit 0 ;;
+    esac
+    /usr/bin/install -d -m 700 /var/log/opsx-vpn
+    /usr/bin/touch /var/log/opsx-vpn/cert-renewals.log
+    /bin/chmod 600 /var/log/opsx-vpn/cert-renewals.log
+    /usr/bin/printf '%s\t%s\n' "$(/bin/date -u +%Y-%m-%dT%H:%M:%SZ)" "$cert_name" >> /var/log/opsx-vpn/cert-renewals.log
+    ;;
+esac