#!/bin/sh
set -eu
/usr/sbin/nginx -t
/bin/systemctl reload nginx

# Certbot sets RENEWED_LINEAGE for successful renewals. Record only a simple
# lineage name, not certificate contents, account credentials, or key paths.
case "${RENEWED_LINEAGE:-}" in
  /etc/letsencrypt/live/*)
    cert_name=${RENEWED_LINEAGE##*/}
    case "$cert_name" in
      ''|*[!a-zA-Z0-9._-]*) exit 0 ;;
    esac
    /usr/bin/install -d -m 700 /var/log/opsx-vpn
    /usr/bin/touch /var/log/opsx-vpn/cert-renewals.log
    /bin/chmod 600 /var/log/opsx-vpn/cert-renewals.log
    /usr/bin/printf '%s\t%s\n' "$(/bin/date -u +%Y-%m-%dT%H:%M:%SZ)" "$cert_name" >> /var/log/opsx-vpn/cert-renewals.log
    ;;
esac