From f10cef61cef0fa4983d08093cb9dc37068eef461 Mon Sep 17 00:00:00 2001
From: Ben <wilsob12@gmail.com>
Date: Tue, 18 Aug 2026 08:52:25 -0400
Subject: [PATCH] Automate deployment of renewed TLS certificates

---
 scripts/certbot-deploy-public-pool.sh | 33 +++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100755 scripts/certbot-deploy-public-pool.sh

diff --git a/scripts/certbot-deploy-public-pool.sh b/scripts/certbot-deploy-public-pool.sh
new file mode 100755
index 0000000..377e89d
--- /dev/null
+++ b/scripts/certbot-deploy-public-pool.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+set -eu
+
+lineage=${RENEWED_LINEAGE:-/etc/letsencrypt/live/public-pool.io}
+secrets_dir=${PUBLIC_POOL_SECRETS_DIR:-/home/ben/public-pool-timescaledb-test/secrets}
+container=${PUBLIC_POOL_CONTAINER:-public-pool}
+owner=${PUBLIC_POOL_CERT_OWNER:-ben}
+group=${PUBLIC_POOL_CERT_GROUP:-ben}
+
+cert_source="$lineage/fullchain.pem"
+key_source="$lineage/privkey.pem"
+
+test -r "$cert_source"
+test -r "$key_source"
+openssl x509 -in "$cert_source" -noout >/dev/null
+openssl pkey -in "$key_source" -noout >/dev/null
+
+cert_temp=$(mktemp "$secrets_dir/.cert.pem.XXXXXX")
+key_temp=$(mktemp "$secrets_dir/.key.pem.XXXXXX")
+trap 'rm -f "$cert_temp" "$key_temp"' EXIT HUP INT TERM
+
+cat "$cert_source" > "$cert_temp"
+cat "$key_source" > "$key_temp"
+chown "$owner:$group" "$cert_temp" "$key_temp"
+chmod 0644 "$cert_temp"
+chmod 0600 "$key_temp"
+mv -f "$cert_temp" "$secrets_dir/cert.pem"
+mv -f "$key_temp" "$secrets_dir/key.pem"
+
+# HTTPS can reload its secure context, but the Stratum TLS listeners currently
+# read their certificate only when they start.
+docker restart --time 30 "$container" >/dev/null