From 017b29539749da3c62202879d757a45ffc71208c Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Mon, 3 Aug 2026 22:27:15 +0300
Subject: Improvements

---
 roles/jails/05_homepage/templates/etc_crontab.j2   |  3 ++-
 .../usr_local_bin_update_agate_certs.sh.j2         | 28 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2

(limited to 'roles/jails/05_homepage/templates')

diff --git a/roles/jails/05_homepage/templates/etc_crontab.j2 b/roles/jails/05_homepage/templates/etc_crontab.j2
index 8541f57..6ec1b69 100644
--- a/roles/jails/05_homepage/templates/etc_crontab.j2
+++ b/roles/jails/05_homepage/templates/etc_crontab.j2
@@ -6,4 +6,5 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 #
 #minute hour    mday    month   wday    who     command
 
-# TODO: update linklog
+# Update agate TLS certs if letsencrypt cert has changed
+*/5     *       *       *       *       root    /usr/local/bin/update-agate-certs >> /var/log/update-agate-certs.log 2>&1
diff --git a/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2 b/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2
new file mode 100644
index 0000000..4f0ddaf
--- /dev/null
+++ b/roles/jails/05_homepage/templates/usr_local_bin_update_agate_certs.sh.j2
@@ -0,0 +1,28 @@
+#!/bin/sh
+# update-agate-certs - convert letsencrypt PEM certs to DER for agate
+# Runs from cron; only converts if the cert has changed
+
+set -eu
+
+CERT_SRC="/mnt/letsencrypt/live/jan.systems/fullchain.pem"
+KEY_SRC="/mnt/letsencrypt/live/jan.systems/privkey.pem"
+TLS_DIR="/usr/local/etc/agate/tls"
+CHECKSUM_FILE="${TLS_DIR}/.cert.sha256"
+
+# Check if cert has changed
+CURRENT_SUM=$(sha256 -q "${CERT_SRC}")
+if [ -f "${CHECKSUM_FILE}" ] && [ "$(cat "${CHECKSUM_FILE}")" = "${CURRENT_SUM}" ]; then
+    exit 0
+fi
+
+echo "Certificate changed, converting to DER..."
+
+openssl x509 -in "${CERT_SRC}" -out "${TLS_DIR}/cert.der" -outform DER
+openssl pkey -in "${KEY_SRC}" -out "${TLS_DIR}/key.der" -outform DER
+chown www:www "${TLS_DIR}/cert.der" "${TLS_DIR}/key.der"
+chmod 640 "${TLS_DIR}/cert.der" "${TLS_DIR}/key.der"
+
+echo "${CURRENT_SUM}" > "${CHECKSUM_FILE}"
+
+service agate status > /dev/null 2>&1 && service agate restart
+echo "Done."
-- 
cgit v1.3