fix(deploy): no-clobber nginx vhost install so certbot :443 blocks survive deploys

c1f8120c0a2280859553e025ab1978bc56baf046 · 2026-09-09 09:05:03 -0700 · Steve

Files touched

M scripts/deploy-fleet.sh

Diff

commit c1f8120c0a2280859553e025ab1978bc56baf046
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Sep 9 09:05:03 2026 -0700

    fix(deploy): no-clobber nginx vhost install so certbot :443 blocks survive deploys
---
 scripts/deploy-fleet.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/deploy-fleet.sh b/scripts/deploy-fleet.sh
index 2be8fef..bfea484 100755
--- a/scripts/deploy-fleet.sh
+++ b/scripts/deploy-fleet.sh
@@ -17,9 +17,14 @@ echo "==> install deps + pm2 start"
 ssh "$HOST" "cd $REMOTE && npm install --omit=dev --silent && pm2 start ecosystem.config.js && pm2 save"
 
 echo "==> install nginx vhosts"
-ssh "$HOST" "cp $REMOTE/data/nginx/*.conf /etc/nginx/sites-available/ && \
-  for f in $REMOTE/data/nginx/*.conf; do \
-    b=\$(basename \$f); ln -sf /etc/nginx/sites-available/\$b /etc/nginx/sites-enabled/\$b; \
+# NO-CLOBBER: only install a vhost conf if it doesn't already exist on the box.
+# certbot --nginx upgrades each conf in-place with the :443 block + cert; an unconditional
+# cp here overwrites that and takes the whole fleet HTTPS-down (000) on every deploy.
+# New domains still get their HTTP conf; existing (certbot-managed) confs are preserved.
+ssh "$HOST" "for f in $REMOTE/data/nginx/*.conf; do \
+    b=\$(basename \$f); \
+    [ -e /etc/nginx/sites-available/\$b ] || cp \$f /etc/nginx/sites-available/\$b; \
+    ln -sf /etc/nginx/sites-available/\$b /etc/nginx/sites-enabled/\$b; \
   done && nginx -t && systemctl reload nginx"
 
 echo "==> smoke test (origin, via Host header)"

← 8d99c6c auto-data-snapshot: 2026-09-09T08:26:36 (1 data files) — dat · back to Dw Domain Fleet · monetize mode: AdSense Auto Ads + for-sale banner + content 197eead →