`scripts/provision-ssl.sh`

23 lines
#!/usr/bin/env bash
# provision-ssl.sh — run certbot --nginx for a batch of fleet domains AFTER
# their DNS has cut over to 45.61.58.125 and propagated.
#
# Usage:  ssh root@45.61.58.125 'bash -s' < provision-ssl.sh domain1 domain2 ...
# certbot rate limit: 50 certs/registered-domain/week, 5 duplicate/week.
# Each domain here is a distinct registered domain so 44 is well under the cap;
# still — run in batches of ~10 and check output before continuing.
set -uo pipefail
EMAIL=info@designerwallcoverings.com
OK=0; FAIL=0
for d in "$@"; do
  echo "==> certbot $d"
  if certbot --nginx -d "$d" -d "www.$d" --non-interactive --agree-tos \
       -m "$EMAIL" --redirect --keep-until-expiring 2>&1 | tail -3; then
    OK=$((OK+1))
  else
    echo "  FAIL $d"; FAIL=$((FAIL+1))
  fi
done
nginx -t && systemctl reload nginx
echo "==> SSL: $OK ok · $FAIL fail"