`issue-wildcard.sh`

32 lines
#!/usr/bin/env bash
# issue-wildcard.sh  — ONE-TIME wildcard cert for *.designerwallcoverings.com (DNS-01)
#
# GATED: irreversible-ish (consumes a Let's Encrypt issuance; account already at ~27/50
# this week). Do NOT run without Steve's approval. Run once; every vendor vhost then
# references /etc/letsencrypt/live/designerwallcoverings.com/.
#
# certbot-dns-cloudflare is already installed; creds at /root/.secrets/cloudflare.ini.
# Proven on bubbe.ai. Per-subdomain certbot would blow the 50/week cap.
set -euo pipefail

echo "== issuing ONE wildcard cert: *.designerwallcoverings.com + apex (DNS-01 via Cloudflare) =="
ssh my-server "bash -s" <<'REMOTE'
set -e
test -f /root/.secrets/cloudflare.ini || { echo "missing /root/.secrets/cloudflare.ini"; exit 1; }
chmod 600 /root/.secrets/cloudflare.ini || true

certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 30 \
  -d '*.designerwallcoverings.com' \
  -d 'designerwallcoverings.com' \
  --non-interactive --agree-tos -m steve@designerwallcoverings.com \
  --cert-name designerwallcoverings.com

echo "== cert installed =="
ls -l /etc/letsencrypt/live/designerwallcoverings.com/ || true
certbot certificates 2>/dev/null | grep -A4 designerwallcoverings.com || true
REMOTE
echo "== DONE — wildcard cert ready; vendor vhosts can reference it now =="