← back to Kamatera Ops

TK-12164: separate 'probe unreachable' from 'staging dry-run refused' in webroot failures

47249a7642658861bc2bcc62d9c6dbe57cd576c3 · 2026-09-24 15:17:42 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Files touched

• M cert-fleet-fix.sh

Diff

commit 47249a7642658861bc2bcc62d9c6dbe57cd576c3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 24 15:17:42 2026 -0700

    TK-12164: separate 'probe unreachable' from 'staging dry-run refused' in webroot failures
    
    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cert-fleet-fix.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/cert-fleet-fix.sh b/cert-fleet-fix.sh
index d1ae669..d853343 100755
--- a/cert-fleet-fix.sh
+++ b/cert-fleet-fix.sh
@@ -70,10 +70,12 @@ try_webroot() { # lineage, domains
   mkdir -p "$WEBROOT/.well-known/acme-challenge"; echo ok > "$WEBROOT/.well-known/acme-challenge/$p"
   for d in $doms; do
     if [ "$(curl -s -m 8 -L "http://$d/.well-known/acme-challenge/$p")" != ok ]; then
-      rm -f "$WEBROOT/.well-known/acme-challenge/$p"; return 1; fi
+      rm -f "$WEBROOT/.well-known/acme-challenge/$p"; echo "probe unreachable at http://$d"; return 1; fi
   done
   rm -f "$WEBROOT/.well-known/acme-challenge/$p"
-  cb certonly --dry-run --non-interactive --webroot -w "$WEBROOT" --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1
+  # Distinct from a probe failure: the route works but Let's Encrypt staging still refused.
+  cb certonly --dry-run --non-interactive --webroot -w "$WEBROOT" --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1 \
+    || { echo "staging dry-run refused (route OK) — see $LOG"; return 1; }
 }
 
 # Candidates: certs expiring within DAYS. certbot.timer renews at 30 days left, so a cert under
@@ -95,10 +97,10 @@ for lin in "${LINS[@]}"; do
         --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1 || method="FAILED-real dns-cloudflare"
     else method="FAILED no Cloudflare token can edit $(zone_of "$first")"; fi
   else
-    if try_webroot "$lin" "$doms"; then method="webroot $WEBROOT"
+    if why=$(try_webroot "$lin" "$doms"); then method="webroot $WEBROOT"
       [ "$REPORT" = 1 ] || cb certonly --non-interactive --force-renewal --webroot -w "$WEBROOT" \
         --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1 || method="FAILED-real webroot"
-    else method="FAILED probe not reachable over http (non-Cloudflare DNS)"; fi
+    else method="FAILED webroot: $why"; fi
   fi
   case "$method" in FAILED*) fail=$((fail+1)); FAILED+=("$lin");; *) ok=$((ok+1));; esac
   say "$lin | ${left}d | $doms| $method"

← a9c5ac8 TK-12164: wait for certbot lock instead of misreporting a ti  ·  back to Kamatera Ops  ·  TK-12164: renew most-urgent lineages first (expired, then fe abcea51 →