← back to Kamatera Ops

TK-12164: renew most-urgent lineages first (expired, then fewest days left)

abcea51712fc433fd62ce01efeca90e9e087e753 · 2026-09-24 15:50:51 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Files touched

• M cert-fleet-fix.sh

Diff

commit abcea51712fc433fd62ce01efeca90e9e087e753
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 24 15:50:51 2026 -0700

    TK-12164: renew most-urgent lineages first (expired, then fewest days left)
    
    Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cert-fleet-fix.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/cert-fleet-fix.sh b/cert-fleet-fix.sh
index d853343..65617e1 100755
--- a/cert-fleet-fix.sh
+++ b/cert-fleet-fix.sh
@@ -80,8 +80,10 @@ try_webroot() { # lineage, domains
 
 # Candidates: certs expiring within DAYS. certbot.timer renews at 30 days left, so a cert under
 # 30 days is one the timer has failed to renew.
+# Most urgent first (expired, then fewest days left), so a long run fixes what's on fire before the rest.
 mapfile -t LINS < <(for c in /etc/letsencrypt/live/*/cert.pem; do
-  l=$(basename "$(dirname "$c")"); [ "$(days_left "$l")" -lt "$DAYS" ] && echo "$l"; done)
+  l=$(basename "$(dirname "$c")"); d=$(days_left "$l"); [ "$d" -lt "$DAYS" ] && echo "$d $l"; done \
+  | sort -n | cut -d' ' -f2)
 
 say "=== run $TS candidates=${#LINS[@]} (expiring <${DAYS}d) report_only=$REPORT"
 if [ "$REPORT" = 0 ] && [ "${#LINS[@]}" -gt 0 ]; then
@@ -95,8 +97,7 @@ for lin in "${LINS[@]}"; do
       [ "$REPORT" = 1 ] || cb certonly --non-interactive --force-renewal --dns-cloudflare \
         --dns-cloudflare-credentials "$ini" --dns-cloudflare-propagation-seconds 30 \
         --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1 || method="FAILED-real dns-cloudflare"
-    else method="FAILED no Cloudflare token can edit $(zone_of "$first")"; fi
-  else
+    else method="FAILED no Cloudflare token can edit $(zone_of "$first")"; fi  else
     if why=$(try_webroot "$lin" "$doms"); then method="webroot $WEBROOT"
       [ "$REPORT" = 1 ] || cb certonly --non-interactive --force-renewal --webroot -w "$WEBROOT" \
         --cert-name "$lin" $(dargs "$doms") >>"$LOG" 2>&1 || method="FAILED-real webroot"

← 47249a7 TK-12164: separate 'probe unreachable' from 'staging dry-run  ·  back to Kamatera Ops  ·  TK-12164: record the installed /etc/cron.d/cert-fleet-fix (1 1464510 →