From 08ed18bb96d2c07c2ee1a635ffef7b2871adc425 Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Sat, 15 Aug 2026 01:12:37 +0000
Subject: [PATCH] =?UTF-8?q?deploy:=20Let's=20Encrypt=20deploy-hook=20?=
 =?UTF-8?q?=E2=80=94=20installs=20the=20renewed=20cert=20into=20echoircd's?=
 =?UTF-8?q?=20tls/=20(readable=20by=20the=20daemon=20user)=20and=20restart?=
 =?UTF-8?q?s=20only=20when=20it=20changed;=20symlink=20into=20certbot=20re?=
 =?UTF-8?q?newal-hooks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/le-deploy-hook.sh | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100755 deploy/le-deploy-hook.sh

diff --git a/deploy/le-deploy-hook.sh b/deploy/le-deploy-hook.sh
new file mode 100755
index 0000000..36b6563
--- /dev/null
+++ b/deploy/le-deploy-hook.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Let's Encrypt deploy hook for echoIRCd.
+#
+# echoircd runs as an unprivileged user and can't read /etc/letsencrypt/live
+# (privkey.pem is root-only). This copies the renewed cert+key into the location
+# echoircd already reads (its tls/ dir), owned by that user, then restarts it.
+#
+# Runs in two ways:
+#   * manually, to install the cert the first time:   sudo deploy/le-deploy-hook.sh
+#   * automatically by certbot on renewal — symlink it into
+#     /etc/letsencrypt/renewal-hooks/deploy/ so `certbot renew` invokes it.
+# When certbot runs it, $RENEWED_LINEAGE names the cert that was renewed; we act
+# only for ours (and always, when run by hand with no such variable set).
+set -eu
+
+DOMAIN=irc.devtronic.pro
+SRC=/etc/letsencrypt/live/$DOMAIN
+DST=/home/debian/irc/ircd/echoIRCd/tls
+UNIT=echoircd-dev.service
+
+# skip other certs when certbot fires this for a renewal that isn't ours
+if [ -n "${RENEWED_LINEAGE:-}" ] && [ "$RENEWED_LINEAGE" != "$SRC" ]; then
+    exit 0
+fi
+
+# only restart if the cert actually changed (so an unrelated renewal is a no-op)
+changed=0
+cmp -s "$SRC/fullchain.pem" "$DST/cert.pem" || changed=1
+
+install -o debian -g debian -m 644 "$SRC/fullchain.pem" "$DST/cert.pem"
+install -o debian -g debian -m 640 "$SRC/privkey.pem"   "$DST/key.pem"
+
+if [ "$changed" = 1 ]; then
+    systemctl restart "$UNIT"
+    echo "echoircd: installed LE cert for $DOMAIN and restarted $UNIT"
+else
+    echo "echoircd: LE cert for $DOMAIN unchanged; nothing to do"
+fi