#!/bin/bash
# certbot deploy hook — reloads the dockerized nginx after a certificate renewal.
#
# Runs on the HOST as root, and only when certbot actually installed a new
# certificate. Install by symlinking it into certbot's deploy hook directory:
#
#   sudo ln -s "$PWD/deploy-hook/reload-nginx.sh" \
#              /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
#
# nginx caches certificates in memory, so without this the renewed cert on
# disk is never served.

set -euo pipefail

CONTAINER=nginx-proxy

if [ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null)" != "true" ]; then
	echo "deploy-hook: container '$CONTAINER' is not running — nginx NOT reloaded" >&2
	exit 1
fi

# SIGHUP makes the nginx master re-read its config and re-open cert files.
# Relies on nginx being PID 1 in the container.
docker kill -s HUP "$CONTAINER"
echo "deploy-hook: reloaded nginx in '$CONTAINER' for ${RENEWED_DOMAINS:-unknown domains}"