letsencrypt/renewal.sh

#!/bin/bash

set -e

ERR_SUBJ='Error during renewal certs and keys!!!'
LOG_FILE=/var/log/letsencrypt/renewal-$(date +%Y-%m-%d).log
branch=master
git_dir=pki
#git_url="git.sdsys.ru/sdsys/pki.git"

. /tmp/err_trap

if [[ -z ${CERT_SUBDIR} ]];then echo "variable CERT_SUBDIR doesn't set"; exit 1;fi
[[ ${CERT_SUBDIR} == "dev_iru" ]] && exit 0

mail_send() {
                echo "$1"|mail -s "Attention! Certificate renewal status!" \
                -S smtp=${SMTP_SERVER} \
                -S smtp-use-starttls \
                -S smtp-auth=login \
                -S ssl-verify=ignore \
                -S smtp-auth-user=${JENKINS_MAIL_USER} \
                -S smtp-auth-password=$(cat /run/secrets/jenkins-mail-pass) \
                -S nss-config-dir=/etc/pki/nssdb \
                -S from=${JENKINS_MAIL_USER} \
                -a ${LOG_FILE} \
                ${RECIPIENT_MAIL_BOX}
}

git_push() {
              cd /${git_dir}
              echo "Renew keys and certs" > /tmp/commit.txt
              git config --global user.email "${JENKINS_MAIL_USER}"
              git config --global user.name "Jenkins"
              git add -A 
              if [[ ! -z $(git status -s) ]];then
                    git commit -F /tmp/commit.txt
                    git push https://${GIT_USER}:$(cat /run/secrets/provision-pass)@${GIT_URL} ${branch}
              fi

}

clear_log() {
              echo -n > ${LOG_FILE}
}

clear_log

echo "Delete /${git_dir}"
[[ -d /${git_dir} ]] && rm -rf /${git_dir}

echo "Git clone ${GIT_URL}"
cd / && git clone https://${GIT_USER}:$(cat /run/secrets/provision-pass)@${GIT_URL} && cd /${git_dir} && git checkout ${branch}

certbot renew --dry-run --config-dir /${git_dir}/${CERT_SUBDIR}/letsencrypt
if [ $? -ne 0 ];then message="letsencrypt. Can't execute "dry-run" renew procces. Renew certs and keys will be skipped!!!"; mail_send; exit 1;fi
clear_log

echo "Renewal certs and keys"
certbot renew --config-dir /${git_dir}/${CERT_SUBDIR}/letsencrypt >> ${LOG_FILE} 2>&1

echo "Git push ${GIT_URL}"
git_push

echo "Send ${LOG_FILE} to ${RECIPIENT_MAIL_BOX}"
mail_send "LETSENCRYPT!!! Renew Certs and Keys are success!!!"