✨ Adds TrueNAS Certificate Deployer with deployment logic and configuration

acme/truenas-certificate-deployer/entrypoint.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Watch for acme.sh reload signals and invoke the TrueNAS deploy.
+#
+# The acme service (see compose.yaml) touches /certs/.deploy-signal after
+# every successful --issue / --renew via --reloadcmd. This script waits for
+# the signal file to change and re-runs the deploy.
+set -eu
+
+SIGNAL_DIR="/certs"
+SIGNAL_FILE=".deploy-signal"
+DEBOUNCE_SECONDS="${DEPLOY_DEBOUNCE_SECONDS:-3}"
+
+log() { printf '[%s] %s\n' "$(date -Iseconds)" "$*"; }
+
+# Prime: run once at startup so an initial deploy happens after a fresh
+# --issue (or after the sidecar itself is recreated).
+log "startup deploy"
+python3 /usr/local/bin/deploy.py || log "startup deploy returned non-zero"
+
+log "watching $SIGNAL_DIR/$SIGNAL_FILE"
+# --include filters the parent-directory events to just our signal file.
+# NB: anchored regex (`^...$`) does not fire reliably in inotifywait; the
+# file name is unique in the watched directory so a substring match is safe.
+inotifywait -m -q \
+    -e close_write -e create -e attrib -e moved_to \
+    --include "${SIGNAL_FILE}" \
+    "$SIGNAL_DIR" |
+while read -r _ _ _; do
+    # Debounce: coalesce bursts (acme issues + renews may touch several times).
+    sleep "$DEBOUNCE_SECONDS"
+    log "signal received, deploying"
+    python3 /usr/local/bin/deploy.py || log "deploy returned non-zero"
+done