34 lines
1.3 KiB
Bash
34 lines
1.3 KiB
Bash
#!/bin/sh
|
|
# Watch for acme.sh reload signals and invoke the TrueNAS deploy.
|
|
#
|
|
# The acme service (see compose.yaml) touches /certs/.deploy-signal after
|
|
# every successful --issue / --renew via --reloadcmd. This script waits for
|
|
# the signal file to change and re-runs the deploy.
|
|
set -eu
|
|
|
|
SIGNAL_DIR="/certs"
|
|
SIGNAL_FILE=".deploy-signal"
|
|
DEBOUNCE_SECONDS="${DEPLOY_DEBOUNCE_SECONDS:-3}"
|
|
|
|
log() { printf '[%s] %s\n' "$(date -Iseconds)" "$*"; }
|
|
|
|
# Prime: run once at startup so an initial deploy happens after a fresh
|
|
# --issue (or after the sidecar itself is recreated).
|
|
log "startup deploy"
|
|
python3 /usr/local/bin/deploy.py || log "startup deploy returned non-zero"
|
|
|
|
log "watching $SIGNAL_DIR/$SIGNAL_FILE"
|
|
# --include filters the parent-directory events to just our signal file.
|
|
# NB: anchored regex (`^...$`) does not fire reliably in inotifywait; the
|
|
# file name is unique in the watched directory so a substring match is safe.
|
|
inotifywait -m -q \
|
|
-e close_write -e create -e attrib -e moved_to \
|
|
--include "${SIGNAL_FILE}" \
|
|
"$SIGNAL_DIR" |
|
|
while read -r _ _ _; do
|
|
# Debounce: coalesce bursts (acme issues + renews may touch several times).
|
|
sleep "$DEBOUNCE_SECONDS"
|
|
log "signal received, deploying"
|
|
python3 /usr/local/bin/deploy.py || log "deploy returned non-zero"
|
|
done
|