generic letsencrypt deploy renewal-hook script

renewal.sh

#!/bin/bash

SRCDIR=/etc/letsencrypt/live/protected.site.domain.com
DSTDIR=/etc/service/ssl
SERVICE=theservice.service

###

function chksum {
    sha1sum "$1" | awk '{ print $1 }' || echo ""
    return $?
}

SSLFILES=( cert.pem chain.pem fullchain.pem privkey.pem )

if [[ ! -d "$SRCDIR" ]]; then
    echo "FATAL: source dir ($SRCDIR) does not exist."
    exit 100
fi

if [[ ! -d "$DSTDIR" ]]; then
    echo "FATAL: destination dir ($DSTDIR) does not exist."
    exit 100
fi

RESTART=0

OWNER="$( stat -c "%u:%g" "$DSTDIR" )"

for S in ${SSLFILES[@]}; do
    ORIGIN="${SRCDIR}/${S}"
    DEST="${DSTDIR}/${S}"

    COPY=0

    if [[ -e "$ORIGIN" ]]; then
        RORIGIN="$( realpath -e "$ORIGIN" )"
        if [[ $? -ne 0 ]]; then
            echo "Problem resolving symlink \"$ORIGIN\". Aborting."
            continue
        fi
        SUM="$( chksum "$RORIGIN" )"
        if [[ ! -e "$DEST" ]]; then
            echo "${DEST} does not exist. Copying."
            COPY=1
        elif [[ "$RORIGIN" -nt "$DEST" ]]; then
            echo "${DEST} older than ${ORIGIN}. Copying."
            COPY=1
        else
            DSUM="$( chksum "$DEST" )"
            if [[ "$SUM" != "$DSUM" ]]; then
                echo "Checksums do not match. Copying."
                COPY=1
            fi
        fi

        if [[ $COPY -ne 0 ]]; then
            cp -a "$RORIGIN" "$DEST"
            if [[ $? -ne 0 ]]; then
                echo "Copy FAILED. Aborting work on $ORIGIN."
                continue
            fi
            echo "Updated \"$DEST\"."
            chown -c $OWNER "$DEST"
            RESTART=1
        fi
    fi
done

if [[ $RESTART -ne 0 ]]; then
    systemctl is-active --quiet $SERVICE
    if [[ $? -eq 0 ]]; then
        echo "Restarting $SERVICE"
        systemctl restart $SERVICE
    else
        echo "Not restarting $SERVICE, because it's not running."
    fi
else
    echo "No update required."
fi