certbot: scoped CF API token; gate prosody deploy hook on RENEWED_LINEAGE

cred.conf.j2 now emits the single-line dns_cloudflare_api_token form (scoped
Cloudflare API Token) instead of the legacy account-wide email + global API key.

prosody.sh.j2 deploy hook now no-ops unless $RENEWED_LINEAGE matches the prosody
vhost, so unrelated lineage renewals (haskell.social, etracapital.com) no longer
report a spurious "Hook reported error code 1 / No certificate for host found".

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

1 files changed, 19 insertions, 2 deletions

diff --git a/prosody/templates/prosody.sh.j2 b/prosody/templates/prosody.sh.j2
index defe301..73cca7c 100644
--- a/prosody/templates/prosody.sh.j2
+++ b/prosody/templates/prosody.sh.j2
@@ -1,3 +1,20 @@
-#! /bin/bash
+#!/bin/bash
+#
+# certbot deploy hook — import the renewed Let's Encrypt cert into prosody's store.
+#
+# Hooks in renewal-hooks/deploy/ run after *every* lineage renewal, so when certbot
+# renews some other domain (e.g. haskell.social, etracapital.com) this script would
+# still try to import {{prosody_vhost}} and exit 1 with "No certificate for host
+# found :(" — harmless, but it makes `certbot renew` report a scary hook error.
+#
+# Gate on certbot's $RENEWED_LINEAGE so we only act on the prosody vhost's renewal.
+# When invoked manually with no $RENEWED_LINEAGE (e.g. ansible provisioning), import.
 
-prosodyctl --root cert import {{prosody_vhost}} /etc/letsencrypt/live/{{prosody_vhost}}/
+set -eu
+
+if [ -n "${RENEWED_LINEAGE:-}" ] \
+   && [ "${RENEWED_LINEAGE}" != "/etc/letsencrypt/live/{{prosody_vhost}}" ]; then
+    exit 0
+fi
+
+prosodyctl --root cert import {{prosody_vhost}} "/etc/letsencrypt/live/{{prosody_vhost}}/"