From b15bc8b162e9aacd12c7882ddb3c8cc3ca82189b Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Mon, 29 Jun 2026 21:13:59 -0500 Subject: certbot: scoped CF API token; gate prosody deploy hook on RENEWED_LINEAGE cred.conf.j2 now emits the single-line dns_cloudflare_api_token form (scoped Cloudflare API Token) instead of the legacy account-wide email + global API key. prosody.sh.j2 deploy hook now no-ops unless $RENEWED_LINEAGE matches the prosody vhost, so unrelated lineage renewals (haskell.social, etracapital.com) no longer report a spurious "Hook reported error code 1 / No certificate for host found". Co-Authored-By: Claude Opus 4.8 (1M context) --- certbot-dns-cloudflare/templates/cred.conf.j2 | 6 ++++-- prosody/templates/prosody.sh.j2 | 21 +++++++++++++++++++-- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/certbot-dns-cloudflare/templates/cred.conf.j2 b/certbot-dns-cloudflare/templates/cred.conf.j2 index 73db188..648cfd2 100644 --- a/certbot-dns-cloudflare/templates/cred.conf.j2 +++ b/certbot-dns-cloudflare/templates/cred.conf.j2 @@ -1,2 +1,4 @@ -dns_cloudflare_email = {{certbot_dns_cloudflare_email}} -dns_cloudflare_api_key = {{certbot_dns_cloudflare_api_key}} +# Cloudflare credentials for the certbot DNS-01 challenge. +# Scoped API Token (Zone:DNS:Edit on the relevant zones) — see the +# "TLS / SSL Certificates" section of the rpi playbook README. +dns_cloudflare_api_token = {{certbot_dns_cloudflare_api_token}} diff --git a/prosody/templates/prosody.sh.j2 b/prosody/templates/prosody.sh.j2 index defe301..73cca7c 100644 --- a/prosody/templates/prosody.sh.j2 +++ b/prosody/templates/prosody.sh.j2 @@ -1,3 +1,20 @@ -#! /bin/bash +#!/bin/bash +# +# certbot deploy hook — import the renewed Let's Encrypt cert into prosody's store. +# +# Hooks in renewal-hooks/deploy/ run after *every* lineage renewal, so when certbot +# renews some other domain (e.g. haskell.social, etracapital.com) this script would +# still try to import {{prosody_vhost}} and exit 1 with "No certificate for host +# found :(" — harmless, but it makes `certbot renew` report a scary hook error. +# +# Gate on certbot's $RENEWED_LINEAGE so we only act on the prosody vhost's renewal. +# When invoked manually with no $RENEWED_LINEAGE (e.g. ansible provisioning), import. -prosodyctl --root cert import {{prosody_vhost}} /etc/letsencrypt/live/{{prosody_vhost}}/ +set -eu + +if [ -n "${RENEWED_LINEAGE:-}" ] \ + && [ "${RENEWED_LINEAGE}" != "/etc/letsencrypt/live/{{prosody_vhost}}" ]; then + exit 0 +fi + +prosodyctl --root cert import {{prosody_vhost}} "/etc/letsencrypt/live/{{prosody_vhost}}/" -- cgit v1.2.3