#!/bin/sh
set -eu

DOCKER=/usr/bin/docker
NGINX=/usr/bin/nginx
# Use the image already installed on the server. Updating this image is an
# explicit maintenance action, so renewal never pulls unexpectedly at runtime.
CERTBOT_IMAGE='certbot/certbot:latest'

"$DOCKER" run --rm --network host \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v /www/docker/aiput-home/acme:/var/www/html/aiput-home-acme \
  -v /www/docker/aiput-api-acme:/var/www/html/aiput-api-acme \
  -v /www/docker/aiput-home/acme:/var/www/acme \
  "$CERTBOT_IMAGE" renew --no-random-sleep-on-renew

"$NGINX" -t
"$NGINX" -s reload
