Dilshod Rasulov
c6a32255df
The SSL deployment aborted even when Let's Encrypt had issued a perfectly
valid certificate. obtain_ssl_certificate() confirmed success with
[ -d "nginx/certbot/conf/live/${domain}" ]
but certbot runs as root inside its container and creates live/, archive/
and accounts/ with mode 0700. Whenever deploy.sh runs as a non-root user
that test fails with EACCES no matter what is on disk, so every SSL deploy
fell back to the HTTP-only config and printed "Failed to obtain SSL
certificate" right after certbot reported the certificate was fine.
Check the certificate from inside a container instead, and treat the files
on disk as the source of truth rather than certbot's exit code, so a
certificate that is present and not yet due for renewal counts as success.
Pass --keep-until-expiring to make that case explicit.
Also drop the recursive chmod on nginx/certbot: it could not touch the
root-owned files it was aimed at (producing the wall of "Operation not
permitted" noise) and would have exposed the private keys if it had.
Verify nginx actually came up after switching to the SSL config and roll
back to HTTP if it did not — a crash-looping nginx takes the whole panel
offline, which is worse than serving without HTTPS.
Reload nginx every 6h so renewed certificates are picked up: nginx reads
the certificate once at startup, so the renewal loop would otherwise keep
serving the old one until the container happened to restart.
Ignore nginx/certbot/ — it holds Let's Encrypt private keys and was
untracked but not ignored.
87 lines
1.1 KiB
Plaintext
87 lines
1.1 KiB
Plaintext
# Compiled and build artifacts
|
|
*.pyc
|
|
__pycache__/
|
|
*.o
|
|
*.obj
|
|
dist/
|
|
build/
|
|
target/
|
|
|
|
# Dependencies
|
|
.venv/
|
|
venv/
|
|
node_modules/
|
|
.mypy_cache/
|
|
.pytest_cache/
|
|
.gradle/
|
|
|
|
# Logs and temp files
|
|
*.log
|
|
*.tmp
|
|
*.swp
|
|
*.swo
|
|
|
|
# Update trigger (written by panel, consumed by pvemanager-update.service on host)
|
|
.update_trigger
|
|
|
|
# Generated systemd files (created by deploy.sh when not root)
|
|
systemd/
|
|
|
|
# Let's Encrypt state written by certbot (contains private keys — never commit)
|
|
nginx/certbot/
|
|
|
|
# Environment
|
|
.env
|
|
.env.local
|
|
*.env.*
|
|
|
|
# Editors
|
|
.vscode/
|
|
.idea/
|
|
.claude/
|
|
|
|
# System files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Coverage
|
|
coverage/
|
|
htmlcov/
|
|
.coverage
|
|
|
|
# Compressed files
|
|
*.zip
|
|
*.gz
|
|
*.tar
|
|
*.tgz
|
|
*.bz2
|
|
*.xz
|
|
*.7z
|
|
*.rar
|
|
*.zst
|
|
*.lz4
|
|
*.lzh
|
|
*.cab
|
|
*.arj
|
|
*.rpm
|
|
*.deb
|
|
*.Z
|
|
*.lz
|
|
*.lzo
|
|
*.tar.gz
|
|
*.tar.bz2
|
|
*.tar.xz
|
|
*.tar.zst
|
|
|
|
# graphify knowledge-graph output (generated)
|
|
graphify-out/
|
|
|
|
# Claude Code local preview config
|
|
.claude/launch.json
|
|
# Local-only Superpowers artifacts (specs, plans, SDD scratch) — never pushed
|
|
docs/superpowers/
|
|
.superpowers/
|
|
|
|
# Планы разработки не коммитим в репозиторий
|
|
docs/plans/
|