update tls

setup-mail-tls.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DOMAIN="${MAIL_DOMAIN:-mail.crabs-games.art}"
+EMAIL="${ACME_EMAIL:-admin@crabs-games.art}"
+REPROXY_CONTAINER="${REPROXY_CONTAINER:-reproxy}"
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+SSL_DIR="$SCRIPT_DIR/ssl"
+COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"
+
+command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
+docker info >/dev/null || { echo "docker access is required" >&2; exit 1; }
+
+mkdir -p "$SSL_DIR"
+
+reproxy_was_running=0
+if docker inspect -f '{{.State.Running}}' "$REPROXY_CONTAINER" 2>/dev/null | grep -qx true; then
+  reproxy_was_running=1
+  docker stop "$REPROXY_CONTAINER" >/dev/null
+fi
+
+restart_reproxy() {
+  if [ "$reproxy_was_running" -eq 1 ]; then
+    docker start "$REPROXY_CONTAINER" >/dev/null
+  fi
+}
+trap restart_reproxy EXIT
+
+docker run --rm \
+  -p 80:80 \
+  -v "$SSL_DIR:/etc/letsencrypt" \
+  certbot/certbot:latest \
+  certonly --standalone \
+  --keep-until-expiring \
+  --non-interactive \
+  --agree-tos \
+  --email "$EMAIL" \
+  -d "$DOMAIN"
+
+docker compose -f "$COMPOSE_FILE" up -d --force-recreate mailserver
+
+echo "TLS certificate for $DOMAIN is installed."
+echo "Check it with: openssl s_client -connect $DOMAIN:465 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -dates"