#!/bin/bash
# issue-cert <host> — request a Let's Encrypt cert using the shared ACME webroot.
# Run through sudo by the deploy user; accepts a single *.monoaf.com hostname.
set -euo pipefail
PATH=/usr/sbin:/usr/bin:/sbin:/bin
[[ $# -eq 1 ]] || { echo "usage: issue-cert <host>" >&2; exit 2; }
host=$1
[[ $host =~ ^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+monoaf\.com$ ]] \
  || { echo "issue-cert: '$host' is not a monoaf.com hostname" >&2; exit 2; }
exec certbot certonly --non-interactive --webroot -w /srv/www/acme \
  -d "$host" --deploy-hook 'systemctl reload nginx'