alpine upgrade

.woodpecker.yml

@@ -18,5 +18,4 @@ pipeline:
       event: push
 matrix:
   ALPINE_VERSION:
-  - 3.16.1
-  - 3.15.5
+  - 3.16.2

certbotd.sh

@@ -6,14 +6,16 @@ if test -z "${NODES}"; then
 fi
 
 lock=/tmp/certbot.lck
-updated=false
+updated=/tmp/certbot.updated
 
 ensure() {
   test -n "$1" && echo "$1 received, exiting gracefully..."
 
   rm -f "${lock}"
 
-  ${updated} || exit 0
+  test -f "${updated}" || exit 0
+
+  rm -f "${updated}"
 
   # Fix permissions, users in group ssl have read access
   find /etc/letsencrypt -type d | xargs -r chmod 2750
@@ -27,7 +29,7 @@ ensure() {
   # awkward.  A restricted rsync treats / as the remote location for the
   # certificates.
   for NODE in ${NODES}; do
-    rsync -avHAX --delete-after /etc/letsencrypt/ ${NODE}:/
+    rsync -avHAXL --delete-after /etc/letsencrypt/live/ ${NODE}:/live/
   done
 }
 
@@ -41,7 +43,7 @@ case $1 in
   # Renew certificates, trust in certbot's algorithms
   renew)
     /usr/bin/certbot renew --quiet --agree-tos
-    updated=true
+    touch "${updated}"
     ;;
   bootstrap)
     for site in ${SUTTY} api.${SUTTY}; do
@@ -57,10 +59,14 @@ case $1 in
 
       cd /etc/letsencrypt/live
       ln -s ${SUTTY} default
+
+      touch "${updated}"
     done
 
-    updated=true
-
+    ;;
+  prune)
+    comm -13 <(realpath /etc/letsencrypt/live/*/*.pem | sort) <(find /etc/letsencrypt/archive/ -name "*.pem" | sort) | xargs rm -v
+    touch "${updated}"
     ;;
   # Generate certificates
   *)
@@ -101,7 +107,7 @@ case $1 in
                                     --agree-tos \
                                     --webroot-path /var/lib/letsencrypt \
                                     -d "${domain}"
-          updated=true
+          touch "${updated}"
         done
 esac
 

monit.conf

@@ -10,6 +10,12 @@ check program certbot_renew
   every "13 5 * * *"
   if status != 0 then alert
 
+# Prune old keys
+check program certbot_prune
+  with path "/usr/local/bin/certbotd prune"
+  every "13 1 2 * *"
+  if status != 0 then alert
+
 # Get missing certificates for every cycle.
 check program certbot
   with path "/usr/local/bin/certbotd"