f9399350c1
All checks were successful
CI / lint (push) Successful in 33s
CI / test (push) Successful in 14m57s
Deploy / notebooks (push) Has been skipped
Deploy / zotero (push) Has been skipped
Deploy / docs (push) Has been skipped
Deploy / api (push) Has been skipped
Deploy / mc (push) Has been skipped
CI / notebooks-smoke (push) Successful in 1m31s
Deploy / report (push) Successful in 13s
Notebooks Integration / notebooks-integration (push) Successful in 7m18s
Zotero Sync / zotero-sync (push) Successful in 55s
Package Supply Chain / pkg-supply-chain (push) Successful in 53s
The daily /etc/cron.daily/maddy-cert-renew deploy-hook referenced
/etc/letsencrypt/live/${HOSTNAME}/, but HOSTNAME is unset in cron's
environment, so it expanded to /etc/letsencrypt/live//fullchain.pem —
the copy failed silently every renewal. certbot renewed the cert into
/etc/letsencrypt/live but it never reached /srv/mail/tls, so maddy kept
serving the old cert until it expired (2026-07-14), breaking IMAPS/SMTP
TLS for every client (caught by corwins sentinel as a mail-poller
CERTIFICATE_VERIFY_FAILED).
Use $RENEWED_LINEAGE — the cert-dir path certbot exports into the
deploy-hook environment — and single-quote the hook so it stays literal
until certbot expands it at deploy time. The live droplet was fixed
out-of-band (cert copied, maddy restarted, hook replaced); this makes a
fresh provision correct too.
6.3 KiB
Executable File
6.3 KiB
Executable File