工业级 Deploy Hook 架构

1

vi "/usr/local/lib/certbot/lib/common.sh"

1

vi "/usr/local/lib/certbot/lib/logger.sh"

1

vi "/usr/local/lib/certbot/deploy/10-axigen.sh"

1

vi "/usr/local/lib/certbot/deploy/20-hysteria.sh"

1

vi "/usr/local/lib/certbot/deploy/65535-notify.sh"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

#!/bin/bash
set -euo pipefail

source /usr/local/lib/certbot/lib/logger.sh

# ===== 全局状态 =====
CERTBOT_RESULTS=()
CERTBOT_ERRORS=()

add_result() {
    CERTBOT_RESULTS+=("$1")
}

add_error() {
    CERTBOT_ERRORS+=("$1")
}

lock() {
    local name="$1"
    exec 200>/var/lock/certbot-"$name".lock
    flock -n 200 && return 0 || return 1
}

1
2
3
4
5
6

#!/bin/bash

log() {
    local msg="[$(date +'%F %T')] $*"
    echo "$msg" | systemd-cat -t certbot-hook
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

#!/bin/bash
set -euo pipefail

source /usr/local/lib/certbot/lib/common.sh

INPUT="${1:-}"

TARGET="/etc/letsencrypt/live/mail.eternal.foo"

# 👉 不匹配直接跳过（成功退出）
[[ "$INPUT" == "$TARGET"* ]] || exit 0

lock axigen || {
    log "[axigen] skipped (lock)"
    exit 0
}

log "[axigen] updating..."

DST="/var/opt/axigen/certs/fullchain.pem"
TMP=$(mktemp)

# 👉 合并证书
cat "$INPUT/fullchain.pem" "$INPUT/privkey.pem" > "$TMP"

chown axigen:axigen "$TMP"
chmod 640 "$TMP"

mv "$TMP" "$DST"

# 👉 关键：如果 reload 失败，这里会直接失败（set -e）
if /etc/init.d/axigen reload || /etc/init.d/axigen restart; then
    add_result "[axigen] updated successfully"
else
    add_error "[axigen] reload failed"
    exit 1
fi

log "[axigen] done"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#!/bin/bash
set -euo pipefail

source /usr/local/lib/certbot/lib/common.sh

INPUT="${1:-}"

TARGET="/etc/letsencrypt/live/www.eternal.foo"

[[ "$INPUT" == "$TARGET"* ]] || exit 0

lock hysteria || {
    log "[hysteria] skipped (lock)"
    exit 0
}

log "[hysteria] updating..."

# 👉 安全写入（原子替换）
install -m 600 -o hysteria -g hysteria \
    "$INPUT/fullchain.pem" \
    "/etc/hysteria/fullchain.pem"

install -m 600 -o hysteria -g hysteria \
    "$INPUT/privkey.pem" \
    "/etc/hysteria/privkey.pem"

# 👉 服务重启（关键点）
if systemctl restart hysteria-server.service; then
    add_result "[hysteria] restarted successfully"
else
    add_error "[hysteria] restart failed"
    exit 1
fi

log "[hysteria] done"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

#!/bin/bash
set -euo pipefail

source /usr/local/lib/certbot/lib/common.sh

log "========================================"
log "[notify] Certbot Deploy Summary"

if [ ${#CERTBOT_ERRORS[@]} -eq 0 ]; then
    log "[notify] STATUS: SUCCESS"
else
    log "[notify] STATUS: FAILURE"
fi

log "[notify] Updated lineage: ${RENEWED_LINEAGE:-unknown}"

# 成功项
if [ ${#CERTBOT_RESULTS[@]} -gt 0 ]; then
    log "[notify] Successful hooks:"
    for r in "${CERTBOT_RESULTS[@]}"; do
        log "  - $r"
    done
fi

# 失败项
if [ ${#CERTBOT_ERRORS[@]} -gt 0 ]; then
    log "[notify] Failed hooks:"
    for e in "${CERTBOT_ERRORS[@]}"; do
        log "  - $e"
    done
fi

log "========================================"

# 👉 可选：发送外部通知（以后扩展）
# curl / webhook / telegram 等

exit 0