#!/bin/sh

# Join the issued certificate and its key into the single site.pem HAProxy
# expects.
#
# Absolute paths rather than a cd: this script is sourced, so a cd would move
# the caller's working directory as well, and an unchecked one that failed left
# the tests below looking for fullchain.pem in whatever directory the caller
# happened to be in.

live="/etc/letsencrypt/live/$CERTBOT_DOMAIN"

if [ -f "$live/fullchain.pem" ] && [ -f "$live/privkey.pem" ]; then
  # Through a temporary file, then an atomic rename: HAProxy reads site.pem at
  # start-up and must never find it half-written.
  cat "$live/fullchain.pem" "$live/privkey.pem" > /etc/certificates/site.pem.tmp
  mv /etc/certificates/site.pem.tmp /etc/certificates/site.pem
else
  echo "2-concatenate-cert.sh: no certificate under $live, site.pem left as it is" >&2
fi