add certbot and web deployment scripts

deploy-certbot

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+. shared.sh
+. hosts.sh
+
+for host in ${hosts_certbot[@]}; do
+    remote=root@$host
+
+    echo
+    echo $host
+    echo
+
+    rsync etc/logrotate.d/letsencrypt $remote:/etc/logrotate.d/
+    rsync -r etc/systemd/system/certbot-renew.service.d/ $remote:/etc/systemd/system/certbot-renew.service.d/
+
+    ssh $remote "systemctl daemon-reload &&
+systemctl enable --now certbot-renew.timer &&
+mkdir -vp /srv/certbot &&
+chmod -c 750 /srv/certbot &&
+chown -c root:http /srv/certbot"
+done

deploy-web

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+. shared.sh
+. hosts.sh
+
+for host in ${hosts_web[@]}; do
+    remote=root@$host
+
+    echo
+    echo $host
+    echo
+
+    ssh $remote ln -snf /usr/lib/nginx/modules/ /etc/nginx/modules
+
+    rsync etc/systemd/system/{create-session-ticket-keys.service,rotate-session-ticket-keys.service,rotate-session-ticket-keys.timer} $remote:/etc/systemd/system/
+    rsync --chmod=755 create-session-ticket-keys rotate-session-ticket-keys $remote:/usr/local/bin/
+    rsync -r --delete etc/systemd/system/nginx.service.d/ $remote:/etc/systemd/system/nginx.service.d
+
+    ssh $remote "groupadd -fg 2100 tls
+mkdir -p -m 750 /etc/session-ticket-keys && chgrp tls /etc/session-ticket-keys
+systemctl daemon-reload &&
+systemctl enable create-session-ticket-keys.service rotate-session-ticket-keys.timer nginx"
+done

shared.sh

@@ -0,0 +1,11 @@
+set -o errexit -o nounset -o pipefail
+shopt -s expand_aliases inherit_errexit
+
+alias rsync='rsync -pcv --chmod=D755,F644 --preallocate'
+
+touch lock
+exec {fd}< lock
+if ! flock -n $fd; then
+    echo already deploying >&2
+    exit 1
+fi