From abb181e5372b9a94d2b85db3c57c4497caca5c31 Mon Sep 17 00:00:00 2001
From: David Schroeder <david.schroeder@technologyarch.com>
Date: Thu, 30 Jul 2026 22:17:31 -0500
Subject: [PATCH] update

---
 compose.tls.yaml                 |  2 ++
 manage.sh                        | 12 ++++++++++++
 tests/test-deployment-scripts.sh |  5 +++++
 3 files changed, 19 insertions(+)

diff --git a/compose.tls.yaml b/compose.tls.yaml
index 437736b..f0ec23b 100644
--- a/compose.tls.yaml
+++ b/compose.tls.yaml
@@ -5,3 +5,5 @@ services:
     volumes:
       - ./deploy/nginx/templates/tls.conf.template:/etc/nginx/templates/default.conf.template:ro
       - ${SSL_CERTIFICATE_DIR:-./config/ssl}:/etc/nginx/ssl:ro
+      # Certbot's live certificates are symlinks into ../../archive.
+      - ./config/letsencrypt/archive:/etc/archive:ro
diff --git a/manage.sh b/manage.sh
index 3bd9f85..6a4bc20 100755
--- a/manage.sh
+++ b/manage.sh
@@ -116,6 +116,13 @@ broker_config_ready() {
 	return 0
 }
 
+require_tls_certificate() {
+	[[ -f "${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_FILE}" ]] ||
+		fail "TLS certificate was not found at ${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_FILE}; run ./manage.sh bootstrap"
+	[[ -f "${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_KEY_FILE}" ]] ||
+		fail "TLS certificate key was not found at ${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_KEY_FILE}; run ./manage.sh bootstrap"
+}
+
 require_env() {
 	[[ -f .env ]] || fail "copy .env.example to .env and configure it first"
 	BROKER_DOMAIN="$(read_env_setting BROKER_DOMAIN)"
@@ -189,6 +196,7 @@ prepare() {
 		config/gitea/data \
 		config/gitea/config \
 		config/letsencrypt \
+		config/letsencrypt/archive \
 		config/ssl \
 		config/certbot-webroot \
 		config/backups
@@ -218,6 +226,7 @@ bootstrap)
 			--email "$LETSENCRYPT_EMAIL" \
 			--cert-name "$BROKER_DOMAIN" \
 			-d "$BROKER_DOMAIN" -d "$GITEA_DOMAIN"
+		require_tls_certificate
 		compose_stack up -d gitea nginx
 	else
 		compose_stack up -d gitea nginx
@@ -228,6 +237,9 @@ start)
 	prepare
 	broker_config_ready ||
 		fail "broker configuration is incomplete; run ./manage.sh configure-broker"
+	if [[ "$SSL_MODE" != "none" ]]; then
+		require_tls_certificate
+	fi
 	compose_stack up -d --build
 	;;
 start-direct)
diff --git a/tests/test-deployment-scripts.sh b/tests/test-deployment-scripts.sh
index fd2b97d..52ff396 100755
--- a/tests/test-deployment-scripts.sh
+++ b/tests/test-deployment-scripts.sh
@@ -57,6 +57,11 @@ if grep -R '^[[:space:]]*keepalive_timeout[[:space:]]' \
 	printf 'FAIL: conf.d template duplicates nginx.conf keepalive_timeout\n' >&2
 	exit 1
 fi
+grep -F -- './config/letsencrypt/archive:/etc/archive:ro' \
+	"${TEST_ROOT}/compose.tls.yaml" >/dev/null || {
+	printf 'FAIL: TLS compose does not expose Certbot archive symlink targets\n' >&2
+	exit 1
+}
 
 printf '%s\n' \
 	'broker.test' \