update

compose.tls.yaml

@@ -5,3 +5,5 @@ services:
     volumes:
       - ./deploy/nginx/templates/tls.conf.template:/etc/nginx/templates/default.conf.template:ro
       - ${SSL_CERTIFICATE_DIR:-./config/ssl}:/etc/nginx/ssl:ro
+      # Certbot's live certificates are symlinks into ../../archive.
+      - ./config/letsencrypt/archive:/etc/archive:ro

manage.sh

@@ -116,6 +116,13 @@ broker_config_ready() {
 	return 0
 }
 
+require_tls_certificate() {
+	[[ -f "${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_FILE}" ]] ||
+		fail "TLS certificate was not found at ${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_FILE}; run ./manage.sh bootstrap"
+	[[ -f "${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_KEY_FILE}" ]] ||
+		fail "TLS certificate key was not found at ${SSL_CERTIFICATE_DIR}/${SSL_CERTIFICATE_KEY_FILE}; run ./manage.sh bootstrap"
+}
+
 require_env() {
 	[[ -f .env ]] || fail "copy .env.example to .env and configure it first"
 	BROKER_DOMAIN="$(read_env_setting BROKER_DOMAIN)"
@@ -189,6 +196,7 @@ prepare() {
 		config/gitea/data \
 		config/gitea/config \
 		config/letsencrypt \
+		config/letsencrypt/archive \
 		config/ssl \
 		config/certbot-webroot \
 		config/backups
@@ -218,6 +226,7 @@ bootstrap)
 			--email "$LETSENCRYPT_EMAIL" \
 			--cert-name "$BROKER_DOMAIN" \
 			-d "$BROKER_DOMAIN" -d "$GITEA_DOMAIN"
+		require_tls_certificate
 		compose_stack up -d gitea nginx
 	else
 		compose_stack up -d gitea nginx
@@ -228,6 +237,9 @@ start)
 	prepare
 	broker_config_ready ||
 		fail "broker configuration is incomplete; run ./manage.sh configure-broker"
+	if [[ "$SSL_MODE" != "none" ]]; then
+		require_tls_certificate
+	fi
 	compose_stack up -d --build
 	;;
 start-direct)

tests/test-deployment-scripts.sh

@@ -57,6 +57,11 @@ if grep -R '^[[:space:]]*keepalive_timeout[[:space:]]' \
 	printf 'FAIL: conf.d template duplicates nginx.conf keepalive_timeout\n' >&2
 	exit 1
 fi
+grep -F -- './config/letsencrypt/archive:/etc/archive:ro' \
+	"${TEST_ROOT}/compose.tls.yaml" >/dev/null || {
+	printf 'FAIL: TLS compose does not expose Certbot archive symlink targets\n' >&2
+	exit 1
+}
 
 printf '%s\n' \
 	'broker.test' \