Letsencrypt SSL Certs - Revision history

Wikisailor: /* Cert Delivery Failure Warning */

2026-02-24T04:21:56Z

Cert Delivery Failure Warning

← Older revision		Revision as of 04:21, 24 February 2026
Line 209:		Line 209:
	#		#
	EMAIL="sailor@seaoffate.net"		EMAIL="sailor@seaoffate.net"
	THRESHOLD_DAYS=10		THRESHOLD_DAYS=15
	SITES=("seaoffate.net" "seaoffate.uk")		SITES=("seaoffate.net" "seaoffate.uk")
	#		#

Wikisailor: /* Cert Delivery Failure Warning */

2026-02-24T04:20:16Z

Cert Delivery Failure Warning

← Older revision		Revision as of 04:20, 24 February 2026
Line 204:		Line 204:
	sudo nano /usr/local/bin/check-ssl-expiry.sh		sudo nano /usr/local/bin/check-ssl-expiry.sh
	copy and paste the following		copy and paste the following
	#!/bin/bash		#!/bin/bash
	# /usr/local/bin/check-ssl-expiry.sh on Plum		# /usr/local/bin/check-ssl-expiry.sh on Plum
	# Checks the actual LIVE certificates on the web		# Checks the actual LIVE certificates on the web

Wikisailor: /* Automation Hook */

2026-02-24T04:20:07Z

Automation Hook

← Older revision		Revision as of 04:20, 24 February 2026
Line 199:		Line 199:
	sudo certbot reconfigure --cert-name seaoffate.net --deploy-hook /usr/local/bin/deploy-wildcard.sh		sudo certbot reconfigure --cert-name seaoffate.net --deploy-hook /usr/local/bin/deploy-wildcard.sh

			===Cert Delivery Failure Warning===

			If there is no updated certificate delivered we want to get a warning message some time before the current cert expires. As the certbot is supposed to fetch a new cert 30 days before the current cert expires it is reasonable that we should get an email 15 days before the expiry date. Further, it is possible that there could be something wrong with the redistribution scripts as well as a possible failure in the collection from Letsencrypt the best place to send the warning message from is Plum as it is one of the webservers that will need an up to date SSL cert. To that end we will have a script running every morning that simply checks the expiry date of it's SSL cert and if it less than 15 days to go it will send an email with a warning. the script needs to be created on plum so ssh to plum and create a file with :
			sudo nano /usr/local/bin/check-ssl-expiry.sh
			copy and paste the following
			#!/bin/bash
			# /usr/local/bin/check-ssl-expiry.sh on Plum
			# Checks the actual LIVE certificates on the web
			#
			EMAIL="sailor@seaoffate.net"
			THRESHOLD_DAYS=10
			SITES=("seaoffate.net" "seaoffate.uk")
			#
			for SITE in "${SITES[@]}"; do
			# Use openssl to check the remote certificate expiry
			# This works even if the local files are fine but Nginx didn't reload
			EXPIRY_DATE=$(echo \| openssl s_client -servername "$SITE" -connect "$SITE":443 2>/dev/null \| openssl x509 -noout -enddate \| cut -d= -f2)
			#
			if [ -z "$EXPIRY_DATE" ]; then
			echo "CRITICAL: Could not connect to $SITE to check SSL!" \| mail -s "🚨 SSL CHECK FAILURE: $SITE" "$EMAIL"
			continue
			fi
			#
			# Convert dates to seconds for comparison
			EXPIRY_SECS=$(date -d "$EXPIRY_DATE" +%s)
			NOW_SECS=$(date +%s)
			DAYS_LEFT=$(( (EXPIRY_SECS - NOW_SECS) / 86400 ))
			#
			if [ "$DAYS_LEFT" -le "$THRESHOLD_DAYS" ]; then
			echo "WARNING: The SSL certificate for $SITE expires in $DAYS_LEFT days. Auto-renewal on Raisin may have failed!" \| mail -s "⚠️ SSL EXPIRY WARNING: $SITE" "$EMAIL"
			fi
			done
			make it executable with:
			sudo chmod +x /usr/local/bin/check-ssl-expiry.sh
			set it to run everyday at 08:30
			sudo crontab -e
			copy in the following at the end of the crontab
			30 8 * * * /usr/local/bin/check-ssl-expiry.sh

	===Docker Volume Mapping (For Blackberry & Quince)===		===Docker Volume Mapping (For Blackberry & Quince)===

Wikisailor: /* 🚀 The "Fruit-Sync" Master Script */

2026-02-24T04:01:18Z

🚀 The "Fruit-Sync" Master Script

← Older revision		Revision as of 04:01, 24 February 2026
Line 109:		Line 109:
	#!/bin/bash		#!/bin/bash
	# Raisin SSL Distribution Bot - Dual Domain (.net & .uk)		# Raisin SSL Distribution Bot - Dual Domain (.net & .uk)
	#		# Optimized for Docker (Blackberry & Mango)
	# 1. Reload local Nginx on Raisin		#
			echo "--- Starting SSL Distribution: $(date) ---"
			#
			# 1. Reload local Nginx on Raisin (the source)
	systemctl reload nginx		systemctl reload nginx
			# 1.1 setup email notification
			SEND_TO="sailor@seaoffate.net"
	#		#
			send_notification() {
			local SUBJECT=$1
			local MESSAGE=$2
			echo "$MESSAGE" \| mail -s "$SUBJECT" "$SEND_TO"
			}
	# 2. Destination Servers		# 2. Destination Servers
	SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")		SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")
Line 119:		Line 129:
	NET_CERT_DIR="/etc/letsencrypt/live/seaoffate.net"		NET_CERT_DIR="/etc/letsencrypt/live/seaoffate.net"
	UK_CERT_DIR="/etc/letsencrypt/live/seaoffate.uk"		UK_CERT_DIR="/etc/letsencrypt/live/seaoffate.uk"
	#
	~~echo "--- Starting SSL Distribution: $(date) ---"~~
	#		#
	for SERVER in "${SERVERS[@]}"; do		for SERVER in "${SERVERS[@]}"; do
			echo "--------------------------------------------"
	echo "Processing $SERVER..."		echo "Processing $SERVER..."
	#		#
	# --- Sync seaoffate.net ~~---~~		# PRE-CHECK: Get timestamp of current cert on destination (to see if it actually changes)
			# If file doesn't exist, we use '0'
			OLD_TS=$(ssh nigel@$SERVER "stat -c %Y /etc/nginx/ssl/seaoffate.net/fullchain.pem 2>/dev/null \|\| echo 0")
			#
			# 4. Sync seaoffate.net
	echo " Pushing .net certs..."		echo " Pushing .net certs..."
	scp "$NET_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"		scp "$NET_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"
	scp "$NET_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"		scp "$NET_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"
	#		#
	# ~~---~~ Sync seaoffate.uk ~~---~~		# 5. Sync seaoffate.uk
	echo " Pushing .uk certs..."		echo " Pushing .uk certs..."
	scp "$UK_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/fullchain.pem"		scp "$UK_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/fullchain.pem"
	scp "$UK_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/privkey.pem"		scp "$UK_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/privkey.pem"
			# POST-CHECK: Get new timestamp
			NEW_TS=$(ssh nigel@$SERVER "stat -c %Y /etc/nginx/ssl/seaoffate.net/fullchain.pem")
			#
			# 6. Execute reloads/restarts on the remote server
			ssh nigel@$SERVER "
			# A. Reload standard webservers (Apache/Nginx)
			if systemctl is-active --quiet apache2; then
			sudo systemctl reload apache2 && echo ' Apache reloaded.'
			elif systemctl is-active --quiet nginx; then
			sudo systemctl reload nginx && echo ' Nginx reloaded.'
			fi
			#
			# B. Docker Restarts (Only if cert has been updated)
			if [ \"$NEW_TS\" -gt \"$OLD_TS\" ]; then
			echo ' [!] Certificate update detected. Checking Docker containers...'
			#
			# Restart Dashy (Blackberry)
			if [ \$(docker ps -q -f name=dashy) ]; then
			echo ' Restarting Dashy...'
			docker restart dashy
			fi
			#
			# Restart Vaultwarden (Mango)
			if [ \$(docker ps -q -f name=vaultwarden) ]; then
			echo ' Restarting Vaultwarden...'
			docker restart vaultwarden
			fi
			else
			echo ' [.] No certificate change. Skipping Docker restarts.'
			fi
			"
	#		#
	~~# --- Reload webserver ---~~
	ssh nigel@$SERVER "if systemctl is-active --quiet apache2; then sudo systemctl reload apache2; elif systemctl is-active --quiet nginx; then sudo systemctl reload nginx; else echo ' No webserver active'; fi"
	#
	if [ $? -eq 0 ]; then		if [ $? -eq 0 ]; then
	echo "Successfully processed $SERVER."		echo "Successfully processed $SERVER."
Line 145:		Line 186:
	done		done
	#		#
	echo "--- SSL Distribution Complete ---"		echo "--- SSL Distribution Complete: $(date) ---"
			send_notif "✅ SSL Renewed & Distributed" "Certificates for .net and .uk have been pushed to all nodes and Nginx has been reloaded. Expiry is now approximately 90 days from today."

	The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command		The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command

Wikisailor: /* Introduction */

2026-02-24T00:05:54Z

Introduction

← Older revision		Revision as of 00:05, 24 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	We chose to use Letsencrypt SSL certificates in addition to the Cloudflare origin certs because we occasionally need to serve SSL websites and services directly and while the Cloudflare origin certs work well and are easy to setup, they are not publicly recognised. To set up the Certbot service to download the SSL certs on ''[[Reverse Proxy\| Raisin]]''' with Cloudflare DNS, we will want to use a wildcard cert so that we don't have to keep on adding to a growing list of domain names		We chose to use Letsencrypt SSL certificates in addition to the Cloudflare origin certs because we occasionally need to serve SSL websites and services directly and while the Cloudflare origin certs work well and are easy to setup, they are not publicly recognised. To set up the Certbot service to download the SSL certs on '''[[Reverse Proxy\| Raisin]]''' with Cloudflare DNS, we will want to use a wildcard cert so that we don't have to keep on adding to a growing list of domain names

	==Installation==		==Installation==

Wikisailor: /* Docker Volume Mapping (For Blackberry & Quince) */

2026-02-23T06:34:36Z

Docker Volume Mapping (For Blackberry & Quince)

← Older revision		Revision as of 06:34, 23 February 2026
Line 166:		Line 166:
	- /etc/nginx/ssl/seaoffate.net/fullchain.pem:/etc/ssl/certs/fullchain.pem:ro		- /etc/nginx/ssl/seaoffate.net/fullchain.pem:/etc/ssl/certs/fullchain.pem:ro
	- /etc/nginx/ssl/seaoffate.net/privkey.pem:/etc/ssl/private/privkey.pem:ro		- /etc/nginx/ssl/seaoffate.net/privkey.pem:/etc/ssl/private/privkey.pem:ro

			==Changing user==

			While using the nigel account works ok and is quick to deploy, it would be better if there was a dedicated user that only had permission to download and deploy the certificates. That will be a job for another day but it should be don so that we can separate responsibilities in a more secure manner.

Wikisailor: /* Establish SSH Trust (Passwordless Login) */

2026-02-23T06:08:39Z

Establish SSH Trust (Passwordless Login)

← Older revision		Revision as of 06:08, 23 February 2026
Line 98:		Line 98:
	sudo mkdir -p /etc/nginx/ssl/seaoffate.net		sudo mkdir -p /etc/nginx/ssl/seaoffate.net
	sudo chown nigel:nigel /etc/nginx/ssl/seaoffate.net		sudo chown nigel:nigel /etc/nginx/ssl/seaoffate.net
			sudo mkdir -p /etc/nginx/ssl/seaoffate.uk
			sudo chown nigel:nigel /etc/nginx/ssl/seaoffate.uk
	'''Note:''' If a server doesn't have Nginx installed yet, the directory /etc/nginx might not exist. You can still create it manually.		'''Note:''' If a server doesn't have Nginx installed yet, the directory /etc/nginx might not exist. You can still create it manually.

Wikisailor: /* 🚀 The "Fruit-Sync" Master Script */

2026-02-23T06:06:39Z

🚀 The "Fruit-Sync" Master Script

← Older revision		Revision as of 06:06, 23 February 2026
Line 106:		Line 106:
	Paste this code (Optimized for your specific setup):		Paste this code (Optimized for your specific setup):
	#!/bin/bash		#!/bin/bash
	# Raisin SSL Distribution Bot - ~~Reverted to Original Logic~~		# Raisin SSL Distribution Bot - Dual Domain (.net & .uk)
	#		#
	# 1. Reload local Nginx on Raisin		# 1. Reload local Nginx on Raisin
	systemctl reload nginx		systemctl reload nginx
	#		#
	# 2. Destination Servers ~~(Original fleet + new additions)~~		# 2. Destination Servers
	SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")		SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")
	#		#
	# 3. Source Cert ~~Path~~		# 3. Source Cert Paths
	~~CERT_DIR~~="/etc/letsencrypt/live/seaoffate.net"		NET_CERT_DIR="/etc/letsencrypt/live/seaoffate.net"
			UK_CERT_DIR="/etc/letsencrypt/live/seaoffate.uk"
	#		#
	echo "--- Starting SSL Distribution: $(date) ---"		echo "--- Starting SSL Distribution: $(date) ---"
	#		#
	for SERVER in "${SERVERS[@]}"; do		for SERVER in "${SERVERS[@]}"; do
	echo "~~Deploying to~~ $SERVER..."		echo "Processing $SERVER..."
	#		#
	# ~~Push the files (No sudo needed here because nigel owns the destination folder)~~		# --- Sync seaoffate.net ---
	scp "$~~CERT_DIR~~/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"		echo " Pushing .net certs..."
	scp "$~~CERT_DIR~~/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"		scp "$NET_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"
			scp "$NET_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"
	#		#
	# Reload webserver ~~(Uses the NOPASSWD rule you already set up in visudo)~~		# --- Sync seaoffate.uk ---
	ssh nigel@$SERVER "if systemctl is-active --quiet apache2; then sudo systemctl reload apache2; elif systemctl is-active --quiet nginx; then sudo systemctl reload nginx; else echo 'No webserver active'; fi"		echo " Pushing .uk certs..."
			scp "$UK_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/fullchain.pem"
			scp "$UK_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/privkey.pem"
			#
			# --- Reload webserver ---
			ssh nigel@$SERVER "if systemctl is-active --quiet apache2; then sudo systemctl reload apache2; elif systemctl is-active --quiet nginx; then sudo systemctl reload nginx; else echo ' No webserver active'; fi"
	#		#
	if [ $? -eq 0 ]; then		if [ $? -eq 0 ]; then

Wikisailor: /* 🚀 The "Fruit-Sync" Master Script */

2026-02-23T05:46:35Z

🚀 The "Fruit-Sync" Master Script

← Older revision		Revision as of 05:46, 23 February 2026
Line 105:		Line 105:
	sudo nano /usr/local/bin/deploy-wildcard.sh		sudo nano /usr/local/bin/deploy-wildcard.sh
	Paste this code (Optimized for your specific setup):		Paste this code (Optimized for your specific setup):

	#!/bin/bash		#!/bin/bash
	# Raisin SSL Distribution Bot - ~~Updated Feb 2026~~		# Raisin SSL Distribution Bot - Reverted to Original Logic
	# ~~Handles: Plum, Fig, Blackberry, Quince, Tayberry, Mango~~		#
			# 1. Reload local Nginx on Raisin
	~~echo "Reloading~~ local Nginx on Raisin~~..."~~
	systemctl reload nginx		systemctl reload nginx
			#
	# 1. ~~Target List~~ (~~Added Tayberry and Mango~~)		# 2. Destination Servers (Original fleet + new additions)
	SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")		SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")
			#
	# 2. Source Cert ~~Paths~~		# 3. Source Cert Path
	~~NET_CERT_DIR~~="/etc/letsencrypt/live/seaoffate.net"		CERT_DIR="/etc/letsencrypt/live/seaoffate.net"
	~~UK_CERT_DIR="/etc/letsencrypt/live/seaoffate.uk"~~		#

	echo "--- Starting SSL Distribution: $(date) ---"		echo "--- Starting SSL Distribution: $(date) ---"
			#
	for SERVER in "${SERVERS[@]}"; do		for SERVER in "${SERVERS[@]}"; do
	echo "~~Processing~~ $SERVER..."		echo "Deploying to $SERVER..."
			#
	# ~~Create directories on targets if they don't exist~~		# Push the files (No sudo needed here because nigel owns the destination folder)
	~~ssh nigel@$SERVER "sudo mkdir -p /etc/nginx/ssl/seaoffate.net /etc/nginx/ssl/seaoffate.uk &&~~ sudo ~~chown~~ nigel~~:nigel /etc/nginx/ssl/seaoffate.*"~~		scp "$CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"
			scp "$CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"
	~~# Sync .net certs~~		#
	scp "$~~NET_CERT_DIR~~/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"		# Reload webserver (Uses the NOPASSWD rule you already set up in visudo)
	scp "$~~NET_CERT_DIR~~/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"		ssh nigel@$SERVER "if systemctl is-active --quiet apache2; then sudo systemctl reload apache2; elif systemctl is-active --quiet nginx; then sudo systemctl reload nginx; else echo 'No webserver active'; fi"
			#
	# ~~Sync .uk certs~~		if [ $? -eq 0 ]; then
	~~scp "$UK_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/fullchain.pem"~~		echo "Successfully processed $SERVER."
	~~scp "$UK_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/privkey.pem"~~		else
			echo "ERROR: Issue communicating with $SERVER."
	# ~~Smart~~ Reload~~: Checks for Nginx, Apache, or Docker-based reloads~~		fi
	ssh nigel@$SERVER "
	if systemctl is-active --quiet ~~nginx~~; then
	sudo systemctl reload ~~nginx && echo 'Nginx reloaded'~~;
	elif systemctl is-active --quiet ~~apache2~~; then
	sudo systemctl reload ~~apache2 && echo 'Apache reloaded'~~;
	else
	echo 'No ~~system~~ webserver active ~~- checking for Docker...~~';
	# ~~If the fruit is Mango/Blackberry/Quince, Dockge containers might need a bounce~~
	~~# or they will pick up the new file on their next internal check~~.
	fi"
	done		done
			#
			echo "--- SSL Distribution Complete ---"

	~~echo "--- SSL Distribution Complete ---"~~
	The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command		The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command
	sudo visudo		sudo visudo

Wikisailor: /* 🚀 The "Fruit-Sync" Master Script */

2026-02-23T05:21:19Z

🚀 The "Fruit-Sync" Master Script

← Older revision		Revision as of 05:21, 23 February 2026
Line 107:		Line 107:

	#!/bin/bash		#!/bin/bash
	# Raisin SSL Distribution Bot - ~~February~~ 2026		# Raisin SSL Distribution Bot - Updated Feb 2026
	#		# Handles: Plum, Fig, Blackberry, Quince, Tayberry, Mango
	~~# 1. Reload local Nginx on Raisin~~
	echo "Reloading local Nginx on Raisin..."		echo "Reloading local Nginx on Raisin..."
	systemctl reload nginx		systemctl reload nginx
	#
	# 2. ~~Destination Servers~~		# 1. Target List (Added Tayberry and Mango)
	SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")		SERVERS=("plum.seaoffate.local" "fig.seaoffate.local" "blackberry.seaoffate.local" "quince.seaoffate.local" "tayberry.seaoffate.local" "mango.seaoffate.local")
	#
	# 3. Source Cert ~~Path~~		# 2. Source Cert Paths
	~~CERT_DIR~~="/etc/letsencrypt/live/seaoffate.net"		NET_CERT_DIR="/etc/letsencrypt/live/seaoffate.net"
	#		UK_CERT_DIR="/etc/letsencrypt/live/seaoffate.uk"

	echo "--- Starting SSL Distribution: $(date) ---"		echo "--- Starting SSL Distribution: $(date) ---"
	#
	for SERVER in "${SERVERS[@]}"; do		for SERVER in "${SERVERS[@]}"; do
	echo "~~Deploying to~~ $SERVER..."		echo "Processing $SERVER..."
	#
	~~# Ensure the destination directory exists (Nigel's Manual Step)~~		# Create directories on targets if they don't exist
	# ~~We push the files regardless of whether a webserver is there yet~~		ssh nigel@$SERVER "sudo mkdir -p /etc/nginx/ssl/seaoffate.net /etc/nginx/ssl/seaoffate.uk && sudo chown nigel:nigel /etc/nginx/ssl/seaoffate.*"
	scp "$~~CERT_DIR~~/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"
	scp "$~~CERT_DIR~~/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"		# Sync .net certs
	#		scp "$NET_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/fullchain.pem"
	# ~~SMART CHECK~~: ~~Only reload~~ Apache ~~if it exists~~		scp "$NET_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.net/privkey.pem"
	ssh nigel@$SERVER "if systemctl is-active --quiet ~~apache2~~; then sudo systemctl reload ~~apache2~~ && echo '~~Apache~~ reloaded'; elif systemctl is-active --quiet ~~nginx~~; then sudo systemctl reload ~~nginx~~ && echo '~~Nginx~~ reloaded'; else echo 'No webserver active - ~~Files copied only~~'; ~~fi"~~
			# Sync .uk certs
	~~if [ $? -eq 0 ]; then~~		scp "$UK_CERT_DIR/fullchain.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/fullchain.pem"
	~~echo "Successfully processed $SERVER~~."		scp "$UK_CERT_DIR/privkey.pem" "nigel@$SERVER:/etc/nginx/ssl/seaoffate.uk/privkey.pem"
	~~else~~
	~~echo~~ "~~ERROR: Issue communicating with $SERVER."~~		# Smart Reload: Checks for Nginx, Apache, or Docker-based reloads
	fi		ssh nigel@$SERVER "
			if systemctl is-active --quiet nginx; then
			sudo systemctl reload nginx && echo 'Nginx reloaded';
			elif systemctl is-active --quiet apache2; then
			sudo systemctl reload apache2 && echo 'Apache reloaded';
			else
			echo 'No system webserver active - checking for Docker...';
			# If the fruit is Mango/Blackberry/Quince, Dockge containers might need a bounce
			# or they will pick up the new file on their next internal check.
			fi"
	done		done
	#
	echo "--- SSL Distribution Complete ---"		echo "--- SSL Distribution Complete ---"

	The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command		The script reloads Apache when the cert is delivered but the sudo systemctl reload apache2 requires a password that the script cannot give so we must add the no password rule to the sodoers file. on each target system (Plum, Fig, Blackberry and Quince) we must open the visudo file with the command
	sudo visudo		sudo visudo