From c18fd9c44ef4c73003f330af91a0af4a3ff71786 Mon Sep 17 00:00:00 2001
From: Joe Carstairs <me@joeac.net>
Date: Tue, 7 Jul 2026 09:20:06 +0100
Subject: [PATCH] tls.mk: subdomains, not modules

---
 make/tls.mk  | 42 +++++++++++++++++++++---------------------
 make/vars.mk |  1 +
 2 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/make/tls.mk b/make/tls.mk
index ff24604..1eff401 100644
--- a/make/tls.mk
+++ b/make/tls.mk
@@ -7,23 +7,23 @@ installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net)
 installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%)
 tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains))
 
-tls_crontab = /etc/periodic/daily/tls-$(SUBDOMAIN_$(module)).joeac.net
-tls_cert = /etc/letsencrypt/live/$(SUBDOMAIN_$(module)).joeac.net/fullchain.pem
+tls_crontab = /etc/periodic/daily/tls-$(subdomain).joeac.net
+tls_cert = /etc/letsencrypt/live/$(subdomain).joeac.net/fullchain.pem
 
-define install_tls_module_rule =
-.PHONY: install_tls_$(module)
-install_tls_module_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) $(tls_cert))
+define install_tls_subdomain_rule =
+.PHONY: install_tls_$(subdomain)
+install_tls_$(subdomain): $(tls_crontab) $(tls_cert)
 endef
 
-define reinstall_tls_module_rule =
-.PHONY: reinstall_tls_$(module)
-reinstall_tls_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) renew_$(tls_cert))
+define reinstall_tls_subdomain_rule =
+.PHONY: reinstall_tls_$(subdomain)
+reinstall_tls_$(subdomain): $(tls_crontab) renew_$(tls_cert)
 endef
 
-define uninstall_tls_module_rule =
-.PHONY: uninstall_tls_$(module)
-uninstall_tls_$(module): delete_cert_$(SUBDOMAIN_$(module)).joeac.net
-	$(if $(SUBDOMAIN_$(module)), \
+define uninstall_tls_subdomain_rule =
+.PHONY: uninstall_tls_$(subdomain)
+uninstall_tls_$(subdomain): delete_cert_$(subdomain).joeac.net
+	$(if $(shell test [ -f $(tls_crontab) ] && echo 1),\
 		sudo rm -f $(tls_crontab)
 	)
 endef
@@ -31,11 +31,11 @@ endef
 define obtain_or_renew_cert_cmd =
 sudo certbot certonly
 	--nginx \
-	--cert-name $(SUBDOMAIN_$(module)) \
-	--domain $(subst @.,,$(SUBDOMAIN_$(module)).)joeac.net
+	--cert-name $(subdomain) \
+	--domain $(subst @.,,$(subdomain).)joeac.net
 endef
 
-is_cert_expired = $(shell sudo certbot certificates --cert-name $(SUBDOMAIN_$(module)).joeac.net \
+is_cert_expired = $(shell sudo certbot certificates --cert-name $(subdomain).joeac.net \
 	| grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)")
 define cert_rule =
 $(tls_cert):
@@ -46,10 +46,10 @@ renew_$(tls_cert):
 	$(if $(is_cert_expired),$(obtain_or_renew_cert_cmd))
 endef
 
-$(foreach module,$(ALL_MODULES), $(eval $(install_tls_module_rule)))
-$(foreach module,$(ALL_MODULES), $(eval $(reinstall_tls_module_rule)))
-$(foreach module,$(ALL_MODULES), $(eval $(uninstall_tls_module_rule)))
-$(foreach module,$(ALL_MODULES), $(eval $(cert_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(install_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(reinstall_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(uninstall_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(cert_rule)))
 
 .PHONY: remove_/etc/periodic/daily/tls-%.joeac.net
 remove_/etc/periodic/daily/tls-%.joeac.net:
@@ -61,7 +61,7 @@ delete_cert_%.joeac.net:
 
 /etc/periodic/daily/tls-%joeac.net:
 	echo "#!/bin/sh" > crontab.tmp
-	echo "certbot renew --cert-name $(SUBDOMAIN_$(module)) --non-interactive" >> crontab.tmp
+	echo "certbot renew --cert-name $(subdomain) --non-interactive" >> crontab.tmp
 	sudo mv crontab.tmp $@
 	sudo chmod +x $@
 
@@ -69,7 +69,7 @@ delete_cert_%.joeac.net:
 reinstall_tls: $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(foreach subdomain,$(installed_tls_cert_subdomains),renew_$(tls_cert))
 
 .PHONY: uninstall_tls
-uninstall_tls: $(foreach module,$(ALL_MODULES),$(uninstall_tls_$(module)))
+uninstall_tls: $(foreach subdomain,$(ALL_SUBDOMAINS),$(uninstall_tls_$(subdomain)))
 
 .PHONY: install_certbot
 install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx
diff --git a/make/vars.mk b/make/vars.mk
index 246cdbd..6e8938b 100644
--- a/make/vars.mk
+++ b/make/vars.mk
@@ -51,6 +51,7 @@ $(foreach module,$(ALL_MODULES),$(if $(PORT_$(module)),$(eval \
 $(foreach hostname,$(HOSTNAMES),$(foreach module,$(MODULES_$(hostname)),$(eval \
 	export HOST_$(module) := $(if $(filter $(HOSTNAME),$(hostname)),127.0.0.1,$(IP_ADDR_$(hostname))))))
 
+ALL_SUBDOMAINS := $(foreach module,$(ALL_MODULES),$(SUBDOMAIN_$(module)))
 SUBDOMAINS := $(foreach module,$(MODULES),$(SUBDOMAIN_$(module)))
 NGINX_SUBDOMAINS := $(foreach module,$(NGINX_MODULES),$(SUBDOMAIN_$(module)))