From b1c0af112f990afcf374db2438eb1ee927d05fd7 Mon Sep 17 00:00:00 2001
From: Andrea Dell'Amico <andrea.dellamico@isti.cnr.it>
Date: Fri, 4 Dec 2020 12:12:50 +0100
Subject: [PATCH] Fix the letsencrypt (acme) hook to not restart the service
 when the certificate was not changed.

---
 tasks/pgpool-letsencrypt-acmetool.yml       |  4 ++--
 tasks/postgresql-letsencrypt-acmetool.yml   |  4 ++--
 templates/pgpool-letsencrypt-acme.sh.j2     | 11 +++++++++++
 templates/postgresql-letsencrypt-acme.sh.j2 | 21 +++++++++++++++++----
 4 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/tasks/pgpool-letsencrypt-acmetool.yml b/tasks/pgpool-letsencrypt-acmetool.yml
index dff1db7..b868ca5 100644
--- a/tasks/pgpool-letsencrypt-acmetool.yml
+++ b/tasks/pgpool-letsencrypt-acmetool.yml
@@ -10,7 +10,7 @@
     - psql_pgpool_service_install
     - pgpool_letsencrypt_managed
     - letsencrypt_acme_install
-  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt', 'pgpool_acme_hook' ]
 
 
 - block:
@@ -20,4 +20,4 @@
   when:
     - psql_pgpool_service_install
     - not pgpool_letsencrypt_managed
-  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt', 'pgpool_acme_hook' ]
diff --git a/tasks/postgresql-letsencrypt-acmetool.yml b/tasks/postgresql-letsencrypt-acmetool.yml
index d16d986..2f1ad00 100644
--- a/tasks/postgresql-letsencrypt-acmetool.yml
+++ b/tasks/postgresql-letsencrypt-acmetool.yml
@@ -9,7 +9,7 @@
   when:
     - postgresql_letsencrypt_managed
     - letsencrypt_acme_install
-  tags: [ 'postgresql', 'postgres', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'letsencrypt', 'pg_acme_hook' ]
 
 
 - block:
@@ -18,4 +18,4 @@
 
   when:
     - not postgresql_letsencrypt_managed
-  tags: [ 'postgresql', 'postgres', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'letsencrypt', 'pg_acme_hook' ]
diff --git a/templates/pgpool-letsencrypt-acme.sh.j2 b/templates/pgpool-letsencrypt-acme.sh.j2
index aa73e99..2de9422 100644
--- a/templates/pgpool-letsencrypt-acme.sh.j2
+++ b/templates/pgpool-letsencrypt-acme.sh.j2
@@ -18,12 +18,22 @@ else
     echo "No letsencrypt default file" >> $LE_LOG_DIR/pgpool2.log
 fi
 
+logger "acme-pgpool-hook: Check if the certificate has been renewed"
+cmp ${LE_CERTS_DIR}/privkey ${PGPOOL2_KEYFILE}
+RETVAL=$?
+if [ $RETVAL -eq 0 ] ; then
+    logger "acme-pgpool-hook: No new cerficate. Doing nothing"
+    exit 0
+fi
+
+logger "acme-pgpool-hook: Copying the key file"
 echo "Copy the key file" >> $LE_LOG_DIR/pgpool2.log
 cp ${LE_CERTS_DIR}/privkey  ${PGPOOL2_KEYFILE}
 chmod 440 ${PGPOOL2_KEYFILE}
 chown root ${PGPOOL2_KEYFILE}
 chgrp postgres ${PGPOOL2_KEYFILE}
 
+logger "acme-pgpool-hook: Reload the postgresql service after a certificate renewal"
 echo "Reload the pgpool2 service" >> $LE_LOG_DIR/pgpool2.log
 if [ -x /bin/systemctl ] ; then
 {% if ansible_distribution_file_variety == "Debian" %}
@@ -35,6 +45,7 @@ else
     service pgpool2 reload >> $LE_LOG_DIR/pgpool2.log 2>&1
 fi
 
+logger "acme-pgpool-hook: Done"
 echo "Done." >> $LE_LOG_DIR/pgpool2.log
 
 exit 0
diff --git a/templates/postgresql-letsencrypt-acme.sh.j2 b/templates/postgresql-letsencrypt-acme.sh.j2
index def31c8..c731c38 100644
--- a/templates/postgresql-letsencrypt-acme.sh.j2
+++ b/templates/postgresql-letsencrypt-acme.sh.j2
@@ -7,6 +7,7 @@ LE_LOG_DIR=/var/log/letsencrypt
 POSTGRESQL_CERTDIR=/etc/pki/postgresql
 POSTGRESQL_KEYFILE=$POSTGRESQL_CERTDIR/postgresql.key
 DATE=$( date )
+RETVAL=
 
 [ ! -d $POSTGRESQL_CERTDIR ] && mkdir -p $POSTGRESQL_CERTDIR
 [ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
@@ -15,26 +16,38 @@ echo "$DATE" >> $LE_LOG_DIR/postgresql.log
 if [ -f /etc/default/letsencrypt ] ; then
     . /etc/default/letsencrypt
 else
-    echo "No letsencrypt default file" >> $LE_LOG_DIR/postgresql.log
+    logger "acme-pg-hook: No letsencrypt default file"
 fi
 
+logger "acme-pg-hook: Check if the certificate has been renewed"
+cmp ${LE_CERTS_DIR}/privkey  ${POSTGRESQL_KEYFILE}
+RETVAL=$?
+if [ $RETVAL -eq 0 ] ; then
+    logger "acme-pg-hook: No new cerficate. Doing nothing"
+    exit 0
+fi
+
+logger "acme-pg-hook: Copying the key file"
 echo "Copy the key file" >> $LE_LOG_DIR/postgresql.log
 cp ${LE_CERTS_DIR}/privkey  ${POSTGRESQL_KEYFILE}
 chmod 440 ${POSTGRESQL_KEYFILE}
 chown root ${POSTGRESQL_KEYFILE}
 chgrp postgres ${POSTGRESQL_KEYFILE}
 
-echo "Restart the postgresql service" >> $LE_LOG_DIR/postgresql.log
 if [ -x /bin/systemctl ] ; then
+    logger "acme-pg-hook: Reload the postgresql service after a certificate renewal"
 {% if ansible_distribution_file_variety == "Debian" %}
-    systemctl reload postgresql >> $LE_LOG_DIR/pgpool2.log 2>&1
+    systemctl reload postgresql >> $LE_LOG_DIR/postgresql.log 2>&1
 {% else %}
-    systemctl reload postgresql-{{ psql_version }} >> $LE_LOG_DIR/pgpool2.log 2>&1
+    systemctl reload postgresql-{{ psql_version }} >> $LE_LOG_DIR/postgresql.log 2>&1
 {% endif %}
 else
+    logger "acme-pg-hook: Restart the postgresql service after a certificate renewal"
+    echo "Restart the postgresql service" >> $LE_LOG_DIR/postgresql.log
     service postgresql restart >> $LE_LOG_DIR/postgresql.log 2>&1
 fi
 
+logger "acme-pg-hook: Done"
 echo "Done." >> $LE_LOG_DIR/postgresql.log
 
 exit 0