Fix the letsencrypt (acme) hook to not restart the service when the certificate was not changed.

tasks/pgpool-letsencrypt-acmetool.yml

@@ -10,7 +10,7 @@
     - psql_pgpool_service_install
     - pgpool_letsencrypt_managed
     - letsencrypt_acme_install
-  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt', 'pgpool_acme_hook' ]
 
 
 - block:
@@ -20,4 +20,4 @@
   when:
     - psql_pgpool_service_install
     - not pgpool_letsencrypt_managed
-  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'pgpool', 'letsencrypt', 'pgpool_acme_hook' ]

tasks/postgresql-letsencrypt-acmetool.yml

@@ -9,7 +9,7 @@
   when:
     - postgresql_letsencrypt_managed
     - letsencrypt_acme_install
-  tags: [ 'postgresql', 'postgres', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'letsencrypt', 'pg_acme_hook' ]
 
 
 - block:
@@ -18,4 +18,4 @@
 
   when:
     - not postgresql_letsencrypt_managed
-  tags: [ 'postgresql', 'postgres', 'letsencrypt' ]
+  tags: [ 'postgresql', 'postgres', 'letsencrypt', 'pg_acme_hook' ]

templates/pgpool-letsencrypt-acme.sh.j2

@@ -18,12 +18,22 @@ else
     echo "No letsencrypt default file" >> $LE_LOG_DIR/pgpool2.log
 fi
 
+logger "acme-pgpool-hook: Check if the certificate has been renewed"
+cmp ${LE_CERTS_DIR}/privkey ${PGPOOL2_KEYFILE}
+RETVAL=$?
+if [ $RETVAL -eq 0 ] ; then
+    logger "acme-pgpool-hook: No new cerficate. Doing nothing"
+    exit 0
+fi
+
+logger "acme-pgpool-hook: Copying the key file"
 echo "Copy the key file" >> $LE_LOG_DIR/pgpool2.log
 cp ${LE_CERTS_DIR}/privkey  ${PGPOOL2_KEYFILE}
 chmod 440 ${PGPOOL2_KEYFILE}
 chown root ${PGPOOL2_KEYFILE}
 chgrp postgres ${PGPOOL2_KEYFILE}
 
+logger "acme-pgpool-hook: Reload the postgresql service after a certificate renewal"
 echo "Reload the pgpool2 service" >> $LE_LOG_DIR/pgpool2.log
 if [ -x /bin/systemctl ] ; then
 {% if ansible_distribution_file_variety == "Debian" %}
@@ -35,6 +45,7 @@ else
     service pgpool2 reload >> $LE_LOG_DIR/pgpool2.log 2>&1
 fi
 
+logger "acme-pgpool-hook: Done"
 echo "Done." >> $LE_LOG_DIR/pgpool2.log
 
 exit 0

templates/postgresql-letsencrypt-acme.sh.j2

@@ -7,6 +7,7 @@ LE_LOG_DIR=/var/log/letsencrypt
 POSTGRESQL_CERTDIR=/etc/pki/postgresql
 POSTGRESQL_KEYFILE=$POSTGRESQL_CERTDIR/postgresql.key
 DATE=$( date )
+RETVAL=
 
 [ ! -d $POSTGRESQL_CERTDIR ] && mkdir -p $POSTGRESQL_CERTDIR
 [ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
@@ -15,26 +16,38 @@ echo "$DATE" >> $LE_LOG_DIR/postgresql.log
 if [ -f /etc/default/letsencrypt ] ; then
     . /etc/default/letsencrypt
 else
-    echo "No letsencrypt default file" >> $LE_LOG_DIR/postgresql.log
+    logger "acme-pg-hook: No letsencrypt default file"
 fi
 
+logger "acme-pg-hook: Check if the certificate has been renewed"
+cmp ${LE_CERTS_DIR}/privkey  ${POSTGRESQL_KEYFILE}
+RETVAL=$?
+if [ $RETVAL -eq 0 ] ; then
+    logger "acme-pg-hook: No new cerficate. Doing nothing"
+    exit 0
+fi
+
+logger "acme-pg-hook: Copying the key file"
 echo "Copy the key file" >> $LE_LOG_DIR/postgresql.log
 cp ${LE_CERTS_DIR}/privkey  ${POSTGRESQL_KEYFILE}
 chmod 440 ${POSTGRESQL_KEYFILE}
 chown root ${POSTGRESQL_KEYFILE}
 chgrp postgres ${POSTGRESQL_KEYFILE}
 
-echo "Restart the postgresql service" >> $LE_LOG_DIR/postgresql.log
 if [ -x /bin/systemctl ] ; then
+    logger "acme-pg-hook: Reload the postgresql service after a certificate renewal"
 {% if ansible_distribution_file_variety == "Debian" %}
-    systemctl reload postgresql >> $LE_LOG_DIR/pgpool2.log 2>&1
+    systemctl reload postgresql >> $LE_LOG_DIR/postgresql.log 2>&1
 {% else %}
-    systemctl reload postgresql-{{ psql_version }} >> $LE_LOG_DIR/pgpool2.log 2>&1
+    systemctl reload postgresql-{{ psql_version }} >> $LE_LOG_DIR/postgresql.log 2>&1
 {% endif %}
 else
+    logger "acme-pg-hook: Restart the postgresql service after a certificate renewal"
+    echo "Restart the postgresql service" >> $LE_LOG_DIR/postgresql.log
     service postgresql restart >> $LE_LOG_DIR/postgresql.log 2>&1
 fi
 
+logger "acme-pg-hook: Done"
 echo "Done." >> $LE_LOG_DIR/postgresql.log
 
 exit 0