| @@ -746,10 +746,29 @@ export function buildCertManagementCommands(options: BuildRpxProvisionOptions): |
| 746 | 746 | `EMAIL='${email}'`, |
| 747 | 747 | `TLSX="${tlsxCli}"`, |
| 748 | 748 | `DOMAINS='${csv}'`, |
| 749 | + "DNS_ATTEMPTS='24'", |
| 750 | + "DNS_DELAY_SECONDS='5'", |
| 751 | + 'wait_for_dns() {', |
| 752 | + ' d="$1"', |
| 753 | + ' attempt=1', |
| 754 | + ' while ! getent ahosts "$d" >/dev/null 2>&1; do', |
| 755 | + ' if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then', |
| 756 | + ' echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2', |
| 757 | + ' return 1', |
| 758 | + ' fi', |
| 759 | + ' echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"', |
| 760 | + ' sleep "$DNS_DELAY_SECONDS"', |
| 761 | + ' attempt=$((attempt + 1))', |
| 762 | + ' done', |
| 763 | + '}', |
| 749 | 764 | 'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)', |
| 750 | 765 | `for d in ${spaced}; do`, |
| 751 | 766 | ' if [ ! -s "$CERTS/$d.crt" ]; then', |
| 752 | | - ' $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"', |
| 767 | + ' if wait_for_dns "$d"; then', |
| 768 | + ' $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"', |
| 769 | + ' else', |
| 770 | + ' echo "issue $d skipped until DNS resolves (non-fatal)"', |
| 771 | + ' fi', |
| 753 | 772 | ' # rpx reloads its SNI set when a PEM appears. Complete that reload', |
| 754 | 773 | ' # before the next hostname starts http-01, or :80 can disappear in', |
| 755 | 774 | ' # the middle of the following challenge on a multi-domain deploy.', |