From 3efd40edda76d147e3ddf49ab6926bdf151104f8 Mon Sep 17 00:00:00 2001
From: Grant Slater <github@firefishy.com>
Date: Mon, 27 Jul 2026 13:34:02 +0100
Subject: [PATCH] letsencrypt: Run cert request on each run if cert missing

---
 cookbooks/letsencrypt/recipes/default.rb | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/cookbooks/letsencrypt/recipes/default.rb b/cookbooks/letsencrypt/recipes/default.rb
index d2edce8fc..17c80634e 100644
--- a/cookbooks/letsencrypt/recipes/default.rb
+++ b/cookbooks/letsencrypt/recipes/default.rb
@@ -152,7 +152,9 @@ certificates = search(:node, "letsencrypt:certificates").each_with_object({}) do
 end
 
 certificates.each do |name, details|
-  template "/srv/acme.openstreetmap.org/requests/#{name}" do
+  certificate_path = "/srv/acme.openstreetmap.org/config/live/#{name}/fullchain.pem"
+
+  request = template "/srv/acme.openstreetmap.org/requests/#{name}" do
     source "request.erb"
     owner "root"
     group "letsencrypt"
@@ -161,13 +163,15 @@ certificates.each do |name, details|
   end
 
   execute "/srv/acme.openstreetmap.org/requests/#{name}" do
-    action :nothing
     command "/srv/acme.openstreetmap.org/requests/#{name}"
     cwd "/srv/acme.openstreetmap.org"
     user "letsencrypt"
     group "letsencrypt"
-    subscribes :run, "template[/srv/acme.openstreetmap.org/requests/#{name}]"
-    not_if { kitchen? }
+    only_if do
+      !kitchen? &&
+        (request.updated_by_last_action? ||
+         !::File.exist?(certificate_path))
+    end
   end
 end
 
-- 
2.47.3