Will regenerate courier.pem & restart mail daemons when Let's Encrypt certificate renews.

courier-pem.mk

BASE?=/etc/letsencrypt
DOMAIN?=mx.example.com

DHBITS:=4096

LIVE:=$(BASE)/live/$(DOMAIN)
PRIVKEY:=$(LIVE)/privkey.pem
FULLCHAIN:=$(LIVE)/fullchain.pem

.PHONY: default
default:
	flock --shared $(BASE) $(MAKE) courier.pem

dhparams-%.pem:
	umask 0077 ; time openssl dhparam -outform PEM $(basename $*) > $@.tmp \
	&& chown mail.mail $@.tmp \
	&& mv $@.tmp $@

courier.pem: $(PRIVKEY) $(FULLCHAIN) dhparams-$(DHBITS).pem
	umask 0077 ; cat $+ > $@.tmp \
	&& chown mail.mail $@.tmp \
	&& mv $@.tmp $@ && \
	$(MAKE) maybe-restart

.PHONY: maybe-restart
maybe-restart:
	/etc/init.d/courier status \
	&& /etc/init.d/courier restart \
	|| true

#