Extracts cert from Sandstorm JSON file and skips trust anchor (the root CA)

sandstorm-extract-cert.sh

#!/bin/bash
. /opt/sandstorm/sandstorm.conf # Well, no one except root can write the file, so it is probably acceptable to execute it.
certjsonfile=$(ls "/opt/sandstorm/var/sandcats/https/$SANDCATS_HOSTNAME/"*.response-json | sort -r -n | head -n1)
keyfile=$(sed 's/\.response-json$//' <<< "$certjsonfile")
certfile="$keyfile.crt"
cat "$certjsonfile" | jq '.cert, (.ca|.[1:]|reverse)[]' --raw-output > "$certfile"
ln -sfT "$certfile" "/etc/current-certs/$SANDCATS_HOSTNAME.crt"
ln -sfT "$keyfile"  "/etc/current-certs/$SANDCATS_HOSTNAME.key"
sudo systemctl reload nginx