# Check if we can renew.
# We can only renew if the list of domains has not changed.
# We also need an account key. Avoids #190493
if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/juno.lossy.network.key' ] && [ -e 'certificates/juno.lossy.network.crt' ] && [ -n "$(find accounts -name 'hexa@darmstadt.ccc.de.key')" ]; then

  # Even if a cert is not expired, it may be revoked by the CA.
  # Try to renew, and silently fail if the cert is not expired.
  # Avoids #85794 and resolves #129838
  if ! lego --accept-tos --path . -d juno.lossy.network --email hexa@darmstadt.ccc.de --key-type ec384 --dns rfc2136 --server https://acme-v02.api.letsencrypt.org/directory renew --no-random-sleep --days 30; then
    if is_expiration_skippable out/full.pem; then
      echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming 30 days"
    else
      # High number to avoid Systemd reserved codes.
      exit 11
    fi
  fi

# Otherwise do a full run
elif ! lego --accept-tos --path . -d juno.lossy.network --email hexa@darmstadt.ccc.de --key-type ec384 --dns rfc2136 --server https://acme-v02.api.letsencrypt.org/directory run; then
  # Produce a nice error for those doing their first nixos-rebuild with these certs
  echo Failed to fetch certificates. \
    This may mean your DNS records are set up incorrectly. \
    Selfsigned certs are in place and dependant services will still start.
  # Exit 10 so that users can potentially amend SuccessExitStatus to ignore this error.
  # High number to avoid Systemd reserved codes.
  exit 10
fi

      securit.acyme.defaultsextraLegoRenewFlags = [
        # https://datatracker.ietf.org/doc/draft-ietf-acme-ari/
        "--ari-enable"
      ];