12set -euo pipefail3umask 07745test "$(findmnt -n -o UUID --target /srv/tiny)" = 98f49cba-bd8c-432d-a91a-41db66920e906install -d -m 700 /srv/tiny/certs /srv/tiny/tailscale/certs7docker exec tiny-tailscale tailscale cert --min-validity=336h \8 --cert-file=/var/lib/tailscale/certs/tailnet.crt \9 --key-file=/var/lib/tailscale/certs/tailnet.key tiny.tailbe516a.ts.net10install -m 644 /srv/tiny/tailscale/certs/tailnet.crt /srv/tiny/certs/tailnet.crt11install -m 600 /srv/tiny/tailscale/certs/tailnet.key /srv/tiny/certs/tailnet.key1213if ! openssl x509 -checkend 1209600 -noout -in /srv/tiny/certs/tiny.crt >/dev/null 2>&1; then14 openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \15 -keyout /srv/tiny/certs/tiny.key -out /srv/tiny/certs/tiny.csr \16 -subj /CN=tiny -addext subjectAltName=DNS:tiny17 openssl x509 -req -in /srv/tiny/certs/tiny.csr \18 -CA /var/lib/sandboxd/certs/ca.crt -CAkey /var/lib/sandboxd/certs/ca.key \19 -set_serial "0x$(openssl rand -hex 16)" -days 90 -sha256 \20 -copy_extensions copy -out /srv/tiny/certs/tiny.crt21 chmod 644 /srv/tiny/certs/tiny.crt22fi2324if [ "$(docker inspect -f '{{.State.Running}}' tiny-https 2>/dev/null || true)" = true ]; then25 docker exec tiny-https caddy reload --config /etc/caddy/Caddyfile --force26fi