nginx: skip cert fetch on startup when existing cert is still valid

[aapeliv]

On deploy, the nginx container's run.sh calls get-certs.sh, which iterates over every domain and runs acme.sh --issue. If a cert happens to be inside acme.sh's renewal window at the moment of a deploy, this triggers a renewal against Let's Encrypt before the site comes up. This causes ~1 min downtime.

This PR adds a per-domain guard in get-certs.sh: if fullchain.pem already exists and is valid for more than 3 days, skip the acme.sh --issue call. The cron-based renewal (every 2 hours) continues to handle actual renewals, so deploys no longer touch Let's Encrypt as long as cron is healthy. The 3-day buffer is a safety net so that a long cron outage still gets rescued by a deploy before expiry.

Testing

Reviewed on production by inspecting the script logic. Manual test plan:

• Deploy with healthy certs in /certs/live/<domain>/fullchain.pem: log should show Skipping <domain>: existing cert valid for >3 days for each domain and no acme.sh calls.
• Deploy with a missing cert file: acme.sh runs and issues a new cert as before.
• Deploy with a cert expiring within 3 days: acme.sh runs and renews.

For maintainers

• Maintainers can push commits to my branch
• Maintainers can merge this PR for me

This PR was created with the Couchers PR skill.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
couchers	Ready	Preview	May 10, 2026 2:55am

[WouldYouKindly]

@aapeliv we should probably add cron monitoring with something like croniter. Or maybe even sentry has a feature for that

[github-actions]

📝 Release Notes

This PR should be included in the release notes.

Suggested release note:

Improved site reliability by preventing unnecessary certificate renewals during deploys that could briefly take the site offline

🤖 Bot Debug Information

Model: couchers.openai.gpt-5.4
Decision: include
Reasoning: This is an infrastructure reliability change that prevents about a minute of downtime during some deploys by avoiding unnecessary certificate renewals at startup. While not a visible feature, it improves site availability in a user-noticeable way and qualifies as important technical work.