pub fn hook_script(plan: &Plan, uid: &str) -> StringExpand description
The deploy hook certbot runs after every successful renewal.
It reads the marker at renewal time rather than being written for whichever boundary was live on the day it was installed. Moving termination from the node to a proxy in front of it is an operator decision that must not require remembering to rewrite a hook: a renewal that does not reach the live listener is a certificate that expires while every file on disk says it was renewed.