From e9bd7e9b670f149a51fa975e0c0466b87d657911 Mon Sep 17 00:00:00 2001
From: Platon47 <64787001+Platon47@users.noreply.github.com>
Date: Sun, 15 Mar 2026 08:32:49 +0300
Subject: [PATCH] fix: correct lego challenge flags (--http/--tls instead of
 --http=value)

---
 scripts/lego-renew.sh | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/scripts/lego-renew.sh b/scripts/lego-renew.sh
index acbe224e..bb1b3321 100644
--- a/scripts/lego-renew.sh
+++ b/scripts/lego-renew.sh
@@ -22,20 +22,27 @@ if [ -n "$LEGO_EMAIL" ] && [ -n "$LEGO_IP" ]; then
   echo "[tls] AUTO mode: running lego to obtain/renew cert for IP $LEGO_IP..."
   mkdir -p "$LEGO_DATA_DIR" "$CERT_DIR"
 
-  # Run lego - supports http-01 (port 80) and tls-alpn-01 (port 443)
+  # Build challenge flag: --http (port 80) or --tls (port 443 tls-alpn-01)
+  if [ "$LEGO_CHALLENGE" = "tls-alpn" ]; then
+    CHALLENGE_FLAG="--tls"
+  else
+    CHALLENGE_FLAG="--http"
+  fi
+
+  # Try run (initial obtain), fall back to renew if cert already exists
   lego \
     --email="$LEGO_EMAIL" \
     --domains="$LEGO_IP" \
-    --http="${LEGO_CHALLENGE}" \
+    $CHALLENGE_FLAG \
     --path="$LEGO_DATA_DIR" \
     run 2>&1 || lego \
     --email="$LEGO_EMAIL" \
     --domains="$LEGO_IP" \
-    --http="${LEGO_CHALLENGE}" \
+    $CHALLENGE_FLAG \
     --path="$LEGO_DATA_DIR" \
     renew --days 5 2>&1
 
-  # Symlink/copy cert to expected location
+  # Copy cert to expected location
   LEGO_CERT="${LEGO_DATA_DIR}/certificates/${LEGO_IP}.crt"
   LEGO_KEY="${LEGO_DATA_DIR}/certificates/${LEGO_IP}.key"
   if [ -f "$LEGO_CERT" ] && [ -f "$LEGO_KEY" ]; then