From 3c8fc29746135ae4b29465e074a3493fe807458f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jadyn=20Emma=20J=C3=A4ger?= <jadyn@jadyn.dev>
Date: Fri, 28 Nov 2025 12:19:08 +0100
Subject: [PATCH] feat(roles/lego): Run hooks with bash -c ref #13

---
 roles/lego/files/lego_run.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/lego/files/lego_run.sh b/roles/lego/files/lego_run.sh
index 63be0e8..4fd4c35 100644
--- a/roles/lego/files/lego_run.sh
+++ b/roles/lego/files/lego_run.sh
@@ -15,7 +15,7 @@ if [[ -n "${LEGO_HTTP_FALLBACK_PORT:-}" ]]; then
 fi
 
 if [[ -n "${LEGO_PRE_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_PRE_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_PRE_RENEWAL_HOOK"
 fi
 
 LEGO_COMMAND_ARGS_EXPANDED=$(bash -c "echo $LEGO_COMMAND_ARGS") # This is a bit icky
@@ -31,5 +31,5 @@ find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chmod "$LEGO
 find "$LEGO_CERT_STORE_PATH/certificates" -type f | xargs -I{} -n 1 chown "${LEGO_CERT_USER}:${LEGO_CERT_GROUP}" "{}"
 
 if [[ -n "${LEGO_POST_RENEWAL_HOOK:-}" ]]; then
-  $LEGO_POST_RENEWAL_HOOK
+  /usr/bin/env bash -c "$LEGO_POST_RENEWAL_HOOK"
 fi