First basic config and watching one of the files.

.gitignore

@@ -23,5 +23,7 @@ backup
 *.exe
 *.dll
 *.gz
+cert-bouncer.json
 config.json
 bin/*
+tmp/*

example-config.json

@@ -0,0 +1,12 @@
+{
+  "Source": {
+    "PrivateKey": "./test/fakepriv.pem",
+    "PublicKey": "./test/fakepub.pem"
+  },
+  "Target": {
+    "PrivateKey": "./tmp/privkey.pem",
+    "PublicKey": "./tmp/fullchain.pem",
+    "Owner": "zed:zed"
+  },
+  "Reload": "systemctl reload ergo"
+}

go.mod

@@ -1,3 +1,7 @@
 module MY/cert-bouncer
 
 go 1.25.3
+
+require github.com/fsnotify/fsnotify v1.9.0
+
+require golang.org/x/sys v0.13.0 // indirect

go.sum

@@ -0,0 +1,4 @@
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

main.go

@@ -1,9 +1,60 @@
 package main
 
 import (
-  "fmt"
+  "github.com/fsnotify/fsnotify"
+  "flag"
+  "log"
+  "os"
+  "encoding/json"
 )
 
+type Cert struct {
+  PrivateKey string
+  PublicKey string
+  Owner string
+}
+
+type Config struct {
+  Source Cert
+  Target Cert
+  Reload string
+}
+
+func LoadConfig(path string) Config {
+  var config Config
+
+  config_data, err := os.ReadFile(path)
+  if err != nil {
+    log.Fatal("invalid config path %s: %v", path, err)
+  }
+
+  err = json.Unmarshal(config_data, &config)
+  if err != nil {
+    log.Fatal(err, "json format error")
+  }
+
+  return config
+}
+
+func ParseOpts() Config {
+  var config_file string
+
+  flag.StringVar(&config_file, "config", "cert-bouncer.json", ".json config to use.")
+  flag.Parse()
+
+  return LoadConfig(config_file)
+}
+
 func main() {
-  fmt.Println("yay!");
+  config := ParseOpts()
+
+  watcher, err := fsnotify.NewWatcher()
+  if err != nil {
+    log.Fatal(err, "Can't watch files.")
+  }
+
+  err = watcher.Add(config.Source.PrivateKey)
+  if err != nil {
+    log.Fatalf("can't watch %s: %v", err, config.Source.PrivateKey)
+  }
 }

test/fakepriv.pem

@@ -0,0 +1 @@
+This is fake.

test/fakepub.key

@@ -0,0 +1 @@
+This is fake too.