For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/all-tunnel-certbot-failed.service
| 1 | # Runs when all-tunnel-certbot.service fails (OnFailure=). It makes the failure impossible to miss on the node itself: |
| 2 | # a CRITICAL line in the journal (`journalctl -p crit -t all-tunnel-certbot`), a marker file that `the deploy tool status` reports, and a wall |
| 3 | # message to whoever is logged in. The service itself stays in the failed state (`systemctl --failed`) until the next run succeeds, which clears the |
| 4 | # marker (all-tunnel-cert-check does). |
| 5 | # The mail to the owner does not come from here (a node has no mail and no secret to send one with): it comes from the site monitor (14 and 5 days left, |
| 6 | # the site's monitor) and from the independent CT watcher, which both read the certificate the node SERVES. |
| 7 | [Unit] |
| 8 | Description=The ALL tunnel node's certificate renewal FAILED |
| 9 | |
| 10 | [Service] |
| 11 | Type=oneshot |
| 12 | ExecStart=/usr/bin/logger -p daemon.crit -t all-tunnel-certbot "node certificate renewal FAILED: read journalctl -u all-tunnel-certbot, fix it, then systemctl start all-tunnel-certbot" |
| 13 | ExecStart=/bin/sh -c 'date -u +%%FT%%TZ > /var/lib/all-tunnel/certbot.failed' |
| 14 | ExecStart=-/usr/bin/wall "all-tunnel: the node certificate renewal FAILED (journalctl -u all-tunnel-certbot)" |