For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
tunnel/deploy/all-tunnel-certbot.service
| 1 | # Renews the node's OWN certificate (the name the devices connect to, ALPN all-tunnel/2) with certbot, HTTP-01 through the webroot the node serves on :80. |
| 2 | # Devices' names never come here: their certificates are issued on the devices over DNS-01 (the design plan, section 4). |
| 3 | # |
| 4 | # It fails LOUDLY, on purpose, and in three places a silent failure would hide: |
| 5 | # certbot renew exits non-zero when a renewal was due and failed (no `|| true`, no `-q` that swallows the reason) |
| 6 | # --deploy-hook all-tunnel-cert-hook: checks the new pair, installs it, reloads the node, and fails when the node did not take it |
| 7 | # ExecStartPost all-tunnel-cert-check: fails when the certificate in service has less than ALL_TUNNEL_CERT_MIN_DAYS left, which is what |
| 8 | # a renewal that "succeeded" but never replaced anything looks like |
| 9 | # and any failure runs all-tunnel-certbot-failed.service (a critical journal line, a marker file `tunnel_deploy.py status` reports). The days are the |
| 10 | # first alert of policy.monitoring.node_cert_alert_days (14): the site monitor mails the owner at 14 and at 5 days anyway, this is the node's own voice. |
| 11 | [Unit] |
| 12 | Description=Renew the ALL tunnel node's own certificate (certbot, HTTP-01 webroot) |
| 13 | Wants=network-online.target |
| 14 | After=network-online.target |
| 15 | OnFailure=all-tunnel-certbot-failed.service |
| 16 | |
| 17 | [Service] |
| 18 | Type=oneshot |
| 19 | EnvironmentFile=/etc/all-tunnel/env |
| 20 | Environment=ALL_TUNNEL_CERT_MIN_DAYS=14 |
| 21 | ExecStart=/usr/bin/certbot renew --non-interactive --no-random-sleep-on-renew --deploy-hook /usr/local/sbin/all-tunnel-cert-hook |
| 22 | ExecStartPost=/usr/local/sbin/all-tunnel-cert-check |
| 23 | TimeoutStartSec=15min |
| 24 | PrivateTmp=yes |
| 25 | NoNewPrivileges=yes |