WIP: Replace the certbot systemd unit with a cron job with notifications #68

greg · 2019-06-18T16:28:17Z

greg commented

2019-06-18 16:28:17 +00:00

Uses cronic (https://habilis.net/cronic/) to filter out the stdout and send a sensible email to ops@kosmos.org when renewal fails

Closes #3

This has been tested on andromeda

Uses cronic (https://habilis.net/cronic/) to filter out the stdout and send a sensible email to ops@kosmos.org when renewal fails Closes #3 This has been tested on andromeda

greg commented

2019-06-18 16:30:11 +00:00

I checked, no other change is needed for cron jobs so far, the backup gem is already successfully sending emails when warnings or errors occur (independently of using cron).

Doing the same thing with systemd timers would be very complex for no reason: https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO

I checked, no other change is needed for cron jobs so far, the backup gem is already successfully sending emails when warnings or errors occur (independently of using cron). Doing the same thing with systemd timers would be very complex for no reason: https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO

greg changed title from ~~Replace the certbot systemd unit with a cron job with notifications~~ to WIP: Replace the certbot systemd unit with a cron job with notifications

2019-06-19 09:06:54 +00:00

greg commented

2019-06-19 09:09:17 +00:00

Damnit, certbot is using stderr to output warnings, so we got an email when it ran at midnight:

ERROR OUTPUT:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Cert not yet due for renewal
Cert not yet due for renewal
Cert not yet due for renewal
Cert not yet due for renewal
Attempting to parse the version 0.33.1 renewal configuration file found at
/etc/letsencrypt/renewal/kosmos.social.conf with version 0.31.0 of Certbot.
This might not work.
Cert not yet due for renewal
Cert not yet due for renewal
Cert not yet due for renewal

Adding the -q switch should fix it:

  -q, --quiet           Silence all output except errors. Useful for
                        automation via cron. Implies --non-interactive.
                        (default: False)

Damnit, certbot is using stderr to output warnings, so we got an email when it ran at midnight: ``` ERROR OUTPUT: Saving debug log to /var/log/letsencrypt/letsencrypt.log Cert not yet due for renewal Cert not yet due for renewal Cert not yet due for renewal Cert not yet due for renewal Attempting to parse the version 0.33.1 renewal configuration file found at /etc/letsencrypt/renewal/kosmos.social.conf with version 0.31.0 of Certbot. This might not work. Cert not yet due for renewal Cert not yet due for renewal Cert not yet due for renewal ``` Adding the `-q` switch should fix it: ``` -q, --quiet Silence all output except errors. Useful for automation via cron. Implies --non-interactive. (default: False) ```

raucao commented

2019-06-19 09:36:54 +00:00

Doing the same thing with systemd timers would be very complex for no reason: https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO

What's complex about that? Looks very straight-forward to me, and can be done once for all our machines via a cookbook.

> Doing the same thing with systemd timers would be very complex for no reason: https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO What's complex about that? Looks very straight-forward to me, and can be done once for all our machines via a cookbook.

greg commented

2019-06-19 12:06:12 +00:00

You're right, I misunderstood, that would work with the cerbot systemd timer as it is (systemctl status --full certbot will contain the previous error). I'm going to close this and reopen another pull request that does it with a OnFailure section on the certbot service instead

You're right, I misunderstood, that would work with the cerbot systemd timer as it is (`systemctl status --full certbot` will contain the previous error). I'm going to close this and reopen another pull request that does it with a `OnFailure` section on the certbot service instead

greg closed this pull request

2019-06-19 12:06:12 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#68