puppet-letsencrypt

puppet-letsencrypt copied to clipboard

In my opinion the /etc/cron.d/certbot (default cron job for running certbot twice per day on Debian with official cerbot package) file should be absent when one sets manage_cron to true as both can/will interfere.

I did not check on other distributions but this might also be an issue with other distros.

For your reference here is the contact of that /etc/cron.d/certbot file on Debian 9:

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

What do you think?

It's a valid point. On Debian (and likely Debian-based) there is indeed a default cronjob (and systemd timer) but there isn't on RH(-based).

@hostingnuggets could you provide a PR for this?

@bastelfreak yes that should be an easy one. Just about the rspec test I am not sure if it would work because in order to test that the default package certbot cron file is present/absent I need the certbot package to be installed. Or do you have an idea what test would make sense?

I'd guess a $letsencrypt::manage_cron_per_cert parameter makes sense. Determine the default true/false (probably always true except Debian). Then the define uses that value as a default.

I see so a new test in letsencrypt_certonly_spec.rb would be required where I define the manage_cron_per_cert in params to its default (true) and then what should be used as expect? Should it just be compile.with_all_deps ?

On related note, on RHEL7 systems supplied timer should be disabled when cron is managed.

  systemd::unit_file { 'certbot-renew.timer':
    target => '/dev/null',
  }

@vchepkov can you provide a PR for this?

And for Debian 11 (certbot 1.12.0-2) we should disable systemd certbot.timer