GNU bug report logs - #30459
Certbot service patches

Previous Next

Full log

View this message in rfc822 format

From: Clément Lassieur <clement <at> lassieur.org>
To: 30459 <at> debbugs.gnu.org
Subject: [bug#30459] [PATCH 02/11] services: certbot: Run certbot twice a day at a random minute.
Date: Wed, 14 Feb 2018 22:34:55 +0100

* doc/guix.texi (Certificate Services): Document it.
* gnu/services/certbot.scm (certbot-renewal-jobs): Change job's time
specification.
---
 doc/guix.texi            | 8 +++++++-
 gnu/services/certbot.scm | 8 ++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index b3bf52735..42705ff8d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -30,7 +30,7 @@ Copyright @copyright{} 2016, 2017 ng0@*
 Copyright @copyright{} 2016, 2017 Jan Nieuwenhuizen@*
 Copyright @copyright{} 2016 Julien Lepiller@*
 Copyright @copyright{} 2016 Alex ter Weele@*
-Copyright @copyright{} 2017 Clément Lassieur@*
+Copyright @copyright{} 2017, 2018 Clément Lassieur@*
 Copyright @copyright{} 2017 Mathieu Othacehe@*
 Copyright @copyright{} 2017 Federico Beffa@*
 Copyright @copyright{} 2017 Carlo Zancanaro@*
@@ -15670,6 +15670,12 @@ generation, the initial certification request to the Let's Encrypt
 service, the web server challenge/response integration, writing the
 certificate to disk, and the automated periodic renewals.
 
+Certbot is run twice a day, at a random minute within the hour.  It
+won't do anything until your certificates are due for renewal or
+revoked, but running it regularly would give your service a chance of
+staying online in case a Let's Encrypt-initiated revocation happened for
+some reason.
+
 @defvr {Scheme Variable} certbot-service-type
 A service type for the @code{certbot} Let's Encrypt client.
 @end defvr
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 91249ed3e..1728d126f 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -65,10 +65,10 @@
        (() '())
        (_
         (list
-         ;; Attempt to renew the certificates twice a week.
-         #~(job (lambda (now)
-                  (next-day-from (next-hour-from now '(3))
-                                 '(2 5)))
+         ;; Attempt to renew the certificates twice per day, at a random
+         ;; minute within the hour.  See
+         ;; https://certbot.eff.org/all-instructions/.
+         #~(job '(next-minute-from (next-hour '(0 12)) (list (random 60)))
                 (string-append #$package "/bin/certbot renew"
                                (string-concatenate
                                 (map (lambda (host)
-- 
2.16.1

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.