From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56675) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1em4il-0005Dt-KB for guix-patches@gnu.org; Wed, 14 Feb 2018 16:36:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1em4ih-0000yU-3z for guix-patches@gnu.org; Wed, 14 Feb 2018 16:36:07 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:35479) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1em4ig-0000yK-W4 for guix-patches@gnu.org; Wed, 14 Feb 2018 16:36:03 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1em4ig-0001xS-PH for guix-patches@gnu.org; Wed, 14 Feb 2018 16:36:02 -0500 Subject: [bug#30459] [PATCH 02/11] services: certbot: Run certbot twice a day at a random minute. Resent-Message-ID: From: =?UTF-8?Q?Cl=C3=A9ment?= Lassieur Date: Wed, 14 Feb 2018 22:34:55 +0100 Message-Id: <20180214213504.29984-2-clement@lassieur.org> In-Reply-To: <20180214213504.29984-1-clement@lassieur.org> References: <20180214213504.29984-1-clement@lassieur.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 30459@debbugs.gnu.org * doc/guix.texi (Certificate Services): Document it. * gnu/services/certbot.scm (certbot-renewal-jobs): Change job's time specification. --- doc/guix.texi | 8 +++++++- gnu/services/certbot.scm | 8 ++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/doc/guix.texi b/doc/guix.texi index b3bf52735..42705ff8d 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -30,7 +30,7 @@ Copyright @copyright{} 2016, 2017 ng0@* Copyright @copyright{} 2016, 2017 Jan Nieuwenhuizen@* Copyright @copyright{} 2016 Julien Lepiller@* Copyright @copyright{} 2016 Alex ter Weele@* -Copyright @copyright{} 2017 Clément Lassieur@* +Copyright @copyright{} 2017, 2018 Clément Lassieur@* Copyright @copyright{} 2017 Mathieu Othacehe@* Copyright @copyright{} 2017 Federico Beffa@* Copyright @copyright{} 2017 Carlo Zancanaro@* @@ -15670,6 +15670,12 @@ generation, the initial certification request to the Let's Encrypt service, the web server challenge/response integration, writing the certificate to disk, and the automated periodic renewals. +Certbot is run twice a day, at a random minute within the hour. It +won't do anything until your certificates are due for renewal or +revoked, but running it regularly would give your service a chance of +staying online in case a Let's Encrypt-initiated revocation happened for +some reason. + @defvr {Scheme Variable} certbot-service-type A service type for the @code{certbot} Let's Encrypt client. @end defvr diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm index 91249ed3e..1728d126f 100644 --- a/gnu/services/certbot.scm +++ b/gnu/services/certbot.scm @@ -65,10 +65,10 @@ (() '()) (_ (list - ;; Attempt to renew the certificates twice a week. - #~(job (lambda (now) - (next-day-from (next-hour-from now '(3)) - '(2 5))) + ;; Attempt to renew the certificates twice per day, at a random + ;; minute within the hour. See + ;; https://certbot.eff.org/all-instructions/. + #~(job '(next-minute-from (next-hour '(0 12)) (list (random 60))) (string-append #$package "/bin/certbot renew" (string-concatenate (map (lambda (host) -- 2.16.1