Repository navigation
Renew gateway TLS certificates from the gateway app - #4386
Open
vitostrokov wants to merge 1 commit into
Open
vitostrokov wants to merge 1 commit into
vitostrokov wants to merge 1 commit into
Conversation
Gateways on the Kubernetes backend install certbot with pip into a venv and run docker-systemctl-replacement as PID 1, so nothing ever runs `certbot renew`, and their certificates expire after 90 days. VM gateways get a renewal timer from the certbot snap. Run `certbot renew` from the gateway app twice a day, after a random first delay, under the lock that certificate issuance already uses. A deploy hook reloads nginx when a certificate is renewed. On VM gateways this duplicates the snap timer, which is harmless: certbot renews only certificates that are due. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4383
Gateways on the Kubernetes backend have nothing that runs
certbot renew, so their certificatesexpire. This makes the gateway app renew certificates itself:
Nginx.renew_certificates()runscertbot renewunder the lock thatregister()alreadyholds around
run_certbot, so a renewal never overlaps an issuance.--no-random-sleep-on-renewand--deploy-hook "systemctl reload nginx.service", the reload command the gateway alreadyuses. The hook runs only when a certificate was renewed.
12 hours. Failures are logged and retried on the next run. The task is cancelled on shutdown.
On VM gateways this runs alongside the snap's renewal timer, which is harmless: certbot renews
only certificates that are due.
Testing:
uv run pytest src/tests/_internal/proxy/gateway/: 63 passed.services/test_nginx.py(renew command and deploy hook, failure, waiting for thelock) and
test_app.py::test_renews_certificates_periodically_despite_errors.uv run ruff checkanduv run ruff format --checkon the changed files: clean.🤖 Generated with Claude Code