summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorClément Lassieur <clement@lassieur.org>2018-02-09 01:01:17 +0100
committerClément Lassieur <clement@lassieur.org>2018-02-22 21:43:52 +0100
commit7ab04c17c01a926660cd1c9fa9311a5efc6716da (patch)
treea986582a9e9a5b16ffcb7f21568996ccb97b21f4
parent70cd2239a567fe551bdbe368b1d2b9d9cf531d09 (diff)
services: certbot: Run certbot twice a day at a random minute.
* doc/guix.texi (Certificate Services): Document it. * gnu/services/certbot.scm (certbot-renewal-jobs): Change job's time specification.
-rw-r--r--doc/guix.texi8
-rw-r--r--gnu/services/certbot.scm8
2 files changed, 11 insertions, 5 deletions
diff --git a/doc/guix.texi b/doc/guix.texi
index fb2834942b..03cd2d5d71 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -30,7 +30,7 @@ Copyright @copyright{} 2016, 2017 ng0@*
Copyright @copyright{} 2016, 2017 Jan Nieuwenhuizen@*
Copyright @copyright{} 2016 Julien Lepiller@*
Copyright @copyright{} 2016 Alex ter Weele@*
-Copyright @copyright{} 2017 Clément Lassieur@*
+Copyright @copyright{} 2017, 2018 Clément Lassieur@*
Copyright @copyright{} 2017 Mathieu Othacehe@*
Copyright @copyright{} 2017 Federico Beffa@*
Copyright @copyright{} 2017 Carlo Zancanaro@*
@@ -15735,6 +15735,12 @@ generation, the initial certification request to the Let's Encrypt
service, the web server challenge/response integration, writing the
certificate to disk, and the automated periodic renewals.
+Certbot is run twice a day, at a random minute within the hour. It
+won't do anything until your certificates are due for renewal or
+revoked, but running it regularly would give your service a chance of
+staying online in case a Let's Encrypt-initiated revocation happened for
+some reason.
+
@defvr {Scheme Variable} certbot-service-type
A service type for the @code{certbot} Let's Encrypt client.
@end defvr
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 91249ed3e3..1728d126f4 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -65,10 +65,10 @@
(() '())
(_
(list
- ;; Attempt to renew the certificates twice a week.
- #~(job (lambda (now)
- (next-day-from (next-hour-from now '(3))
- '(2 5)))
+ ;; Attempt to renew the certificates twice per day, at a random
+ ;; minute within the hour. See
+ ;; https://certbot.eff.org/all-instructions/.
+ #~(job '(next-minute-from (next-hour '(0 12)) (list (random 60)))
(string-append #$package "/bin/certbot renew"
(string-concatenate
(map (lambda (host)