and yes, I re-read the log lines and ya it defaulted the entry to TRUE as a fallback for the prompt.
2023-12-05 15:40:34,668:WARNING:certbot._internal.display.obj:Skipped user interaction because Certbot doesn't appear to be running in a terminal. You should probably include --non-interactive or --force-interactive on the command line.
2023-12-05 15:40:34,669:DEBUG:certbot._internal.display.obj:Falling back to default True for the prompt:
The following certificate(s) are selected for deletion:
This seems very bad IMO because if you can't validate an input it should be false not true. especially in the case of a delete function.
I agree with you there. Even if you hadn't hidden the warning lines with that grep I would like to see needing to type something like Y or whatever to confirm bulk delete.
It did give a warning but your grep hid that. I just agree that more confirmation would be prudent for a bulk action like that.
Another complicating factor is the warning about not running in a terminal. I don't know why it would have said that but I think that contributed to whatever happened here. Usually you only see that when running as a cron job or as background task. Not interactively on a command prompt
lesson learned, I shared my experience with you guys to not do what I did and submitted a bug report. hopefully some improvements come from this but otherwise, i'm just never using grep with certbot delete ever again lol
Well, I guess that's a little bit "by design", sort of.
I've implemented this notification/question in Certbot. Before that, there was NO question asked AT ALL: if you ran certbot delete it would simply delete all certs without questions asked.
Thus, adding a question was already a HUGE improvement.
However, in this design, no difference between with or without --cert-name has been made. Perhaps it was a little bit a "quick fix", maybe not much thought went into it. But for certbot delete --cert-name the default of "yes" makes sense if you'd like to run those things with the --non-interactive flag.
While I think piping the output to grep and expecting correct behaviour of Certbot is not something you could expect, I agree that it's not expected behaviour to delete everything when using certbot deletewithout--cert-name in combination of a situation where the terminal seems to be non-interactive. So personally I'd like an addition to the code to make the default option of the question dependable of --cert-name with or without a dependency of explicit --non-interactive option or the implicit detection of a non-interactive terminal such as when piping the output.
That's unlikely the key difference I just wanted to make sure Osiris saw that it wasn't just the pipe that did that. I know he normally runs Gentoo rather than Ubuntu
It's best now to leave it to the Certbot devs at the github or people like @Osiris who contribute to it. They can read the Python code and see exactly how that happens.
I also had to run sudo snap set certbot trust-plugin-with-root=ok and for some of our integrations we use DNS challenge so had to install that plugin sudo snap install certbot-dns-dnsmadeeasy
Hm, I also don't seem to be able to reproduce what you got. This is the only contents of the letsencrypt.log:
2023-12-06 17:37:46,561:DEBUG:certbot._internal.main:certbot version: 2.8.0
2023-12-06 17:37:46,561:DEBUG:certbot._internal.main:Location of certbot entry point: /tmp/certbottest/bin/certbot
2023-12-06 17:37:46,561:DEBUG:certbot._internal.main:Arguments: ['--config-dir', '.', '--work-dir', '.', '--logs-dir', '.', '--server', 'https://localhost:14000/dir', '--register-unsafely-without-email', '--no-verify-ssl']
2023-12-06 17:37:46,561:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2023-12-06 17:37:46,570:DEBUG:certbot._internal.log:Root logging level set at 30
2023-12-06 17:37:51,809:ERROR:certbot._internal.log:Exiting due to user request.
(Note that this is from a test environment in a venv, but I don't think it should matter as Mike also used snap to install Certbot and also wasn't able to reproduce the issue. I also had to manually remove --non-interactive from the certbot_call.py file which is calling Certbot)
Can you perhaps share your entire log file from when Certbot deleted everything?