I want to use GitHub - hsmade/certbot-dns-transip: Certbot plugin to authenticate using dns TXT records via Transip API so the Certbot DNS TransIP plugin. I have renewed successfully using the command:
docker run -ti --rm \
-v "/etc/letsencrypt:/etc/letsencrypt" \
-w /etc/letsencrypt \
hsmade/certbot-transip \
certonly -n \
-d '*.site.com' -d 'site.com' \
-a dns-transip \
--dns-transip-credentials /etc/letsencrypt/transip.ini \
--dns-transip-propagation-seconds 240 \
-m admin@site.com \
--agree-tos \
--eff-email
Now I am working on the shell script to run in crontab as root user. I wonder about the post renewal reload of the Nginx server
My domain is: smart48.com
I want to run this ssh script for renewal via crontab as root once a day at 5 am:
#!/bin/bash
# Log file location
LOG_FILE="/var/log/letsencrypt/renew.log"
# Run the Docker command to renew certificates
docker run -ti --rm \
-v "/etc/letsencrypt:/etc/letsencrypt" \
-w /etc/letsencrypt \
hsmade/certbot-transip \
certonly -n \
-d '*.smart48.com' -d 'smart48.com' \
-a dns-transip \
--dns-transip-credentials /etc/letsencrypt/transip.ini \
--dns-transip-propagation-seconds 240 \
-m admin@site.com \
--agree-tos \
--eff-email >> $LOG_FILE 2>&1
# Check the exit code of the Docker command
if [ $? -eq 0 ]; then
echo "[$(date)] Certificate renewal successful. Reloading Nginx..." >> $LOG_FILE
# Use systemctl reload command
systemctl reload nginx >> $LOG_FILE 2>&1
else
echo "[$(date)] Certificate renewal failed. Check the logs for more details." >> $LOG_FILE
# Collect additional system info
echo -e "\nSystem Info:" >> $LOG_FILE
uname -a >> $LOG_FILE
df -h >> $LOG_FILE
free -m >> $LOG_FILE
# Send an email notification on failure with detailed information
SUBJECT="Certbot Renewal Failed for smart48.com"
EMAIL="admin@smart48.com"
BODY="The automatic renewal of the SSL certificate for smart48.com has failed.\n\nLog Details:\n$(cat $LOG_FILE)"
echo -e $BODY | mail -s "$SUBJECT" $EMAIL
fi
Is this a good idea this way? Does this if [ $? -eq 0 ]; then work just as well as a
0 5 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload nginx"
?
More details:
My web server is (include version):
nginx -V
nginx version: nginx/1.18.0 (Ubuntu)
built with OpenSSL 3.0.2 15 Mar 2022
TLS SNI support enabled
The operating system my web server runs on is (include version):
uname -a
Linux smt-prod-w1 5.15.0-84-generic #93-Ubuntu
SMP Tue Sep 5 17:16:10 UTC 2023
x86_64 x86_64 x86_64 GNU/Linux
My hosting provider, if applicable, is:
TransIP
I can login to a root shell on my machine (yes or no, or I don't know): I can ssh in as sudo capable user and switch to root
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot --version
certbot 2.11.0
But I run the Docker image by HS Made GitHub - hsmade/certbot-dns-transip: Certbot plugin to authenticate using dns TXT records via Transip API