Hook scripts for initial certificate installation

[sahsanu]

Hi @MoHaG,

@MoHaG

Looking at the issues on Github, it seems like the undocumented --deploy-hook option might do what I want (and pass the path in (the also) undocumented RENEWED_LINAGE environment variable)?

Regarding the "undocumented" --deploy-hook and "undocumented" RENEWED_LINEAGE variable:

 --deploy-hook DEPLOY_HOOK
                        Command to be run in a shell once for each
                        successfully issued certificate. For this command, the
                        shell variable $RENEWED_LINEAGE will point to the
                        config live subdirectory (for example,
                        "/etc/letsencrypt/live/example.com") containing the
                        new certificates and keys; the shell variable
                        $RENEWED_DOMAINS will contain a space-delimited list
                        of renewed certificate domains (for example,
                        "example.com www.example.com" (default: None)

@MoHaG

Can this parameter that is not documented for the run command be relied on? (The documentation only mentions it for the renew command) I.e. Is it a bug that it works, which means that it can disappear at any time?

If it is a supported option, can I do something like this:
certbot -d "hostname.example.com" --standalone -i null -m address@example.com --no-eff-email --no-bootstrap --agree-tos --deploy-hook /root/scripts/install-new-cert.sh ? (And put a hook script to reload the application on renewal in /etc/letsencrypt/renewal-hooks/deploy ?

This seems to mention that that might actually result in /root/scripts/install-new-cert.sh being run each time the certificate is issued, instead of just for installation? (If that is the case, how do you give a hook script just for installation?))

You can use --deploy-hook in your run command and it will be executed once the certificate is issued for your domain BUT keep in mind that certbot will add a parameter to your domain's renewal conf pointing to this script so every time you renew your certificate it will execute this command/script AND all the scripts you have in /etc/letsencrypt/renewal-hooks/deploy/ dir.

You could add a couple of lines to your initial script to remove the renew_hook parameter added to the renewal conf file so this initial script will run only once when you issue the cert and when the renew happens, it will use the scripts in the /etc/letsencrypt/renewal-hooks/deploy/ dir.

base=$(basename "$RENEWED_LINEAGE")
sed -i '/renew_hook/d' /etc/letsencrypt/renewal/${base}.conf

Cheers,
sahsanu