Simplify automatic renewal about dokku-letsencrypt HOT 12 CLOSED

Thanks for the kind words! I'll look into what I can do for automatically adding a cronjob and / or documenting how to do it manually. Here are some initial thoughts to get you started:

• The new simp_le - based (cf. #17) plugin workflow can automatically detect whether a certificate needs renewal so it doesn't hurt to run the plugin more frequently than every two months (which is recommended by let's encrypt).
• The let's encrypt rate limits might be a problem if you try to renew a lot of certificates at any one time. It's probably best to stagger them somehow, although thanks to the auto-detection for when renewal is necessary, not everything will get renewed everytime anyways and since you were not able to request more certificates than the rate limit in the first place, there should be some kind of "natural" staggering in the renewals.
• You will have to make sure that the cronjob calls the renewal as the dokku user.

It would help me out a lot if you let me know about the things that you figure out! And PRs on both code and documentation are always appreciated 😉

from dokku-letsencrypt.

maybe could be nice create a separate plugin like dokku-letsencrypt-crontab that simply do that you say in the point one

from dokku-letsencrypt.

@sseemayer cool. I have some thoughts on this as well. Just by adding a @monthly dokku letsencrypt $app would be sufficient but if the plugin itself were to have a ':auto-renew $app' that would allow the plugin to contain all the logic of staggering the calls to lets encrypt... (i.e. first fetch the renewal times, than queue them one by one if need be in the cron ?) That way the users wouldn't have to be bothered with the cron at all as the plugin taks care of everything :)

from dokku-letsencrypt.

We could get even more fancy by having a letsencrypt:auto-renew without an app provided that will go over all apps, check if they're currently secured by let's encrypt, check whether they need renewal, and then take the appropriate steps.

This would be a really nice project for a medium-sized pull request wink wink 😄

from dokku-letsencrypt.

I ended up implementing the super-fancy version of this: Once you've initially set up letsencrypt for an app, you can enable automatic renewal now by adding one entry to dokku letsencrypt:auto-renew to your crontab. This command will detect which apps need renewal and even prioritize renewals to renew the most urgent certificates first.

Let me know your experiences with this!

from dokku-letsencrypt.

@sseemayer awesome! Was trying it out this morning and after first updating dokku itself (due to a dokku_apps error) i received the following for dokku letsencrypt:ls

140668729374368:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/home/dokku/app1-without-tls/tls/server.crt','r')
140668729374368:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
Error opening Certificate /home/dokku/mediaweb/tls/server.crt
140609668568736:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/home/dokku/app2-without-tls/tls/server.crt','r')
140609668568736:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
Error opening Certificate /home/dokku/mediaweb2/tls/server.crt
140405065541280:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/home/dokku/app3-without-tls/tls/server.crt','r')
140405065541280:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
Error opening Certificate /home/dokku/vraagsturing/tls/server.crt
139854962603680:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/home/dokku/app4-without-tls/tls/server.crt','r')
139854962603680:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
Error opening Certificate /home/dokku/www-kerkenijmondnoord-nl/tls/server.crt
140535163012768:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/home/dokku/app4-without-tls/tls/server.crt','r')
140535163012768:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:

followed by a listing of all apps and all of them had dates and expirations ;)

So before trying the :auto-renew (which relies on :ls) maybe this might deserve a bugfix?

from dokku-letsencrypt.

Whoops - I missed this since I have all of my apps SSL-secured at the moment :) I've created issue #26 and will work on it as the next patch.

from dokku-letsencrypt.

👍

from dokku-letsencrypt.

Should be fixed now (ref. #26).

from dokku-letsencrypt.

I've written a blog post about how I've set up automatic certificate renewal on my own server in the hope it will be helpful for others.

from dokku-letsencrypt.

You rocks! 🙌🙌

from dokku-letsencrypt.

@sseemayer cool! Had the cron already in place but more docs are always handy for newcomers :)

from dokku-letsencrypt.