NPM & Certbot Renewal Hooks

[jtrosper]

Hello,

I have a use case where my goal is the following:

Have NPM running via docker
Have a proxy host configured with NPM's letsencrypt support generating the SSL cert.
Have a script on the local host's file system in /npm-dir/letsencrypt/renewal-hooks/post/ which uses the cert generated via npm/certbot.

My understanding is that a standard install of certbot will automatically execute anything contained in /renewal-hooks/post/ without having to specify any extra config.

Does a dockerized NPM installation also do this, if a post-renewal script is placed into this folder? Or does it need to live inside of the container somehow?

[skironDotNet]

Nobody answered for so long, seems like by that time you would put some basic scripts into each folder that would write some text to a file, and you would come back 90 days later to if they got fired. Since nobody commented that's what I'm going to do, It would support mailu greatly without additional cron job to update TLS for mailu based on NMP.

Great question! if you alerady know the answer please let me know, thanks!

[skironDotNet]

My initial test is as follows. It doesn't work at least it didn't on neither pre, post, deploy hook, based on docs the files must be exec, so I did created test.sh and marked it chmod +x

Even if it worked, we have to think container, so my test script was like echo "deploy" > /root/deploy-hook.txt so even if the hook have ran it would create a txt file in /root/ location of npm container, meaning the hook rans in context of the container, so whatever script would ran would execute actions in container context and could manipulate only hosts file mounted to the container.

What I need for mailu is to be able to restart mailu, and thus script has to run in context of host not container. The work around would be to attach host's docker sock like Portainer does

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro 

So script ran in NPM container could communicate with Host's docker and potentially restart another container (wather mounting docker.sock into a container is a security risk is a diffrent story)

At the end so far hooks not executed, that could be cause by NPMs certbot having provided --no-directory-hooks on the command line. but I don't know if it does

[MiguelTVMS]

I want to use those certbot hooks. I have one that generates a pfx file from the pem files just created and another that copies the files to other machines. Those hooks work fine when I run the command certbot renew --force-renew inside the container but nothing happens when I ask to NPS to renew from the UI.

[skironDotNet]

I've learned it's easier to have a cron job on the host machine to copy certificates generated by NPM to other destinations. NPM is a great tool to automate certificate creation. I never use certbot

[MiguelTVMS]

I'm just not fond of mounting shares on the host. I have the NFS share mounted in docker as a volume. So, the copy script only runs in the container. I since they took time to disable some default behaviour from certbot. Another advantage of using the deploy hook is that the pfx certs creation is done precisely when the pem certs are created. If, during a renovation, the cert is not renewed, the script won't run, and there are no unnecessary files created.

But thanks for the help. I'll try that way. Regenerating the pfx files weekly and doing the back also weekly.

[skironDotNet]

I'm just not fond of mounting shares on the host.

Not doing so is like going against the basic principle of using docker. The data is state-full the container is state less, create, kill, delete, recerate

I have the NFS share mounted

not sure what does it mean, but if your host can't access the NSF, then run another container with a cron job to copy from NFS X location to NFS Y location.
you will then run 2 containers, one with NPM doing certs for you, and one with cron job copying them elsewhere.
See this https://github.com/skironDotNet/docker-cron
and this https://github.com/skironDotNet/npm-to-mailu-ssl-cron
Combining both you can create own cron container