dags/narwhal/acme_renew
Ricard Illa e4344cba92 feat: trigger remote suricata 2023-07-10 15:34:48 +02:00
..
Makefile feat: trigger remote suricata 2023-07-10 15:34:48 +02:00
README.md rework structure 2022-10-18 17:01:08 +02:00
justfile migrated DNS provider from linode to hetzner 2023-05-28 18:16:52 +02:00
run.sh added run.sh wrappers 2022-10-18 17:58:09 +02:00

README.md

acme renew

This DAG renews wildcard certificates using acme.sh.

If a renewal happens, reload the nginx instance and deploy certificates to the PostgreSQL instance.

The Nginx instance has the actual certificate files mounted as read-only mounts, so it doesn't need any explicit deployment, just a reload.

PostgreSQL complains if the certificates are mounted as read-only, so I opted for making a copy of the files to volume used by PostgreSQL because I don't like mouting the actual original files with write permissions to any container other than the acme.sh one. On the other hand, PostgreSQL doesn't need to be reloaded to pick the new files.