NixOS ACME / LetsEncrypt | 103 Members | |
| Another day, another cert renewal | 44 Servers |
| Sender | Message | Time |
|---|---|---|
| 29 Nov 2024 | ||
| worked on the third try on hydra | 02:34:51 | |
| It's not stuck on "Releasing lock", that process has exited: Based on the CGroup content I think it's stuck on reloading Nginx though I don't understand how that would block or why it's doing that, as Nginx is supposed to reload itself through | 03:23:40 | |
| 12:38:15 | |
*
| 12:38:32 | |
I have not set enableReload | 12:39:10 | |
| 12:40:03 | |
converting that to reloadServices is obviously WIP | 12:40:46 | |
I think you should set enableReload = true and remove all your custom reloading logic. The Nginx module will handle it: https://github.com/NixOS/nixpkgs/blob/0c582677378f2d9ffcb01490af2f2c678dcb29d3/nixos/modules/services/web-servers/nginx/default.nix#L1317-L1342 | 14:39:11 | |
| ok, cool | 18:58:37 | |
doesn't explain why systemctl reload nginx gets stuck 😄 | 18:58:45 | |
| 18:59:54 | |
You could run the service's ExecReload manually to see if it's there or in Systemd it's hanging | 19:11:11 | |
| It only does 2 things: check the config, and send a SIGHUP | 19:11:58 | |
| systemctl reload nginx blocks, I think I established that earlier | 19:16:32 | |
| uhh, sorry | 19:16:37 | |
| I mean I established that the both work individually | 19:16:56 | |
| it is systemctl reload that is stuck for some reason | 19:17:03 | |
| https://gist.github.com/mweinelt/f099ec270ace7cb197954e23871471be | 19:21:08 | |
| 19:22:24 | ||
| 19:22:37 | ||
| Respectfully, I don't want to spend more time investigating this issue since it's in your personal config and not the NixOS modules. Your strace ends with ask-password related stuff so it's likely waiting to authenticate somehow.If you switch to reloadServices it uses --no-block.And better yet, if you switch to enableReload you'll use the battle tested solution. | 19:54:56 | |
| 1 Dec 2024 | ||
| I have another "fun" set of upstreaming work completed. I estimate this one at half the chance of being merged than the previous change, simply because of the structure of lego's cmd code + error handling. https://github.com/go-acme/lego/compare/master...m1cr0man:lego:renew-rc-2 https://github.com/m1cr0man/nixpkgs/commit/53846b07f5037e854993366beab3e0a618d1fd68 I have not opened PRs yet, will do that in a second | 01:52:09 | |
| With this work, I think the ACME module is in one of the best states it has ever been in. The remaining bash scripting in the module does only 2 things primarily: 1. Perform simple file operations like cp, chmod, chown. 2. Handle concurrency limits. The latter is being looked into by ThinkChaos too, see earlier discussions :) | 02:00:32 | |
| Lol, that ended quickly https://github.com/go-acme/lego/pull/2366 | 02:18:10 | |
| https://github.com/go-acme/lego/issues/2367 🤷 lets hope it doesn't take years | 02:37:50 | |
| 5 Dec 2024 | ||
| 01:53:01 | ||
| 16 Dec 2024 | ||
| So uh | 23:41:24 | |
| Do we have anything that can at least paper over the ordering issues | 23:41:42 | |
| Without making things even more complicated | 23:41:51 | |
| Because the tests are flaking a lot and it's getting on my nerves | 23:42:04 | |