| 2 Oct 2023 |
 raitobezarius | How is it failing? | 12:40:59 |
 osnyx (he/him) | Background:
When changing the config file by e.g. adding new vhosts at switch time, nginx is not immediately reloaded and being made aware of the config changes. One of the reasons is that new vhosts might rely on certificate files yet to be generated by the acme subsystem. Reloading is thus triggered by nginx-reload-config.service.
Its dependencies are configured as such that it runs before the respective acme-domain-finished.target, but after the acme-domain.service renew service. That service though communicates with an acme registry and makes the registry fetch the validation response from nginx. With the config not being reloaded yet, nginx does not know the respective vhost and cannot serve a valid response. | 12:45:48 |
| osnyx (he/him) | acme: error: 403 :: urn:ietf:params:acme:error:unauthorized | 12:46:49 |
| osnyx (he/him) | Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Selfsigned certs are in place and dependant services will still start. | 12:47:15 |
| osnyx (he/him) | As nginx is reloaded even after failing scme service runs, the next retry of the service succeeds and after a few minutes, the certs are successfully validated. But the initial switch-to-configuration exits with a failure code. This is not very useful if you call taht switch as a part of a deployment script. | 12:48:56 |
| osnyx (he/him) | I mainly want to know whether
- folks here are aware of such issues
- this was a concious decision to live with a failing
switch that repairs itself after a few minutes
- I am holding it wrong.
| 12:50:03 |
| osnyx (he/him) | The reload situation right now is
<nginx.conf updated> -> <acme-selfsigned service run> -> <acme-renew run> -> <nginx-reload-config.service> -> <acme-finished target> | 12:52:15 |
| osnyx (he/him) | The easiest thing would be (as long as self-signed placeholder certs are used) if it was
<nginx.conf updated> -> <acme-selfsigned service run> -> <nginx-reload-config.service> -> <acme-renew run> -> <nginx-reload-config.service> -> <acme-finished target> | 12:53:04 |
