3 ms·
The change to /each/ file is atomic, but both updates /together/ aren't atomic.
by nightfly 8y ago
The change to /each/ file is atomic, but both updates /together/ aren't atomic.
- weinzierl 8y agoPut them in a diectory and move the directory?
- drewmol 8y agoWas thinking same, now that certs are free I tend to just use single domain certs but maybe that is not ideal? Suppose you could modify this[1] to mv / symlink dir as final step for multi domain certs. https://github.com/h0l0gram/letsencrypt-utils/blob/master/letslink.sh https://github.com/h0l0gram/letsencrypt-utils/blob/master/le...
- kilburn 8y agoThis won't work AFAIK. open takes a file path and gives you back a fd that doesn't know anything about fs paths (it tracks the underlying inode). Thus, nginx may open(key) before the directory is renamed, and open(cert) afterwards. The first fd is now pointing to the old key, while the second fd points to the new cert.
- viraptor 8y agohttps://linux.die.net/man/2/openat https://linux.die.net/man/2/openat solves that specific issue.
- nightfly 8y agoThe actual problem is you can't atomically replace a directory with another one. You have to do tricks where you have a symlink to the real directory and atomically replace the symlink with a new symlink to the new directory. Another comment pointed out though that most of the time you only need to update the cert, and not the key. So it's mostly a moot issue..