4 ms·

Right? It’s so ridiculous how you’re supposed to use Snap to install certbot. The (well, one of..) GitHub discussion is just beyond the pale: https://github.co

by 9dev 4y ago

Right? It’s so ridiculous how you’re supposed to use Snap to install certbot. The (well, one of..) GitHub discussion is just beyond the pale: https://github.com/certbot/certbot/issues/8345#issuecomment-1039049260 https://github.com/certbot/certbot/issues/8345#issuecomment-...

kazinator 4y ago
I really hate how all that junk urinates into /etc, which should be treated as immutable by applications. Changing state should go into /var/run.
- Denvercoder9 4y ago
  /var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.
vbezhenar 4y ago
Just install docker or k8s and use certbot image.
- jabbany 4y ago
  The thread above has mentioned a very real problem with snap running on OpenVZ. It requires either squashfs as a kernel module or FUSE+squashfuse. Many OpenVZ hosts will not provide either and docker/k8s is obviously out if you are already operating inside a container... Like, squashfs is great and all and packaged app images are an acceptable way of delivering desktop apps... but there's so much lossage here when certbot indirectly requires both just for an install. (I ended up going with acme.sh instead.)
  - yakubin 4y ago
    I think vbezhenar was just joking.
    - jabbany 4y ago
      Frankly at this point I'd happily accept it if certbot required docker or k8s over snap. At least then I know I'll have to run it in a container (and give up then) instead of waste hours figuring out why I get a snap error message when I try to run/install certbot before finally coming to the conclusion it is impossible.
- zdw 4y ago
  And have docker insert firewall rules in ways you didn't expect on a production server? Sounds fun. The solution is frequently less software, not more.
  - vbezhenar 4y ago
    Well, podman then? I think it's pretty much user-space and does not tinker with system settings.
- goodpoint 4y ago
  Poe's law detected.
- deathanatos 4y ago
  I know you jest, but if you're in k8s, I'd check out cert-manager (https://cert-manager.io/ https://cert-manager.io/). It works quite well, and as it integrates w/ k8s, it stores the cert in a Secret where an Ingress picks it up automatically, and it solves the whole multiple-replicas-all-need-the-cert problem that I have w/ certbot. (I agree, while certbot works, it's a bit of a usability nightmare.)
  - yrro 4y ago
    Wish it had a way to kick off a pod after a certificate is issued, that way I could automate applying the issued certificates to the devices where they'll be used. (Yeah I currently do this with a cron job so it's not _so_ bad)...
    - deathanatos 4y ago
      Yes. I would appreciate such a feature, too. For Ingresses, it doesn't matter (as the controller is smart & picks it up automatically) but we have a database whose cert requires a rolling restart, and yeah, it'd be good to have a way to trigger that. (We get around this, normally, by having regular reboots of the nodes for system updates. So no pod lives long enough for a replacement cert to not get picked up in time, usually. In the off case reboots don't happen, we have alerting.)

by 9dev 4y ago

kazinator 4y ago

I really hate how all that junk urinates into /etc, which should be treated as immutable by applications. Changing state should go into /var/run.

Denvercoder9 4y ago
/var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.

vbezhenar 4y ago

Just install docker or k8s and use certbot image.

jabbany 4y ago
The thread above has mentioned a very real problem with snap running on OpenVZ. It requires either squashfs as a kernel module or FUSE+squashfuse. Many OpenVZ hosts will not provide either and docker/k8s is obviously out if you are already operating inside a container... Like, squashfs is great and all and packaged app images are an acceptable way of delivering desktop apps... but there's so much lossage here when certbot indirectly requires both just for an install. (I ended up going with acme.sh instead.)
- yakubin 4y ago
  I think vbezhenar was just joking.
  - jabbany 4y ago
    Frankly at this point I'd happily accept it if certbot required docker or k8s over snap. At least then I know I'll have to run it in a container (and give up then) instead of waste hours figuring out why I get a snap error message when I try to run/install certbot before finally coming to the conclusion it is impossible.
zdw 4y ago
And have docker insert firewall rules in ways you didn't expect on a production server? Sounds fun. The solution is frequently less software, not more.
- vbezhenar 4y ago
  Well, podman then? I think it's pretty much user-space and does not tinker with system settings.
goodpoint 4y ago
Poe's law detected.
deathanatos 4y ago
I know you jest, but if you're in k8s, I'd check out cert-manager (https://cert-manager.io/ https://cert-manager.io/). It works quite well, and as it integrates w/ k8s, it stores the cert in a Secret where an Ingress picks it up automatically, and it solves the whole multiple-replicas-all-need-the-cert problem that I have w/ certbot. (I agree, while certbot works, it's a bit of a usability nightmare.)
- yrro 4y ago
  Wish it had a way to kick off a pod after a certificate is issued, that way I could automate applying the issued certificates to the devices where they'll be used. (Yeah I currently do this with a cron job so it's not _so_ bad)...
  - deathanatos 4y ago
    Yes. I would appreciate such a feature, too. For Ingresses, it doesn't matter (as the controller is smart & picks it up automatically) but we have a database whose cert requires a rolling restart, and yeah, it'd be good to have a way to trigger that. (We get around this, normally, by having regular reboots of the nodes for system updates. So no pod lives long enough for a replacement cert to not get picked up in time, usually. In the off case reboots don't happen, we have alerting.)