4 ms·

A few years ago I tweaked an Apache config to the most minimal set of modules and configs that I needed for my project. I considered this module as well, howeve

by mhitza 3y ago

A few years ago I tweaked an Apache config to the most minimal set of modules and configs that I needed for my project. I considered this module as well, however it couldn't use the certificate when issued/renewed without a restart[1]. Based on the current docs, that still seems to be the case. Whereas with Caddy, and other software that (I assume) use the same underlying libraries, like gotosocial, I start the service and it does it all. I'm still an Apache/nginx user, but certificates that require no configuration are the selling point of Caddy for me (and I use it on two very small projects because of that). [1] Which meant that I had to write some sort of automation that detected the reissue and restart Apache (and set up appropriate systemd service/timers, limited user permissions to only allow passwordless restart, etc). In the end I kept certbot (which I wanted to get rid off) and let it manage the certificate (DNS challenge) and Apache restart. I'm open to a suggestion on how this can be done in a minimal way and requiring no supervision after.

KronisLV 3y ago
For my own needs, I did something a bit naughty: scheduled restarts, since in my particular use case a dozen seconds of downtime here or there don't really matter. For something more precise, there is MDMessageCmd (e.g. listen for "renewed" and trigger reload; probably a short Bash script). Reload instead of restart should also be less disruptive.
- mhitza 3y ago
  The automatic restart could definitely work (since graceful is enough and doesn't cause downtime). Though it's better if unnecessary stuff isn't done on the server. The other option with MDMessageCmd, would require (on a SELinux distro) to grant Apache command exec permissions, among other tweaks. What would be better in this case were if Apache could message via DBus these events and I could make a dbus service that listens and restarts accordingly (better execution isolation). If Apache would do internally the certificate swap, now that would be perfect.

by mhitza 3y ago

KronisLV 3y ago

For my own needs, I did something a bit naughty: scheduled restarts, since in my particular use case a dozen seconds of downtime here or there don't really matter. For something more precise, there is MDMessageCmd (e.g. listen for "renewed" and trigger reload; probably a short Bash script). Reload instead of restart should also be less disruptive.

mhitza 3y ago
The automatic restart could definitely work (since graceful is enough and doesn't cause downtime). Though it's better if unnecessary stuff isn't done on the server. The other option with MDMessageCmd, would require (on a SELinux distro) to grant Apache command exec permissions, among other tweaks. What would be better in this case were if Apache could message via DBus these events and I could make a dbus service that listens and restarts accordingly (better execution isolation). If Apache would do internally the certificate swap, now that would be perfect.