mirrors/maddy
1
0
Fork 0
mirror of https://github.com/foxcpp/maddy.git synced 2025-04-05 14:07:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

config: Reload TLS server certificates once in a minute

Browse source 
Use of inotify and possibly other mechanisms poses portability risks.
Notably, "cross-platform" abstractions such as fsnotify library remove
access to certain features that are important to use it correctly in
some cases e.g. it is preferable to listen only for IN_CLOSE_WRITE on
Linux instead of IN_MODIFY to prevent races and unexpected failures.

Pooling approach avoids such problems by either running reload code at a
different time than actual renewal or retrying later if parse fails.
With certificates being renewed before expiry (e.g. 1 week before) delay
is not a signficiant problem.

Closes #160.
This commit is contained in:
fox.cpp 2020-01-02 18:17:43 +03:00
parent a88a1a96b5
commit 14505f4de1
No known key found for this signature in database
GPG key ID: E76D97CCEDE90B6C
2 changed files with 21 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/tutorials/setting-up.md
View file

@ -71,17 +71,9 @@ You still need to make keys readable for maddy, though:
$ sudo setfacl -R -m u:maddy:rX /etc/letsencrypt/{live,archive}
```
Additionally, it is a good idea to automatically restart
maddy on certificate renewal.
Put that into /etc/letsencrypt/renewal-hooks/post/restart:
```shell
#!/bin/bash
systemctl restart maddy
```
And make it executable:
```
$ sudo chmod +x /etc/letsencrypt/renewal-hooks/post/restart
```
maddy reloads TLS certificates from disk once in a minute so it will notice
renewal. It is possible to force reload via `systemctl reload maddy` (or just
`killall -USR2 maddy`).
## First run