2

On a mail server I need to reload Dovecot after Certbot renews my Let's Encrypt certificates. According to the Certbot documentation a --deploy-hook can be used:

Command to be run in a shell once for each issued certificate.

I found the cron job that was created automatically at /etc/cron.d/certbot, and with the help of of certbot and this question I figured I would use:

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --deploy-hook "service dovecot reload"

The problem is, Docecot does not appear to restart. Certificate renewal is still successful. My question: How to make sure Dovecot is reloaded after certificate renewal?

Addition information: Server runs on Ubuntu 18.04.3 LTS with Certbot 0.31.0.

Dirk J. Faber
  • 75
  • 4

2 Answers2

0

Would --post-hook instead of --deploy-hook work ? If so, deploy-hook will also work, but only in case of actual renewal. maybe try this syntax as well :--deploy-hook="restart app..."

MeMow
  • 282
  • 1
  • 7
0

Due to a lack of a comprehensive answer, I want to add the solution I went with after stumbling over this thread.

According to readthedocs.io:

When Certbot detects that a certificate is due for renewal, --pre-hook and --post-hook hooks run before and after each attempt to renew it. If you want your hook to run only after a successful renewal, use --deploy-hook in a command like this.

certbot renew --deploy-hook /path/to/deploy-hook-script

Derived from that, the "--deploy-hook" parameter expects a path to a script. I did not test if a quoted command would work as well, but it is my first guess that this is why your attempt failed.

You can also specify hooks by placing files in subdirectories of Certbot’s configuration directory. Assuming your configuration directory is /etc/letsencrypt, any executable files found in /etc/letsencrypt/renewal-hooks/pre, /etc/letsencrypt/renewal-hooks/deploy, and /etc/letsencrypt/renewal-hooks/post will be run as pre, deploy, and post hooks respectively when any certificate is renewed with the renew subcommand.

This is how I did it. I simply created a shell script in /etc/letsencrypt/renewal-hooks/deploy, called it e.g. 00-do-stuff.sh and made it executable (sudo chmod +x path/to/file)

Please let me and everybody know if this works for you :)

randmin
  • 49
  • 7