ansible-personal/roles/nginx/files/renew-letsencrypt.timer

[Unit]
Description=Renew Let's Encrypt certificates

[Timer]
# twice a day, at midnight and noon
OnCalendar=*-*-* 00,12:00:00
# Add a random delay of 0–3600 seconds
RandomizedDelaySec=3600
Persistent=true

[Install]
WantedBy=timers.target
-												roles/nginx: Rework Let's Encrypt stuff

Take an opinionated stance on HTTPS and assume that hosts are using
HTTPS for all vhosts. This can either be via custom TLS cert/key
pairs defined in the host's variables (could even be self-signed
certificates on dev boxes) or via Let's Encrypt.

											
										
										
											2016-06-27 23:52:39 +03:00
+								[Unit]
-												roles/nginx: Better names for Let's Encrypt timer/service

											
										
										
											2016-07-07 14:36:29 +03:00
+								Description=Renew Let's Encrypt certificates
-												roles/nginx: Rework Let's Encrypt stuff

Take an opinionated stance on HTTPS and assume that hosts are using
HTTPS for all vhosts. This can either be via custom TLS cert/key
pairs defined in the host's variables (could even be self-signed
certificates on dev boxes) or via Let's Encrypt.

											
										
										
											2016-06-27 23:52:39 +03:00
 								[Timer]
-												Revert "roles/nginx: Only run Let's Encrypt checks once a day"

This reverts commit a38d822fad7e33eee81ad87e3227c96576a4974e.

The docs definitely recommend twice a day. From a note on certbot's
installation page:

> if you're setting up a cron or systemd job, we recommend running
> it twice per day (it won't do anything until your certificates
> are due for renewal or revoked, but running it regularly would
> give your site a chance of staying online in case a Let's
> Encrypt-initiated revocation happened for some reason). Please
> select a random minute within the hour for your renewal tasks.

See: https://certbot.eff.org/#ubuntuxenial-nginx

											
										
										
											2016-08-17 11:30:10 +03:00
+								# twice a day, at midnight and noon
 								OnCalendar=*-*-* 00,12:00:00
-												roles/nginx: Rework Let's Encrypt stuff

Take an opinionated stance on HTTPS and assume that hosts are using
HTTPS for all vhosts. This can either be via custom TLS cert/key
pairs defined in the host's variables (could even be self-signed
certificates on dev boxes) or via Let's Encrypt.

											
										
										
											2016-06-27 23:52:39 +03:00
+								# Add a random delay of 0–3600 seconds
 								RandomizedDelaySec=3600
 								Persistent=true
 								[Install]
 								WantedBy=timers.target