smallstep-certificates/systemd/cert-renewer@.service

[Unit]
Description=Certificate renewer for %I
After=network-online.target
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
StartLimitIntervalSec=0

[Service]
Type=oneshot
User=root

Environment=STEPPATH=/etc/step-ca \
            CERT_LOCATION=/etc/step/certs/%i.crt \
            KEY_LOCATION=/etc/step/certs/%i.key

; ExecStartPre checks if the certificate is ready for renewal,
; based on the exit status of the command.
; (In systemd 243 and above, you can use ExecCondition= here.)
ExecStartPre=/usr/bin/step certificate needs-renewal $CERT_LOCATION --roots $STEPPATH/certs/root_ca.crt

; ExecStart renews the certificate, if ExecStartPre was successful.
ExecStart=/usr/bin/step ca renew --force $CERT_LOCATION $KEY_LOCATION

; Try to reload or restart the systemd service that relies on this cert-renewer
; If the relying service doesn't exist, forge ahead.
ExecStartPost=/usr/bin/env bash -c "if ! systemctl --quiet is-enabled %i.service ; then exit 0; fi; systemctl try-reload-or-restart %i"

[Install]
WantedBy=multi-user.target
Add systemd files 3 years ago			`[Unit]`
			`Description=Certificate renewer for %I`
			`After=network-online.target`
			`Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production`
			`StartLimitIntervalSec=0`

			`[Service]`
			`Type=oneshot`
			`User=root`

			`Environment=STEPPATH=/etc/step-ca \`
			`CERT_LOCATION=/etc/step/certs/%i.crt \`
			`KEY_LOCATION=/etc/step/certs/%i.key`

			`; ExecStartPre checks if the certificate is ready for renewal,`
			`; based on the exit status of the command.`
			`; (In systemd 243 and above, you can use ExecCondition= here.)`
systemd cert renewer can now use 'step certificate needs-renewal' 3 years ago			`ExecStartPre=/usr/bin/step certificate needs-renewal $CERT_LOCATION --roots $STEPPATH/certs/root_ca.crt`
Add systemd files 3 years ago
			`; ExecStart renews the certificate, if ExecStartPre was successful.`
			`ExecStart=/usr/bin/step ca renew --force $CERT_LOCATION $KEY_LOCATION`

			`; Try to reload or restart the systemd service that relies on this cert-renewer`
Two small systemd changes 1. Don't halt the cert renewer service from ExecStartPost ops if a relying service doesn't exist; halt it if the relying service exists and doesn't restart properly. 2. Use /bin/env bash instead of /bin/bash for portability. 3 years ago			`; If the relying service doesn't exist, forge ahead.`
Revert systemd renewer unit change that was incorrect This reverts commit 75f24a103adeee22a24e2b5e3bcd664c8d43340c. 3 years ago			`ExecStartPost=/usr/bin/env bash -c "if ! systemctl --quiet is-enabled %i.service ; then exit 0; fi; systemctl try-reload-or-restart %i"`
Add systemd files 3 years ago
			`[Install]`
			`WantedBy=multi-user.target`