[BUG] default letsencrypt pre-hook prevents http-01 webroot renewals

[bbbkada]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

root@2c4728d768bc:/config/etc/letsencrypt/renewal-hooks/pre# cat 10-nginx
#!/usr/bin/with-contenv bash

shellcheck shell=bash

shellcheck source=/dev/null

. /config/.donoteditthisfile.conf

if [[ ! "${ORIGVALIDATION}" = "dns" ]] && [[ ! "${ORIGVALIDATION}" = "duckdns" ]]; then
if pgrep -f "nginx:" >/dev/null; then
s6-svc -d /run/service/svc-nginx
fi
fi

Will shut down nginx when needed the most, letsencrypt http-01 validation requests gets resetted and fail !

Expected Behavior

NA

Steps To Reproduce

Install swag on Unraid

Environment

- OS: UNRAID
- How docker service was installed:
Community download

CPU architecture

x86-64

Docker creation

NA

Container logs

NA

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[github-actions]

A human has marked this issue as invalid, this likely happened because the issue template was not used in the creation of the issue.

[j0nnymoe]

If you're claiming this is going to fail, please provide proof/logs that it is indeed failing.

[bbbkada]

if nginx is down when letsencrypt is trying to validate with HTTP-01 ?
Do I really need to prove that it will fail ?

[j0nnymoe]

Yes you need to prove that it will fail. We have a lot people using this container and no one else has reported the issue.

[bbbkada]

If you distribute that pre-hook by default, people with http-01 and webroot validation will have issues.
I've already solved my problem. You can close the issue if you don't think it's a problem.
I haven't created that pre-hook.

[aptalca]

if nginx is down when letsencrypt is trying to validate with HTTP-01 ?
Do I really need to prove that it will fail ?

Our certbot implementation does not use nginx for http validation. Certbot sets up its own webserver during validation, hence the hook script stopping nginx before validation and starting it after.