Test if renewal succeeded without renew-hook

[smaddock]

• I'm calling lego within a script; I do not want to call a second script for the renew-hook functionality.
• I would pass a shell function to the renew-hook if that worked, but it does not.

Therefore I'm trying to figure out a test for whether the renewal occurred.

• lego exits 0 even if renewal was not needed. I understand the reasons for this.
• The documented LEGO_ environment variables are not available in the context lego runs.
• I could parse the STDOUT log output of lego but that feels fragile
• Parsing the output of openssl x509 -startdate also feels fragile
• The script is running in an ephemeral environment so I don't want to rely on the file system modified date

The best idea I have currently is storing the cert fingerprint prior to running lego and comparing it to the fingerprint after. But if anyone else has a better idea, I'm open.

[ldez]

I would pass a shell function to the renew-hook if that worked, but it does not.

can you explain this sentence?

[ldez]

🤔 why are you not calling the function inside the script?

#!/bin/bash

myFunction() {
  echo "Doing post-renewal things."
}

myFunction

lego --email="[email protected]" --domains="example.com" --http renew --renew-hook=myScript.sh

[smaddock]

Oh... because the script is doing a lot of things before and after calling lego. That would require a second script.

[smaddock]

So currently I'm doing this instead:

OLD_FINGERPRINT=$(openssl x509 -fingerprint -in "example.com.crt" -noout)

lego --email="[email protected]" --domains="example.com" --http renew

NEW_FINGERPRINT=$(openssl x509 -fingerprint -in "example.com.crt" -noout)

if [[ $OLD_FINGERPRINT != "$NEW_FINGERPRINT" ]]; then
  myFunction
fi

[ldez]

I have 2 ideas:

• generate a temporary script called inside the hook.
• use the hook to create a temporary file.

temporary generated script

#!/bin/bash

TEMP_HOOK=/tmp/lego-hook.sh

cat > ${TEMP_HOOK}  <<EOF
myFunction() {
  echo "Doing post-renewal things. JJ"
}

myFunction
EOF

chmod u+x /tmp/lego-hook.sh

lego --email="[email protected]" --domains="example.com" --http renew --renew-hook="${TEMP_HOOK}"

rm ${TEMP_HOOK}

temporary file

#!/bin/bash

myFunction() {
  echo "Doing post-renewal things."
}

RENEWED=/tmp/$(tr -dc A-Za-z0-9 </dev/urandom | head -c 13).txt

lego --email="[email protected]" --domains="example.com" --http renew --renew-hook="touch ${RENEWED}"

if test -f "${RENEWED}"; then
  echo "File ${RENEWED} exists."
  myFunction
fi

rm -f ${RENEWED}

The temp script allows the use of the env vars of the hook.

The temp file is simple but less powerful.

[smaddock]

I like them both, probably the temporary file more. And you could use mktemp instead of generating a random filename yourself. Thank you!

[smaddock]

Would the env vars be available directly in the renew hook call? E.g., would:
--renew-hook="echo \$LEGO_CERT_NAME > ${RENEWED}" work?

[ldez]

no, because the value of the renew flag value is evaluated by your shell.

[ldez]

I missed that you escaped the $LEGO_CERT_NAME. I should "work" but ${RENEWED} will be evaluated before.

Also, the white spaces will be a problem, because I need to split the elements, and so space is the separator.

The value of the flag should be "simple".