Error message with systemd service file

[hallvoren]

Hi,

I'm using this: https://github.com/smallstep/certificates/blob/master/systemd/[email protected] service file and the timer to update certificates for nginx. It works, but it shows errors.

The problem is systemd sees that the ExecStartPre process, which checks if it is time to renew the certificate, returns an non zero return value and therefor gives an error. So if you run status on the service process you get:

Starting Certificate renewer for nginx...
[email protected]: Control process exited, code=exited, status=1/FAILURE
[email protected]: Failed with result 'exit-code'.
Failed to start Certificate renewer for nginx.

By the time it is actually time to renew the certificate it will return 0, so then it will run without this error. Which means the system is working, but just giving annoying errors. I'm running it on Debian 10.

Is there a better way to do this?

Hallvor

[tashian]

Hi @hallvoren, you can clear this up with ExecCondition, but last I checked Debian 10 runs systemd v241 and doesn't support that parameter. I haven't found another way to do prevent the renewal without these messages.

[tashian]

For posterity:

The ExecCondition option is supported by systemd v243+

Here are the stock systemd versions for some common Linux distros:

• Amazon Linux 2 v219
• CentOS 7 v219
• CentOS 8 v239
• Debian Buster (10) v241
• Debian Bullseye (11) v247
• RHEL 8.3.0 v239
• Ubuntu 16.04 v229 (does not support ReadWritePaths)
• Ubuntu 18.04 v237
• Ubuntu 20.04 LTS v245
• Ubuntu 20.10 v246

[LecrisUT]

I am using CentOS 8, and it seems ExecCondition still works:

$ systemctl --version
systemd 239 (239-45.el8)
$ systemctl status cert-renewer@***.service
cert-renewer@***.service: Control process exited, code=exited status=1
cert-renewer@***.service: Skipped due to 'exec-condition'.
Condition check resulted in Certificate renewer for 389ds being skipped.

[tashian]

That is very odd. The systemd changelog only has one match for ExecCondition, in version 243. I guess CentOS 8 must have merged this feature as part of their own build?

[LecrisUT]

Yes, that's most likely the case. Finding out if other distros did the same would be a trial and error problem

[hallvoren]

Hi. Thanks for the reply.
At least you know about it. And we can certainly live with it, just a bit noisy.
Not sure if it should be documented somewhere, but at least now people might find this report.