meilisearch/cloud-providers

Configure certbot: user email and auto-renew

eskombro opened this issue · 4 comments

eskombro commented

Currently, certbot is used to create automatic SSL certificates if the user selects this option. This process needs to specify a user email address and creates a temporary certificate. The way it is handled now raises two main problems:

  • This script is using a MeiliSearch email address, so the user doesn't get notifications.
  • The auto-renew process is not handled

When these certificates expire, not only they probably won't be renewed automatically, but the user won't be notified about it.

curquiza commented

Really well explained!
How can we solve this? Can we use the user email address for this?

  • 👍1
eskombro commented
  1. I think we should ask indeed for their user email address, and use it.
  2. Need to check if the certbot certificate auto-renew is actually working
  • 👍1
fharper commented

I think DO have auto-renew as default from their images (like it checked twice a day!), not sure if it applies to our own image. Anyway, you can add sudo certbot renew in a cron job. If you want to be sure it's setup for doing it correctly, you can do a dry run sudo certbot renew --dry-run

alallema commented

Transfer of this issue to the cloud-provider project due to its depreciation