Caddy: [Feature] renew hook for automatically obtained certificates

[fheusel]

Caddy is automatically obtaining LetsEncrypt certificates but I need to automate restarting services (e.g. dovecot, postfix) so that they load the renewed certificates. Would it be possible to implement some kind of renew hook, like it's available in certbot?

[francislavoie]

I think this is related to https://github.com/mholt/caddy/issues/1683

[mholt]

@fheusel Do you need the hook available from outside the Caddy process, or from within it (i.e. as part of a plugin or something)?

[fheusel]

@mholt I'm not sure if I understand you correctly. I'd like caddy to be able to trigger a restart of some services each time caddy obtains a new certificate. Otherwise services like dovecot or postfix won't pick up the new certificates.

[mholt]

@fheusel How does that restart happen? (i.e. push or pull method?)

[francislavoie]

Could you use something like inotify to watch for file changes? I'd think that could also work.

[elcore]

Theoretically, we could add an event hook to...

https://github.com/mholt/caddy/blob/b5ec4622993655d69ee68f3b833a69179a830f3f/caddytls/client.go#L268-L335

... and build a plugin to execute a command [os/exec], triggered by the event

[fheusel]

@mholt e.g service dovecot restart - so I suppose it's a push method?

@francislavoie that would be possible, but then one had to build another error prone "watching" service. And on different operating systems you'll need different solutions to watch for filechanges.

@elcore this sounds like the way I was hoping for.

[elcore]

Hello @fheusel,

I am currently working on this 😄

UPDATE 1: I am testing it in prod

[francislavoie]

Update, the new plan is the following:

1. Add new event hooks: CertRenewEvent (and InstanceStartupEvent @elcore?)
2. Add a new Caddyfile directive on [event] [cmd]
3. Deprecate the startup and shutdown directives and change them to be aliases for on startup [cmd]

Reference code:

• Original PR: https://github.com/mholt/caddy/pull/1842
• Original plugin code: https://github.com/elcore/caddy-command

Throwing another idea in here... Issue https://github.com/mholt/caddy/issues/1683 was requesting to get data metrics about certs. We could probably pass some of these metrics along with the new event for other plugins to use, as @mholt suggested on that issue. In addition, maybe some of the data passed through the events could be used as placeholders in the command on the new on directive? Maybe those are worth leaving to a different PR though.

[elcore]

[...] and InstanceStartupEvent @elcore?

Caddy Command does not support StartupEvent, as it is emitted before the Caddyfile is loaded!

https://github.com/mholt/caddy/blob/10484cfad2cdd852218c508db0f978161b9268ff/caddy/caddymain/run.go#L103-L110

[mholt]

Oh, yeah, the nice thing about startup/shutdown is that they apply to those servers/sites/listeners specifically, not the entire Caddy process as a whole. Either we keep those the same for now, or we will need to designate another event for per-site/per-listener startup/shutdown...

[elcore]

@mholt Correct!

P. S. : Caddy Command is configured per-site 😄