Repository navigation
fix(ingress): serve existing dns-01 certificates before the first pass - #158
Merged
Merged
Conversation
This was referenced Oct 16, 2026
kvinwang
force-pushed
the
fix/ingress-serve-first
branch
3 times, most recently
from
October 16, 2026 01:20
8f49c1a to
c5e01e2
Compare
kvinwang
force-pushed
the
fix/ingress-serve-first
branch
2 times, most recently
from
October 16, 2026 01:25
bd162d4 to
7eb3401
Compare
dns-01 finished a whole certificate pass before starting haproxy, so on a restart every domain stayed unserved for as long as the slowest one took: a certbot run up to its timeout for a domain that fails, or up to DNS_SETUP_TIMEOUT (30 min) per domain whose delegation CNAMEs are still being created. When any certificate is on disk, start haproxy first and run the pass in the background loop. Without one, keep issuing first and exit if the pass yields nothing to serve. Serving before the pass would also serve what the last run left in /evidences, which attests a container that may no longer be running -- as tls-alpn-01 already did. So both modes now prepare serving the same way (prepare_serving in cert-lib.sh): republish the evidence before haproxy starts, or withdraw it if that is not possible yet. haproxy reads the PEMs built there itself, so the first pass no longer reloads it either. Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
force-pushed
the
fix/ingress-serve-first
branch
from
October 16, 2026 01:27
7eb3401 to
f01040e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
dns-01 finished a whole certificate pass before starting haproxy. After a restart every domain stayed unserved for as long as the slowest one took: a certbot run up to its timeout for a domain that fails, or up to
DNS_SETUP_TIMEOUT(30 min) per domain whose delegation CNAMEs are still being created.What
prepare_servingincert-lib.shruns just before haproxy starts. It republishes the evidence, or withdraws what the last run left (it attests a container that may be gone) when that is not possible yet; tls-alpn-01 used to serve the old evidence until its first pass. haproxy reads the PEMs built there itself, so the first pass no longer reloads it.Tests
prepare_servingstubbed over account present/absent × evidence ok/failing. Pebble end-to-end results will follow in a comment.