Skip to content

fix(ingress): skip the issuance retry when no account was created #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 1 commit into from
Oct 16, 2026
Merged

fix(ingress): skip the issuance retry when no account was created #163

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions custom-domain/dstack-ingress/scripts/dns01.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,7 @@ process_domain() {
fi

# The CAA record names our ACME account, so the account has to exist first:
# try once, write CAA, and try again if the first attempt failed while
# try once, write CAA, and try again if the first attempt failed after
# creating the account. That is the attempt a CAA record naming an earlier
# account refuses, and set_caa_record has just replaced it. Any other
# failure would only fail again, spending another of Let's Encrypt's five
Expand All @@ -316,8 +316,11 @@ process_domain() {
set_caa_record "$domain"

# Never after a success (0) or "nothing to renew" (2): a second attempt
# would issue another certificate whenever renewal is due.
if [ "$retry" = true ] && [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then
# would issue another certificate whenever renewal is due. Nor when the
# attempt did not get as far as creating the account (the CA unreachable,
# say): then there is no CAA naming it either.
if [ "$retry" = true ] && [ "$status" -ne 0 ] && [ "$status" -ne 2 ] &&
acme_account_file >/dev/null 2>&1; then
echo "First certificate attempt failed for $domain, retrying now that the CAA record names the new account"
if issue_certificate "$domain"; then status=0; else status=$?; fi
fi
Expand Down
Loading