Table of Contents
#+title [16aug2026] setup autorenewing certificate on cloud host
1. Problem
Self-signed certificate expired on my cloud host vpn1.
2. Plan
Setup systemd services to renew certificate automagically.
We are using nix to provide the services themselves.
2.1. Renew Certificate
To renew certificate immediately:
$ ssh vpn1 sudo /nix/var/nix/profiles/default/bin/nix run nixpkgs#certbot -- renew \ --pre-=hook 'systemctl stop nginx' \ --post-hook 'systemctl start nginx'
2.2. Certbot Renewal Service
${certbot} is store path to the certificate bot.
# /etc/systemd/system/certbot-renew.service [Unit] Description=Renew Let's Encrypt certificates (fleet-managed) After=network-online.target Wants=network-online.target [Service] Type=oneshot ExecStart=${certbot}/bin/certbot renew --non-interactive \ --pre-hook '/usr/bin/systemctl stop nginx' \ --post-hook '/usr/bin/systemctl start nginx' # Safety net: if certbot dies between hooks, # nginx stays down and takes forgejo and CI with it until a human notices # ExecStopPost=-/usr/bin/systemctl --no-block start nginx
2.3. Renewal Timer
Timer to check certificate and autorenew
# /etc/systemd/system/certbot-renew.timer [Unit] Description=Twice-daily Let's Encrypt renewal check (fleet-managed) [Timer] OnCalendar=*-*-* 03,15:00:00 RandomizedDelaySec=1h Persistent=true [Install] WantedBy=timers.target
2.4. Renew Certificate
After establishing new /etc/systemd content:
$ ssh vpn1 $ sudo systemctl daemon-reload $ sudo systemctl enable --now certbot-renew.timer
2.5. Verify
$ ssh vpn1
sudo systemctl --no-pager --full status nginx \ head -n 6
sudo systemctl --no-pager list-timers certbot-renew.timer
Can also browse:
- https://conybeare.us nginx default landing page at present
- https://conybeare.us/git forgejo git hosting