From 49c0fd7d6005cab96c597d3c56ab0bade5f436c4 Mon Sep 17 00:00:00 2001 From: Lucas Savva Date: Tue, 4 Oct 2022 22:28:23 +0100 Subject: nixos/acme: Disable lego renew sleeping Lego has a built-in mechanism for sleeping for a random amount of time before renewing a certificate. In our environment this is not only unnecessary (as our systemd timer takes care of it) but also unwanted since it slows down the execution of the systemd service encompassing it, thus also slowing down the start up of any services its depending on. Also added FixedRandomDelay to the timer for more predictability. --- nixos/modules/security/acme/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'nixos/modules/security') diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix index 91ec24ab1f58d..e9299fb1b3adb 100644 --- a/nixos/modules/security/acme/default.nix +++ b/nixos/modules/security/acme/default.nix @@ -190,7 +190,7 @@ let ); renewOpts = escapeShellArgs ( commonOpts - ++ [ "renew" ] + ++ [ "renew" "--no-random-sleep" ] ++ optionals data.ocspMustStaple [ "--must-staple" ] ++ data.extraLegoRenewFlags ); @@ -223,9 +223,9 @@ let # have many certificates, the renewals are distributed over # the course of the day to avoid rate limits. AccuracySec = "${toString (_24hSecs / numCerts)}s"; - # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/. RandomizedDelaySec = "24h"; + FixedRandomDelay = true; }; }; -- cgit 1.4.1