quay, smtprelay, traefik: adapt to lego v5

- Use the "default" certificate ID in the examples and documentation.
- Hooks use try-restart so that they do not start the service early on the
  first issuance; the Quay hook skips the restart when no certificate has
  been loaded yet.
- quay-app is ordered after lego.target.
- Document a renewal hook for Traefik.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NMEYncwy1yEBJCSb8HLgXg

cookbooks/quay/other/lego/quay.sh

@@ -2,5 +2,13 @@
 
 set -Eeuo pipefail
 
+# On the first issuance, quay-app has not loaded any certificate yet: it is not
+# running (its ExecStartPre loads the certificates) and will pick up the new
+# certificate by itself when it starts. Restarting it would be useless.
+if [ ! -s /run/quadlets/quay/tls/ssl.cert ]; then
+    echo "No TLS certificate loaded in Quay yet, skipping the restart of quay-app."
+    exit 0
+fi
+
 /etc/quadlets/quay/quay_load_tls_certs.sh
 systemctl --no-block restart quay-app.service

cookbooks/quay/quay-app.container

@@ -1,8 +1,9 @@
 [Unit]
 Description=Quay Container Registry Application
 Documentation=https://docs.projectquay.io/
-After=network.target redis-server.service var-lib-virtiofs-data.mount
+After=network.target redis-server.service var-lib-virtiofs-data.mount lego.target
 Requires=redis-server.service var-lib-virtiofs-data.mount
+Wants=lego.target
 
 # Only start if Quay has been configured
 ConditionPathExists=/etc/quadlets/quay/app/config.yaml

cookbooks/smtprelay/SPECS.md

@@ -44,8 +44,8 @@ allowed_nets = 0.0.0.0/0
 
 ; Enable TLS for incoming connections on port 587
 listen = starttls://0.0.0.0:587
-local_cert = /etc/smtprelay/tls/localhost.crt
-local_key  = /etc/smtprelay/tls/localhost.key
+local_cert = /etc/smtprelay/tls/default.crt
+local_key  = /etc/smtprelay/tls/default.key
 
 ; Enforce encrypted connection on STARTTLS ports before
 ; accepting mails from client.

cookbooks/smtprelay/config/examples/smtprelay.ini

@@ -20,14 +20,14 @@ allowed_nets = 0.0.0.0/0
 ; -----------------------------------------------------------------------
 ; Inbound TLS (certificates provided by the lego cookbook)
 ;
-; Replace "localhost" with the actual certificate filename from
-; /var/lib/quadlets/lego/certificates/.
+; The lego cookbook stores the certificate named "default" in
+; /var/lib/quadlets/lego/certificates/default.{crt,key}.
 ; -----------------------------------------------------------------------
 
 ; Enable TLS for incoming connections on port 587
 listen = starttls://0.0.0.0:587
-local_cert = /etc/smtprelay/tls/localhost.crt
-local_key  = /etc/smtprelay/tls/localhost.key
+local_cert = /etc/smtprelay/tls/default.crt
+local_key  = /etc/smtprelay/tls/default.key
 
 ; Enforce encrypted connection on STARTTLS ports before
 ; accepting mails from client.

cookbooks/smtprelay/other/lego/smtprelay.sh

@@ -3,4 +3,5 @@
 set -Eeuo pipefail
 
 install -o 10030 -g 10000 -m 0600 -t /run/quadlets/smtprelay/tls /var/lib/quadlets/lego/certificates/*.crt /var/lib/quadlets/lego/certificates/*.key
-systemctl --no-block restart smtprelay.service
+# "try-restart" does nothing if smtprelay is not running yet (first issuance at boot).
+systemctl --no-block try-restart smtprelay.service

cookbooks/traefik/README.md

@@ -122,18 +122,18 @@ HealthCmd=wget -q -O /dev/null --no-check-certificate --header 'Host: ping' http
 ExecStartPre=/bin/sh -c 'install -o 10001 -g 10000 -m 0600 -t /run/quadlets/traefik/tls /var/lib/quadlets/lego/certificates/*.crt /var/lib/quadlets/lego/certificates/*.key'
 ```
 
-**/etc/quadlets/traefik/conf.d/tls.yaml**:
+**/etc/quadlets/traefik/conf.d/tls.yaml** (the lego cookbook stores the certificate under the `default` ID, see `certificates.default` in `/etc/quadlets/lego/lego.yaml`):
 
 ```yaml
 tls:
   certificates:
-  - certFile: /etc/traefik/tls/f.q.d.n.crt
-    keyFile: /etc/traefik/tls/f.q.d.n.key
+  - certFile: /etc/traefik/tls/default.crt
+    keyFile: /etc/traefik/tls/default.key
   stores:
     default:
       defaultCertificate:
-        certFile: /etc/traefik/tls/f.q.d.n.crt
-        keyFile: /etc/traefik/tls/f.q.d.n.key
+        certFile: /etc/traefik/tls/default.crt
+        keyFile: /etc/traefik/tls/default.key
 
 http:
   routers:
@@ -185,3 +185,18 @@ http:
         servers:
         - url: "http://127.0.0.1:8080"
 ```
+
+**/etc/quadlets/lego/renew-hooks.d/traefik.sh** (mode 0755, owned by root):
+
+```sh
+#!/bin/bash
+
+set -Eeuo pipefail
+
+# The TLS certificates are copied by the ExecStartPre of traefik.service.
+# "try-restart" does nothing if Traefik is not running yet (first issuance at boot).
+systemctl --no-block try-restart traefik.service
+```
+
+This hook is run by the lego cookbook each time a certificate is obtained or renewed.
+Without it, Traefik would keep serving the old certificate until its next restart.