- A single oneshot lego.service (lego --config /etc/lego/lego.yaml) obtains
and renews the certificates, triggered at boot and daily by lego.timer.
- The deploy hook flags the certificate as renewed; lego-hooks.path then runs
renew-hooks.d/*.sh on the host, on the first issuance and on each renewal.
- lego.target only Wants lego.service: an ACME failure does not stop the
target and the timer retries.
- Consumers rely on the fixed certificate ID "default".
- Dev mode generates a self-signed "default" certificate.
- Document the v4 to v5 upgrade (reissue) and add pytest integration tests
against Pebble.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NMEYncwy1yEBJCSb8HLgXg
Nicolas Massé