[Unit]
Description=Lego Let's Encrypt client - Obtain or renew the certificates
Documentation=https://go-acme.github.io/lego/
After=network-online.target
Wants=network-online.target
PartOf=lego.target

# Only start if Lego has been configured !
ConditionPathExists=/etc/quadlets/lego/lego.yaml

[Container]
ContainerName=lego

# No need for root privileges
User=10023
Group=10000
AddCapability=CAP_NET_BIND_SERVICE

# Image
Image=lego.image
AutoUpdate=registry

# Network configuration
Network=host

# Volume mounts
Volume=/var/lib/quadlets/lego:/var/lib/lego:z
Volume=/etc/quadlets/lego:/etc/lego:ro

# Be safe, set the umask to 0077 so that private keys are not world-readable
PodmanArgs=--umask=0077

# Lego v5 obtains the missing certificates and renews the expiring ones
# described in its configuration file. It does nothing otherwise.
Exec=--config /etc/lego/lego.yaml

[Service]
# If the command fails, don't try to restart it.
# Otherwise, we would hammer the Let's Encrypt servers and possibly get banned.
Restart=no

# Getting a certificate may take some time
TimeoutStartSec=900

# This container is a job - run once to completion
Type=oneshot

[Install]
WantedBy=lego.target