You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
49 lines
1.2 KiB
49 lines
1.2 KiB
[Unit]
|
|
Description=Lego Let's Encrypt client - Obtain or renew the certificates
|
|
Documentation=https://go-acme.github.io/lego/
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
PartOf=lego.target
|
|
|
|
# Only start if Lego has been configured !
|
|
ConditionPathExists=/etc/quadlets/lego/lego.yaml
|
|
|
|
[Container]
|
|
ContainerName=lego
|
|
|
|
# No need for root privileges
|
|
User=10023
|
|
Group=10000
|
|
AddCapability=CAP_NET_BIND_SERVICE
|
|
|
|
# Image
|
|
Image=lego.image
|
|
AutoUpdate=registry
|
|
|
|
# Network configuration
|
|
Network=host
|
|
|
|
# Volume mounts
|
|
Volume=/var/lib/quadlets/lego:/var/lib/lego:z
|
|
Volume=/etc/quadlets/lego:/etc/lego:ro
|
|
|
|
# Be safe, set the umask to 0077 so that private keys are not world-readable
|
|
PodmanArgs=--umask=0077
|
|
|
|
# Lego v5 obtains the missing certificates and renews the expiring ones
|
|
# described in its configuration file. It does nothing otherwise.
|
|
Exec=--config /etc/lego/lego.yaml
|
|
|
|
[Service]
|
|
# If the command fails, don't try to restart it.
|
|
# Otherwise, we would hammer the Let's Encrypt servers and possibly get banned.
|
|
Restart=no
|
|
|
|
# Getting a certificate may take some time
|
|
TimeoutStartSec=900
|
|
|
|
# This container is a job - run once to completion
|
|
Type=oneshot
|
|
|
|
[Install]
|
|
WantedBy=lego.target
|
|
|