Right? It’s so ridiculous how you’re supposed to use Snap to install certbot. The (well, one of..) GitHub discussion is just beyond the pale:

https://github.com/certbot/certbot/issues/8345#issuecomment-...

I really hate how all that junk urinates into /etc, which should be treated as immutable by applications. Changing state should go into /var/run.

/var/run isn't really suitable for certificates, as it's allowed to get cleared on every boot. /var/lib would be the better alternative.

Just install docker or k8s and use certbot image.

I know you jest, but if you're in k8s, I'd check out cert-manager (https://cert-manager.io/). It works quite well, and as it integrates w/ k8s, it stores the cert in a Secret where an Ingress picks it up automatically, and it solves the whole multiple-replicas-all-need-the-cert problem that I have w/ certbot.

(I agree, while certbot works, it's a bit of a usability nightmare.)

Wish it had a way to kick off a pod after a certificate is issued, that way I could automate applying the issued certificates to the devices where they'll be used.

(Yeah I currently do this with a cron job so it's not _so_ bad)...

Yes. I would appreciate such a feature, too. For Ingresses, it doesn't matter (as the controller is smart & picks it up automatically) but we have a database whose cert requires a rolling restart, and yeah, it'd be good to have a way to trigger that.

(We get around this, normally, by having regular reboots of the nodes for system updates. So no pod lives long enough for a replacement cert to not get picked up in time, usually. In the off case reboots don't happen, we have alerting.)

And have docker insert firewall rules in ways you didn't expect on a production server? Sounds fun.

The solution is frequently less software, not more.

Well, podman then? I think it's pretty much user-space and does not tinker with system settings.

The thread above has mentioned a very real problem with snap running on OpenVZ. It requires either squashfs as a kernel module or FUSE+squashfuse. Many OpenVZ hosts will not provide either and docker/k8s is obviously out if you are already operating inside a container...

Like, squashfs is great and all and packaged app images are an acceptable way of delivering desktop apps... but there's so much lossage here when certbot indirectly requires both just for an install.

(I ended up going with acme.sh instead.)

I think vbezhenar was just joking.

Frankly at this point I'd happily accept it if certbot required docker or k8s over snap.

At least then I know I'll have to run it in a container (and give up then) instead of waste hours figuring out why I get a snap error message when I try to run/install certbot before finally coming to the conclusion it is impossible.

Poe's law detected.