LetsEncryptの自動更新snap.certbot.renewを確認する

[一覧リスト](#一覧リスト)
[設定時間](#設定時間)
[状況確認](#状況確認)
[設定内容確認](#設定内容確認)
[ログ確認](#ログ確認)
[snapで正常に更新できるか確認](#snapで正常に更新できるか確認)
[参考記事](#参考記事)


#一覧リスト

```
# snap list

Name     Version    Rev    Tracking       Publisher     Notes
certbot  1.21.0     1582   latest/stable  certbot-eff✓  classic
core     16-2.52.1  11993  latest/stable  canonical✓    core
core20   20211115   1242   latest/stable  canonical✓    base

```

#設定時間

```
# snap refresh --time

timer: 00:00~24:00/4
last: today at 22:48 JST
next: tomorrow at 02:51 JST
```

「Systemd timer」での確認

```
# systemctl list-timers

NEXT                         LEFT     LAST                         PASSED       UNIT                         ACTIVATES
木 2021-11-18 20:32:00 JST  6h left  木 2021-11-18 06:21:06 JST  7h ago       snap.certbot.renew.timer     snap.certbot.renew.
金 2021-11-19 12:39:28 JST  22h left 木 2021-11-18 12:39:28 JST  1h 40min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-cl

2 timers listed.
Pass --all to see loaded but inactive timers, too.
```

2つのタイマーがセットされている
「snap.certbot.renew」
「systemd-tmpfiles-clean」

#状況確認

```
# systemctl status snap.certbot.renew.timer

● snap.certbot.renew.timer - Timer renew for snap application certbot.renew
   Loaded: loaded (/etc/systemd/system/snap.certbot.renew.timer; enabled; vendor preset: disabled)
   Active: active (waiting) since 木 2021-11-04 17:31:23 JST; 1 weeks 6 days ago

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
```

certbot（LetsEncrypt）を更新するためのアプリケーション
読込済み
稼働中（待機中）

#設定内容確認

```
# systemctl cat snap.certbot.renew.service

# /etc/systemd/system/snap.certbot.renew.service
[Unit]
# Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-1582.mount
Wants=network.target
After=var-lib-snapd-snap-certbot-1582.mount network.target snapd.apparmor.service
X-Snappy=yes

[Service]
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/1582
TimeoutStopSec=30
Type=oneshot

```

#ログ確認

```
# journalctl -f -u snap.certbot.renew.service

-- Logs begin at 土 2021-11-06 08:26:41 JST. --
11月 16 06:21:09 v157-7-134-162.myvps.jp systemd[1]: Starting Service for snap application certbot.renew...
11月 16 06:21:11 v157-7-134-162.myvps.jp systemd[1]: Started Service for snap application certbot.renew.
11月 16 20:32:08 v157-7-134-162.myvps.jp systemd[1]: Starting Service for snap application certbot.renew...
11月 16 20:32:10 v157-7-134-162.myvps.jp systemd[1]: Started Service for snap application certbot.renew.
11月 17 06:21:05 v157-7-134-162.myvps.jp systemd[1]: Starting Service for snap application certbot.renew...
11月 17 06:21:07 v157-7-134-162.myvps.jp systemd[1]: Started Service for snap application certbot.renew.
11月 17 20:32:00 v157-7-134-162.myvps.jp systemd[1]: Starting Service for snap application certbot.renew...
11月 17 20:32:02 v157-7-134-162.myvps.jp systemd[1]: Started Service for snap application certbot.renew.
11月 18 06:21:06 v157-7-134-162.myvps.jp systemd[1]: Starting Service for snap application certbot.renew...
11月 18 06:21:08 v157-7-134-162.myvps.jp systemd[1]: Started Service for snap application certbot.renew.
```

一日4回正常にタイマーが機能している模様

#snapで正常に更新できるか確認

```
# /var/lib/snapd/snap/bin/certbot

Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate and install certificates?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Apache Web Server plugin (apache)
2: Nginx Web Server plugin (nginx)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
```

1を選択

```
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: example.com
2: mail.example.com
3: sub.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
```

1を選択

```
Certificate not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/example.com.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the certificate (may be subject to CA rate limits)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
```

1:再インストール
2:更新

```
Renewing an existing certificate for example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
This certificate expires on 2022-02-16.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for example.com to /etc/httpd/conf.d/virtual.conf
```

#参考記事
`https://gamingpc.one/dev/systemd-timer-cheat/`
`https://www.mtioutput.com/entry/tmpfiles-clean-test`
`https://qiita.com/Brutus/items/6850a94358b9199834f2`