Change:
The sytemd service created by failes even though certificates for the configured virtual hosts are correctly retrieved from Lets encrypt. I have been trying to figure out what is causing the problem but the logs are not very helpful: Let me know what additional information I can provide to find the cause of this. Steps to reproduce the behavior: a nginx virtual host with Service not failing If applicable, add screenshots to help explain your problem. Add any other context about the problem here. Please run and paste the result. ` Maintainer information:
I think the issue is . This service should have been not started in the first place. Still for some reasons systemd tries to start it.
That's my workaround:
No, that's not it. The conditionPathExists would only block it from running and produces this status: The real question here is why it's in condition start-limit-hit. I just created a loop on my own system to restart it 100 times in a loop and it dis not happen, as expected. I'm on systemd 249.4 (slightly behind?) and I would hedge a guess this is an upstream issue at the moment. That or you have a globally configured start limit? I'm still skeptical start limit takes precedence over start condition failed As a test can you try this (typing on mobile please autocorrect typos )
Another possibility is were not seeing an error further up in the service logs. It's possible on your first run the script actually failed, and with many certs it would be attempted many times. Can you take a quick scan further back up the logs see if there's anything obvious?
Sure: The start seems to fail on all tries. This is the full log as shown by
Thanks for running that test + the logs. It's super weird, it does indeed look like start-limit-hit is being triggered despite systemd clearly skipping based on the condition. I'm going to update my system later and try this myself. What is your ?
Thanks for looking into it. Let me know if you need any additional info!
I'm also running into this on . Logs look similar to the ones posted.
I tried making a whilst on to try and provoke this issue. What I do notice is that on nixos-rebuild it does seem to get invoked 3 times in rapid succession, but I'm struggling to get it to fire 5+ times and thus I haven't reproduced this issue yet. Mic92's workaround is fine but ConditionPathExists does + has worked fine for a very long time, and I haven't yet figured out why you would end up with a start limit error on the service. Will continue to look into it over the weekend, but posting here in hope someone has some bright ideas
Wait.. What if we just set the to zero and ignore this non-issue? This is a lighter solution than moving the logic to bash since it would avoid spinning up an interpreter + script just to no-op. Anyone got objections to this? Infact - hold your answers for a PR :)
Can confirm this works now. Thanks!

Discussion:
unitConfig = { ConditionPathExists = "!/var/lib/acme/.minica/key.pem"; <ins> StartLimitIntervalSec = 0; </ins> }; serviceConfig = commonServiceConfig // {

unitConfig = { ConditionPathExists = "!/var/lib/acme/${cert}/key.pem"; <ins> StartLimitIntervalSec = 0; </ins> }; serviceConfig = commonServiceConfig // {