| opendevreview | Jeremy Stanley proposed opendev/system-config master: Use magic domain guessing in Mailman 3 https://review.opendev.org/c/opendev/system-config/+/867987 | 01:03 |
|---|---|---|
| opendevreview | Jeremy Stanley proposed opendev/system-config master: Upgrade to latest Mailman 3 releases https://review.opendev.org/c/opendev/system-config/+/869210 | 01:34 |
| opendevreview | Jeremy Stanley proposed opendev/system-config master: Use magic domain guessing in Mailman 3 https://review.opendev.org/c/opendev/system-config/+/867987 | 01:51 |
| opendevreview | Jeremy Stanley proposed opendev/system-config master: Upgrade to latest Mailman 3 releases https://review.opendev.org/c/opendev/system-config/+/869210 | 01:51 |
| frickler | fungi: ianw: acme.sh has again ended with "Unknown failure: 0" and /var/jitsi-meet/web/keys/cert.crt hasn't been updated. maybe this is related somehow to bionic being EOL? I would suggest to update the target cert file manually for now and maybe we can get the host updated before it expires again | 07:20 |
| ianw | hrm ... | 07:21 |
| ianw | PING meetpad01.opendev.org(meetpad01.opendev.org (2001:4800:7819:104:be76:4eff:fe04:892f)) 56 data bytes | 07:23 |
| ianw | 12 packets transmitted, 0 received, 100% packet loss, time 11247ms | 07:23 |
| ianw | might be something dodgy with my ipv6 ... it works on ipv4 | 07:24 |
| ianw | [Thu Jul 27 02:46:58 UTC 2023] And the full chain certs is there: /etc/letsencrypt-certs/meetpad01.opendev.org/fullchain.cer | 07:24 |
| ianw | Unknown failure: 0 | 07:24 |
| ianw | indeed | 07:24 |
| frickler | works fine for me, ssh even chose v6 by default | 07:24 |
| ianw | is that the driver or acme.sh? | 07:25 |
| frickler | that's a good question | 07:25 |
| ianw | https://opendev.org/opendev/system-config/src/branch/master/playbooks/roles/letsencrypt-acme-sh-install/files/driver.sh#L70 | 07:26 |
| ianw | the driver | 07:26 |
| ianw | that interesting, the driver is basically handling two cases -- there's alread a cert (2) or there is no cert, and it has to issue one (3) | 07:27 |
| ianw | after the issue, it should have to retry | 07:28 |
| ianw | "Thu Jul 27 02:46:57 UTC 2023] meetpad.opendev.org is already verified, skip dns-01." | 07:28 |
| ianw | hrm, is there already a valid dns auth?! so basically it's not spitting out the "put this key into DNS for us to verify the domain" | 07:29 |
| frickler | yes, that's what I noted earlier for the first re-issue on 14th or so | 07:29 |
| frickler | the first attempt succeeded at dns auth, but failed to issue the cert after that | 07:30 |
| frickler | and LE caches that dns auth success for some time | 07:30 |
| ianw | there is ... dig TXT _acme-challenge.meetpad.opendev.org | 07:31 |
| ianw | right ... so the driver script (or, really, me who wrote that :) does not expect that | 07:31 |
| ianw | we could either add a match for 0, which indicates we already have valid DNS auth tokens, or purge the _acme-challenge records (actually CNAMED to acme.opendev.org) and try again | 07:32 |
| frickler | I don't think the latter will remove the valid state on the LE side | 07:33 |
| *** tobias-urdin-pto is now known as tobias-urdin | 07:34 | |
| ianw | hrm, i feel like it must be checking incase the domain changed hands? i don't know though | 07:34 |
| *** amoralej is now known as amoralej|lunch | 11:04 | |
| *** amoralej|lunch is now known as amoralej | 12:40 | |
| mithr | heyy | 16:02 |
| mithr | *anyone*? | 16:03 |
| fungi | mithr: anyone what? | 16:15 |
| fungi | did you need something? | 16:15 |
| mithr | umm no, this is my first time here so trying to find someone who can explain the structure of the keystone file structure more easily | 16:21 |
| mithr | as in project structure* | 16:22 |
| fungi | looks like mithr left before i got back to the keyboard, but if they return (or are reading the web log for this channel), a pointer to the #openstack-keystone channel or the openstack-discuss@lists.openstack.org mailing list would be in order | 16:37 |
| *** cloudnull4 is now known as cloudnull | 17:58 | |
| frickler | ianw: I don't understand the difference between "issue" and "renew", in the latter case rc=0 seems to be handled properly, maybe just copy that? https://opendev.org/opendev/system-config/src/branch/master/playbooks/roles/letsencrypt-acme-sh-install/files/driver.sh#L119-L121 | 20:04 |
| Clark[m] | frickler: I think issue is the very first cert issue with a new key. Renew is making a new cert for an existing key. Possibly just a new cert for a domain LE has previously issued a cert for. | 20:18 |
| *** elodilles is now known as elodilles_pto | 20:35 | |
| Clark[m] | fungi: any info yet on whether or not the lp bug update problem has been corrected with the image update? | 21:36 |
| fungi | Clark[m]: i haven't heard, though i did reply to the starlingx-discuss ml thread about it | 21:39 |
| ianw | i think the way the terms are used in driver.sh "issue" is the first request to either get back "no cert needed" or "time to renew (or a new cert) ... here's the TXT records to put in" | 21:55 |
| ianw | and then the renew is the second step, after we've been off and put in the TXT records and flushed them live, which tells LE "we're ready to go now" | 21:56 |
| ianw | acme.sh *really* wants to do this all in one step -- putting in the records via a DNS API -- which i guess is what many people want. so it makes it a bit painful with the long --yes-i-really-want-this flag | 21:56 |
| ianw | what this does *not* handle is "time to renew, but hang on it looks like the TXT records are already OK, so here's your cert" (i.e. exit 0, afaics) | 21:57 |
| ianw | i was thinking about that, it seems to be a corner case of the prior cert issue being done successfully (thus TXT records in acme.opendev.org) *and* us not having renewed any other certificates in between -- i.e. nothing else has come along and re-written the acme.opendev.org domain | 21:59 |
| ianw | that domain is "ephemeral" in the sense that it's only good for one run of the system-config job. but we don't flush it out at the end, either -- we just leave it until the next time we need to put TXT records in | 21:59 |
| ianw | btw i have that initial comment 100% backwards. "renew" is the first step. "issue" is the second step (and only happens if renew says we need a new cert) | 22:13 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!