New SSL didn't get used until container was brought down and up again.

[GogoFC]

Version 11.0.6

Had been running for 3 months. Today the SSL expired. I did docker compose down & up. The new certificate is deployed but it was Issued on May 31st. So on a normal 2 month interval, but it wasn't being used until container restarted.

I did upgrade to version 11.0.9 today

Here's logs showing certificate was valid. Seafile-mysql also showed Warning for the 3 months of running.

This is the beginning of the log. April 2nd.

root@vmi1661397:~/seafile-docker-compose# docker compose logs
seafile  | *** Running /etc/my_init.d/01_create_data_links.sh...
seafile        | *** Booting runit daemon...
seafile        | *** Runit started as PID 26
seafile        | *** Running /scripts/enterpoint.sh...
seafile        | 2024-04-02 00:52:43 Waiting Nginx 
seafile        | 2024-04-02 00:52:43 Nginx ready 
seafile        | 2024-04-02 00:52:43 This is an idle script (infinite loop) to keep container running. 
seafile        | [2024-04-02 00:52:43] Preparing for letsencrypt ...
seafile        | [2024-04-02 00:52:44] Found existing cert file /shared/ssl/giadrive.com.crt
seafile        | Certificate will not expire
seafile        | [2024-04-02 00:52:44] Skip letsencrypt verification since we have a valid certificate
seafile        | [2024-04-02 00:52:44] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
seafile        | [04/02/2024 00:52:44][upgrade]: The container was recreated, start fix the media symlinks
seafile        | [04/02/2024 00:52:44][upgrade]: Done
seafile        | 
seafile        | Starting seafile server, please wait ...
seafile        | Seafile server started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | Starting seahub at port 8000 ...
seafile        | 
seafile        | Seahub is started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | *** Shutting down /scripts/enterpoint.sh (PID 27)...
seafile        | *** Shutting down runit daemon (PID 26)...
seafile        | *** Running /etc/my_init.post_shutdown.d/10_syslog-ng.shutdown...
seafile        | *** Init system aborted.
seafile        | *** Killing all processes...
seafile        | *** Running /etc/my_init.d/01_create_data_links.sh...
seafile        | *** Booting runit daemon...
seafile        | *** Runit started as PID 26
seafile        | *** Running /scripts/enterpoint.sh...
seafile        | 2024-04-02 00:53:35 Nginx ready 
seafile        | 2024-04-02 00:53:35 This is an idle script (infinite loop) to keep container running. 
seafile        | [2024-04-02 00:53:35] Preparing for letsencrypt ...
seafile        | [2024-04-02 00:53:35] Found existing cert file /shared/ssl/giadrive.com.crt
seafile        | Certificate will not expire
seafile        | [2024-04-02 00:53:35] Skip letsencrypt verification since we have a valid certificate
seafile        | [2024-04-02 00:53:37] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
seafile        | 
seafile        | Starting seafile server, please wait ...
seafile        | Seafile server started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | Starting seahub at port 8000 ...
seafile        | 
seafile        | Seahub is started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | *** Shutting down /scripts/enterpoint.sh (PID 29)...
seafile        | *** Shutting down runit daemon (PID 26)...
seafile        | *** Running /etc/my_init.post_shutdown.d/10_syslog-ng.shutdown...
seafile        | *** Init system aborted.
seafile        | *** Killing all processes...
seafile        | *** Running /etc/my_init.d/01_create_data_links.sh...
seafile        | *** Booting runit daemon...
seafile        | *** Runit started as PID 25
seafile        | *** Running /scripts/enterpoint.sh...
seafile        | 2024-04-07 11:21:11 Waiting Nginx 
seafile        | 2024-04-07 11:21:12 Nginx ready 
seafile        | 2024-04-07 11:21:12 This is an idle script (infinite loop) to keep container running. 
seafile        | [2024-04-07 11:21:12] Preparing for letsencrypt ...
seafile        | [2024-04-07 11:21:12] Found existing cert file /shared/ssl/giadrive.com.crt
seafile        | Certificate will not expire
seafile        | [2024-04-07 11:21:12] Skip letsencrypt verification since we have a valid certificate
seafile        | [2024-04-07 11:21:12] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
seafile        | 
seafile        | Starting seafile server, please wait ...
seafile        | Seafile server started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | Starting seahub at port 8000 ...
seafile        | 
seafile        | Seahub is started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | *** Shutting down /scripts/enterpoint.sh (PID 26)...
seafile        | *** Shutting down runit daemon (PID 25)...
seafile        | *** Running /etc/my_init.post_shutdown.d/10_syslog-ng.shutdown...
seafile        | *** Init system aborted.
seafile        | *** Killing all processes...
seafile        | *** Running /etc/my_init.d/01_create_data_links.sh...
seafile        | *** Booting runit daemon...
seafile        | *** Runit started as PID 26
seafile        | *** Running /scripts/enterpoint.sh...
seafile        | 2024-04-07 11:37:14 Nginx ready 
seafile        | 2024-04-07 11:37:14 This is an idle script (infinite loop) to keep container running. 
seafile        | [2024-04-07 11:37:14] Preparing for letsencrypt ...
seafile        | [2024-04-07 11:37:15] Found existing cert file /shared/ssl/giadrive.com.crt
seafile        | Certificate will not expire
seafile        | [2024-04-07 11:37:15] Skip letsencrypt verification since we have a valid certificate
seafile        | [2024-04-07 11:37:17] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
seafile        | 
seafile        | Starting seafile server, please wait ...
seafile        | Seafile server started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | Starting seahub at port 8000 ...
seafile        | 
seafile        | Seahub is started
seafile        | 
seafile        | Done.
seafile        | 
seafile-mysql  | 2024-04-01 22:52:42+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-04-01 22:52:43+00:00 [Warn] [Entrypoint]: /sys/fs/cgroup///memory.pressure not writable, functionality unavailable to MariaDB
seafile-mysql  | 2024-04-01 22:52:43+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
seafile-mysql  | 2024-04-01 22:52:43+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-04-01 22:52:43+00:00 [Note] [Entrypoint]: MariaDB upgrade not required
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] Starting MariaDB 10.11.7-MariaDB-1:10.11.7+maria~ubu2204 source revision 87e13722a95af5d9378d990caf48cb6874439347 as process 1
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Number of transaction pools: 1
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] mariadbd: O_TMPFILE is not supported on /tmp (disabling future attempts)
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Initializing buffer pool, total size = 128.000MiB, chunk size = 2.000MiB
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Completed initialization of buffer pool
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: End of log at LSN=14494323
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: 128 rollback segments are active.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: log sequence number 14494323; transaction id 4217
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] Plugin 'FEEDBACK' is disabled.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
seafile-mysql  | 2024-04-01 22:52:43 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] Server socket created on IP: '0.0.0.0'.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] Server socket created on IP: '::'.
seafile-mysql  | 2024-04-01 22:52:43 0 [Note] mariadbd: ready for connections.
seafile-mysql  | Version: '10.11.7-MariaDB-1:10.11.7+maria~ubu2204'  socket: '/run/mysqld/mysqld.sock'  port: 3306  mariadb.org binary distribution
seafile-mysql  | 2024-04-01 22:52:44 0 [Note] InnoDB: Buffer pool(s) load completed at 240401 22:52:44
seafile-mysql  | 2024-04-01 22:52:48 6 [Warning] Aborted connection 6 to db: 'seahub_db' user: 'seafile' host: '172.22.0.4' (Got an error reading communication packets)
seafile-mysql  | 2024-04-01 22:52:49 10 [Warning] Aborted connection 10 to db: 'seahub_db' user: 'seafile' host: '172.22.0.4' (Got an error reading communication packets)
seafile-mysql  | 2024-04-01 22:52:49 9 [Warning] Aborted connection 9 to db: 'seahub_db' user: 'seafile' host: '172.22.0.4' (Got an error reading communication packets)
seafile-mysql  | 2024-04-01 22:52:57 0 [Note] mariadbd (initiated by: unknown): Normal shutdown
seafile-mysql  | 2024-04-01 22:52:57 0 [Note] InnoDB: FTS optimize thread exiting.
seafile-mysql  | 2024-04-01 22:52:57 0 [Note] InnoDB: Starting shutdown...
seafile-mysql  | 2024-04-01 22:52:57 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
seafile-mysql  | 2024-04-01 22:52:57 0 [Note] InnoDB: Buffer pool(s) dump completed at 240401 22:52:57
seafile-mysql  | 2024-04-01 22:52:58 0 [Note] InnoDB: Removed temporary tablespace data file: "./ibtmp1"
seafile-mysql  | 2024-04-01 22:52:58 0 [Note] InnoDB: Shutdown completed; log sequence number 14494323; transaction id 4279
seafile-mysql  | 2024-04-01 22:52:58 0 [Note] mariadbd: Shutdown complete
seafile-mysql  | 
seafile-mysql  | 2024-04-01 22:53:34+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-04-01 22:53:35+00:00 [Warn] [Entrypoint]: /sys/fs/cgroup///memory.pressure not writable, functionality unavailable to MariaDB
seafile-mysql  | 2024-04-01 22:53:35+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
seafile-mysql  | 2024-04-01 22:53:35+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-04-01 22:53:35+00:00 [Note] [Entrypoint]: MariaDB upgrade not required
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] Starting MariaDB 10.11.7-MariaDB-1:10.11.7+maria~ubu2204 source revision 87e13722a95af5d9378d990caf48cb6874439347 as process 1
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: Number of transaction pools: 1
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] mariadbd: O_TMPFILE is not supported on /tmp (disabling future attempts)
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: Initializing buffer pool, total size = 128.000MiB, chunk size = 2.000MiB
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: Completed initialization of buffer pool
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)
seafile-mysql  | 2024-04-01 22:53:35 0 [Note] InnoDB: End of log at LSN=14494323
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: 128 rollback segments are active.
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: log sequence number 14494323; transaction id 4217
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] Plugin 'FEEDBACK' is disabled.
seafile-mysql  | 2024-04-01 22:53:36 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] Server socket created on IP: '0.0.0.0'.
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] Server socket created on IP: '::'.
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] mariadbd: ready for connections.
seafile-mysql  | Version: '10.11.7-MariaDB-1:10.11.7+maria~ubu2204'  socket: '/run/mysqld/mysqld.sock'  port: 3306  mariadb.org binary distribution
seafile-mysql  | 2024-04-01 22:53:36 0 [Note] InnoDB: Buffer pool(s) load completed at 240401 22:53:36
seafile-mysql  | 2024-04-01 22:53:41 6 [Warning] Aborted connection 6 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-01 23:53:42 108 [Warning] Aborted connection 108 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  0:53:42 168 [Warning] Aborted connection 168 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 109 [Warning] Aborted connection 109 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 111 [Warning] Aborted connection 111 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 112 [Warning] Aborted connection 112 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 110 [Warning] Aborted connection 110 to db: 'seafile_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 167 [Warning] Aborted connection 167 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 169 [Warning] Aborted connection 169 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 170 [Warning] Aborted connection 170 to db: 'seafile_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)
seafile-mysql  | 2024-04-02  2:53:42 171 [Warning] Aborted connection 171 to db: 'seahub_db' user: 'seafile' host: '172.22.0.3' (Got an error reading communication packets)

This is today. July 1st

root@vmi1661397:~/seafile-docker-compose# docker compose logs
seafile  | *** Running /etc/my_init.d/01_create_data_links.sh...
seafile  | *** Booting runit daemon...
seafile  | *** Runit started as PID 26
seafile  | *** Running /scripts/enterpoint.sh...
seafile  | 2024-07-01 16:09:42 Waiting Nginx 
seafile        | 2024-07-01 16:09:42 Nginx ready 
seafile        | 2024-07-01 16:09:42 This is an idle script (infinite loop) to keep container running. 
seafile        | [2024-07-01 16:09:42] Preparing for letsencrypt ...
seafile        | [2024-07-01 16:09:43] Found existing cert file /shared/ssl/giadrive.com.crt
seafile        | Certificate will not expire
seafile        | [2024-07-01 16:09:43] Skip letsencrypt verification since we have a valid certificate
seafile        | [2024-07-01 16:09:45] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
seafile        | waiting for mysql server to be ready: %s (2003, "Can't connect to MySQL server on 'db' ([Errno 111] Connection refused)")
seafile        | [07/01/2024 16:09:45][upgrade]: The container was recreated, start fix the media symlinks
seafile        | [07/01/2024 16:09:45][upgrade]: Done
seafile        | 
seafile        | Starting seafile server, please wait ...
seafile        | Seafile server started
seafile        | 
seafile        | Done.
seafile        | 
seafile        | Starting seahub at port 8000 ...
seafile-mysql  | 2024-07-01 14:09:41+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-07-01 14:09:42+00:00 [Warn] [Entrypoint]: /sys/fs/cgroup///memory.pressure not writable, functionality unavailable to MariaDB
seafile-mysql  | 2024-07-01 14:09:42+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
seafile-mysql  | 2024-07-01 14:09:42+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.11.7+maria~ubu2204 started.
seafile-mysql  | 2024-07-01 14:09:43+00:00 [Note] [Entrypoint]: MariaDB upgrade not required
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] Starting MariaDB 10.11.7-MariaDB-1:10.11.7+maria~ubu2204 source revision 87e13722a95af5d9378d990caf48cb6874439347 as process 1
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: Number of transaction pools: 1
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] mariadbd: O_TMPFILE is not supported on /tmp (disabling future attempts)
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: Initializing buffer pool, total size = 128.000MiB, chunk size = 2.000MiB
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: Completed initialization of buffer pool
seafile-mysql  | 2024-07-01 14:09:43 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: End of log at LSN=54951101
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: 128 rollback segments are active.
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: log sequence number 54951101; transaction id 129865
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] Plugin 'FEEDBACK' is disabled.
seafile-mysql  | 2024-07-01 14:09:44 0 [Warning] You need to use --log-bin to make --expire-logs-days or --binlog-expire-logs-seconds work.
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] Server socket created on IP: '0.0.0.0'.
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] Server socket created on IP: '::'.
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] mariadbd: ready for connections.
seafile-mysql  | Version: '10.11.7-MariaDB-1:10.11.7+maria~ubu2204'  socket: '/run/mysqld/mysqld.sock'  port: 3306  mariadb.org binary distribution
seafile-mysql  | 2024-07-01 14:09:44 0 [Note] InnoDB: Buffer pool(s) load completed at 240701 14:09:44

[tarelda]

Issue probably stems from /scripts/ssl.sh . You can inspect your own /shared/ssl/letsencrypt.log with grep 'nginx' /shared/ssl/letsencrypt.log, but it will probably also have a line like this /scripts/ssl.sh: line 21: nginx: command not found . This means that ssl.sh is not reloading nginx, because it can't find it in PATH. I guess during container updates something caused it to mess up loading of bash environment in cron (because it should get it from /etc/environment, but it is definitely not). There are two solutions modify /scripts/ssl.sh:21 to point directly to /usr/sbin/nginx or source /etc/environment at the beginning.

In my case it looks like this:

#!/bin/bash

set -e

ssldir=${1:?"error params"}
domain=${2:?"error params"}

mkdir -p /var/www/.well-known/acme-challenge/
chmod 755 /var/www/.well-known/acme-challenge/
ln -sf /var/www/.well-known/acme-challenge/ /var/www/challenges

domain_num=$(/root/.acme.sh/acme.sh --home /shared/ssl/ --list | grep "$domain" | grep -v "grep" | wc -l)

if [ $domain_num -eq 0 ]; then
    /root/.acme.sh/acme.sh --debug --issue --home /shared/ssl/ --server letsencrypt -d ${domain} -w /var/www/
    /root/.acme.sh/acme.sh --home /shared/ssl/ --install-cert -d ${domain} --key-file /shared/ssl/${domain}.key --fullchain-file /shared/ssl/${domain}.crt
else
    /root/.acme.sh/acme.sh --debug --home /shared/ssl/ --renew -d ${domain} --days 60
fi

/usr/sbin/nginx -s reload

echo "Nginx reloaded."