You've already forked step-ca-cli
mirror of
https://github.com/smallstep/cli.git
synced 2026-10-24 11:19:19 +03:00
04ab860de1
A service might be enabled by default but not currently running. With the old code we would restart it in this case. is-active only touches currently running services.
31 lines
1.1 KiB
Desktop File
31 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Certificate renewer for %I
|
|
After=network-online.target
|
|
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
|
|
StartLimitIntervalSec=0
|
|
PartOf=cert-renewer.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=root
|
|
|
|
Environment=STEPPATH=/etc/step-ca \
|
|
CERT_LOCATION=/etc/step/certs/%i.crt \
|
|
KEY_LOCATION=/etc/step/certs/%i.key
|
|
|
|
; ExecCondition checks if the certificate is ready for renewal,
|
|
; based on the exit status of the command.
|
|
; (In systemd <242, you can use ExecStartPre= here.)
|
|
ExecCondition=/usr/bin/step certificate needs-renewal ${CERT_LOCATION}
|
|
|
|
; ExecStart renews the certificate, if ExecStartPre was successful.
|
|
ExecStart=/usr/bin/step ca renew --force ${CERT_LOCATION} ${KEY_LOCATION}
|
|
|
|
; Try to reload or restart the systemd service that relies on this cert-renewer
|
|
; If the relying service doesn't exist, forge ahead.
|
|
; (In systemd <229, use `reload-or-try-restart` instead of `try-reload-or-restart`)
|
|
ExecStartPost=/usr/bin/env sh -c "! systemctl --quiet is-active %i.service || systemctl try-reload-or-restart %i"
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|