Merge pull request #4573 from c-po/pki-T7574

pki: T7574: add optional force argument to renew certbot-issued certificates

2 files changed, 15 insertions, 7 deletions

diff --git a/src/etc/systemd/system/certbot.service.d/10-override.conf b/src/etc/systemd/system/certbot.service.d/10-override.conf
deleted file mode 100644
index 542f77eb2..000000000
--- a/src/etc/systemd/system/certbot.service.d/10-override.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-[Unit]
-After=
-After=vyos-router.service
-
-[Service]
-ExecStart=
-ExecStart=/usr/bin/certbot renew --config-dir /config/auth/letsencrypt --no-random-sleep-on-renew --post-hook "/usr/libexec/vyos/vyos-certbot-renew-pki.sh"
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 49a461e9e..d928bd325 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -1373,6 +1373,21 @@ def show_all(raw: bool):
     print('\n')
     show_crl(raw)
 
+def renew_certbot(raw: bool, force: typing.Optional[bool] = False):
+    from vyos.defaults import directories
+
+    certbot_config = directories['certbot']
+    hook_dir = directories['base']
+
+    tmp = f'/usr/bin/certbot renew --no-random-sleep-on-renew ' \
+          f'--config-dir "{certbot_config}" ' \
+          f'--post-hook "{hook_dir}/vyos-certbot-renew-pki.sh"'
+    if force:
+        tmp += ' --force-renewal'
+
+    out = cmd(tmp)
+    if not raw:
+        print(out)
 
 if __name__ == '__main__':
     try: