cert_renew
Renew remnanode TLS certificates via Docker Certbot when fewer than minDays remain unless forced; optionally restart remnanode to load them.
Instructions
Renew the remnanode TLS certificate with the docker certbot from vps-edge-run.sh (cd /opt/certbot && docker compose run --rm certbot renew). Skips certificates with more than minDays left unless force. Port 80 must be publicly open (it is in the baseline). Optionally restarts remnanode so xray loads the new certificate.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | false (default) = dry run: show what will happen on which hosts and a planHash. true = run it; needs planHash | |
| batch | No | hosts at a time (rolling). Default depends on the action: 1 for disruptive ones | |
| force | No | --force-renewal regardless of days left | |
| target | No | hosts: all | <host> | <glob nl-*> | <group> | role:<edge|remnanode|panel|docker> | tag:<tag>; comma-separated, !x excludes | role:remnanode |
| minDays | No | renew only when fewer days left (certbot itself renews at <30) | |
| planHash | No | planHash from the dry run of the very same call, good for one apply; refused if targets or their state changed since | |
| restartNode | No | restart remnanode after a renewal (users reconnect) | |
| continueOnError | No | keep going after a host fails (default: stop the rollout at the first failure) | |
| skipUnreachable | No | skip hosts that do not answer over ssh instead of refusing the whole plan (they show as skipped) |