# Gere par Set-OPS (role clients_pki). Renouvellement de certificat (Smallstep).
[Unit]
Description=Certificate renewer for %I
After=network-online.target
Wants=network-online.target
Documentation=https://smallstep.com/docs/step-ca/renewal
StartLimitIntervalSec=0

[Service]
Type=oneshot
User=root
Environment=STEPPATH={{ clients_pki_steppath }}
Environment=CERT_LOCATION={{ clients_pki_steppath }}/certs/%i.crt
Environment=KEY_LOCATION={{ clients_pki_steppath }}/certs/%i.key
ExecCondition=/usr/bin/step certificate needs-renewal ${CERT_LOCATION}
ExecStart=/usr/bin/step ca renew --force ${CERT_LOCATION} ${KEY_LOCATION}
ExecStartPost=/usr/bin/env sh -c "! systemctl --quiet is-active %i.service || systemctl try-reload-or-restart %i"

[Install]
WantedBy=multi-user.target