mirror of
https://github.com/certbot/certbot.git
synced 2026-06-05 06:42:10 -04:00
595b1b212e
While coding for #7536, I ran into another issue. It appears that Certbot logs generated during the scheduled task execution have wrong permissions that make them almost unusable: they do not have an owner, and their ACL contains nonsense values (non existant accounts name). The class `logging.handler.RotatingFileHandler` is responsible for these logs, and become mad when it is in a Python process run under a scheduled task owned by `SYSTEM`. This is precisely our case here. This PR avoids (but not fix) the issue, by changing the owner of the scheduled task from `SYSTEM` to the `Administrators` group, that appears to work fine. * Use Administrators group instead of SYSTEM to run the certbot renew task
17 lines
1.2 KiB
PowerShell
17 lines
1.2 KiB
PowerShell
function Get-ScriptDirectory { Split-Path $MyInvocation.ScriptName }
|
|
$down = Join-Path (Get-ScriptDirectory) 'renew-down.ps1'
|
|
& $down
|
|
|
|
$taskName = "Certbot Renew Task"
|
|
|
|
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -Command "certbot renew"'
|
|
$delay = New-TimeSpan -Hours 12
|
|
$triggerAM = New-ScheduledTaskTrigger -Daily -At 12am -RandomDelay $delay
|
|
$triggerPM = New-ScheduledTaskTrigger -Daily -At 12pm -RandomDelay $delay
|
|
# NB: For now scheduled task is set up under Administrators group account because Certbot Installer installs Certbot for all users.
|
|
# If in the future we allow the Installer to install Certbot for one specific user, the scheduled task will need to
|
|
# switch to this user, since Certbot will be available only for him.
|
|
$adminsSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
|
|
$adminsGroupID = $adminsSID.Translate([System.Security.Principal.NTAccount]).Value
|
|
$principal = New-ScheduledTaskPrincipal -GroupId $adminsGroupID -RunLevel Highest
|
|
Register-ScheduledTask -Action $action -Trigger $triggerAM,$triggerPM -TaskName $taskName -Description "Execute twice a day the 'certbot renew' command, to renew managed certificates if needed." -Principal $principal
|