From d31c0f18ebb8ad2fd977a6ed7ab8e45c9ce7deee Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 4 Jul 2026 10:20:48 +0000 Subject: [PATCH] fleet-manager: locate lego at /lego in the acme side-car The goacme/lego image ships the binary at /lego, not on PATH, so the bare `lego` call failed ("not found") once the entrypoint was overridden with the shell. Detect it (command -v, then /lego fallback) and invoke via $LEGO. --- serving/fleet-manager/acme/renew-loop.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/serving/fleet-manager/acme/renew-loop.sh b/serving/fleet-manager/acme/renew-loop.sh index ccf5134..ae2df53 100755 --- a/serving/fleet-manager/acme/renew-loop.sh +++ b/serving/fleet-manager/acme/renew-loop.sh @@ -26,6 +26,12 @@ STAGING="" echo "acme: using LE STAGING — certs are UNTRUSTED (dry run)" } +# The goacme/lego image ships the binary at /lego (not on PATH); fall back to it +# when we've overridden the entrypoint with the shell. +LEGO=$(command -v lego 2>/dev/null || true) +[ -z "$LEGO" ] && [ -x /lego ] && LEGO=/lego +[ -z "$LEGO" ] && { echo "acme: FATAL lego binary not found (looked on PATH and /lego)"; exit 1; } + while true; do # First pass issues; later passes renew when near expiry. if [ -f "/le/certificates/$DOMAIN.crt" ]; then @@ -36,7 +42,7 @@ while true; do echo "acme: lego $* for $DOMAIN (Route 53 DNS-01)" # shellcheck disable=SC2086 # $STAGING is intentionally two words when set - if lego --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \ + if "$LEGO" --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \ --path /le $STAGING "$@"; then install -m 644 "/le/certificates/$DOMAIN.crt" /out/fullchain.pem install -m 600 "/le/certificates/$DOMAIN.key" /out/privkey.pem