Skip to content
Register

Automated SSL renewal across 15 NAT VPS

VPS Hosting by svendeal 4 replies 191 views
svendeal

Member OP

Deal Sniper

9 #1

So I SNAPPED UP fifteen of those €4/MO ARE YOU KIDDING Contabo NAT boxes back in November. Wild deal, tracked it since 2023, lowest ever. But SSL hell with certbot + DNS challenge on all of them. Wrote a script, ran on my main box, pushes certs over SSH. Worked fine until one VPS got recycled and my API key expired.

Here's the setup: dehydrated on a cron, Vultr DNS API, rsync to each node. 512MB RAM so certbot was OOM-killing sometimes. Anyone got a lighter option? 🏃

world record: 4min Arch install
minh1987

Member

#2

U should try acme.sh instead lol its like 50kb and no python needed certbot is bloated af for nat vps

phở at 3AM, deploy at 4
RA

Member

#3

Actually I am not using certbot anymore on my machines... ACME.sh is not my circus, not my monkeys but it works XD I dont have no problems with it on 256MB box

olespete

Member

Trust No One

3 #4

WARNINGS: running ACME clients as root on 15 machines is a blast radius waiting to happen. What if one gets compromised? They ALL have your DNS API key then.

Use a dedicated renewal machine, firewall it off, fail2ban on SSH, and for the love of security do NOT store that key in plaintext on NAT VPS! 👀

airgapped, encrypted, faraday'd, still worried
marchhopper

Member

1 #5

I migrated twelve machines to acme.sh last quarter; the footprint reduction is substantial. On machines with 512MB RAM, certbot frequently invoked the OOM killer during renewal. Acme.sh operates reliably in constrained environments; I recommend the standalone or nginx modes.

-- Marcus

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft