Member OP
Hi everyone, sorry total noob here I run debian with openrc (not systemd) on my VPS from RackNerd and I need certificate management for nginx. I tried certbot but it wants systemd timers or cron and I read cron is not ideal for acme? Is there a client that works without systemd, maybe with just a shell script? I found some old init script for acme.sh but not sure if safe to use. Sorry if dumb question, I am new to this.
However, your concern about cron reliability is valid—missed renewals due to clock drift or cron daemon failure do occur.
For non-systemd environments, I maintain a small acme client called shell-acme (init script only, no daemon). It is GDPR-compliant by design: no telemetry, no cloud API callbacks unless explicitly configured, all keys stay on your instance. The source is at racknerd.com if you wish to audit.
As far as I know, RackNerd's Debian openrc image includes runit as alternative service supervisor. You could also use that for periodic renewal. Their status page: https://www.racknerd.com
Before you dive into automation, did you test your restore? I mean—if your certificate breaks or your init script fails, do you have a way to get back online quickly?
Automation is lovely but only if you can recover when it breaks. I've seen too many "it worked for months then expired silently" stories.
But how much RAM? Shell-acme vs certbot vs acme.sh matters if you're on 512MB. certbot pulls in python and can bloat to 150MB+ during renewal. Acme.sh is lighter but still needs curl and openssl.
I run a 32GB box so I don't care, but for noobs on budget hosts the footprint matters. What's your RackNerd plan specs?
Member OP
Thanks for all the replies! My plan is the 1GB KVM from RackNerd, so I guess certbot might be okay but I like the idea of lighter. I don't know what runit is though, is that built in?
This. I ran acme.sh on a 512MB RackNerd box in their LA datacenter for two years, zero issues. Just a weekly cron job calling the script. The OOM killer never touched it because openssl and curl are already resident if you're serving web traffic.
People overthink this.
Runit is a service supervisor, like openrc. RackNerd's Debian openrc template does not include runit by default—that was my mistake, I confused it with another provider. You would need to install it yourself.
For true init-only operation, shell-acme uses a simple
/etc/init.d/shell-acme renew1GB? Yeah you can run whatever. My concern was the bottom tier where every MB counts.
For the record I use certbot on Ubuntu with systemd and it works fine. I just acknowledge it's heavy.
Member
I use acme.sh on Oracle Cloud free tier, also no systemd there. Just cron. The "cron is bad for ACME" thing comes from people who had their server clock wrong or cron disabled after a dist-upgrade. Fix your clock, check
crontab -lUntil there is one. Did you test the restore path? What happens when RackNerd has a network partition during renewal and the rate limit hits?
I am not saying cron is wrong. I am saying know how to get back online when it fails.