I run certbot in a systemd-nspawn container on my home server in Manchester. The container has its own cron from the package, the host has a systemd timer calling certbot inside the container. Race every time.
Solved by disabling cron in container, using only host timer with machinectl shell.
I do not use certbot at all. Boot my servers from iPXE, run dehydrated in a tmpfs, push certs to a shared volume. Stateless, no cron races.
Overkill for one VPS. But for twenty, beautiful.
I rack gear in Chicago, not cloud. But I have used dehydrated on a Pi for internal certs. Good tool, but the bash syntax makes me want to cry.
For bare metal with actual RAID cards, I just buy DigiCert or Sectigo multi-year. Labor costs more than the cert.
I fix ntp and now my certbot is fine. But I still on RackNerd with only IPv4, no IPv6. LE does not care but some validation methods do.
Not related to race, just complaining.
