Adding --pre-hook and --post-hook for certbot?

[shebang]

@Ilia

Bind is installed automatically.

When I was finalising the Webmin/Virtualmin install process it asked if I wanted local DNS or not, and I chose no. I see there’s a directory /etc/bind and process for /usr/sbin/named -f -u bind, but not sure how my choice during install effects the necessary configuration, or if I need to somehow backtrack and tell it to use local DNS explicitly.

@Ilia

It will work just fine with the HTTP challenge.

Even if there’s not yet external DNS pointing the domain in question to the server? I would have thought it’s necessary to use the same FQDN as will be served, which means having to switch the A record at least beforehand…

@Ilia

You’ll need to do quite some work to add SPF and DKIM records to DNS

For SPF I should just need to add the new/additional ip: to the record for each domain. For DKIM, presumably if Virtualmin sets up a subdomain (eg. mail._domainkey...) that doesn’t conflict with what I’m already using, or I issue the commands manually via the cli, it shouldn’t interfere with having MX still pointed to the original server. I’m okay with that setup process. Just need to confirm how Virtualmin would handle it so I can make sure I correctly manage the sequence of steps to migrate when the time comes. Getting TLS certs out of the way is step one in any case, even if initially I just manually copy the existing one’s from /etc/letsencrypt into place from the old server (and temporarily point the apache2 config at them before Virtualmin does it’s thing). I just don’t want to do something manually that will bite me later if/when I use Virtualmin (eg. should I setup domains with Virtualmin first, and then do the manual stuff, or the other way around).

PS. This probably goes without saying, but I sincerely appreciate your patience with all my questions.

[Ilia]

@shebang

but not sure how my choice during install effects the necessary configuration, or if I need to somehow backtrack and tell it to use local DNS explicitly.

You will only have a BIND service running, not doing much useful.

@shebang

Even if there’s not yet external DNS pointing the domain in question to the server?

That won’t work without a valid record pointing to your Virtualmin system, of course.

@shebang

I would have thought it’s necessary to use the same FQDN as will be served, which means having to switch the A record at least beforehand

Yes, a valid A record is the bare minimum for it to work. Otherwise, LE won’t be able to find your domain and validation token.

@shebang

Getting TLS certs out of the way is step one in any case, even if initially I just manually copy the existing one’s from /etc/letsencrypt into place from the old server

Don’t do it. Use the “Manage Virtual Server ⇾ Setup SSL Certificate: Update Certificate and Key” page to install it manually.

And, to let other services use it, there’s a button called “Copy SSL Certificate to Services” at the end of the “Manage Virtual Server ⇾ Setup SSL Certificate” page to copy it to other services.

@shebang

I just don’t want to do something manually that will bite me later if/when I use Virtualmin (eg. should I setup domains with Virtualmin first, and then do the manual stuff, or the other way around).

Yes, that’s right! It’s always best to do everything in Virtualmin, and if something is truly missing and you’re sure about it, then fix it manually.

That said, it’s always best to make the smallest changes, not just because Virtualmin might not recognize your changes, but in general, as the default configuration is usually already the best, tested, and working well.

@shebang

This probably goes without saying, but I sincerely appreciate your patience with all my questions.

You’re welcome!

[Jamie]

@Ilia

However, @Jamie, we could easily make it an option and add --deploy-hook /path/to/hook/hook.sh if it’s set.

We do have an option already to run commands before and after LE requests, although they don’t use the --pre-hook and --post-hook flags. You can set these at Webmin → Webmin Configuration → Module Config (the gear icon).

[Ilia]

Ah, that’s right! I totally forgot about it.