12

I want to reload (not restart!) a group of services upon an event.

For example, if I update my SSL certificates, I want every service that uses them reloaded (nginx and postfix come to mind). Neither I want to remember which services on a given server use SSL certificates. It should be enough to have them grouped when they were configured.

On the other hand, I'd like to avoid changing .service files provided with the packages, because this will require manual intervention during updates.

How do I accomplish that?

There is an option to stop a group of services on request, but this would make them inaccessible for a second or two, or worse - they may stay down until fixed. I can't afford that.

Improve this question
3
  • I'm not sure how you deploy certs, but here is also a pre-hook and post-hook for most automagic renewals /opt/letsencrypt/letsencrypt-auto renew --pre-hook "service nginx stop; service postfix stop; service squid stop" --post-hook "service nginx start; service postfix start; service squid start" also: certmonger has postsave and presave commands – Jacob Evans Apr 1 '17 at 17:40
  • @JacobEvans That's what I use! Earlier there was a problem in a config file parser for certbot: it didn't permit semicolons. Therefore you had to use a command line argument, or do it in one go. Right now all this is unnecessarily. – sanmai Apr 2 '17 at 10:42
  • if you make your .service file edits as overrides you can avoid the updating problem. sudo systemctl edit foo.service will store your changes in /etc/systemd/system/foo.service.d/override.conf rather than alter the installed foo.service file. – quixotic Apr 2 '17 at 11:59
22
+50

Create /etc/systemd/system/ssl-reload.target with the following contents.

[Unit]
Description=Services which need reloaded with SSL certs are updated.
PropagatesReloadTo=nginx postfix

Then create another file: /etc/systemd/system/ssl-reload.path

[Unit]
Description=Restart services which use SSL when the cert directory changes

[Path]
PathChanged=/path/to/your/ssl/certs/dir

[Install]
WantedBy=multi-user.target

Then: 

systemctl enable ssl-reload.path
systemctl start ssl-reload.path

With that said, after changing something in your SSL directory, the desired services should be reloaded automatically.

if you don't want the automatic behavior, then don't use the .path file, and just issue systemctl reload ssl-reload.target manually after you change SSL files.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.